Static Code Analysis

4.

Common Findings and Detected Issues

4.1.

Security Vulnerabilities (SAST)

4.1.1.

Injection Flaws

4.1.1.1.

SQL Injection (SQLi)

4.1.1.1.1.

Union-Based Attacks

4.1.1.1.2.

Blind SQL Injection

4.1.1.1.3.

Time-Based Attacks

4.1.1.2.

Cross-Site Scripting (XSS)

4.1.1.2.1.

4.1.1.2.2.

4.1.1.2.3.

4.1.1.3.

Command Injection

4.1.1.3.1.

OS Command Injection

4.1.1.3.2.

4.1.1.4.

4.1.1.5.

NoSQL Injection

4.1.1.6.

Header Injection

4.1.2.

Broken Authentication and Session Management

4.1.2.1.

Weak Password Handling

4.1.2.1.1.

Password Storage Issues

4.1.2.1.2.

Password Policy Violations

4.1.2.2.

Session Fixation

4.1.2.3.

Session Hijacking Vulnerabilities

4.1.2.4.

Insufficient Session Expiration

4.1.2.5.

Weak Session Token Generation

4.1.3.

Sensitive Data Exposure

4.1.3.1.

Hardcoded Secrets

4.1.3.1.1.

4.1.3.1.2.

4.1.3.1.3.

Database Credentials

4.1.3.1.4.

Encryption Keys

4.1.3.2.

Weak Cryptographic Algorithms

4.1.3.2.1.

Deprecated Hash Functions

4.1.3.2.2.

Insecure Encryption Modes

4.1.3.2.3.

Weak Key Generation

4.1.3.3.

Information Disclosure

4.1.3.3.1.

Debug Information Leakage

4.1.3.3.2.

Error Message Exposure

4.1.4.

XML External Entities (XXE)

4.1.4.1.

External Entity Processing

4.1.4.2.

XML Parser Configuration Issues

4.1.4.3.

Billion Laughs Attack

4.1.5.

Broken Access Control

4.1.5.1.

Privilege Escalation

4.1.5.1.1.

Vertical Privilege Escalation

4.1.5.1.2.

Horizontal Privilege Escalation

4.1.5.2.

Insecure Direct Object References

4.1.5.3.

Missing Function Level Access Control

4.1.5.4.

Forced Browsing Vulnerabilities

4.1.6.

Security Misconfiguration

4.1.6.1.

Default Credentials

4.1.6.2.

Insecure Permissions

4.1.6.3.

Unnecessary Services Enabled

4.1.6.4.

Missing Security Headers

4.1.7.

Insecure Deserialization

4.1.7.1.

Object Injection Attacks

4.1.7.2.

Remote Code Execution

4.1.7.3.

4.1.8.

Memory Management Errors

4.1.8.1.

Buffer Overflows and Overruns

4.1.8.1.1.

Stack-Based Overflows

4.1.8.1.2.

Heap-Based Overflows

4.1.8.2.

Integer Overflows

4.1.8.2.1.

Arithmetic Overflow

4.1.8.2.2.

Integer Wraparound

4.1.8.3.

4.1.8.4.

Double-Free Errors

4.1.8.5.

4.1.8.5.1.

Heap Memory Leaks

4.1.8.5.2.

Resource Handle Leaks

4.2.

Code Quality and Reliability Defects

4.2.1.

Null Pointer Dereferences

4.2.1.1.

Null Check Violations

4.2.1.2.

Optional Type Misuse

4.2.2.

Uninitialized Variables

4.2.2.1.

Local Variable Initialization

4.2.2.2.

Field Initialization Issues

4.2.3.

4.2.3.1.

4.2.3.1.1.

File Handle Leaks

4.2.3.1.2.

Stream Closure Issues

4.2.3.2.

4.2.3.2.1.

Network Connection Leaks

4.2.3.2.2.

Socket Closure Problems

4.2.3.3.

Database Connections

4.2.3.3.1.

Connection Pool Exhaustion

4.2.3.3.2.

Transaction Management Issues

4.2.3.4.

Memory Resources

4.2.4.

Unreachable Code (Dead Code)

4.2.4.1.

Conditional Dead Code

4.2.4.2.

Exception Handler Dead Code

4.2.4.3.

Method-Level Dead Code

4.2.5.

Concurrency Issues

4.2.5.1.

Race Conditions

4.2.5.1.1.

Data Race Detection

4.2.5.1.2.

Time-of-Check-Time-of-Use

4.2.5.2.

4.2.5.2.1.

Circular Wait Conditions

4.2.5.2.2.

Lock Ordering Issues

4.2.5.3.

Improper Synchronization

4.2.5.3.1.

Missing Synchronization

4.2.5.3.2.

Over-Synchronization

4.2.5.4.

Atomic Operation Violations

4.2.6.

4.2.6.1.

Off-by-One Errors

4.2.6.1.1.

Array Boundary Errors

4.2.6.1.2.

Loop Condition Errors

4.2.6.2.

Incorrect Conditionals

4.2.6.2.1.

Boolean Logic Errors

4.2.6.2.2.

Comparison Operator Misuse

4.2.6.3.

Algorithm Implementation Errors

4.3.

Coding Standard and Style Violations

4.3.1.

Adherence to Naming Conventions

4.3.1.1.

Variable Naming Standards

4.3.1.2.

Function Naming Conventions

4.3.1.3.

Class and Interface Naming

4.3.2.

Code Formatting and Layout

4.3.2.1.

Indentation Standards

4.3.2.2.

Line Length Limits

4.3.2.3.

Whitespace Usage

4.3.3.

Code Complexity Metrics

4.3.3.1.

Cyclomatic Complexity

4.3.3.1.1.

Decision Point Counting

4.3.3.1.2.

Complexity Thresholds

4.3.3.2.

Cognitive Complexity

4.3.3.2.1.

Mental Model Complexity

4.3.3.2.2.

Nested Structure Analysis

4.3.3.3.

Halstead Complexity Measures

4.3.4.

Use of Deprecated Functions or APIs

4.3.4.1.

Legacy API Usage

4.3.4.2.

Version Compatibility Issues

4.3.4.3.

Migration Path Identification

4.3.5.

Commenting and Documentation Standards

4.3.5.1.

Code Documentation Requirements

4.3.5.2.

API Documentation Standards

4.3.5.3.

Inline Comment Guidelines

Previous

3. Types of Static Analysis

Go to top

Next

5. Integration into the Development Process