KISA GuidLine Bug Pattern

1. SQL 삽입

   • FindBugs
     • CUSTOM_INJECTION [1]
     • SQL_INJECTION [2]
     • SQL_INJECTION_TURBINE [3]
     • SQL_INJECTION_HIBERNATE [4]
     • SQL_INJECTION_JDO [5]
     • SQL_INJECTION_JPA [6]
     • SQL_INJECTION_SPRING_JDBC [7]
     • SQL_INJECTION_JDBC [8]
     • SCALA_SQL_INJECTION_SLICK [9]
     • SCALA_SQL_INJECTION_ANORM [10]
     • SQL_INJECTION_ANDROID [11]
     • AWS_QUERY_INJECTION [12]
     • SQL_NONCONSTANT_STRING_PASSED_TO_EXECUTE [13]
     • SQL_PREPARED_STATEMENT_GENERATED_FROM_NONCONSTANT_STRING [14]
   • LAPSE+
     • SQL Injection [2]
   • SonarQube
     • SQL binding mechanisms should be used [14]

2. 경로조작 및 자원삽입

   • FindBugs
     • PATH_TRAVERSAL_IN [1]
     • PATH_TRAVERSAL_OUT [2]
     • SCALA_PATH_TRAVERSAL_IN [3]
     • STRUTS_FILE_DISCLOSURE [4]
     • SPRING_FILE_DISCLOSURE [5]
     • REQUESTDISPATCHER_FILE_DISCLOSURE [6]
     • EXTERNAL_CONFIG_CONTROL [7]
     • BEAN_PROPERTY_INJECTION [8]
     • PT_ABSOLUTE_PATH_TRAVERSAL [9]
     • PT_RELATIVE_PATH_TRAVERSAL [10]
   • LAPSE+
     • Path Traversal [1]

3. 크로스사이트 스크립트

   • FindBugs
     • XSS_REQUEST_WRAPPER [1]
     • JSP_JSTL_OUT [2]
     • XSS_JSP_PRINT [3]
     • XSS_SERVLET [4]
     • ANDROID_GEOLOCATION [5]
     • ANDROID_WEB_VIEW_JAVASCRIPT [6]
     • ANDROID_WEB_VIEW_JAVASCRIPT_INTERFACE [7]
     • HTTPONLY_COOKIE [8]
     • SCALA_XSS_TWIRL [9]
     • SCALA_XSS_MVC_API [10]
     • XSS_REQUEST_PARAMETER_TO_JSP_WRITER [11]
     • XSS_REQUEST_PARAMETER_TO_SEND_ERROR [12]
     • XSS_REQUEST_PARAMETER_TO_SERVLET_WRITER [13]
   • LAPSE+
     • Cross-Site-Scripting(XSS) [1]

4. 운영체제 명령어 삽입

   • FindBugs
     • COMMAND_INJECTION [1]
     • SCALA_COMMAND_INJECTION [2]
   • LAPSE+
     • Command Injection [1]
   • SonarQube
     • Values passed to OS commands should be sanitized [1]

5. 위험한 형식 파일 업로드

   • FindBugs
     • WEAK_FILENAMEUTILS [1]
     • FILE_UPLOAD_FILENAME [2]

6. 신뢰되지 않는 URL 주소로 자동접속 연결

   • FindBugs
     • UNVALIDATED_REDIRECT [1]
     • PLAY_UNVALIDATED_REDIRECT [2]
     • SPRING_UNVALIDATED_REDIRECT [3]
   • LAPSE+
     • URL Tampering [1]

7. XQuery 삽입

   • FindBugs
     • XMLStreamReader [1]
     • XXE_SAXPARSER [2]
     • XXE_XMLREADER [3]
     • XXE_DOCUMENT [4]
     • XXE_DTD_TRANSFORM_FACTORY [5]
     • XXE_XSLT_TRANSFORM_FACTORY [6]
     • XML_DECODER [7]
     • JSP_XSLT [8]
     • MALICIOUS_XSLT [9]
   • LAPSE+
     • XML Injection [4]

