iframe-proxy | Sunbelt Computer Software

37 lines (34 loc) · 1.38 KB

 * @name EJB uses file input/output
 * @description An EJB should not attempt to access files or directories in the file system.
 *              Such use could compromise security and is not a suitable data access method
 *              for enterprise components.
 * @kind problem
 * @problem.severity error
 * @precision low
 * @id java/ejb/file-io
 * @tags reliability
 *       external/cwe/cwe-576
import java
import semmle.code.java.frameworks.javaee.ejb.EJB
import semmle.code.java.frameworks.javaee.ejb.EJBRestrictions
 * JSR 220: Enterprise JavaBeansTM,Version 3.0
 * EJB Core Contracts and Requirements
 * Section 21.1.2 Programming Restrictions
 * - An enterprise bean must not use the java.io package to attempt to access files and directo-
 * ries in the file system.
 * The file system APIs are not well-suited for business components to access data. Business components
 * should use a resource manager API, such as JDBC, to store data.
 * - The enterprise bean must not attempt to directly read or write a file descriptor.
 * Allowing the enterprise bean to read and write file descriptors directly could compromise security.
from Callable origin, ForbiddenFileCallable target, Call call
where ejbCalls(origin, target, call)
select origin, "EJB should not access the file system by calling $@.", call,
  target.getDeclaringType().getName() + "." + target.getName()

Sunbelt Computer Software

PL/B Language Development and Support

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Sunbelt Computer Software

PL/B Language Development and Support

FilesExpand file tree

EjbFileIO.ql

Latest commit

History

EjbFileIO.ql

File metadata and controls