docs/data/reusables/code-scanning/codeql-query-tables/java.md

{% rowheaders %}

Query name	Related CWEs	Default	Extended	{% data variables.copilot.copilot_autofix_short %}
TrustManager that accepts all certificates	295	{% octicon "check" aria-label="Included" %}	{% octicon "check" aria-label="Included" %}	{% octicon "check" aria-label="Included" %}
Android WebView that accepts all certificates	295	{% octicon "check" aria-label="Included" %}	{% octicon "check" aria-label="Included" %}	{% octicon "check" aria-label="Included" %}
Android debuggable attribute enabled	489	{% octicon "check" aria-label="Included" %}	{% octicon "check" aria-label="Included" %}	{% octicon "check" aria-label="Included" %}
Android fragment injection	470	{% octicon "check" aria-label="Included" %}	{% octicon "check" aria-label="Included" %}	{% octicon "check" aria-label="Included" %}
Android fragment injection in PreferenceActivity	470	{% octicon "check" aria-label="Included" %}	{% octicon "check" aria-label="Included" %}	{% octicon "check" aria-label="Included" %}
Android Intent redirection	926, 940	{% octicon "check" aria-label="Included" %}	{% octicon "check" aria-label="Included" %}	{% octicon "check" aria-label="Included" %}
Android Webview debugging enabled	489	{% octicon "check" aria-label="Included" %}	{% octicon "check" aria-label="Included" %}	{% octicon "check" aria-label="Included" %}
Arbitrary file access during archive extraction ("Zip Slip")	022	{% octicon "check" aria-label="Included" %}	{% octicon "check" aria-label="Included" %}	{% octicon "check" aria-label="Included" %}
Cleartext storage of sensitive information in cookie	315	{% octicon "check" aria-label="Included" %}	{% octicon "check" aria-label="Included" %}	{% octicon "check" aria-label="Included" %}
Cross-site scripting	079	{% octicon "check" aria-label="Included" %}	{% octicon "check" aria-label="Included" %}	{% octicon "check" aria-label="Included" %}
Depending upon JCenter/Bintray as an artifact repository	1104	{% octicon "check" aria-label="Included" %}	{% octicon "check" aria-label="Included" %}	{% octicon "check" aria-label="Included" %}
Deserialization of user-controlled data	502	{% octicon "check" aria-label="Included" %}	{% octicon "check" aria-label="Included" %}	{% octicon "x" aria-label="Not included" %}
Detect JHipster Generator Vulnerability CVE-2019-16303	338	{% octicon "check" aria-label="Included" %}	{% octicon "check" aria-label="Included" %}	{% octicon "check" aria-label="Included" %}
Disabled Netty HTTP header validation	093, 113	{% octicon "check" aria-label="Included" %}	{% octicon "check" aria-label="Included" %}	{% octicon "check" aria-label="Included" %}
Disabled Spring CSRF protection	352	{% octicon "check" aria-label="Included" %}	{% octicon "check" aria-label="Included" %}	{% octicon "check" aria-label="Included" %}
Exposed Spring Boot actuators	200	{% octicon "check" aria-label="Included" %}	{% octicon "check" aria-label="Included" %}	{% octicon "x" aria-label="Not included" %}
Exposed Spring Boot actuators in configuration file	200	{% octicon "check" aria-label="Included" %}	{% octicon "check" aria-label="Included" %}	{% octicon "x" aria-label="Not included" %}
Expression language injection (JEXL)	094	{% octicon "check" aria-label="Included" %}	{% octicon "check" aria-label="Included" %}	{% octicon "check" aria-label="Included" %}
Expression language injection (MVEL)	094	{% octicon "check" aria-label="Included" %}	{% octicon "check" aria-label="Included" %}	{% octicon "check" aria-label="Included" %}
Expression language injection (Spring)	094	{% octicon "check" aria-label="Included" %}	{% octicon "check" aria-label="Included" %}	{% octicon "check" aria-label="Included" %}
Failure to use HTTPS or SFTP URL in Maven artifact upload/download	300, 319, 494, 829	{% octicon "check" aria-label="Included" %}	{% octicon "check" aria-label="Included" %}	{% octicon "check" aria-label="Included" %}
