enable publish #509
AdamVeAnnotations
203 warnings
|
May expose internal representation by returning reference to mutable object (MALICIOUS_CODE):
com/yubico/yubikit/android/app/databinding/ActivityMainBinding.java#L38
com.yubico.yubikit.android.app.databinding.ActivityMainBinding.getRoot() may expose internal representation by returning ActivityMainBinding.rootView
Summary:
...
|
|
May expose internal representation by returning reference to mutable object (MALICIOUS_CODE):
com/yubico/yubikit/android/app/databinding/AppBarMainBinding.java#L33
com.yubico.yubikit.android.app.databinding.AppBarMainBinding.getRoot() may expose internal representation by returning AppBarMainBinding.rootView
Summary:
...
|
|
May expose internal representation by returning reference to mutable object (MALICIOUS_CODE):
com/yubico/yubikit/android/app/databinding/FragmentWebBinding.java#L44
com.yubico.yubikit.android.app.databinding.FragmentWebBinding.getRoot() may expose internal representation by returning FragmentWebBinding.rootView
Summary:
...
|
|
Be wary of letting constructors throw exceptions. (BAD_PRACTICE):
com/yubico/yubikit/android/transport/nfc/NfcYubiKeyManager.java#L55
Exception thrown in class com.yubico.yubikit.android.transport.nfc.NfcYubiKeyManager at new com.yubico.yubikit.android.transport.nfc.NfcYubiKeyManager(Context, NfcDispatcher) will leave the constructor. The object under construction remains partially initialized and may be vulnerable to Finalizer attacks.
Summary:
...
|
|
Be wary of letting constructors throw exceptions. (BAD_PRACTICE):
com/yubico/yubikit/android/transport/usb/UsbYubiKeyDevice.java#L69
Exception thrown in class com.yubico.yubikit.android.transport.usb.UsbYubiKeyDevice at new com.yubico.yubikit.android.transport.usb.UsbYubiKeyDevice(UsbManager, UsbDevice) will leave the constructor. The object under construction remains partially initialized and may be vulnerable to Finalizer attacks.
Summary:
...
|
|
Be wary of letting constructors throw exceptions. (BAD_PRACTICE):
com/yubico/yubikit/android/transport/usb/connection/UsbSmartCardConnection.java#L89
Exception thrown in class com.yubico.yubikit.android.transport.usb.connection.UsbSmartCardConnection at new com.yubico.yubikit.android.transport.usb.connection.UsbSmartCardConnection(UsbDeviceConnection, UsbInterface, UsbEndpoint, UsbEndpoint) will leave the constructor. The object under construction remains partially initialized and may be vulnerable to Finalizer attacks.
Summary:
...
|
|
Non-null field is not initialized (CORRECTNESS):
com/yubico/yubikit/android/ui/OtpActivity.java#L39
Non-null field keyListener is not initialized by new com.yubico.yubikit.android.ui.OtpActivity()
Summary:
...
|
|
Non-null field is not initialized (CORRECTNESS):
com/yubico/yubikit/android/ui/YubiKeyPromptActivity.java#L59
Non-null field action is not initialized by new com.yubico.yubikit.android.ui.YubiKeyPromptActivity()
Summary:
...
|
|
Non-null field is not initialized (CORRECTNESS):
com/yubico/yubikit/android/ui/YubiKeyPromptActivity.java#L59
Non-null field cancelButton is not initialized by new com.yubico.yubikit.android.ui.YubiKeyPromptActivity()
Summary:
...
|
|
Non-null field is not initialized (CORRECTNESS):
com/yubico/yubikit/android/ui/YubiKeyPromptActivity.java#L59
Non-null field enableNfcButton is not initialized by new com.yubico.yubikit.android.ui.YubiKeyPromptActivity()
Summary:
...
|
|
Non-null field is not initialized (CORRECTNESS):
com/yubico/yubikit/android/ui/YubiKeyPromptActivity.java#L59
Non-null field helpTextView is not initialized by new com.yubico.yubikit.android.ui.YubiKeyPromptActivity()
Summary:
...
|
|
Non-null field is not initialized (CORRECTNESS):
com/yubico/yubikit/android/ui/YubiKeyPromptActivity.java#L59
Non-null field yubiKit is not initialized by new com.yubico.yubikit.android.ui.YubiKeyPromptActivity()
Summary:
...
|
|
Wait not in loop (MT_CORRECTNESS):
com/yubico/yubikit/core/application/CommandState.java#L57
Wait not in loop in com.yubico.yubikit.core.application.CommandState.waitForCancel(long)
Summary:
...
|
|
Be wary of letting constructors throw exceptions. (BAD_PRACTICE):
com/yubico/yubikit/core/fido/FidoProtocol.java#L58
Exception thrown in class com.yubico.yubikit.core.fido.FidoProtocol at new com.yubico.yubikit.core.fido.FidoProtocol(FidoConnection) will leave the constructor. The object under construction remains partially initialized and may be vulnerable to Finalizer attacks.
Summary:
...
|
|
Potential CRLF Injection for logs (SECURITY):
com/yubico/yubikit/core/internal/Logger.java#L119
This use of org/slf4j/Logger.trace(Ljava/lang/String;)V might be used to include CRLF characters into log messages
Summary:
...
|
|
Potential CRLF Injection for logs (SECURITY):
com/yubico/yubikit/core/internal/Logger.java#L119
This use of org/slf4j/Logger.debug(Ljava/lang/String;)V might be used to include CRLF characters into log messages
Summary:
...
|
|
Potential CRLF Injection for logs (SECURITY):
com/yubico/yubikit/core/internal/Logger.java#L119
This use of org/slf4j/Logger.info(Ljava/lang/String;)V might be used to include CRLF characters into log messages
Summary:
...
|
|
Potential CRLF Injection for logs (SECURITY):
com/yubico/yubikit/core/internal/Logger.java#L119
This use of org/slf4j/Logger.warn(Ljava/lang/String;)V might be used to include CRLF characters into log messages
Summary:
...
|
|
Potential CRLF Injection for logs (SECURITY):
com/yubico/yubikit/core/internal/Logger.java#L119
This use of org/slf4j/Logger.error(Ljava/lang/String;)V might be used to include CRLF characters into log messages
Summary:
...
|
|
Potential CRLF Injection for logs (SECURITY):
com/yubico/yubikit/core/internal/Logger.java#L147
This use of org/slf4j/Logger.trace(Ljava/lang/String;Ljava/lang/Object;)V might be used to include CRLF characters into log messages
Summary:
...
|
|
Potential CRLF Injection for logs (SECURITY):
com/yubico/yubikit/core/internal/Logger.java#L147
This use of org/slf4j/Logger.debug(Ljava/lang/String;Ljava/lang/Object;)V might be used to include CRLF characters into log messages
Summary:
...
|
|
Potential CRLF Injection for logs (SECURITY):
com/yubico/yubikit/core/internal/Logger.java#L147
This use of org/slf4j/Logger.info(Ljava/lang/String;Ljava/lang/Object;)V might be used to include CRLF characters into log messages
Summary:
...
|
|
Potential CRLF Injection for logs (SECURITY):
com/yubico/yubikit/core/internal/Logger.java#L147
This use of org/slf4j/Logger.warn(Ljava/lang/String;Ljava/lang/Object;)V might be used to include CRLF characters into log messages
Summary:
...
|
|
Potential CRLF Injection for logs (SECURITY):
com/yubico/yubikit/core/internal/Logger.java#L147
This use of org/slf4j/Logger.error(Ljava/lang/String;Ljava/lang/Object;)V might be used to include CRLF characters into log messages
Summary:
...
|
|
Potential CRLF Injection for logs (SECURITY):
com/yubico/yubikit/core/internal/Logger.java#L171
This use of org/slf4j/Logger.trace(Ljava/lang/String;Ljava/lang/Object;Ljava/lang/Object;)V might be used to include CRLF characters into log messages
Summary:
...
|
|
Potential CRLF Injection for logs (SECURITY):
com/yubico/yubikit/core/internal/Logger.java#L171
This use of org/slf4j/Logger.debug(Ljava/lang/String;Ljava/lang/Object;Ljava/lang/Object;)V might be used to include CRLF characters into log messages
Summary:
...
|
|
Potential CRLF Injection for logs (SECURITY):
com/yubico/yubikit/core/internal/Logger.java#L171
This use of org/slf4j/Logger.info(Ljava/lang/String;Ljava/lang/Object;Ljava/lang/Object;)V might be used to include CRLF characters into log messages
Summary:
...
|
|
Potential CRLF Injection for logs (SECURITY):
com/yubico/yubikit/core/internal/Logger.java#L171
This use of org/slf4j/Logger.warn(Ljava/lang/String;Ljava/lang/Object;Ljava/lang/Object;)V might be used to include CRLF characters into log messages
Summary:
...
|
|
Potential CRLF Injection for logs (SECURITY):
com/yubico/yubikit/core/internal/Logger.java#L171
This use of org/slf4j/Logger.error(Ljava/lang/String;Ljava/lang/Object;Ljava/lang/Object;)V might be used to include CRLF characters into log messages
Summary:
...
