Critical Question

Reasons Causing Vulnerabilities

Suggested Solutions

Q.1

Classes are public

The product should make all classes package-private, since they are in the same package (M3Application) and not served as an API or interface for external classes.

Q.1

Methods are public

This implementation is not appropriate. Methods in the product should obtain at least default access modifier privilege. Most of them should be in private access modifier privilege, since they are used internally.

Q.1

Variables are public

Variables should limit the accessibility. In this product, most variable should be in private access modifier privilege.

Q.2

Resource is not proper closed

This product should use try-with-resources statement to ensure each resource is closed at the end of the statement.

Q.2

More than one resource operations in the try-catch-finally block

Since several exceptions may be thrown, some exceptions will be masked.

Q.5

Static variables

Since other classes in the same scope may be able to access and modify a static variable, this variable should better be claimed as final static.

Q.9

Inner class

Since there are some security issues related to inner class. It is better to move inner classes to outer classes.

Q.12

Sensitive information

Use Java security APIs to handle sensitive information.