Failure to use secure cookies	614	{% octicon "check" aria-label="Included" %}	{% octicon "check" aria-label="Included" %}	{% octicon "check" aria-label="Included" %}
Groovy Language injection	094	{% octicon "check" aria-label="Included" %}	{% octicon "check" aria-label="Included" %}	{% octicon "check" aria-label="Included" %}
HTTP response splitting	113	{% octicon "check" aria-label="Included" %}	{% octicon "check" aria-label="Included" %}	{% octicon "check" aria-label="Included" %}
Implicit narrowing conversion in compound assignment	190, 192, 197, 681	{% octicon "check" aria-label="Included" %}	{% octicon "check" aria-label="Included" %}	{% octicon "check" aria-label="Included" %}
Implicitly exported Android component	926	{% octicon "check" aria-label="Included" %}	{% octicon "check" aria-label="Included" %}	{% octicon "check" aria-label="Included" %}
Improper verification of intent by broadcast receiver	925	{% octicon "check" aria-label="Included" %}	{% octicon "check" aria-label="Included" %}	{% octicon "check" aria-label="Included" %}
Inefficient regular expression	1333, 730, 400	{% octicon "check" aria-label="Included" %}	{% octicon "check" aria-label="Included" %}	{% octicon "x" aria-label="Not included" %}
Information exposure through a stack trace	209, 497	{% octicon "check" aria-label="Included" %}	{% octicon "check" aria-label="Included" %}	{% octicon "check" aria-label="Included" %}
Information exposure through an error message	209	{% octicon "check" aria-label="Included" %}	{% octicon "check" aria-label="Included" %}	{% octicon "check" aria-label="Included" %}
Insecure Bean Validation	094	{% octicon "check" aria-label="Included" %}	{% octicon "check" aria-label="Included" %}	{% octicon "check" aria-label="Included" %}
Insecure LDAP authentication	522, 319	{% octicon "check" aria-label="Included" %}	{% octicon "check" aria-label="Included" %}	{% octicon "check" aria-label="Included" %}
Insecure local authentication	287	{% octicon "check" aria-label="Included" %}	{% octicon "check" aria-label="Included" %}	{% octicon "check" aria-label="Included" %}
Insecure randomness	330, 338	{% octicon "check" aria-label="Included" %}	{% octicon "check" aria-label="Included" %}	{% octicon "check" aria-label="Included" %}
Intent URI permission manipulation	266, 926	{% octicon "check" aria-label="Included" %}	{% octicon "check" aria-label="Included" %}	{% octicon "check" aria-label="Included" %}
JNDI lookup with user-controlled name	074	{% octicon "check" aria-label="Included" %}	{% octicon "check" aria-label="Included" %}	{% octicon "check" aria-label="Included" %}
LDAP query built from user-controlled sources	090	{% octicon "check" aria-label="Included" %}	{% octicon "check" aria-label="Included" %}	{% octicon "check" aria-label="Included" %}
Missing JWT signature check	347	{% octicon "check" aria-label="Included" %}	{% octicon "check" aria-label="Included" %}	{% octicon "check" aria-label="Included" %}
OGNL Expression Language statement with user-controlled input	917	{% octicon "check" aria-label="Included" %}	{% octicon "check" aria-label="Included" %}	{% octicon "check" aria-label="Included" %}
Overly permissive regular expression range	020	{% octicon "check" aria-label="Included" %}	{% octicon "check" aria-label="Included" %}	{% octicon "check" aria-label="Included" %}
Partial path traversal vulnerability from remote	023	{% octicon "check" aria-label="Included" %}	{% octicon "check" aria-label="Included" %}	{% octicon "check" aria-label="Included" %}
Polynomial regular expression used on uncontrolled data	1333, 730, 400	{% octicon "check" aria-label="Included" %}	{% octicon "check" aria-label="Included" %}	{% octicon "x" aria-label="Not included" %}
Query built from user-controlled sources	089, 564	{% octicon "check" aria-label="Included" %}	{% octicon "check" aria-label="Included" %}	{% octicon "check" aria-label="Included" %}
Reading from a world writable file	732	{% octicon "check" aria-label="Included" %}	{% octicon "check" aria-label="Included" %}	{% octicon "check" aria-label="Included" %}