|
|
Potential CRLF Injection for logs (SECURITY):
com/yubico/yubikit/core/internal/Logger.java#L195
This use of org/slf4j/Logger.trace(Ljava/lang/String;[Ljava/lang/Object;)V might be used to include CRLF characters into log messages
Summary:
...
|
|
Potential CRLF Injection for logs (SECURITY):
com/yubico/yubikit/core/internal/Logger.java#L195
This use of org/slf4j/Logger.debug(Ljava/lang/String;[Ljava/lang/Object;)V might be used to include CRLF characters into log messages
Summary:
...
|
|
Potential CRLF Injection for logs (SECURITY):
com/yubico/yubikit/core/internal/Logger.java#L195
This use of org/slf4j/Logger.info(Ljava/lang/String;[Ljava/lang/Object;)V might be used to include CRLF characters into log messages
Summary:
...
|
|
Potential CRLF Injection for logs (SECURITY):
com/yubico/yubikit/core/internal/Logger.java#L195
This use of org/slf4j/Logger.warn(Ljava/lang/String;[Ljava/lang/Object;)V might be used to include CRLF characters into log messages
Summary:
...
|
|
Potential CRLF Injection for logs (SECURITY):
com/yubico/yubikit/core/internal/Logger.java#L195
This use of org/slf4j/Logger.error(Ljava/lang/String;[Ljava/lang/Object;)V might be used to include CRLF characters into log messages
Summary:
...
|
|
Be wary of letting constructors throw exceptions. (BAD_PRACTICE):
com/yubico/yubikit/core/keys/PrivateKeyValues.java#L161
Exception thrown in class com.yubico.yubikit.core.keys.PrivateKeyValues$Rsa at new com.yubico.yubikit.core.keys.PrivateKeyValues$Rsa(BigInteger, BigInteger, BigInteger, BigInteger, BigInteger, BigInteger, BigInteger) will leave the constructor. The object under construction remains partially initialized and may be vulnerable to Finalizer attacks.
Summary:
...
|
|
Be wary of letting constructors throw exceptions. (BAD_PRACTICE):
com/yubico/yubikit/core/keys/PublicKeyValues.java#L103
Exception thrown in class com.yubico.yubikit.core.keys.PublicKeyValues$Cv25519 at new com.yubico.yubikit.core.keys.PublicKeyValues$Cv25519(EllipticCurveValues, byte[]) will leave the constructor. The object under construction remains partially initialized and may be vulnerable to Finalizer attacks.
Summary:
...
|
|
Be wary of letting constructors throw exceptions. (BAD_PRACTICE):
com/yubico/yubikit/core/keys/PublicKeyValues.java#L149
Exception thrown in class com.yubico.yubikit.core.keys.PublicKeyValues$Ec at new com.yubico.yubikit.core.keys.PublicKeyValues$Ec(EllipticCurveValues, BigInteger, BigInteger) will leave the constructor. The object under construction remains partially initialized and may be vulnerable to Finalizer attacks.
Summary:
...
|
|
Be wary of letting constructors throw exceptions. (BAD_PRACTICE):
com/yubico/yubikit/core/otp/ChecksumUtils.java#L62
Exception thrown in class com.yubico.yubikit.core.otp.ChecksumUtils at new com.yubico.yubikit.core.otp.ChecksumUtils() will leave the constructor. The object under construction remains partially initialized and may be vulnerable to Finalizer attacks.
Summary:
...
|
|
Consider using Locale parameterized version of invoked method (I18N):
com/yubico/yubikit/core/otp/Modhex.java#L44
Use of non-localized String.toUpperCase() or String.toLowerCase() in com.yubico.yubikit.core.otp.Modhex.decode(String)
Summary:
...
|
|
Be wary of letting constructors throw exceptions. (BAD_PRACTICE):
com/yubico/yubikit/core/otp/OtpProtocol.java#L59
Exception thrown in class com.yubico.yubikit.core.otp.OtpProtocol at new com.yubico.yubikit.core.otp.OtpProtocol(OtpConnection) will leave the constructor. The object under construction remains partially initialized and may be vulnerable to Finalizer attacks.
Summary:
...
|
|
Be wary of letting constructors throw exceptions. (BAD_PRACTICE):
com/yubico/yubikit/core/smartcard/ApduResponse.java#L32
Exception thrown in class com.yubico.yubikit.core.smartcard.ApduResponse at new com.yubico.yubikit.core.smartcard.ApduResponse(byte[]) will leave the constructor. The object under construction remains partially initialized and may be vulnerable to Finalizer attacks.
Summary:
...
|
|
Be wary of letting constructors throw exceptions. (BAD_PRACTICE):
com/yubico/yubikit/core/util/RandomUtils.java#L40
Exception thrown in class com.yubico.yubikit.core.util.RandomUtils at new com.yubico.yubikit.core.util.RandomUtils() will leave the constructor. The object under construction remains partially initialized and may be vulnerable to Finalizer attacks.
Summary:
...
|
|
Be wary of letting constructors throw exceptions. (BAD_PRACTICE):
com/yubico/yubikit/core/util/StringUtils.java#L49
Exception thrown in class com.yubico.yubikit.core.util.StringUtils at new com.yubico.yubikit.core.util.StringUtils() will leave the constructor. The object under construction remains partially initialized and may be vulnerable to Finalizer attacks.
Summary:
...
|
|
Be wary of letting constructors throw exceptions. (BAD_PRACTICE):
com/yubico/yubikit/fido/client/BasicWebAuthnClient.java#L108
Exception thrown in class com.yubico.yubikit.fido.client.BasicWebAuthnClient at new com.yubico.yubikit.fido.client.BasicWebAuthnClient(Ctap2Session) will leave the constructor. The object under construction remains partially initialized and may be vulnerable to Finalizer attacks.
Summary:
...
|
|
May expose internal representation by returning reference to mutable object (MALICIOUS_CODE):
com/yubico/yubikit/fido/client/BasicWebAuthnClient.java#L135
com.yubico.yubikit.fido.client.BasicWebAuthnClient.getUserAgentConfiguration() may expose internal representation by returning BasicWebAuthnClient.userAgentConfiguration
Summary:
...
|
|
May expose internal representation by incorporating reference to mutable object (MALICIOUS_CODE):
com/yubico/yubikit/fido/client/BasicWebAuthnClient.java#L100
com.yubico.yubikit.fido.client.BasicWebAuthnClient$UserAgentConfiguration.setEpSupportedRpIds(List) may expose internal representation by storing an externally mutable object into BasicWebAuthnClient$UserAgentConfiguration.epSupportedRpIds
Summary:
...
|
|
Dead store to local variable (STYLE):
com/yubico/yubikit/fido/client/CredentialManager.java#L96
Dead store to credentialIdMap in com.yubico.yubikit.fido.client.CredentialManager.getCredentials(String)
Summary:
...
|
|
NullPointerException caught (STYLE):
com/yubico/yubikit/fido/client/MultipleAssertionsAvailable.java#L67
Do not catch NullPointerException like in com.yubico.yubikit.fido.client.MultipleAssertionsAvailable.getUsers()
Summary:
...
|
|
Be wary of letting constructors throw exceptions. (BAD_PRACTICE):
com/yubico/yubikit/fido/ctap/Config.java#L71
Exception thrown in class com.yubico.yubikit.fido.ctap.Config at new com.yubico.yubikit.fido.ctap.Config(Ctap2Session, PinUvAuthProtocol, byte[]) will leave the constructor. The object under construction remains partially initialized and may be vulnerable to Finalizer attacks.
Summary:
...
|
|
Be wary of letting constructors throw exceptions. (BAD_PRACTICE):
com/yubico/yubikit/fido/ctap/CredentialManagement.java#L77
Exception thrown in class com.yubico.yubikit.fido.ctap.CredentialManagement at new com.yubico.yubikit.fido.ctap.CredentialManagement(Ctap2Session, PinUvAuthProtocol, byte[]) will leave the constructor. The object under construction remains partially initialized and may be vulnerable to Finalizer attacks.
