APrieto034095 (Community Member) asked a question.
CWE-382: J2EE Bad Practices: Use of System.exit()
I got two CWE-382 on the following code:
catch (ParameterException e) {
String command = jCommander.getParsedCommand();
if (command != null) {
e.getJCommander().usage(command);
}
else {
e.usage();
}
System.exit(-1);
}
if (command.showHelp()) {
jCommander.usage(commandName.getCommandName());
System.exit(0);
}
How could I fix it?
.png){kind=logo}
Hello @APrieto034095 (Community Member),
Thanks for your question. I recommend reviewing the flaw within the Triage Flaws section of the Veracode Platform for the scan in question. The attack vector, description and remediation text should be read which contains a wealth of information about where the flaw was found and how to resolve it. In this case the flaw is simply the use of System.exit(). We do not recommend invoking this when running within a J2EE container as it could shut down the application container. This could potentially be exploited by an attacker to perform a Denial of Service (DoS) attack against the application container.
Thanks,
Anthony Fielding