Regular expression injection	730, 400	{% octicon "check" aria-label="Included" %}	{% octicon "check" aria-label="Included" %}	{% octicon "x" aria-label="Not included" %}
Resolving XML external entity in user-controlled data	611, 776, 827	{% octicon "check" aria-label="Included" %}	{% octicon "check" aria-label="Included" %}	{% octicon "check" aria-label="Included" %}
Sensitive cookies without the HttpOnly response header set	1004	{% octicon "check" aria-label="Included" %}	{% octicon "check" aria-label="Included" %}	{% octicon "x" aria-label="Not included" %}
Server-side request forgery	918	{% octicon "check" aria-label="Included" %}	{% octicon "check" aria-label="Included" %}	{% octicon "check" aria-label="Included" %}
Server-side template injection	1336, 094	{% octicon "check" aria-label="Included" %}	{% octicon "check" aria-label="Included" %}	{% octicon "check" aria-label="Included" %}
Uncontrolled command line	078, 088	{% octicon "check" aria-label="Included" %}	{% octicon "check" aria-label="Included" %}	{% octicon "check" aria-label="Included" %}
Uncontrolled data used in content resolution	441, 610	{% octicon "check" aria-label="Included" %}	{% octicon "check" aria-label="Included" %}	{% octicon "check" aria-label="Included" %}
Uncontrolled data used in path expression	022, 023, 036, 073	{% octicon "check" aria-label="Included" %}	{% octicon "check" aria-label="Included" %}	{% octicon "check" aria-label="Included" %}
Unsafe hostname verification	297	{% octicon "check" aria-label="Included" %}	{% octicon "check" aria-label="Included" %}	{% octicon "check" aria-label="Included" %}
URL forward from a remote source	552	{% octicon "check" aria-label="Included" %}	{% octicon "check" aria-label="Included" %}	{% octicon "check" aria-label="Included" %}
URL redirection from remote source	601	{% octicon "check" aria-label="Included" %}	{% octicon "check" aria-label="Included" %}	{% octicon "check" aria-label="Included" %}
Use of a broken or risky cryptographic algorithm	327, 328	{% octicon "check" aria-label="Included" %}	{% octicon "check" aria-label="Included" %}	{% octicon "check" aria-label="Included" %}
Use of a cryptographic algorithm with insufficient key size	326	{% octicon "check" aria-label="Included" %}	{% octicon "check" aria-label="Included" %}	{% octicon "check" aria-label="Included" %}
Use of a predictable seed in a secure random number generator	335, 337	{% octicon "check" aria-label="Included" %}	{% octicon "check" aria-label="Included" %}	{% octicon "check" aria-label="Included" %}
Use of externally-controlled format string	134	{% octicon "check" aria-label="Included" %}	{% octicon "check" aria-label="Included" %}	{% octicon "check" aria-label="Included" %}
Use of implicit PendingIntents	927	{% octicon "check" aria-label="Included" %}	{% octicon "check" aria-label="Included" %}	{% octicon "check" aria-label="Included" %}
Use of RSA algorithm without OAEP	780	{% octicon "check" aria-label="Included" %}	{% octicon "check" aria-label="Included" %}	{% octicon "check" aria-label="Included" %}
User-controlled data in numeric cast	197, 681	{% octicon "check" aria-label="Included" %}	{% octicon "check" aria-label="Included" %}	{% octicon "check" aria-label="Included" %}
User-controlled data used in permissions check	807, 290	{% octicon "check" aria-label="Included" %}	{% octicon "check" aria-label="Included" %}	{% octicon "check" aria-label="Included" %}
Using a static initialization vector for encryption	329, 1204	{% octicon "check" aria-label="Included" %}	{% octicon "check" aria-label="Included" %}	{% octicon "check" aria-label="Included" %}
XPath injection	643	{% octicon "check" aria-label="Included" %}	{% octicon "check" aria-label="Included" %}	{% octicon "check" aria-label="Included" %}
XSLT transformation with user-controlled stylesheet	074	{% octicon "check" aria-label="Included" %}	{% octicon "check" aria-label="Included" %}	{% octicon "check" aria-label="Included" %}