Summary:
...
|
|
May expose internal representation by incorporating reference to mutable object (MALICIOUS_CODE):
com/yubico/yubikit/fido/ctap/CredentialManagement.java#L77
new com.yubico.yubikit.fido.ctap.CredentialManagement(Ctap2Session, PinUvAuthProtocol, byte[]) may expose internal representation by storing an externally mutable object into CredentialManagement.pinUvToken
Summary:
...
|
|
May expose internal representation by returning reference to mutable object (MALICIOUS_CODE):
com/yubico/yubikit/fido/ctap/CredentialManagement.java#L287
com.yubico.yubikit.fido.ctap.CredentialManagement$CredentialData.getCredentialId() may expose internal representation by returning CredentialManagement$CredentialData.credentialId
Summary:
...
|
|
May expose internal representation by returning reference to mutable object (MALICIOUS_CODE):
com/yubico/yubikit/fido/ctap/CredentialManagement.java#L291
com.yubico.yubikit.fido.ctap.CredentialManagement$CredentialData.getPublicKey() may expose internal representation by returning CredentialManagement$CredentialData.publicKey
Summary:
...
|
|
May expose internal representation by returning reference to mutable object (MALICIOUS_CODE):
com/yubico/yubikit/fido/ctap/CredentialManagement.java#L283
com.yubico.yubikit.fido.ctap.CredentialManagement$CredentialData.getUser() may expose internal representation by returning CredentialManagement$CredentialData.user
Summary:
...
|
|
May expose internal representation by returning reference to mutable object (MALICIOUS_CODE):
com/yubico/yubikit/fido/ctap/CredentialManagement.java#L252
com.yubico.yubikit.fido.ctap.CredentialManagement$RpData.getRp() may expose internal representation by returning CredentialManagement$RpData.rp
Summary:
...
|
|
May expose internal representation by returning reference to mutable object (MALICIOUS_CODE):
com/yubico/yubikit/fido/ctap/CredentialManagement.java#L256
com.yubico.yubikit.fido.ctap.CredentialManagement$RpData.getRpIdHash() may expose internal representation by returning CredentialManagement$RpData.rpIdHash
Summary:
...
|
|
Be wary of letting constructors throw exceptions. (BAD_PRACTICE):
com/yubico/yubikit/fido/ctap/Ctap2Session.java#L125
Exception thrown in class com.yubico.yubikit.fido.ctap.Ctap2Session at new com.yubico.yubikit.fido.ctap.Ctap2Session(Version, Ctap2Session$Backend) will leave the constructor. The object under construction remains partially initialized and may be vulnerable to Finalizer attacks.
Summary:
...
|
|
Be wary of letting constructors throw exceptions. (BAD_PRACTICE):
com/yubico/yubikit/fido/ctap/Ctap2Session.java#L118
Exception thrown in class com.yubico.yubikit.fido.ctap.Ctap2Session at new com.yubico.yubikit.fido.ctap.Ctap2Session(FidoConnection) will leave the constructor. The object under construction remains partially initialized and may be vulnerable to Finalizer attacks.
Summary:
...
|
|
Be wary of letting constructors throw exceptions. (BAD_PRACTICE):
com/yubico/yubikit/fido/ctap/Ctap2Session.java#L155
Exception thrown in class com.yubico.yubikit.fido.ctap.Ctap2Session at new com.yubico.yubikit.fido.ctap.Ctap2Session(FidoProtocol) will leave the constructor. The object under construction remains partially initialized and may be vulnerable to Finalizer attacks.
Summary:
...
|
|
Be wary of letting constructors throw exceptions. (BAD_PRACTICE):
com/yubico/yubikit/fido/ctap/Ctap2Session.java#L106
Exception thrown in class com.yubico.yubikit.fido.ctap.Ctap2Session at new com.yubico.yubikit.fido.ctap.Ctap2Session(SmartCardConnection) will leave the constructor. The object under construction remains partially initialized and may be vulnerable to Finalizer attacks.
Summary:
...
|
|
Be wary of letting constructors throw exceptions. (BAD_PRACTICE):
com/yubico/yubikit/fido/ctap/Ctap2Session.java#L111
Exception thrown in class com.yubico.yubikit.fido.ctap.Ctap2Session at new com.yubico.yubikit.fido.ctap.Ctap2Session(SmartCardConnection, Version) will leave the constructor. The object under construction remains partially initialized and may be vulnerable to Finalizer attacks.
Summary:
...
|
|
An overridable method is called from a constructor (MALICIOUS_CODE):
com/yubico/yubikit/fido/ctap/Ctap2Session.java#L125
Overridable method getInfo is called from constructor new com.yubico.yubikit.fido.ctap.Ctap2Session(Version, Ctap2Session$Backend).
Summary:
...
|
|
May expose internal representation by returning reference to mutable object (MALICIOUS_CODE):
com/yubico/yubikit/fido/ctap/Ctap2Session.java#L1072
com.yubico.yubikit.fido.ctap.Ctap2Session$AssertionData.getAuthenticatorData() may expose internal representation by returning Ctap2Session$AssertionData.authenticatorData
Summary:
...
|
|
May expose internal representation by returning reference to mutable object (MALICIOUS_CODE):
com/yubico/yubikit/fido/ctap/Ctap2Session.java#L1053
com.yubico.yubikit.fido.ctap.Ctap2Session$AssertionData.getCredential() may expose internal representation by returning Ctap2Session$AssertionData.credential
Summary:
...
|
|
May expose internal representation by returning reference to mutable object (MALICIOUS_CODE):
com/yubico/yubikit/fido/ctap/Ctap2Session.java#L1062
com.yubico.yubikit.fido.ctap.Ctap2Session$AssertionData.getSignature() may expose internal representation by returning Ctap2Session$AssertionData.signature
Summary:
...
|
|
May expose internal representation by returning reference to mutable object (MALICIOUS_CODE):
com/yubico/yubikit/fido/ctap/Ctap2Session.java#L1043
com.yubico.yubikit.fido.ctap.Ctap2Session$AssertionData.getUser() may expose internal representation by returning Ctap2Session$AssertionData.user
Summary:
...
|
|
May expose internal representation by returning reference to mutable object (MALICIOUS_CODE):
com/yubico/yubikit/fido/ctap/Ctap2Session.java#L978
com.yubico.yubikit.fido.ctap.Ctap2Session$CredentialData.getAttestationStatement() may expose internal representation by returning Ctap2Session$CredentialData.attestationStatement
Summary:
...
|
|
May expose internal representation by returning reference to mutable object (MALICIOUS_CODE):
com/yubico/yubikit/fido/ctap/Ctap2Session.java#L960
com.yubico.yubikit.fido.ctap.Ctap2Session$CredentialData.getAuthenticatorData() may expose internal representation by returning Ctap2Session$CredentialData.authenticatorData
Summary:
...
|
|
May expose internal representation by returning reference to mutable object (MALICIOUS_CODE):
com/yubico/yubikit/fido/ctap/Ctap2Session.java#L998
com.yubico.yubikit.fido.ctap.Ctap2Session$CredentialData.getLargeBlobKey() may expose internal representation by returning Ctap2Session$CredentialData.largeBlobKey
Summary:
...
|
|
May expose internal representation by returning reference to mutable object (MALICIOUS_CODE):
com/yubico/yubikit/fido/ctap/Ctap2Session.java#L680
com.yubico.yubikit.fido.ctap.Ctap2Session$InfoData.getAaguid() may expose internal representation by returning Ctap2Session$InfoData.aaguid
Summary:
...
|
|
May expose internal representation by returning reference to mutable object (MALICIOUS_CODE):
com/yubico/yubikit/fido/ctap/Ctap2Session.java#L752
com.yubico.yubikit.fido.ctap.Ctap2Session$InfoData.getAlgorithms() may expose internal representation by returning Ctap2Session$InfoData.algorithms
Summary:
...
|
|
May expose internal representation by returning reference to mutable object (MALICIOUS_CODE):
com/yubico/yubikit/fido/ctap/Ctap2Session.java#L858
com.yubico.yubikit.fido.ctap.Ctap2Session$InfoData.getCertifications() may expose internal representation by returning Ctap2Session$InfoData.certifications
Summary:
...
|
|
May expose internal representation by returning reference to mutable object (MALICIOUS_CODE):
com/yubico/yubikit/fido/ctap/Ctap2Session.java#L671
com.yubico.yubikit.fido.ctap.Ctap2Session$InfoData.getExtensions() may expose internal representation by returning Ctap2Session$InfoData.extensions
Summary:
...
|
|
May expose internal representation by returning reference to mutable object (MALICIOUS_CODE):
com/yubico/yubikit/fido/ctap/Ctap2Session.java#L689
com.yubico.yubikit.fido.ctap.Ctap2Session$InfoData.getOptions() may expose internal representation by returning Ctap2Session$InfoData.options
Summary:
...
|
|
May expose internal representation by returning reference to mutable object (MALICIOUS_CODE):
com/yubico/yubikit/fido/ctap/Ctap2Session.java#L709
com.yubico.yubikit.fido.ctap.Ctap2Session$InfoData.getPinUvAuthProtocols() may expose internal representation by returning Ctap2Session$InfoData.pinUvAuthProtocols
Summary:
...
|
|
May expose internal representation by returning reference to mutable object (MALICIOUS_CODE):
com/yubico/yubikit/fido/ctap/Ctap2Session.java#L741
com.yubico.yubikit.fido.ctap.Ctap2Session$InfoData.getTransports() may expose internal representation by returning Ctap2Session$InfoData.transports
Summary:
...
|
|
May expose internal representation by returning reference to mutable object (MALICIOUS_CODE):
com/yubico/yubikit/fido/ctap/Ctap2Session.java#L879
com.yubico.yubikit.fido.ctap.Ctap2Session$InfoData.getVendorPrototypeConfigCommands() may expose internal representation by returning Ctap2Session$InfoData.vendorPrototypeConfigCommands
Summary:
...
|
|
May expose internal representation by returning reference to mutable object (MALICIOUS_CODE):
com/yubico/yubikit/fido/ctap/Ctap2Session.java#L662
com.yubico.yubikit.fido.ctap.Ctap2Session$InfoData.getVersions() may expose internal representation by returning Ctap2Session$InfoData.versions
Summary:
...
|
|
Be wary of letting constructors throw exceptions. (BAD_PRACTICE):
com/yubico/yubikit/fido/ctap/Hkdf.java#L36
Exception thrown in class com.yubico.yubikit.fido.ctap.Hkdf at new com.yubico.yubikit.fido.ctap.Hkdf(String) will leave the constructor. The object under construction remains partially initialized and may be vulnerable to Finalizer attacks.