8. XPath 삽입

   • FindBugs
     • XPATH_INJECTION [1]
   • LAPSE+
     • XPath Injection [1]

9. LDAP 삽입

   • FindBugs
     • LDAP_INJECTION [1]
     • LDAP_ANONYMOUS [2]
     • LDAP_ENTRY_POISONING [3]
   • LAPSE+
     • LDAP Injection [1]
   • SonarQube
     • Values passed to LDAP queries should be sanitized [1]

10. 크로스사이트 요청 위조 [Extended]

    • FindBugs
      • SPRING_CSRF_PROTECTION_DISABLED [1]
      • SPRING_CSRF_UNRESTRICTED_REQUEST_MAPPING [2]
      • SCALA_PLAY_SSRF [3]
      • URLCONNECTION_SSRF_FD [4]
    • PMD
      • NoUnsanitizedJSPExpression [5]

11. HTTP 응답분할

    • FindBugs
      • HTTP_RESPONSE_SPLITTING [1]
      • HRS_REQUEST_PARAMETER_TO_HTTP_HEADER [2]
    • LAPSE+
      • Header Manipulation [2]
      • HTTP Response Splitting [1]

12. 정수형 오버플로우 [Extended]

    • FindBugs
      • BAD_HEXA_CONVERSION [1]
    • PMD
      • BadComparison [2]
    • SonarQube
      • "Double.longBitsToDouble" should not be used for "int" [3]

13. 보안기능 결정에 사용되는 부적절한 입력값 [Extended]

    • FindBugs
      • SERVLET_PARAMETER [1]
      • SERVLET_CONTENT_TYPE [2]
      • SERVLET_SERVER_NAME [3]
      • SERVLET_SESSION_ID [4]
      • SERVLET_QUERY_STRING [5]
      • SERVLET_HEADER [6]
      • SERVLET_HEADER_REFERER [7]
      • SERVLET_HEADER_USER_AGENT [8]
      • HTTP_PARAMETER_POLLUTION [9]
      • TRUST_BOUNDARY_VIOLATION [12]
    • LAPSE+
      • Cookie Poisoning [10]
      • Parameter Tampering [1]
    • SonarQube
      • "HttpServletRequest.getRequestedSessionId()" should not be used [4]
      • HTTP referers should not be relied on [7]
      • Untrusted data should not be stored in sessions [11]

14. 포멧 스트링 삽입

    • FindBugs
      • FORMAT_STRING_MANIPULATION [1]

15. 적절한 인증 없는 중요기능 허용

16. 부적절한 인가

17. 중요한 자원에 대한 잘못된 권한 설정

18. 취약한 암호화 알고리즘 사용 [Extended]

    • FindBugs
      • WEAK_MESSAGE_DIGEST_MD5 [1]
      • WEAK_MESSAGE_DIGEST_SHA1 [2]
      • SSL_CONTEXT [3]
      • CUSTOM_MESSAGE_DIGEST [4]
      • HAZELCAST_SYMMETRIC_ENCRYPTION [5]
      • NULL_CIPHER [6]
      • DES_USAGE [7]
      • TDES_USAGE [8]
      • RSA_NO_PADDING [9]
      • ECB_MODE [10]
      • PADDING_ORACLE [11]
      • ESAPI_ENCRYPTOR [12]
      • CIPHER_INTEGRITY [15]
    • SonarQube
      • Neither DES (Data Encryption Standard) nor DESede (3DES) should be used [7]
      • Cryptographic RSA algorithms should always incorporate OAEP (Optimal Asymmetric Encryption Padding) [13]
      • "javax.crypto.NullCipher" should not be used for anything other than testing [6]
      • Only standard cryptographic algorithms should be used [4]
      • Pseudorandom number generators (PRNGs) should not be used in secure contexts [14]
      • SHA-1 and Message-Digest hash algorithms should not be used [2]