Access Java object methods through JavaScript exposure	079	{% octicon "x" aria-label="Not included" %}	{% octicon "check" aria-label="Included" %}	{% octicon "x" aria-label="Not included" %}
Android APK installation	094	{% octicon "x" aria-label="Not included" %}	{% octicon "check" aria-label="Included" %}	{% octicon "x" aria-label="Not included" %}
Android missing certificate pinning	295	{% octicon "x" aria-label="Not included" %}	{% octicon "check" aria-label="Included" %}	{% octicon "check" aria-label="Included" %}
Android sensitive keyboard cache	524	{% octicon "x" aria-label="Not included" %}	{% octicon "check" aria-label="Included" %}	{% octicon "check" aria-label="Included" %}
Android WebSettings file access	200	{% octicon "x" aria-label="Not included" %}	{% octicon "check" aria-label="Included" %}	{% octicon "check" aria-label="Included" %}
Android WebView JavaScript settings	079	{% octicon "x" aria-label="Not included" %}	{% octicon "check" aria-label="Included" %}	{% octicon "check" aria-label="Included" %}
Android WebView settings allows access to content links	200	{% octicon "x" aria-label="Not included" %}	{% octicon "check" aria-label="Included" %}	{% octicon "check" aria-label="Included" %}
Application backup allowed	312	{% octicon "x" aria-label="Not included" %}	{% octicon "check" aria-label="Included" %}	{% octicon "check" aria-label="Included" %}
Building a command line with string concatenation	078, 088	{% octicon "x" aria-label="Not included" %}	{% octicon "check" aria-label="Included" %}	{% octicon "x" aria-label="Not included" %}
Building a command with an injected environment variable	078, 088, 454	{% octicon "x" aria-label="Not included" %}	{% octicon "check" aria-label="Included" %}	{% octicon "check" aria-label="Included" %}
Cleartext storage of sensitive information in the Android filesystem	312	{% octicon "x" aria-label="Not included" %}	{% octicon "check" aria-label="Included" %}	{% octicon "check" aria-label="Included" %}
Cleartext storage of sensitive information using 'Properties' class	313	{% octicon "x" aria-label="Not included" %}	{% octicon "check" aria-label="Included" %}	{% octicon "check" aria-label="Included" %}
Cleartext storage of sensitive information using SharedPreferences on Android	312	{% octicon "x" aria-label="Not included" %}	{% octicon "check" aria-label="Included" %}	{% octicon "check" aria-label="Included" %}
Cleartext storage of sensitive information using a local database on Android	312	{% octicon "x" aria-label="Not included" %}	{% octicon "check" aria-label="Included" %}	{% octicon "x" aria-label="Not included" %}
Comparison of narrow type with wide type in loop condition	190, 197	{% octicon "x" aria-label="Not included" %}	{% octicon "check" aria-label="Included" %}	{% octicon "check" aria-label="Included" %}
Executing a command with a relative path	078, 088	{% octicon "x" aria-label="Not included" %}	{% octicon "check" aria-label="Included" %}	{% octicon "check" aria-label="Included" %}
Exposure of sensitive information to notifications	200	{% octicon "x" aria-label="Not included" %}	{% octicon "check" aria-label="Included" %}	{% octicon "check" aria-label="Included" %}
Exposure of sensitive information to UI text views	200	{% octicon "x" aria-label="Not included" %}	{% octicon "check" aria-label="Included" %}	{% octicon "check" aria-label="Included" %}
HTTP request type unprotected from CSRF	352	{% octicon "x" aria-label="Not included" %}	{% octicon "check" aria-label="Included" %}	{% octicon "check" aria-label="Included" %}
Improper validation of user-provided array index	129	{% octicon "x" aria-label="Not included" %}	{% octicon "check" aria-label="Included" %}	{% octicon "check" aria-label="Included" %}
Improper validation of user-provided size used for array construction	129	{% octicon "x" aria-label="Not included" %}	{% octicon "check" aria-label="Included" %}	{% octicon "check" aria-label="Included" %}
Insecure basic authentication	522, 319	{% octicon "x" aria-label="Not included" %}	{% octicon "check" aria-label="Included" %}	{% octicon "check" aria-label="Included" %}