Summary:
...
|
|
Cipher with no integrity (SECURITY):
com/yubico/yubikit/fido/ctap/PinUvAuthProtocolV1.java#L132
The cipher does not provide data integrity
Summary:
...
|
|
Cipher with no integrity (SECURITY):
com/yubico/yubikit/fido/ctap/PinUvAuthProtocolV1.java#L119
The cipher does not provide data integrity
Summary:
...
|
|
Static IV (SECURITY):
com/yubico/yubikit/fido/ctap/PinUvAuthProtocolV1.java#L119
The initialization vector (IV) is not properly generated
Summary:
...
|
|
Cipher with no integrity (SECURITY):
com/yubico/yubikit/fido/ctap/PinUvAuthProtocolV2.java#L146
The cipher does not provide data integrity
Summary:
...
|
|
Static IV (SECURITY):
com/yubico/yubikit/fido/ctap/PinUvAuthProtocolV2.java#L146
The initialization vector (IV) is not properly generated
Summary:
...
|
|
May expose internal representation by returning reference to mutable object (MALICIOUS_CODE):
com/yubico/yubikit/fido/webauthn/AttestationObject.java#L85
com.yubico.yubikit.fido.webauthn.AttestationObject.getAttestationStatement() may expose internal representation by returning AttestationObject.attestationStatement
Summary:
...
|
|
May expose internal representation by returning reference to mutable object (MALICIOUS_CODE):
com/yubico/yubikit/fido/webauthn/AttestationObject.java#L97
com.yubico.yubikit.fido.webauthn.AttestationObject.getLargeBlobKey() may expose internal representation by returning AttestationObject.largeBlobKey
Summary:
...
|
|
May expose internal representation by incorporating reference to mutable object (MALICIOUS_CODE):
com/yubico/yubikit/fido/webauthn/AttestationObject.java#L56
new com.yubico.yubikit.fido.webauthn.AttestationObject(String, AuthenticatorData, Map, Boolean, byte[]) may expose internal representation by storing an externally mutable object into AttestationObject.attestationStatement
Summary:
...
|
|
May expose internal representation by incorporating reference to mutable object (MALICIOUS_CODE):
com/yubico/yubikit/fido/webauthn/AttestationObject.java#L56
new com.yubico.yubikit.fido.webauthn.AttestationObject(String, AuthenticatorData, Map, Boolean, byte[]) may expose internal representation by storing an externally mutable object into AttestationObject.largeBlobKey
Summary:
...
|
|
May expose internal representation by returning reference to mutable object (MALICIOUS_CODE):
com/yubico/yubikit/fido/webauthn/AttestedCredentialData.java#L65
com.yubico.yubikit.fido.webauthn.AttestedCredentialData.getAaguid() may expose internal representation by returning AttestedCredentialData.aaguid
Summary:
...
|
|
May expose internal representation by returning reference to mutable object (MALICIOUS_CODE):
com/yubico/yubikit/fido/webauthn/AttestedCredentialData.java#L75
com.yubico.yubikit.fido.webauthn.AttestedCredentialData.getCosePublicKey() may expose internal representation by returning AttestedCredentialData.cosePublicKey
Summary:
...
|
|
May expose internal representation by returning reference to mutable object (MALICIOUS_CODE):
com/yubico/yubikit/fido/webauthn/AttestedCredentialData.java#L70
com.yubico.yubikit.fido.webauthn.AttestedCredentialData.getCredentialId() may expose internal representation by returning AttestedCredentialData.credentialId
Summary:
...
|
|
May expose internal representation by incorporating reference to mutable object (MALICIOUS_CODE):
com/yubico/yubikit/fido/webauthn/AttestedCredentialData.java#L39
new com.yubico.yubikit.fido.webauthn.AttestedCredentialData(byte[], byte[], Map) may expose internal representation by storing an externally mutable object into AttestedCredentialData.aaguid
Summary:
...
|
|
May expose internal representation by incorporating reference to mutable object (MALICIOUS_CODE):
com/yubico/yubikit/fido/webauthn/AttestedCredentialData.java#L39
new com.yubico.yubikit.fido.webauthn.AttestedCredentialData(byte[], byte[], Map) may expose internal representation by storing an externally mutable object into AttestedCredentialData.cosePublicKey
Summary:
...
|
|
May expose internal representation by incorporating reference to mutable object (MALICIOUS_CODE):
com/yubico/yubikit/fido/webauthn/AttestedCredentialData.java#L39
new com.yubico.yubikit.fido.webauthn.AttestedCredentialData(byte[], byte[], Map) may expose internal representation by storing an externally mutable object into AttestedCredentialData.credentialId
Summary:
...
|
|
May expose internal representation by returning reference to mutable object (MALICIOUS_CODE):
com/yubico/yubikit/fido/webauthn/AuthenticatorAssertionResponse.java#L52
com.yubico.yubikit.fido.webauthn.AuthenticatorAssertionResponse.getAuthenticatorData() may expose internal representation by returning AuthenticatorAssertionResponse.authenticatorData
Summary:
...
|
|
May expose internal representation by returning reference to mutable object (MALICIOUS_CODE):
com/yubico/yubikit/fido/webauthn/AuthenticatorAssertionResponse.java#L56
com.yubico.yubikit.fido.webauthn.AuthenticatorAssertionResponse.getSignature() may expose internal representation by returning AuthenticatorAssertionResponse.signature
Summary:
...
|
|
May expose internal representation by returning reference to mutable object (MALICIOUS_CODE):
com/yubico/yubikit/fido/webauthn/AuthenticatorAssertionResponse.java#L61
com.yubico.yubikit.fido.webauthn.AuthenticatorAssertionResponse.getUserHandle() may expose internal representation by returning AuthenticatorAssertionResponse.userHandle
Summary:
...
|
|
May expose internal representation by incorporating reference to mutable object (MALICIOUS_CODE):
com/yubico/yubikit/fido/webauthn/AuthenticatorAssertionResponse.java#L45
new com.yubico.yubikit.fido.webauthn.AuthenticatorAssertionResponse(byte[], byte[], byte[], byte[]) may expose internal representation by storing an externally mutable object into AuthenticatorAssertionResponse.authenticatorData
Summary:
...
|
|
May expose internal representation by incorporating reference to mutable object (MALICIOUS_CODE):
com/yubico/yubikit/fido/webauthn/AuthenticatorAssertionResponse.java#L45
new com.yubico.yubikit.fido.webauthn.AuthenticatorAssertionResponse(byte[], byte[], byte[], byte[]) may expose internal representation by storing an externally mutable object into AuthenticatorAssertionResponse.signature
Summary:
...
|
|
May expose internal representation by incorporating reference to mutable object (MALICIOUS_CODE):
com/yubico/yubikit/fido/webauthn/AuthenticatorAssertionResponse.java#L45
new com.yubico.yubikit.fido.webauthn.AuthenticatorAssertionResponse(byte[], byte[], byte[], byte[]) may expose internal representation by storing an externally mutable object into AuthenticatorAssertionResponse.userHandle
Summary:
...
|
|
Be wary of letting constructors throw exceptions. (BAD_PRACTICE):
com/yubico/yubikit/fido/webauthn/AuthenticatorAttestationResponse.java#L79
Exception thrown in class com.yubico.yubikit.fido.webauthn.AuthenticatorAttestationResponse at new com.yubico.yubikit.fido.webauthn.AuthenticatorAttestationResponse(byte[], List, AttestationObject) will leave the constructor. The object under construction remains partially initialized and may be vulnerable to Finalizer attacks.
Summary:
...
|
|
May expose internal representation by returning reference to mutable object (MALICIOUS_CODE):
com/yubico/yubikit/fido/webauthn/AuthenticatorAttestationResponse.java#L129
com.yubico.yubikit.fido.webauthn.AuthenticatorAttestationResponse.getAttestationObject() may expose internal representation by returning AuthenticatorAttestationResponse.attestationObject
Summary:
...
|
|
May expose internal representation by returning reference to mutable object (MALICIOUS_CODE):
com/yubico/yubikit/fido/webauthn/AuthenticatorAttestationResponse.java#L120
com.yubico.yubikit.fido.webauthn.AuthenticatorAttestationResponse.getPublicKey() may expose internal representation by returning AuthenticatorAttestationResponse.publicKey
Summary:
...
|
|
May expose internal representation by returning reference to mutable object (MALICIOUS_CODE):
com/yubico/yubikit/fido/webauthn/AuthenticatorAttestationResponse.java#L114
com.yubico.yubikit.fido.webauthn.AuthenticatorAttestationResponse.getTransports() may expose internal representation by returning AuthenticatorAttestationResponse.transports
Summary:
...
|
|
May expose internal representation by incorporating reference to mutable object (MALICIOUS_CODE):
com/yubico/yubikit/fido/webauthn/AuthenticatorAttestationResponse.java#L65
new com.yubico.yubikit.fido.webauthn.AuthenticatorAttestationResponse(byte[], AuthenticatorData, List, byte[], int, byte[]) may expose internal representation by storing an externally mutable object into AuthenticatorAttestationResponse.attestationObject
Summary:
...
