rspec/rules/S899/java/rule.adoc
Egon Okerman d1417e82f8
Modify CWE and OWASP Top 10 links to follow standard link format (APPSEC-1134) (#3529)
* Fix all CWE references

* Fix all OWASP references

* Fix missing CWE prefixes
2024-01-15 17:15:56 +01:00

61 lines
1.7 KiB
Plaintext

== Why is this an issue?
include::../jvm-description.adoc[]
=== Noncompliant code example
[source,java]
----
public void doSomething(File file, Lock lock) {
file.delete(); // Noncompliant
// ...
lock.tryLock(); // Noncompliant
}
----
=== Compliant solution
[source,java]
----
public void doSomething(File file, Lock lock) {
if (!lock.tryLock()) {
// lock failed; take appropriate action
}
if (!file.delete()) {
// file delete failed; take appropriate action
}
}
----
== Resources
* https://wiki.sei.cmu.edu/confluence/x/xzdGBQ[CERT, EXP00-J.] - Do not ignore values returned by methods
* https://wiki.sei.cmu.edu/confluence/x/TTZGBQ[CERT, FIO02-J.] - Detect and handle file-related errors
* CWE - https://cwe.mitre.org/data/definitions/754[CWE-754 - Improper Check for Unusual Exceptional Conditions]
ifdef::env-github,rspecator-view[]
'''
== Implementation Specification
(visible only on this page)
include::../message.adoc[]
'''
== Comments And Links
(visible only on this page)
=== on 1 Dec 2014, 10:13:50 Freddy Mallet wrote:
Hi @Ann, I let you specify this one and would only track call to File.delete() for the time being. Thanks
=== on 11 May 2016, 18:22:00 Michael Gumowski wrote:
Updated to add case of ``++Lock.tryLock()++``.
=== on 18 Aug 2016, 14:37:57 Ann Campbell wrote:
``++File.mkdirs++`` excluded because Javadoc says: "true if and only if the directory was created, along with all necessary parent directories; false otherwise." Meaning that it will return ``++true++`` if it had to create the dir and ``++false++`` if the dir already existed. Either way, I have my dir.
include::../comments-and-links.adoc[]
endif::env-github,rspecator-view[]