Unchecked/unconfirmed cast from org.apache.struts.action.ActionForm to demo.form.ChangePasswordForm in demo.action.ChangePasswordAction.execute(ActionMapping, ActionForm, HttpServletRequest, HttpServletResponse)

Improper handling of Unicode transformations such as case mapping and normalization.

The method getParameter returns a String value that is controlled by the client

demo.action.ChangePasswordAction is a Struts 1 endpoint (Action)

Unchecked/unconfirmed cast from org.apache.struts.action.ActionForm to demo.form.CreateAccountForm in demo.action.CreateAccountAction.execute(ActionMapping, ActionForm, HttpServletRequest, HttpServletResponse)

demo.action.CreateAccountAction is a Struts 1 endpoint (Action)

The method getParameter returns a String value that is controlled by the client

The method getParameter returns a String value that is controlled by the client

demo.action.DeleteAllResultsAction is a Struts 1 endpoint (Action)

demo.action.EditResultsViaImportAction is a Struts 1 endpoint (Action)

demo.action.EditRunnerPhotoAction is a Struts 1 endpoint (Action)

The method getParameter returns a String value that is controlled by the client

demo.action.LoadDynamicRunnerDetailsAction is a Struts 1 endpoint (Action)

demo.action.LogoutAction is a Struts 1 endpoint (Action)

Unchecked/unconfirmed cast from org.apache.struts.action.ActionForm to demo.form.SearchRunnerForm in demo.action.SearchRunnerAction.execute(ActionMapping, ActionForm, HttpServletRequest, HttpServletResponse)

demo.action.SearchRunnerAction is a Struts 1 endpoint (Action)

demo.action.ShowMarathonsAction is a Struts 1 endpoint (Action)

The method getParameter returns a String value that is controlled by the client

The method getParameter returns a String value that is controlled by the client

demo.action.ShowResultsAction is a Struts 1 endpoint (Action)

Possible information exposure through an error message

Exception is caught when Exception is not thrown in demo.action.ShowRunnerAction.execute(ActionMapping, ActionForm, HttpServletRequest, HttpServletResponse)

The method getParameter returns a String value that is controlled by the client

demo.action.ShowRunnerAction is a Struts 1 endpoint (Action)

Unchecked/unconfirmed cast from org.apache.struts.action.ActionForm to demo.form.RunnerAttendancesForm in demo.action.ShowRunnerAttendancesAction.execute(ActionMapping, ActionForm, HttpServletRequest, HttpServletResponse)

demo.action.ShowRunnerAttendancesAction is a Struts 1 endpoint (Action)

Unchecked/unconfirmed cast from org.apache.struts.action.ActionForm to demo.form.RunnerForm in demo.action.ShowRunnerProfileAction.execute(ActionMapping, ActionForm, HttpServletRequest, HttpServletResponse)

Cookie without the HttpOnly flag could be read by a malicious script in the browser

This use of javax/servlet/http/Cookie.<init>(Ljava/lang/String;Ljava/lang/String;)V might be used to include CRLF characters into HTTP headers

Cookie without the secure flag could be sent in clear text if a HTTP URL is visited

The method getParameter returns a String value that is controlled by the client

demo.action.ShowRunnerProfileAction is a Struts 1 endpoint (Action)

demo.action.ShowUnregisteredAction is a Struts 1 endpoint (Action)

Unchecked/unconfirmed cast from org.apache.struts.action.ActionForm to demo.form.ResultsForm in demo.action.UpdateResultsAction.execute(ActionMapping, ActionForm, HttpServletRequest, HttpServletResponse)

demo.action.UpdateResultsAction is a Struts 1 endpoint (Action)

Unchecked/unconfirmed cast from org.apache.struts.action.ActionForm to demo.form.ResultsImportForm in demo.action.UpdateResultsViaImportAction.execute(ActionMapping, ActionForm, HttpServletRequest, HttpServletResponse)

Use of non-localized String.toUpperCase() or String.toLowerCase() in demo.action.UpdateResultsViaImportAction.execute(ActionMapping, ActionForm, HttpServletRequest, HttpServletResponse)

Improper handling of Unicode transformations such as case mapping and normalization.

demo.action.UpdateResultsViaImportAction is a Struts 1 endpoint (Action)

The use of DocumentBuilder.parse(...) (DocumentBuilder) is vulnerable to XML External Entity attacks