|
|
May expose internal representation by incorporating reference to mutable object (MALICIOUS_CODE):
com/yubico/yubikit/fido/webauthn/AuthenticatorAttestationResponse.java#L65
new com.yubico.yubikit.fido.webauthn.AuthenticatorAttestationResponse(byte[], AuthenticatorData, List, byte[], int, byte[]) may expose internal representation by storing an externally mutable object into AuthenticatorAttestationResponse.publicKey
Summary:
...
|
|
May expose internal representation by incorporating reference to mutable object (MALICIOUS_CODE):
com/yubico/yubikit/fido/webauthn/AuthenticatorAttestationResponse.java#L65
new com.yubico.yubikit.fido.webauthn.AuthenticatorAttestationResponse(byte[], AuthenticatorData, List, byte[], int, byte[]) may expose internal representation by storing an externally mutable object into AuthenticatorAttestationResponse.transports
Summary:
...
|
|
May expose internal representation by incorporating reference to mutable object (MALICIOUS_CODE):
com/yubico/yubikit/fido/webauthn/AuthenticatorAttestationResponse.java#L79
new com.yubico.yubikit.fido.webauthn.AuthenticatorAttestationResponse(byte[], List, AttestationObject) may expose internal representation by storing an externally mutable object into AuthenticatorAttestationResponse.transports
Summary:
...
|
|
May expose internal representation by returning reference to mutable object (MALICIOUS_CODE):
com/yubico/yubikit/fido/webauthn/AuthenticatorData.java#L168
com.yubico.yubikit.fido.webauthn.AuthenticatorData.getBytes() may expose internal representation by returning AuthenticatorData.rawData
Summary:
...
|
|
May expose internal representation by returning reference to mutable object (MALICIOUS_CODE):
com/yubico/yubikit/fido/webauthn/AuthenticatorData.java#L143
com.yubico.yubikit.fido.webauthn.AuthenticatorData.getExtensions() may expose internal representation by returning AuthenticatorData.extensions
Summary:
...
|
|
May expose internal representation by returning reference to mutable object (MALICIOUS_CODE):
com/yubico/yubikit/fido/webauthn/AuthenticatorData.java#L121
com.yubico.yubikit.fido.webauthn.AuthenticatorData.getRpIdHash() may expose internal representation by returning AuthenticatorData.rpIdHash
Summary:
...
|
|
May expose internal representation by incorporating reference to mutable object (MALICIOUS_CODE):
com/yubico/yubikit/fido/webauthn/AuthenticatorData.java#L64
new com.yubico.yubikit.fido.webauthn.AuthenticatorData(byte[], byte, int, AttestedCredentialData, Map, byte[]) may expose internal representation by storing an externally mutable object into AuthenticatorData.extensions
Summary:
...
|
|
May expose internal representation by incorporating reference to mutable object (MALICIOUS_CODE):
com/yubico/yubikit/fido/webauthn/AuthenticatorData.java#L64
new com.yubico.yubikit.fido.webauthn.AuthenticatorData(byte[], byte, int, AttestedCredentialData, Map, byte[]) may expose internal representation by storing an externally mutable object into AuthenticatorData.rawData
Summary:
...
|
|
May expose internal representation by incorporating reference to mutable object (MALICIOUS_CODE):
com/yubico/yubikit/fido/webauthn/AuthenticatorData.java#L64
new com.yubico.yubikit.fido.webauthn.AuthenticatorData(byte[], byte, int, AttestedCredentialData, Map, byte[]) may expose internal representation by storing an externally mutable object into AuthenticatorData.rpIdHash
Summary:
...
|
|
May expose internal representation by returning reference to mutable object (MALICIOUS_CODE):
com/yubico/yubikit/fido/webauthn/AuthenticatorResponse.java#L31
com.yubico.yubikit.fido.webauthn.AuthenticatorResponse.getClientDataJson() may expose internal representation by returning AuthenticatorResponse.clientDataJson
Summary:
...
|
|
Suspicious reference comparison of Boolean values (BAD_PRACTICE):
com/yubico/yubikit/fido/webauthn/AuthenticatorSelectionCriteria.java#L79
Suspicious comparison of Boolean references in com.yubico.yubikit.fido.webauthn.AuthenticatorSelectionCriteria.fromMap(Map, SerializationType)
Summary:
...
|
|
May expose internal representation by incorporating reference to mutable object (MALICIOUS_CODE):
com/yubico/yubikit/fido/webauthn/PublicKeyCredential.java#L66
new com.yubico.yubikit.fido.webauthn.PublicKeyCredential(byte[], AuthenticatorResponse) may expose internal representation by storing an externally mutable object into PublicKeyCredential.rawId
Summary:
...
|
|
May expose internal representation by returning reference to mutable object (MALICIOUS_CODE):
com/yubico/yubikit/fido/webauthn/PublicKeyCredentialCreationOptions.java#L86
com.yubico.yubikit.fido.webauthn.PublicKeyCredentialCreationOptions.getChallenge() may expose internal representation by returning PublicKeyCredentialCreationOptions.challenge
Summary:
...
|
|
May expose internal representation by returning reference to mutable object (MALICIOUS_CODE):
com/yubico/yubikit/fido/webauthn/PublicKeyCredentialCreationOptions.java#L99
com.yubico.yubikit.fido.webauthn.PublicKeyCredentialCreationOptions.getExcludeCredentials() may expose internal representation by returning PublicKeyCredentialCreationOptions.excludeCredentials
Summary:
...
|
|
May expose internal representation by returning reference to mutable object (MALICIOUS_CODE):
com/yubico/yubikit/fido/webauthn/PublicKeyCredentialCreationOptions.java#L90
com.yubico.yubikit.fido.webauthn.PublicKeyCredentialCreationOptions.getPubKeyCredParams() may expose internal representation by returning PublicKeyCredentialCreationOptions.pubKeyCredParams
Summary:
...
|
|
May expose internal representation by incorporating reference to mutable object (MALICIOUS_CODE):
com/yubico/yubikit/fido/webauthn/PublicKeyCredentialCreationOptions.java#L65
new com.yubico.yubikit.fido.webauthn.PublicKeyCredentialCreationOptions(PublicKeyCredentialRpEntity, PublicKeyCredentialUserEntity, byte[], List, Long, List, AuthenticatorSelectionCriteria, String, Extensions) may expose internal representation by storing an externally mutable object into PublicKeyCredentialCreationOptions.challenge
Summary:
...
|
|
May expose internal representation by incorporating reference to mutable object (MALICIOUS_CODE):
com/yubico/yubikit/fido/webauthn/PublicKeyCredentialCreationOptions.java#L65
new com.yubico.yubikit.fido.webauthn.PublicKeyCredentialCreationOptions(PublicKeyCredentialRpEntity, PublicKeyCredentialUserEntity, byte[], List, Long, List, AuthenticatorSelectionCriteria, String, Extensions) may expose internal representation by storing an externally mutable object into PublicKeyCredentialCreationOptions.pubKeyCredParams
Summary:
...
|
|
May expose internal representation by returning reference to mutable object (MALICIOUS_CODE):
com/yubico/yubikit/fido/webauthn/PublicKeyCredentialDescriptor.java#L57
com.yubico.yubikit.fido.webauthn.PublicKeyCredentialDescriptor.getId() may expose internal representation by returning PublicKeyCredentialDescriptor.id
Summary:
...
|
|
May expose internal representation by returning reference to mutable object (MALICIOUS_CODE):
com/yubico/yubikit/fido/webauthn/PublicKeyCredentialDescriptor.java#L62
com.yubico.yubikit.fido.webauthn.PublicKeyCredentialDescriptor.getTransports() may expose internal representation by returning PublicKeyCredentialDescriptor.transports
Summary:
...
|
|
May expose internal representation by incorporating reference to mutable object (MALICIOUS_CODE):
com/yubico/yubikit/fido/webauthn/PublicKeyCredentialDescriptor.java#L40
new com.yubico.yubikit.fido.webauthn.PublicKeyCredentialDescriptor(String, byte[]) may expose internal representation by storing an externally mutable object into PublicKeyCredentialDescriptor.id
Summary:
...
|
|
May expose internal representation by incorporating reference to mutable object (MALICIOUS_CODE):
com/yubico/yubikit/fido/webauthn/PublicKeyCredentialDescriptor.java#L46
new com.yubico.yubikit.fido.webauthn.PublicKeyCredentialDescriptor(String, byte[], List) may expose internal representation by storing an externally mutable object into PublicKeyCredentialDescriptor.id
Summary:
...
|
|
May expose internal representation by incorporating reference to mutable object (MALICIOUS_CODE):
com/yubico/yubikit/fido/webauthn/PublicKeyCredentialDescriptor.java#L46
new com.yubico.yubikit.fido.webauthn.PublicKeyCredentialDescriptor(String, byte[], List) may expose internal representation by storing an externally mutable object into PublicKeyCredentialDescriptor.transports
Summary:
...
