> ## Documentation Index
> Fetch the complete documentation index at: https://docs.codeant.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Security

<AccordionGroup>
  <Accordion title="xmlinputfactory-possible-xxe">
    XML external entities are not explicitly disabled for this XMLInputFactory. This could be vulnerable to XML external entity vulnerabilities. Explicitly disable external entities by setting "javax.xml.stream.isSupportingExternalEntities" to false.<br />**Likelihood**: LOW<br />**Confidence**: MEDIUM<br />**CWE**: <br />- CWE-611: Improper Restriction of XML External Entity Reference
    <br />**OWASP**: <br />- A04:2017 - XML External Entities (XXE)
    <br />- A05:2021 - Security Misconfiguration
  </Accordion>

  <Accordion title="do-privileged-use">
    Marking code as privileged enables a piece of trusted code to temporarily enable access to more resources than are available directly to the code that called it. Be very careful in your use of the privileged construct, and always remember to make the privileged code section as small as possible.<br />**Likelihood**: LOW<br />**Confidence**: LOW<br />**CWE**: <br />- CWE-269: Improper Privilege Management
    <br />**OWASP**: <br />- A04:2021 - Insecure Design
  </Accordion>

  <Accordion title="httpservlet-path-traversal">
    Detected a potential path traversal. A malicious actor could control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths are sanitized. You may also consider using a utility method such as org.apache.commons.io.FilenameUtils.getName(...) to only retrieve the file name from the path.<br />**Likelihood**: HIGH<br />**Confidence**: MEDIUM<br />**CWE**: <br />- CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
    <br />**OWASP**: <br />- A05:2017 - Broken Access Control
    <br />- A01:2021 - Broken Access Control
  </Accordion>

  <Accordion title="jackson-unsafe-deserialization">
    When using Jackson to marshall/unmarshall JSON to Java objects, enabling default typing is dangerous and can lead to RCE. If an attacker can control `$JSON` it might be possible to provide a malicious JSON which can be used to exploit unsecure deserialization. In order to prevent this issue, avoid to enable default typing (globally or by using "Per-class" annotations) and avoid using `Object` and other dangerous types for member variable declaration which creating classes for Jackson based deserialization.<br />**Likelihood**: LOW<br />**Confidence**: MEDIUM<br />**CWE**: <br />- CWE-502: Deserialization of Untrusted Data
    <br />**OWASP**: <br />- A8:2017 Insecure Deserialization
    <br />- A8:2021 Software and Data Integrity Failures
  </Accordion>

  <Accordion title="insecure-jms-deserialization">
    JMS Object messages depend on Java Serialization for marshalling/unmarshalling of the message payload when ObjectMessage.getObject() is called. Deserialization of untrusted data can lead to security flaws; a remote attacker could via a crafted JMS ObjectMessage to execute arbitrary code with the permissions of the application listening/consuming JMS Messages. In this case, the JMS MessageListener consume an ObjectMessage type received inside the onMessage method, which may lead to arbitrary code execution when calling the \$Y.getObject method.<br />**Likelihood**: LOW<br />**Confidence**: MEDIUM<br />**CWE**: <br />- CWE-502: Deserialization of Untrusted Data
    <br />**OWASP**: <br />- A08:2017 - Insecure Deserialization
    <br />- A08:2021 - Software and Data Integrity Failures
  </Accordion>

  <Accordion title="servletresponse-writer-xss">
    Cross-site scripting detected in HttpServletResponse writer with variable '$VAR'. User input was detected going directly from the HttpServletRequest into output. Ensure your data is properly encoded using org.owasp.encoder.Encode.forHtml: 'Encode.forHtml($VAR)'.<br />**Likelihood**: MEDIUM<br />**Confidence**: MEDIUM<br />**CWE**: <br />- CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
    <br />**OWASP**: <br />- A07:2017 - Cross-Site Scripting (XSS)
    <br />- A03:2021 - Injection
  </Accordion>

  <Accordion title="xmlinputfactory-external-entities-enabled">
    XML external entities are enabled for this XMLInputFactory. This is vulnerable to XML external entity attacks. Disable external entities by setting "javax.xml.stream.isSupportingExternalEntities" to false.<br />**Likelihood**: LOW<br />**Confidence**: LOW<br />**CWE**: <br />- CWE-611: Improper Restriction of XML External Entity Reference
    <br />**OWASP**: <br />- A04:2017 - XML External Entities (XXE)
    <br />- A05:2021 - Security Misconfiguration
  </Accordion>

  <Accordion title="use-snakeyaml-constructor">
    Used SnakeYAML org.yaml.snakeyaml.Yaml() constructor with no arguments, which is vulnerable to deserialization attacks. Use the one-argument Yaml(...) constructor instead, with SafeConstructor or a custom Constructor as the argument.<br />**Likelihood**: LOW<br />**Confidence**: LOW<br />**CWE**: <br />- CWE-502: Deserialization of Untrusted Data
    <br />**OWASP**: <br />- A08:2017 - Insecure Deserialization
    <br />- A08:2021 - Software and Data Integrity Failures
  </Accordion>
</AccordionGroup>