Unchecked/unconfirmed cast from org.apache.struts.action.ActionForm to demo.form.RunnerAttendancesForm in demo.action.UpdateRunnerAttendancesAction.execute(ActionMapping, ActionForm, HttpServletRequest, HttpServletResponse)

Dead store to $L5 in demo.action.UpdateRunnerAttendancesAction.deserializeInput(String)

Possible information exposure through an error message

Object deserialization is used in demo.action.UpdateRunnerAttendancesAction.deserializeInput(String)

The method getParameter returns a String value that is controlled by the client

The method getParameter returns a String value that is controlled by the client

demo.action.UpdateRunnerAttendancesAction is a Struts 1 endpoint (Action)

Unchecked/unconfirmed cast from org.apache.struts.action.ActionForm to demo.form.RunnerPhotoForm in demo.action.UpdateRunnerPhotoAction.execute(ActionMapping, ActionForm, HttpServletRequest, HttpServletResponse)

This usage of java/lang/Runtime.exec(Ljava/lang/String;)Ljava/lang/Process; can be vulnerable to Command Injection

This usage of java/lang/Runtime.exec([Ljava/lang/String;[Ljava/lang/String;Ljava/io/File;)Ljava/lang/Process; can be vulnerable to Command Injection

Use of non-localized String.toUpperCase() or String.toLowerCase() in demo.action.UpdateRunnerPhotoAction.<static initializer for UpdateRunnerPhotoAction>()

Use of non-localized String.toUpperCase() or String.toLowerCase() in demo.action.UpdateRunnerPhotoAction.checkAndSaveImage(File, Upload, String, String, File)

Improper handling of Unicode transformations such as case mapping and normalization.

Possible information exposure through an error message

This API (java/io/File.<init>(Ljava/io/File;Ljava/lang/String;)V) reads a file whose location might be specified by user input

This API (java/io/File.<init>(Ljava/lang/String;)V) reads a file whose location might be specified by user input

This API (java/io/File.<init>(Ljava/lang/String;)V) reads a file whose location might be specified by user input

Exceptional return value of java.io.File.delete() ignored in demo.action.UpdateRunnerPhotoAction.checkAndSaveImage(File, Upload, String, String, File)

Exceptional return value of java.io.File.mkdir() ignored in demo.action.UpdateRunnerPhotoAction.checkAndSaveImage(File, Upload, String, String, File)

Exceptional return value of java.io.File.mkdirs() ignored in demo.action.UpdateRunnerPhotoAction.getPhotoFolder(ServletContext)

Exceptional return value of java.io.File.mkdirs() ignored in demo.action.UpdateRunnerPhotoAction.getVirusScannerScript(ServletContext)

demo.action.UpdateRunnerPhotoAction is a Struts 1 endpoint (Action)

Found reliance on default encoding in demo.action.UpdateRunnerPhotoAction$StreamGobbler.run(): new java.io.InputStreamReader(InputStream)

Unchecked/unconfirmed cast from org.apache.struts.action.ActionForm to demo.form.RunnerPhotoImportForm in demo.action.UpdateRunnerPhotoViaImportAction.execute(ActionMapping, ActionForm, HttpServletRequest, HttpServletResponse)

demo.action.UpdateRunnerPhotoViaImportAction.saveFileFromURL(URL, File) may fail to clean up java.io.OutputStream on checked exception

demo.action.UpdateRunnerPhotoViaImportAction.saveFileFromURL(URL, File) may fail to close stream on exception

Exceptional return value of java.io.File.delete() ignored in demo.action.UpdateRunnerPhotoViaImportAction.fetchPhoto(String, String)

demo.action.UpdateRunnerPhotoViaImportAction is a Struts 1 endpoint (Action)

This web server request could be used by an attacker to expose internal services and filesystem.