|
|
May expose internal representation by returning reference to mutable object (MALICIOUS_CODE):
com/yubico/yubikit/fido/webauthn/PublicKeyCredentialRequestOptions.java#L80
com.yubico.yubikit.fido.webauthn.PublicKeyCredentialRequestOptions.getAllowCredentials() may expose internal representation by returning PublicKeyCredentialRequestOptions.allowCredentials
Summary:
...
|
|
May expose internal representation by returning reference to mutable object (MALICIOUS_CODE):
com/yubico/yubikit/fido/webauthn/PublicKeyCredentialRequestOptions.java#L67
com.yubico.yubikit.fido.webauthn.PublicKeyCredentialRequestOptions.getChallenge() may expose internal representation by returning PublicKeyCredentialRequestOptions.challenge
Summary:
...
|
|
May expose internal representation by incorporating reference to mutable object (MALICIOUS_CODE):
com/yubico/yubikit/fido/webauthn/PublicKeyCredentialRequestOptions.java#L57
new com.yubico.yubikit.fido.webauthn.PublicKeyCredentialRequestOptions(byte[], Long, String, List, String, Extensions) may expose internal representation by storing an externally mutable object into PublicKeyCredentialRequestOptions.challenge
Summary:
...
|
|
May expose internal representation by returning reference to mutable object (MALICIOUS_CODE):
com/yubico/yubikit/fido/webauthn/PublicKeyCredentialUserEntity.java#L41
com.yubico.yubikit.fido.webauthn.PublicKeyCredentialUserEntity.getId() may expose internal representation by returning PublicKeyCredentialUserEntity.id
Summary:
...
|
|
May expose internal representation by incorporating reference to mutable object (MALICIOUS_CODE):
com/yubico/yubikit/fido/webauthn/PublicKeyCredentialUserEntity.java#L35
new com.yubico.yubikit.fido.webauthn.PublicKeyCredentialUserEntity(String, byte[], String) may expose internal representation by storing an externally mutable object into PublicKeyCredentialUserEntity.id
Summary:
...
|
|
May expose internal representation by incorporating reference to mutable object (MALICIOUS_CODE):
com/yubico/yubikit/management/DeviceInfo.java#L66
new com.yubico.yubikit.management.DeviceInfo(DeviceConfig, Integer, Version, FormFactor, Map, boolean, boolean, boolean) may expose internal representation by storing an externally mutable object into DeviceInfo.supportedCapabilities
Summary:
...
|
|
Be wary of letting constructors throw exceptions. (BAD_PRACTICE):
com/yubico/yubikit/management/ManagementSession.java#L207
Exception thrown in class com.yubico.yubikit.management.ManagementSession at new com.yubico.yubikit.management.ManagementSession(FidoConnection) will leave the constructor. The object under construction remains partially initialized and may be vulnerable to Finalizer attacks.
Summary:
...
|
|
Be wary of letting constructors throw exceptions. (BAD_PRACTICE):
com/yubico/yubikit/management/ManagementSession.java#L172
Exception thrown in class com.yubico.yubikit.management.ManagementSession at new com.yubico.yubikit.management.ManagementSession(OtpConnection) will leave the constructor. The object under construction remains partially initialized and may be vulnerable to Finalizer attacks.
Summary:
...
|
|
Be wary of letting constructors throw exceptions. (BAD_PRACTICE):
com/yubico/yubikit/management/ManagementSession.java#L107
Exception thrown in class com.yubico.yubikit.management.ManagementSession at new com.yubico.yubikit.management.ManagementSession(SmartCardConnection) will leave the constructor. The object under construction remains partially initialized and may be vulnerable to Finalizer attacks.
Summary:
...
|
|
Consider using Locale parameterized version of invoked method (I18N):
com/yubico/yubikit/oath/CredentialData.java#L293
Use of non-localized String.toUpperCase() or String.toLowerCase() in com.yubico.yubikit.oath.CredentialData.decodeSecret(String)
Summary:
...
|
|
Regex DOS (ReDOS) (SECURITY):
com/yubico/yubikit/oath/CredentialIdUtils.java#L30
The regular expression "^((\\d+)/)?(([^:]+):)?(.+)$" is vulnerable to a denial of service attack (ReDOS)
Summary:
...
|
|
Improper handling of Unicode transformations (SECURITY):
com/yubico/yubikit/oath/HashAlgorithm.java#L72
Improper handling of Unicode transformations such as case mapping and normalization.
Summary:
...
|
|
Be wary of letting constructors throw exceptions. (BAD_PRACTICE):
com/yubico/yubikit/oath/OathSession.java#L128
Exception thrown in class com.yubico.yubikit.oath.OathSession at new com.yubico.yubikit.oath.OathSession(SmartCardConnection) will leave the constructor. The object under construction remains partially initialized and may be vulnerable to Finalizer attacks.
Summary:
...
|
|
Improper handling of Unicode transformations (SECURITY):
com/yubico/yubikit/oath/OathType.java#L54
Improper handling of Unicode transformations such as case mapping and normalization.
Summary:
...
|
|
Improper handling of Unicode transformations (SECURITY):
com/yubico/yubikit/oath/OathType.java#L54
Improper handling of Unicode transformations such as case mapping and normalization.
Summary:
...
|
|
May expose internal representation by returning reference to mutable object (MALICIOUS_CODE):
com/yubico/yubikit/openpgp/ApplicationRelatedData.java#L69
com.yubico.yubikit.openpgp.ApplicationRelatedData.getGeneralFeatureManagement() may expose internal representation by returning ApplicationRelatedData.generalFeatureManagement
Summary:
...
|
|
May expose internal representation by incorporating reference to mutable object (MALICIOUS_CODE):
com/yubico/yubikit/openpgp/ApplicationRelatedData.java#L46
new com.yubico.yubikit.openpgp.ApplicationRelatedData(OpenPgpAid, byte[], ExtendedLengthInfo, EnumSet, DiscretionaryDataObjects) may expose internal representation by storing an externally mutable object into ApplicationRelatedData.generalFeatureManagement
Summary:
...
|
|
May expose internal representation by incorporating reference to mutable object (MALICIOUS_CODE):
com/yubico/yubikit/openpgp/ApplicationRelatedData.java#L46
new com.yubico.yubikit.openpgp.ApplicationRelatedData(OpenPgpAid, byte[], ExtendedLengthInfo, EnumSet, DiscretionaryDataObjects) may expose internal representation by storing an externally mutable object into ApplicationRelatedData.historical
Summary:
...
|
|
May expose internal representation by incorporating reference to mutable object (MALICIOUS_CODE):
com/yubico/yubikit/openpgp/DiscretionaryDataObjects.java#L70
new com.yubico.yubikit.openpgp.DiscretionaryDataObjects(ExtendedCapabilities, AlgorithmAttributes, AlgorithmAttributes, AlgorithmAttributes, AlgorithmAttributes, PwStatus, Map, Map, Map, Map, Uif, Uif, Uif, Uif) may expose internal representation by storing an externally mutable object into DiscretionaryDataObjects.caFingerprints
Summary:
...
|
|
May expose internal representation by incorporating reference to mutable object (MALICIOUS_CODE):
com/yubico/yubikit/openpgp/DiscretionaryDataObjects.java#L70
new com.yubico.yubikit.openpgp.DiscretionaryDataObjects(ExtendedCapabilities, AlgorithmAttributes, AlgorithmAttributes, AlgorithmAttributes, AlgorithmAttributes, PwStatus, Map, Map, Map, Map, Uif, Uif, Uif, Uif) may expose internal representation by storing an externally mutable object into DiscretionaryDataObjects.fingerprints
Summary:
...
|
|
May expose internal representation by incorporating reference to mutable object (MALICIOUS_CODE):
com/yubico/yubikit/openpgp/DiscretionaryDataObjects.java#L70
new com.yubico.yubikit.openpgp.DiscretionaryDataObjects(ExtendedCapabilities, AlgorithmAttributes, AlgorithmAttributes, AlgorithmAttributes, AlgorithmAttributes, PwStatus, Map, Map, Map, Map, Uif, Uif, Uif, Uif) may expose internal representation by storing an externally mutable object into DiscretionaryDataObjects.generationTimes
Summary:
...
|
|
May expose internal representation by incorporating reference to mutable object (MALICIOUS_CODE):
com/yubico/yubikit/openpgp/DiscretionaryDataObjects.java#L70
new com.yubico.yubikit.openpgp.DiscretionaryDataObjects(ExtendedCapabilities, AlgorithmAttributes, AlgorithmAttributes, AlgorithmAttributes, AlgorithmAttributes, PwStatus, Map, Map, Map, Map, Uif, Uif, Uif, Uif) may expose internal representation by storing an externally mutable object into DiscretionaryDataObjects.keyInformation
Summary:
...
|
|
Consider returning a zero length array rather than null (STYLE):
com/yubico/yubikit/openpgp/DiscretionaryDataObjects.java#L122
Should com.yubico.yubikit.openpgp.DiscretionaryDataObjects.getCaFingerprint(KeyRef) return a zero length array rather than null?
Summary:
...
|
|
Consider returning a zero length array rather than null (STYLE):
com/yubico/yubikit/openpgp/DiscretionaryDataObjects.java#L113
Should com.yubico.yubikit.openpgp.DiscretionaryDataObjects.getFingerprint(KeyRef) return a zero length array rather than null?
