| Severity | Number of Issues | |
|---|---|---|
| BLOCKER | 67 | |
| CRITICAL | 1774 | |
| MAJOR | 3229 | |
| MINOR | 2276 |
| Rule | Severity | Component | Line | Description | Message |
|---|---|---|---|---|---|
| squid:S2975 | BLOCKER | java/org/apache/catalina/util/URLEncoder.java | 190 | "clone" should not be overridden | Remove this "clone" implementation; use a copy constructor or copy factory instead. |
| Rule | Description | ||||||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| squid:S864 |
The rules of operator precedence are complicated and can lead to errors. For this reason, parentheses should be used for clarification in complex statements. However, this does not mean that parentheses should be gratuitously added around every operation. This rule raises issues when
Noncompliant Code Example
x = a + b - c;
x = a + 1 << b; // Noncompliant
if ( a > b || c < d || a == d) {...}
if ( a > b && c < d || a == b) {...} // Noncompliant
if (a = f(b,c) == 1) { ... } // Noncompliant; == evaluated first
Compliant Solution
x = a + b - c;
x = (a + 1) << b;
if ( a > b || c < d || a == d) {...}
if ( (a > b && c < d) || a == b) {...}
if ( (a = f(b,c)) == 1) { ... }
See
|
||||||||||||||||||||||||||||||||||||
| squid:S2115 |
Failure to password-protect a database is so careless or naive as to be almost negligent. Databases should always be password protected, but the use of a database connection with an empty password is a clear indication of a database that is not protected. This rule flags database connections with empty passwords. Noncompliant Code Example
Connection conn = DriverManager.getConnection("jdbc:derby:memory:myDB;create=true", "AppLogin", "");
Connection conn2 = DriverManager.getConnection("jdbc:derby:memory:myDB;create=true?user=user&password=");
Compliant Solution
DriverManager.getConnection("jdbc:derby:memory:myDB;create=true?user=user&password=password");
DriverManager.getConnection("jdbc:mysql://address=(host=myhost1)(port=1111)(key1=value1)(user=sandy)(password=secret),address=(host=myhost2)(port=2222)(key2=value2)(user=sandy)(password=secret)/db");
DriverManager.getConnection("jdbc:mysql://sandy:secret@[myhost1:1111,myhost2:2222]/db");
String url = "jdbc:postgresql://localhost/test";
Properties props = new Properties();
props.setProperty("user", "fred");
props.setProperty("password", "secret");
DriverManager.getConnection(url, props);
See
|
||||||||||||||||||||||||||||||||||||
| squid:S1148 |
Loggers should be used instead to print
This rule raises an issue when Noncompliant Code Example
try {
/* ... */
} catch(Exception e) {
e.printStackTrace(); // Noncompliant
}
Compliant Solution
try {
/* ... */
} catch(Exception e) {
LOGGER.log("context", e);
}
See
|