Unchecked/unconfirmed cast from org.apache.struts.action.ActionForm to demo.form.RunnerForm in demo.action.UpdateRunnerProfileAction.execute(ActionMapping, ActionForm, HttpServletRequest, HttpServletResponse)

Dead store to someMap in demo.action.UpdateRunnerProfileAction.unmarshalInput(String)

Found reliance on default encoding in demo.action.UpdateRunnerProfileAction.unmarshalInput(String): new String(byte[])

Possible information exposure through an error message

The method getParameter returns a String value that is controlled by the client

demo.action.UpdateRunnerProfileAction is a Struts 1 endpoint (Action)

demo.dao.AttendanceDAO.loadAttendingMarathons(Runner) may fail to clean up java.sql.Statement on checked exception

demo.dao.AttendanceDAO.updateAttendances(Runner, List) may fail to clean up java.sql.Statement on checked exception

demo.dao.AttendanceDAO.loadAttendingMarathons(Runner) may fail to close database resource on exception

demo.dao.AttendanceDAO.updateAttendances(Runner, List) may fail to close database resource on exception

demo.dao.DAOUtils.isAlive() might ignore java.sql.SQLException

Possible information exposure through an error message

demo.dao.MarathonDAO.loadMarathons() may fail to clean up java.sql.Statement on checked exception

demo.dao.MarathonDAO.loadMarathons() may fail to close database resource on exception

demo.dao.ResultsDAO.loadResults(String, boolean) may fail to close database resource on exception

This use of java/sql/Statement.executeQuery(Ljava/lang/String;)Ljava/sql/ResultSet; can be vulnerable to SQL injection (with JDBC)

demo.dao.ResultsDAO.loadResults(String, boolean) passes a nonconstant String to an execute or addBatch method on an SQL statement

Use of non-localized String.toUpperCase() or String.toLowerCase() in demo.dao.RunnerDAO.searchRunners(String)

demo.dao.RunnerDAO.hasRunnerFinished(String) may fail to clean up java.sql.Statement on checked exception

demo.dao.RunnerDAO.loadRunner(long) may fail to clean up java.sql.Statement on checked exception

demo.dao.RunnerDAO.loadRunnerByName(String) may fail to clean up java.sql.Statement on checked exception

demo.dao.RunnerDAO.getAllRunners() may fail to close PreparedStatement

demo.dao.RunnerDAO.getRunnersNotRegisteredOnAnyDiscipline() may fail to close database resource on exception

demo.dao.RunnerDAO.hasRunnerFinished(String) may fail to close database resource on exception

demo.dao.RunnerDAO.loadRunner(long) may fail to close database resource on exception

demo.dao.RunnerDAO.loadRunnerByName(String) may fail to close database resource on exception

demo.dao.RunnerDAO.searchRunners(String) may fail to close database resource on exception

This use of java/sql/Statement.executeQuery(Ljava/lang/String;)Ljava/sql/ResultSet; can be vulnerable to SQL injection (with JDBC)

This use of java/sql/Connection.prepareStatement(Ljava/lang/String;)Ljava/sql/PreparedStatement; can be vulnerable to SQL injection (with JDBC)

This use of java/sql/Statement.executeQuery(Ljava/lang/String;)Ljava/sql/ResultSet; can be vulnerable to SQL injection (with JDBC)

demo.dao.RunnerDAO.hasRunnerFinished(String) passes a nonconstant String to an execute or addBatch method on an SQL statement

demo.dao.RunnerDAO.searchRunners(String) passes a nonconstant String to an execute or addBatch method on an SQL statement

A prepared statement is generated from a nonconstant String in demo.dao.RunnerDAO.createRunner(String, String, String, String, String, String, String, String)

demo.dao.SystemDAO.createAccount(String, String) may fail to clean up java.sql.Statement

demo.dao.SystemDAO.createAccount(String, String) may fail to close PreparedStatement

This use of java/util/logging/Logger.info(Ljava/lang/String;)V might be used to include CRLF characters into log messages

Found reliance on default encoding in demo.filter.AccessLogFilter.init(FilterConfig): new java.io.FileWriter(File)

This API (java/io/File.<init>(Ljava/lang/String;)V) reads a file whose location might be specified by user input

This API (java/io/File.<init>(Ljava/io/File;Ljava/lang/String;)V) reads a file whose location might be specified by user input

Exceptional return value of java.io.File.mkdir() ignored in demo.filter.AccessLogFilter.init(FilterConfig)

The header "User-Agent" can easily be spoofed by the client

Unchecked/unconfirmed cast from javax.servlet.ServletResponse to javax.servlet.http.HttpServletResponse in demo.filter.SecurityFilter.doFilter(ServletRequest, ServletResponse, FilterChain)

The method getParameterNames returns a String value that is controlled by the client

The method getParameter returns a String value that is controlled by the client

The method getParameterNames returns a String value that is controlled by the client

The method getParameter returns a String value that is controlled by the client

This use of java/io/PrintWriter.print(Ljava/lang/Object;)V could be vulnerable to XSS in the Servlet