Summary:
...
|
|
May expose internal representation by returning reference to mutable object (MALICIOUS_CODE):
com/yubico/yubikit/openpgp/ExtendedCapabilities.java#L52
com.yubico.yubikit.openpgp.ExtendedCapabilities.getFlags() may expose internal representation by returning ExtendedCapabilities.flags
Summary:
...
|
|
May expose internal representation by incorporating reference to mutable object (MALICIOUS_CODE):
com/yubico/yubikit/openpgp/ExtendedCapabilities.java#L41
new com.yubico.yubikit.openpgp.ExtendedCapabilities(EnumSet, int, int, int, int, boolean, boolean) may expose internal representation by storing an externally mutable object into ExtendedCapabilities.flags
Summary:
...
|
|
May expose internal representation by incorporating reference to mutable object (MALICIOUS_CODE):
com/yubico/yubikit/openpgp/Kdf.java#L126
new com.yubico.yubikit.openpgp.Kdf$IterSaltedS2k(Kdf$IterSaltedS2k$HashAlgorithm, int, byte[], byte[], byte[], byte[], byte[]) may expose internal representation by storing an externally mutable object into Kdf$IterSaltedS2k.initialHashAdmin
Summary:
...
|
|
May expose internal representation by incorporating reference to mutable object (MALICIOUS_CODE):
com/yubico/yubikit/openpgp/Kdf.java#L126
new com.yubico.yubikit.openpgp.Kdf$IterSaltedS2k(Kdf$IterSaltedS2k$HashAlgorithm, int, byte[], byte[], byte[], byte[], byte[]) may expose internal representation by storing an externally mutable object into Kdf$IterSaltedS2k.initialHashUser
Summary:
...
|
|
May expose internal representation by incorporating reference to mutable object (MALICIOUS_CODE):
com/yubico/yubikit/openpgp/Kdf.java#L126
new com.yubico.yubikit.openpgp.Kdf$IterSaltedS2k(Kdf$IterSaltedS2k$HashAlgorithm, int, byte[], byte[], byte[], byte[], byte[]) may expose internal representation by storing an externally mutable object into Kdf$IterSaltedS2k.saltAdmin
Summary:
...
|
|
May expose internal representation by incorporating reference to mutable object (MALICIOUS_CODE):
com/yubico/yubikit/openpgp/Kdf.java#L126
new com.yubico.yubikit.openpgp.Kdf$IterSaltedS2k(Kdf$IterSaltedS2k$HashAlgorithm, int, byte[], byte[], byte[], byte[], byte[]) may expose internal representation by storing an externally mutable object into Kdf$IterSaltedS2k.saltReset
Summary:
...
|
|
May expose internal representation by incorporating reference to mutable object (MALICIOUS_CODE):
com/yubico/yubikit/openpgp/Kdf.java#L126
new com.yubico.yubikit.openpgp.Kdf$IterSaltedS2k(Kdf$IterSaltedS2k$HashAlgorithm, int, byte[], byte[], byte[], byte[], byte[]) may expose internal representation by storing an externally mutable object into Kdf$IterSaltedS2k.saltUser
Summary:
...
|
|
Be wary of letting constructors throw exceptions. (BAD_PRACTICE):
com/yubico/yubikit/openpgp/OpenPgpSession.java#L161
Exception thrown in class com.yubico.yubikit.openpgp.OpenPgpSession at new com.yubico.yubikit.openpgp.OpenPgpSession(SmartCardConnection) will leave the constructor. The object under construction remains partially initialized and may be vulnerable to Finalizer attacks.
Summary:
...
|
|
An overridable method is called from a constructor (MALICIOUS_CODE):
com/yubico/yubikit/openpgp/OpenPgpSession.java#L161
Overridable method getApplicationRelatedData is called from constructor new com.yubico.yubikit.openpgp.OpenPgpSession(SmartCardConnection).
Summary:
...
|
|
Consider using Locale parameterized version of invoked method (I18N):
com/yubico/yubikit/openpgp/PinPolicy.java#L31
Use of non-localized String.toUpperCase() or String.toLowerCase() in com.yubico.yubikit.openpgp.PinPolicy.toString()
Summary:
...
|
|
Consider using Locale parameterized version of invoked method (I18N):
com/yubico/yubikit/openpgp/Uif.java#L42
Use of non-localized String.toUpperCase() or String.toLowerCase() in com.yubico.yubikit.openpgp.Uif.toString()
Summary:
...
|
|
Be wary of letting constructors throw exceptions. (BAD_PRACTICE):
com/yubico/yubikit/piv/ObjectId.java#L73
Exception thrown in class com.yubico.yubikit.piv.ObjectId at new com.yubico.yubikit.piv.ObjectId() will leave the constructor. The object under construction remains partially initialized and may be vulnerable to Finalizer attacks.
Summary:
...
|
|
String is modified after validation and not before it (SECURITY):
com/yubico/yubikit/piv/Padding.java#L50
String is modified after validation and not before it. Tricky attackers may pass malicious strings which bypass validation.
Summary:
...
|
|
RSA with no padding is insecure (SECURITY):
com/yubico/yubikit/piv/Padding.java#L50
Use of RSA cipher without proper padding
Summary:
...
|
|
RSA with no padding is insecure (SECURITY):
com/yubico/yubikit/piv/Padding.java#L119
Use of RSA cipher without proper padding
Summary:
...
|
|
Unsafe hash equals (SECURITY):
com/yubico/yubikit/piv/Padding.java#L50
Unsafe comparison of hash that are susceptible to timing attack
Summary:
...
|
|
Unchecked/unconfirmed cast (STYLE):
com/yubico/yubikit/piv/PivSession.java#L975
Unchecked/unconfirmed cast from com.yubico.yubikit.core.keys.PrivateKeyValues to com.yubico.yubikit.core.keys.PrivateKeyValues$Ec in com.yubico.yubikit.piv.PivSession.putKey(Slot, PrivateKeyValues, PinPolicy, TouchPolicy)
Summary:
...
|
|
Unchecked/unconfirmed cast (STYLE):
com/yubico/yubikit/piv/PivSession.java#L975
Unchecked/unconfirmed cast from com.yubico.yubikit.core.keys.PrivateKeyValues to com.yubico.yubikit.core.keys.PrivateKeyValues$Rsa in com.yubico.yubikit.piv.PivSession.putKey(Slot, PrivateKeyValues, PinPolicy, TouchPolicy)
Summary:
...
|
|
Be wary of letting constructors throw exceptions. (BAD_PRACTICE):
com/yubico/yubikit/piv/PivSession.java#L198
Exception thrown in class com.yubico.yubikit.piv.PivSession at new com.yubico.yubikit.piv.PivSession(SmartCardConnection) will leave the constructor. The object under construction remains partially initialized and may be vulnerable to Finalizer attacks.
Summary:
...
|
|
Be wary of letting constructors throw exceptions. (BAD_PRACTICE):
com/yubico/yubikit/piv/jca/PivCipherSpi.java#L60
Exception thrown in class com.yubico.yubikit.piv.jca.PivCipherSpi at new com.yubico.yubikit.piv.jca.PivCipherSpi(Callback, Map) will leave the constructor. The object under construction remains partially initialized and may be vulnerable to Finalizer attacks.
Summary:
...
|
|
RSA with no padding is insecure (SECURITY):
com/yubico/yubikit/piv/jca/PivCipherSpi.java#L144
Use of RSA cipher without proper padding
Summary:
...
|
|
Be wary of letting constructors throw exceptions. (BAD_PRACTICE):
com/yubico/yubikit/piv/jca/PivEcSignatureSpi.java#L144
Exception thrown in class com.yubico.yubikit.piv.jca.PivEcSignatureSpi$Hashed at new com.yubico.yubikit.piv.jca.PivEcSignatureSpi$Hashed(Callback, String) will leave the constructor. The object under construction remains partially initialized and may be vulnerable to Finalizer attacks.
Summary:
...
|
|
May expose internal representation by returning reference to mutable object (MALICIOUS_CODE):
com/yubico/yubikit/piv/jca/PivKeyManager.java#L63
com.yubico.yubikit.piv.jca.PivKeyManager.getPrivateKey(String) may expose internal representation by returning PivKeyManager.privateKey
Summary:
...
|
|
May expose internal representation by incorporating reference to mutable object (MALICIOUS_CODE):
com/yubico/yubikit/piv/jca/PivKeyManager.java#L31
new com.yubico.yubikit.piv.jca.PivKeyManager(PivPrivateKey, X509Certificate[]) may expose internal representation by storing an externally mutable object into PivKeyManager.privateKey
Summary:
...
|
|
Unchecked/unconfirmed cast (STYLE):
com/yubico/yubikit/piv/jca/PivKeyStoreSpi.java#L221
Unchecked/unconfirmed cast from java.security.Key to java.security.PrivateKey in com.yubico.yubikit.piv.jca.PivKeyStoreSpi.engineSetKeyEntry(String, Key, char[], Certificate[])
Summary:
...
|
|
Consider returning a zero length array rather than null (STYLE):
com/yubico/yubikit/piv/jca/PivPrivateKey.java#L151
Should com.yubico.yubikit.piv.jca.PivPrivateKey.getEncoded() return a zero length array rather than null?
