SEI CERT Oracle Secure Coding Standard for Java - Guidelines 00. Input Validation and Data Sanitization (IDS)

The product performs authentication based on the name of a resource being accessed, or the name of the actor performing the access, but it does not properly check all ...

The product filters data in a way that causes it to be reduced or "collapsed" into an unsafe value that violates an expected security property.

The product prepares a structured message for communication with another component, but encoding or escaping of the data is either missing or done incorrectly. As a re...

The product does not handle or incorrectly handles a compressed input with a very high compression ratio that produces a large output.

The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could be interpreted as escape, meta...

The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could be interpreted as line delimit...

The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes...

The product does not neutralize or incorrectly neutralizes output that is written to logs.

The product validates input before it is canonicalized, which prevents the product from detecting data that becomes invalid after the canonicalization step.

The product uses a function that accepts a format string as an argument, but the format string originates from an external source.

CWE entries in this view (graph) are fully or partially eliminated by following the guidance presented in the online wiki that reflects that current rules and recommen...