19. 중요정보 평문 저장

20. 중요정보 평문 전송 [Extended]

    • FindBugs
      • DEFAULT_HTTP_CLIENT [1]
      • UNENCRYPTED_SOCKET [2]
      • UNENCRYPTED_SERVER_SOCKET [3]
      • INSECURE_COOKIE [4]
      • INSECURE_SMTP_SSL [5]
      • URL_REWRITING [6]
    • SonarQube
      • Cookies should be “secure” [4]

21. 하드코드된 비밀번호

    • FindBugs
      • HARD_CODE_PASSWORD [1]
      • DMI_CONSTANT_DB_PASSWORD [2]
      • DMI_EMPTY_DB_PASSWORD [3]
    • SonarQube
      • Credentials should not be hard-coded [2]

22. 충분하지 않은 키 길이 사용

    • FindBugs
      • BLOWFISH_KEY_SIZE [1]
      • RSA_KEY_SIZE [2]

23. 적절하지 않은 난수값 사용

    • FindBugs
      • PREDICTABLE_RANDOM [1]
      • PREDICTABLE_RANDOM_SCALA [2]
    • SonarQube
      • "SecureRandom" seeds should not be predictable [3]

24. 취약한 비밀번호 사용

25. 하드코드된 암호화 키 [Extended]

    • FindBugs
      • HARD_CODE_KEY [1]
    • SonarQube
      • IP addresses should not be hardcoded [2]

26. 사용자 하드디스크에 저장되는 쿠키를 통한 정보노출

    • FindBugs
      • COOKIE_USAGE [1]
      • COOKIE_PERSISTENT [2]
      • HRS_REQUEST_PARAMETER_TO_COOKIE [3]

27. 주석문 안에 포함된 시스템 주요정보

28. 솔트 없이 일방향 해쉬함수 사용

29. 무결성 검사 없는 코드 다운로드

    • FindBugs
      • JSP_INCLUDE [1]
    • SonarQube
      • Classes should not be loaded dynamically [2]

30. 반복된 인증시도 제한 기능 부재

31. 경쟁조건: 검사 시점과 사용 시점(TOCTOU)