Summary:
...
|
|
Consider using Locale parameterized version of invoked method (I18N):
com/yubico/yubikit/piv/jca/PivProvider.java#L68
Use of non-localized String.toUpperCase() or String.toLowerCase() in new com.yubico.yubikit.piv.jca.PivProvider(Callback)
Summary:
...
|
|
Improper handling of Unicode transformations (SECURITY):
com/yubico/yubikit/piv/jca/PivProvider.java#L68
Improper handling of Unicode transformations such as case mapping and normalization.
Summary:
...
|
|
Be wary of letting constructors throw exceptions. (BAD_PRACTICE):
com/yubico/yubikit/piv/jca/PivRsaSignatureSpi.java#L53
Exception thrown in class com.yubico.yubikit.piv.jca.PivRsaSignatureSpi at new com.yubico.yubikit.piv.jca.PivRsaSignatureSpi(Callback, Map, String) will leave the constructor. The object under construction remains partially initialized and may be vulnerable to Finalizer attacks.
Summary:
...
|
|
RSA with no padding is insecure (SECURITY):
com/yubico/yubikit/piv/jca/PivRsaSignatureSpi.java#L115
Use of RSA cipher without proper padding
Summary:
...
|
|
Inefficient use of keySet iterator instead of entrySet iterator (PERFORMANCE):
com/yubico/yubikit/testing/fido/BasicWebAuthnClientTests.java#L493
com.yubico.yubikit.testing.fido.BasicWebAuthnClientTests.testClientCredentialManagement(Ctap2Session, Object[]) makes inefficient use of keySet iterator instead of entrySet iterator
Summary:
...
|
|
Suspicious reference comparison of Boolean values (BAD_PRACTICE):
com/yubico/yubikit/testing/fido/EnterpriseAttestationTests.java#L55
Suspicious comparison of Boolean references in com.yubico.yubikit.testing.fido.EnterpriseAttestationTests.enableEp(Ctap2Session, PinUvAuthProtocol)
Summary:
...
|
|
Potential CRLF Injection for logs (SECURITY):
com/yubico/yubikit/testing/openpgp/OpenPgpDeviceTests.java#L191
This use of org/slf4j/Logger.info(Ljava/lang/String;Ljava/lang/Object;)V might be used to include CRLF characters into log messages
Summary:
...
|
|
Potential CRLF Injection for logs (SECURITY):
com/yubico/yubikit/testing/openpgp/OpenPgpDeviceTests.java#L297
This use of org/slf4j/Logger.info(Ljava/lang/String;Ljava/lang/Object;)V might be used to include CRLF characters into log messages
Summary:
...
|
|
Potential CRLF Injection for logs (SECURITY):
com/yubico/yubikit/testing/piv/PivJcaDecryptTests.java#L70
This use of org/slf4j/Logger.debug(Ljava/lang/String;Ljava/lang/Object;)V might be used to include CRLF characters into log messages
Summary:
...
|
|
Potential CRLF Injection for logs (SECURITY):
com/yubico/yubikit/testing/piv/PivJcaDecryptTests.java#L86
This use of org/slf4j/Logger.debug(Ljava/lang/String;Ljava/lang/Object;)V might be used to include CRLF characters into log messages
Summary:
...
|
|
Potential CRLF Injection for logs (SECURITY):
com/yubico/yubikit/testing/piv/PivJcaDecryptTests.java#L86
This use of org/slf4j/Logger.debug(Ljava/lang/String;Ljava/lang/Object;Ljava/lang/Object;)V might be used to include CRLF characters into log messages
Summary:
...
|
|
Potential CRLF Injection for logs (SECURITY):
com/yubico/yubikit/testing/piv/PivJcaDecryptTests.java#L86
This use of org/slf4j/Logger.debug(Ljava/lang/String;Ljava/lang/Object;)V might be used to include CRLF characters into log messages
Summary:
...
|
|
Potential CRLF Injection for logs (SECURITY):
com/yubico/yubikit/testing/piv/PivJcaSigningTests.java#L71
This use of org/slf4j/Logger.debug(Ljava/lang/String;Ljava/lang/Object;)V might be used to include CRLF characters into log messages
Summary:
...
|
|
Potential CRLF Injection for logs (SECURITY):
com/yubico/yubikit/testing/piv/PivJcaSigningTests.java#L71
This use of org/slf4j/Logger.debug(Ljava/lang/String;Ljava/lang/Object;)V might be used to include CRLF characters into log messages
Summary:
...
|
|
Potential CRLF Injection for logs (SECURITY):
com/yubico/yubikit/testing/piv/PivJcaSigningTests.java#L172
This use of org/slf4j/Logger.debug(Ljava/lang/String;Ljava/lang/Object;)V might be used to include CRLF characters into log messages
Summary:
...
|
|
Potential CRLF Injection for logs (SECURITY):
com/yubico/yubikit/testing/piv/PivJcaSigningTests.java#L172
This use of org/slf4j/Logger.debug(Ljava/lang/String;Ljava/lang/Object;)V might be used to include CRLF characters into log messages
Summary:
...
|
|
Potential CRLF Injection for logs (SECURITY):
com/yubico/yubikit/testing/piv/PivJcaUtils.java#L46
This use of org/slf4j/Logger.debug(Ljava/lang/String;[Ljava/lang/Object;)V might be used to include CRLF characters into log messages
Summary:
...
|
|
Potential CRLF Injection for logs (SECURITY):
com/yubico/yubikit/testing/piv/PivJcaUtils.java#L46
This use of org/slf4j/Logger.debug(Ljava/lang/String;[Ljava/lang/Object;)V might be used to include CRLF characters into log messages
Summary:
...
|
|
Unchecked/unconfirmed cast (STYLE):
com/yubico/yubikit/testing/piv/PivTestUtils.java#L292
Unchecked/unconfirmed cast from java.security.PublicKey to java.security.interfaces.ECKey in com.yubico.yubikit.testing.piv.PivTestUtils.ecKeyAgreement(PrivateKey, PublicKey)
Summary:
...
|
|
Be wary of letting constructors throw exceptions. (BAD_PRACTICE):
com/yubico/yubikit/yubiotp/HmacSha1SlotConfiguration.java#L52
Exception thrown in class com.yubico.yubikit.yubiotp.HmacSha1SlotConfiguration at new com.yubico.yubikit.yubiotp.HmacSha1SlotConfiguration(byte[]) will leave the constructor. The object under construction remains partially initialized and may be vulnerable to Finalizer attacks.
Summary:
...
|
|
SHA-1 is a weak hash function (SECURITY):
com/yubico/yubikit/yubiotp/HmacSha1SlotConfiguration.java#L32
This API SHA1 (SHA-1) is not a recommended cryptographic hash function
Summary:
...
|
|
Be wary of letting constructors throw exceptions. (BAD_PRACTICE):
com/yubico/yubikit/yubiotp/StaticPasswordSlotConfiguration.java#L31
Exception thrown in class com.yubico.yubikit.yubiotp.StaticPasswordSlotConfiguration at new com.yubico.yubikit.yubiotp.StaticPasswordSlotConfiguration(byte[]) will leave the constructor. The object under construction remains partially initialized and may be vulnerable to Finalizer attacks.
Summary:
...
|
|
Be wary of letting constructors throw exceptions. (BAD_PRACTICE):
com/yubico/yubikit/yubiotp/StaticTicketSlotConfiguration.java#L34
Exception thrown in class com.yubico.yubikit.yubiotp.StaticTicketSlotConfiguration at new com.yubico.yubikit.yubiotp.StaticTicketSlotConfiguration(byte[], byte[], byte[]) will leave the constructor. The object under construction remains partially initialized and may be vulnerable to Finalizer attacks.
Summary:
...
|
|
Be wary of letting constructors throw exceptions. (BAD_PRACTICE):
com/yubico/yubikit/yubiotp/YubiOtpSession.java#L207
Exception thrown in class com.yubico.yubikit.yubiotp.YubiOtpSession at new com.yubico.yubikit.yubiotp.YubiOtpSession(OtpConnection) will leave the constructor. The object under construction remains partially initialized and may be vulnerable to Finalizer attacks.
Summary:
...
|
|
Be wary of letting constructors throw exceptions. (BAD_PRACTICE):
com/yubico/yubikit/yubiotp/YubiOtpSession.java#L148
Exception thrown in class com.yubico.yubikit.yubiotp.YubiOtpSession at new com.yubico.yubikit.yubiotp.YubiOtpSession(SmartCardConnection) will leave the constructor. The object under construction remains partially initialized and may be vulnerable to Finalizer attacks.
Summary:
...
|
|
Be wary of letting constructors throw exceptions. (BAD_PRACTICE):
com/yubico/yubikit/yubiotp/YubiOtpSlotConfiguration.java#L31
Exception thrown in class com.yubico.yubikit.yubiotp.YubiOtpSlotConfiguration at new com.yubico.yubikit.yubiotp.YubiOtpSlotConfiguration(byte[], byte[], byte[]) will leave the constructor. The object under construction remains partially initialized and may be vulnerable to Finalizer attacks.
Summary:
...
|