Insecure JavaMail SSL Configuration	297	{% octicon "x" aria-label="Not included" %}	{% octicon "check" aria-label="Included" %}	{% octicon "check" aria-label="Included" %}
Insecurely generated keys for local authentication	287	{% octicon "x" aria-label="Not included" %}	{% octicon "check" aria-label="Included" %}	{% octicon "check" aria-label="Included" %}
Insertion of sensitive information into log files	532	{% octicon "x" aria-label="Not included" %}	{% octicon "check" aria-label="Included" %}	{% octicon "check" aria-label="Included" %}
Leaking sensitive information through a ResultReceiver	927	{% octicon "x" aria-label="Not included" %}	{% octicon "check" aria-label="Included" %}	{% octicon "check" aria-label="Included" %}
Leaking sensitive information through an implicit Intent	927	{% octicon "x" aria-label="Not included" %}	{% octicon "check" aria-label="Included" %}	{% octicon "x" aria-label="Not included" %}
Local information disclosure in a temporary directory	200, 732	{% octicon "x" aria-label="Not included" %}	{% octicon "check" aria-label="Included" %}	{% octicon "check" aria-label="Included" %}
Log Injection	117	{% octicon "x" aria-label="Not included" %}	{% octicon "check" aria-label="Included" %}	{% octicon "check" aria-label="Included" %}
Loop with unreachable exit condition	835	{% octicon "x" aria-label="Not included" %}	{% octicon "check" aria-label="Included" %}	{% octicon "x" aria-label="Not included" %}
Missing read or write permission in a content provider	926	{% octicon "x" aria-label="Not included" %}	{% octicon "check" aria-label="Included" %}	{% octicon "check" aria-label="Included" %}
Partial path traversal vulnerability	023	{% octicon "x" aria-label="Not included" %}	{% octicon "check" aria-label="Included" %}	{% octicon "check" aria-label="Included" %}
Query built by concatenation with a possibly-untrusted string	089, 564	{% octicon "x" aria-label="Not included" %}	{% octicon "check" aria-label="Included" %}	{% octicon "check" aria-label="Included" %}
Race condition in socket authentication	421	{% octicon "x" aria-label="Not included" %}	{% octicon "check" aria-label="Included" %}	{% octicon "check" aria-label="Included" %}
Time-of-check time-of-use race condition	367	{% octicon "x" aria-label="Not included" %}	{% octicon "check" aria-label="Included" %}	{% octicon "check" aria-label="Included" %}
Trust boundary violation	501	{% octicon "x" aria-label="Not included" %}	{% octicon "check" aria-label="Included" %}	{% octicon "check" aria-label="Included" %}
Uncontrolled data in arithmetic expression	190, 191	{% octicon "x" aria-label="Not included" %}	{% octicon "check" aria-label="Included" %}	{% octicon "check" aria-label="Included" %}
Unreleased lock	764, 833	{% octicon "x" aria-label="Not included" %}	{% octicon "check" aria-label="Included" %}	{% octicon "x" aria-label="Not included" %}
Unsafe certificate trust	273	{% octicon "x" aria-label="Not included" %}	{% octicon "check" aria-label="Included" %}	{% octicon "check" aria-label="Included" %}
Unsafe resource fetching in Android WebView	749, 079	{% octicon "x" aria-label="Not included" %}	{% octicon "check" aria-label="Included" %}	{% octicon "x" aria-label="Not included" %}
Use of a potentially broken or risky cryptographic algorithm	327, 328	{% octicon "x" aria-label="Not included" %}	{% octicon "check" aria-label="Included" %}	{% octicon "check" aria-label="Included" %}
Use of a potentially dangerous function	676	{% octicon "x" aria-label="Not included" %}	{% octicon "check" aria-label="Included" %}	{% octicon "x" aria-label="Not included" %}
User-controlled bypass of sensitive method	807, 290	{% octicon "x" aria-label="Not included" %}	{% octicon "check" aria-label="Included" %}	{% octicon "x" aria-label="Not included" %}
User-controlled data in arithmetic expression	190, 191	{% octicon "x" aria-label="Not included" %}	{% octicon "check" aria-label="Included" %}	{% octicon "check" aria-label="Included" %}

{% endrowheaders %}