    • FindBugs
      • AT_OPERATION_SEQUENCE_ON_CONCURRENT_ABSTRACTION [1]
      • DC_DOUBLECHECK [2]
      • DC_PARTIALLY_CONSTRUCTED [3]
      • DL_SYNCHRONIZATION_ON_BOOLEAN [4]
      • DL_SYNCHRONIZATION_ON_UNSHARED_BOXED_PRIMITIVE [5]
      • DL_SYNCHRONIZATION_ON_SHARED_CONSTANT [6]
      • DL_SYNCHRONIZATION_ON_UNSHARED_BOXED_PRIMITIVE [7]
      • DM_MONITOR_WAIT_ON_CONDITION [8]
      • DM_USELESS_THREAD [9]
      • ESync_EMPTY_SYNC [10]
      • IS2_INCONSISTENT_SYNC [11]
      • IS_FIELD_NOT_GUARDED [12]
      • JLM_JSR166_LOCK_MONITORENTER [13]
      • JLM_JSR166_UTILCONCURRENT_MONITORENTER [14]
      • JML_JSR166_CALLING_WAIT_RATHER_THAN_AWAIT [15]
      • LI_LAZY_INIT_STATIC [16]
      • LI_LAZY_INIT_UPDATE_STATIC [17]
      • ML_SYNC_ON_FIELD_TO_GUARD_CHANGING_THAT_FIELD [18]
      • ML_SYNC_ON_UPDATED_FIELD [19]
      • MWN_MISMATCHED_NOTIFY [20]
      • MWN_MISMATCHED_WAIT [21]
      • NN_NAKED_NOTIFY [22]
      • NO_NOTIFY_NOT_NOTIFYALL [23]
      • RS_READOBJECT_SYNC [24]
      • RV_RETURN_VALUE_OF_PUTIFABSENT_IGNORED [25]
      • RU_INVOKE_RUN [26]
      • SC_START_IN_CTOR [27]
      • SP_SPIN_ON_FIELD [28]
      • STCAL_INVOKE_ON_STATIC_CALENDAR_INSTANCE [29]
      • STCAL_INVOKE_ON_STATIC_DATE_FORMAT_INSTANCE [30]
      • STCAL_STATIC_CALENDAR_INSTANCE [31]
      • STCAL_STATIC_SIMPLE_DATE_FORMAT_INSTANCE [32]
      • SWL_SLEEP_WITH_LOCK_HELD [33]
      • TLW_TWO_LOCK_WAIT [34]
      • UG_SYNC_SET_UNSYNC_GET [35]
      • UL_UNRELEASED_LOCK [36]
      • UL_UNRELEASED_LOCK_EXCEPTION_PATH [37]
      • UW_UNCOND_WAIT [38]
      • VO_VOLATILE_INCREMENT [39]
      • VO_VOLATILE_REFERENCE_TO_ARRAY [40]
      • WL_USING_GETCLASS_RATHER_THANODR_OPEN_DATABASE_RESOURCE_EXCEPTION_PATH_CLASS_LITERAL [41]
      • WS_WRITEOBJECT_SYNC [42]
      • WA_AWAIT_NOT_IN_LOOP [43]
      • WA_NOT_IN_LOOP [44]
    • PMD
      • AvoidSynchronizedAtMethodLevel [45]
      • AvoidUsingVolatile [46]
      • DoubleCheckedLocking [47]
      • NonThreadSafeSingleton [48]
      • UnsynchronizedStaticDateFormatter [49]
      • UseConcurrentHashMap [49]
    • SonarQube
      • "wait" should not be called when multiple locks are held [34]
      • Value-based classes should not be used for locking [50]
      • "getClass" should not be used for synchronization [51]
      • Getters and setters should be synchronized in pairs [52]
      • Non-thread-safe fields should not be static [53]
      • Blocks should be synchronized on "private final" fields [54]
      • ".equals()" should not be used to test the values of "Atomic" classes [55]
      • Synchronization should not be based on Strings or boxed primitives [56]

32. 종료되지 않은 반복문 또는 재귀함수

    • FindBugs
      • IL_CONTAINER_ADDED_TO_ITSELF [1]
      • IL_INFINITE_LOOP [2]
      • IL_INFINITE_RECURSIVE_LOOP [3]
    • PMD
      • EmptyWhileStmt [4]
    • SonarQube
      • Loops should not be infinite [2]
      • Double-checked locking should not be used [5]
      • Locks should be released [6]

33. 오류메시지를 통한 정보노출

    • SonarQube
      • Throwable.printStackTrace(...) should not be called [1]

34. 오류 상황 대응 부재

    • PMD
      • AvoidInstanceofChecksInCatchClause [1]
      • AvoidLiteralsInIfCondition [2]
      • CloneThrowsCloneNotSupportedException [3]
      • DoNotExtendJavaLangThrowable [4]
      • EmptyCatchBlock [5]
      • ReturnFromFinallyBlock [6]
    • SonarQube
      • Exceptions should not be thrown from servlet methods [7]
      • "SingleConnectionFactory" instances should be set to "reconnectOnException" [8]
      • "Iterator.next()" methods should throw "NoSuchElementException" [9]
      • Return values should not be ignored when they contain the operation status code [10]
      • Exception should not be created without being thrown [11]

35. 부적절한 예외 처리

    • FindBugs
      • DE_MIGHT_DROP [1]
      • DE_MIGHT_IGNORE [2]
    • PMD
      • AvoidCatchingNPE [2]
      • AvoidLosingExceptionInformation [2]
      • UseCorrectExceptionLogging [3]
      • DoNotThrowExceptionInFinally [4]
    • SonarQube
      • "InterruptedException" should not be ignored [2]

