Java - Code Pathfinder Atlas

Browse our specialized collection of Java security rules designed to detect cryptographic vulnerabilities, secure communication issues, and OWASP Top 10 risks. Our rules help identify common security pitfalls in Java applications, with a focus on modern cryptography, secure networking, and industry best practices.

Test Locally

To run these rules against your Java codebase:

codepathfinder ci --project /src/project --ruleset cpf/java

Rules (4)

Insecure Random

Severity: High | OWASP: Cryptographic Failures
Identifies usage of Math.random() which is not cryptographically secure and could lead to predictable values in security-critical contexts.

// ❌ Vulnerable: Not cryptographically secure
double value = Math.random();

// ✅ Safe: Using SecureRandom
SecureRandom secureRandom = new SecureRandom();
double value = secureRandom.nextDouble();

Weak Cryptography

Severity: High | OWASP: Cryptographic Failures
Detects usage of deprecated or weak cryptographic algorithms (RC4, RC2, SHA1, Blowfish) that are vulnerable to known attacks.

// ❌ Vulnerable: Weak algorithms
Cipher rc4Cipher = Cipher.getInstance("RC4");
MessageDigest sha1 = MessageDigest.getInstance("SHA-1");
Cipher blowfish = Cipher.getInstance("Blowfish");

// ✅ Safe: Strong algorithms
Cipher aesCipher = Cipher.getInstance("AES/GCM/NoPadding");
MessageDigest sha256 = MessageDigest.getInstance("SHA-256");

Insecure HTTP Client

Severity: High | OWASP: Identification and Authentication Failures
Identifies usage of deprecated DefaultHttpClient which lacks modern security features and proper certificate validation.

// ❌ Vulnerable: Deprecated client
HttpClient client = new DefaultHttpClient();

// ✅ Safe: Modern HTTP client
HttpClient client = HttpClientBuilder.create()
  .setSSLContext(SSLContexts.createDefault())
  .build();

Unencrypted Socket

Severity: High | OWASP: Cryptographic Failures
Detects usage of unencrypted socket connections that could expose sensitive data to network-level attacks.

// ❌ Vulnerable: Unencrypted socket
Socket socket = new Socket("example.com", 80);

// ✅ Safe: SSL/TLS socket
SSLSocketFactory factory = (SSLSocketFactory) SSLSocketFactory.getDefault();
SSLSocket socket = (SSLSocket) factory.createSocket("example.com", 443);

For more information on using Code PathFinder with Java, see our documentation.