This use of java/io/PrintWriter.print(Ljava/lang/Object;)V could be vulnerable to XSS in the Servlet

Confusing to have methods demo.form.CreateAccountForm.getCreditcardNumber() and demo.pojo.Runner.getCreditCardNumber()

Confusing to have methods demo.form.CreateAccountForm.getFirstname() and demo.service.RunnerRegistration.getFirstName()

Confusing to have methods demo.form.CreateAccountForm.getLastname() and demo.service.RunnerRegistration.getLastName()

Confusing to have methods demo.form.CreateAccountForm.getUsername() and demo.service.RunnerRegistration.getUserName()

Confusing to have methods demo.form.CreateAccountForm.setCreditcardNumber(String) and demo.pojo.Runner.setCreditCardNumber(String)

Confusing to have methods demo.form.CreateAccountForm.setFirstname(String) and demo.service.RunnerRegistration.setFirstName(String)

Confusing to have methods demo.form.CreateAccountForm.setLastname(String) and demo.service.RunnerRegistration.setLastName(String)

Confusing to have methods demo.form.CreateAccountForm.setUsername(String) and demo.service.RunnerRegistration.setUserName(String)

demo.form.RunnerForm.getDateOfBirthAsDate() may expose internal representation by returning RunnerForm.dateOfBirth

Run.finishingSeconds not initialized in constructor and dereferenced in demo.pojo.Run.getFinishingPixels()

demo.pojo.Runner.getDateOfBirth() may expose internal representation by returning Runner.dateOfBirth

new demo.pojo.Runner(Long, String, String, String, String, String, String, Date, String) may expose internal representation by storing an externally mutable object into Runner.dateOfBirth

demo.pojo.Runner.setDateOfBirth(Date) may expose internal representation by storing an externally mutable object into Runner.dateOfBirth

demo.pojo.Upload.getData() may expose internal representation by returning Upload.data

demo.pojo.Upload.setData(byte[]) may expose internal representation by storing an externally mutable object into Upload.data

JavaBeans property name populated with user controlled parameters

Sensitive data may be stored by the application in a cookie

Sensitive data may be stored by the application in a cookie

demo.service.MarathonService.demo.service.MarathonService.checkWinner(String) is a REST Web Service endpoint

demo.service.MarathonService.demo.service.MarathonService.createRunner(RunnerRegistration) is a REST Web Service endpoint

demo.service.MarathonService.demo.service.MarathonService.deleteRunnerPhoto(HttpServletRequest, String) is a REST Web Service endpoint

demo.service.MarathonService.demo.service.MarathonService.getProfilePic(String, int, int) is a REST Web Service endpoint

demo.service.MarathonService.demo.service.MarathonService.getUnregisteredRunners(HttpServletRequest) is a REST Web Service endpoint

demo.service.MarathonService.demo.service.MarathonService.listRunners() is a REST Web Service endpoint

demo.service.MarathonService.demo.service.MarathonService.updateRunner(HttpServletRequest, String, Map) is a REST Web Service endpoint

This API (java/io/File.<init>(Ljava/io/File;Ljava/lang/String;)V) reads a file whose location might be specified by user input

The class demo.service.MarathonService$1 could be refactored into a named _static_ inner class

This use of java/io/PrintWriter.println(Ljava/lang/String;)V could be vulnerable to XSS in the Servlet

HTTP parameter directly written to HTTP header output in demo.util.PermalinkServlet.doGet(HttpServletRequest, HttpServletResponse)

The method getParameter returns a String value that is controlled by the client

The following redirection could be used by an attacker to redirect users to a phishing website.

This API (java/io/File.<init>(Ljava/io/File;Ljava/lang/String;)V) reads a file whose location might be specified by user input

The method getParameter returns a String value that is controlled by the client

demo.util.SessionListener.hexArray should be package protected

The application mixes trusted and untrusted data in session attributes.

The following actions uses node12 which is deprecated and will be forced to run on node16: jwgmeligmeyling/spotbugs-github-action@master. For more info: https://github.blog/changelog/2023-06-13-github-actions-all-actions-will-run-on-node16-instead-of-node12-by-default/

The following actions use a deprecated Node.js version and will be forced to run on node20: jwgmeligmeyling/spotbugs-github-action@master. For more info: https://github.blog/changelog/2024-03-07-github-actions-all-actions-will-run-on-node20-instead-of-node16-by-default/