36. 잘못된 세션에 의한 데이터 정보노출

    • FindBugs
      • MSF_MUTABLE_SERVLET_FIELD [1]
    • PMD
      • StaticEJBFieldShouldBeFinal [2]
    • SonarQube
      • Members of Spring components should be injected [3]
      • Servlets should not have mutable instance fields [1]

37. 제거되지 않고 남은 디버그 코드

    • SonarQube
      • Web applications should not have a "main" method [1]

38. 시스템 데이터 정보노출

39. Public 메서드로부터 반환된 Private 배열

    • FindBugs
      • EI_EXPOSE_REP [1]
      • MS_EXPOSE_REP [2]
    • SonarQube
      • Mutable members should not be stored or returned directly [1]

40. Private 배열에 Public 데이터 할당

    • FindBugs
      • EI_EXPOSE_REP2 [1]

41. DNS lookup에 의존한 보안결정

42. 취약한 API

    • FindBugs
      • DM_EXIT [1]
      • DM_RUN_FINALIZERS_ON_EXIT [2]
    • PMD
      • AvoidThreadGroup [3]
      • DoNotUseThreads [4]
      • DontCallThreadRun [5]
      • ProperCloneImplementation [6]
      • UseNotifyAllInsteadOfNotify [7]
      • UseProperClassLoader [8]
    • SonarQube
      • "File.createTempFile" should not be used to create a directory [9]
      • Thread.run() should not be called directly [5]

Non-KISA GuidLine Bug Pattern

1. 암호화 방식의 잘못된 사용
   • FindBugs
     • WEAK_TRUST_MANAGER [1]
     • WEAK_HOSTNAME_VERIFIER [2]
     • STATIC_IV [3]
     • UNSAFE_HASH_EQUALS [4]
2. 프레임워크의 고유한 프로그래밍 규칙 위반
   • FindBugs
     • JAXWS_ENDPOINT [1]
     • JAXRS_ENDPOINT [2]
     • TAPESTRY_ENDPOINT [3]
     • WICKET_ENDPOINT [4]
     • STRUTS1_ENDPOINT [5]
     • STRUTS2_ENDPOINT [6]
     • SPRING_ENDPOINT [7]
     • STRUTS_FORM_VALIDATION [8]
     • ANDROID_BROADCAST [9]
     • ANDROID_WORLD_WRITABLE [10]
     • PERMISSIVE_CORS [11]
     • ANDROID_EXTERNAL_FILE_ACCESS [12]
     • SCALA_SENSITIVE_DATA_EXPOSURE [13]
   • SonarQube
     • Default EJB interceptors should be declared in "ejb-jar.xml [14]
     • Defined filters should be used [15]
     • "@RequestMapping" methods should be "public" [16]
     • Struts validation forms should have unique names [17]
     • Security constraints should be defined [18]
     • Non-public methods should not be "@Transactional" [19]
3. 자원부족을 일으킬 수 있는 명령 허용
   • FindBugs
     • ReDOS [1]
   • SonarQube
     • Inappropriate regular expressions should not be used [2]
     • The value returned from a stream read should be checked [3]
4. 코드 삽입
   • FindBugs
     • SCRIPT_ENGINE_INJECTION [1]
     • SPEL_INJECTION [2]
     • EL_INJECTION [3]
     • OGNL_INJECTION [4]
     • JSP_SPRING_EVAL [5]
     • OBJECT_DESERIALIZATION [6]
     • JACKSON_UNSAFE_DESERIALIZATION [7]
     • DESERIALIZATION_GADGET [8]
     • TEMPLATE_INJECTION_VELOCITY [9]
     • TEMPLATE_INJECTION_FREEMARKER [10]
5. 로그 삽입
   • FindBugs
     • SEAM_LOG_INJECTION [1]
     • CRLF_INJECTION_LOGS [2]