{"@ID": "576", "@Name": "EJB Bad Practices: Use of Java I/O", "@Abstraction": "Variant", "@Structure": "Simple", "@Status": "Draft", "Description": "The product violates the Enterprise JavaBeans (EJB) specification by using the java.io package.", "Extended_Description": "The Enterprise JavaBeans specification requires that every bean provider follow a set of programming guidelines designed to ensure that the bean will be portable and behave consistently in any EJB container. In this case, the product violates the following EJB guideline: \"An enterprise bean must not use the java.io package to attempt to access files and directories in the file system.\" The specification justifies this requirement in the following way: \"The file system APIs are not well-suited for business components to access data. Business components should use a resource manager API, such as JDBC, to store data.\"", "Related_Weaknesses": {"Related_Weakness": {"@Nature": "ChildOf", "@CWE_ID": "695", "@View_ID": "1000", "@Ordinal": "Primary"}}, "Weakness_Ordinalities": {"Weakness_Ordinality": {"Ordinality": "Primary"}}, "Applicable_Platforms": {"Language": {"@Name": "Java", "@Prevalence": "Undetermined"}}, "Modes_Of_Introduction": {"Introduction": {"Phase": "Implementation"}}, "Common_Consequences": {"Consequence": {"Scope": "Other", "Impact": "Quality Degradation"}}, "Detection_Methods": {"Detection_Method": {"@Detection_Method_ID": "DM-14", "Method": "Automated Static Analysis", "Description": "Automated static analysis, commonly referred to as Static Application Security Testing (SAST), can find some instances of this weakness by analyzing source code (or binary/compiled code) without having to execute it. Typically, this is done by building a model of data flow and control flow, then searching for potentially-vulnerable patterns that connect \"sources\" (origins of input) with \"sinks\" (destinations where the data interacts with external components, a lower layer such as the OS, etc.)"}}, "Potential_Mitigations": {"Mitigation": {"Phase": "Implementation", "Description": "Do not use Java I/O when writing EJBs."}}, "Demonstrative_Examples": {"Demonstrative_Example": {"Intro_Text": "The following Java example is a simple stateless Enterprise JavaBean that retrieves the interest rate for the number of points for a mortgage. In this example, the interest rates for various points are retrieved from an XML document on the local file system, and the EJB uses the Java I/O API to retrieve the XML document from the local file system.", "Example_Code": [{"@Nature": "Bad", "@Language": "Java", "xhtml:div": {"xhtml:br": [null, null], "xhtml:div": {"@style": "margin-left:1em;", "xhtml:div": {"xhtml:br": [null, null, null, null, null, null, null, null, null], "xhtml:div": [{"@style": "margin-left:1em;", "xhtml:div": {"xhtml:div": {"@style": "margin-left:1em;", "xhtml:div": {"xhtml:br": [null, null, null, null, null], "xhtml:i": "/* get XML document from the local filesystem */", "xhtml:div": {"@style": "margin-left:1em;", "xhtml:br": [null, null], "#text": "DocumentBuilderFactory dbf = DocumentBuilderFactory.newInstance();DocumentBuilder db = dbf.newDocumentBuilder();interestRateXMLDocument = db.parse(interestRateFile);"}, "#text": "interestRateFile = new File(Constants.INTEREST_RATE_FILE);\n                                       if (interestRateFile.exists()){}"}}, "#text": "try {} catch (IOException ex) {...}"}}, {"@style": "margin-left:1em;", "#text": "return getInterestRateFromXML(points);"}], "xhtml:i": "/* member function to retrieve interest rate from XML document on the local file system */", "#text": "private Document interestRateXMLDocument = null;private File interestRateFile = null;\n                           public InterestRateBean() {}\n                           public BigDecimal getInterestRate(Integer points) {}\n                           \n                           \n                           \n                           private BigDecimal getInterestRateFromXML(Integer points) {...}"}}, "#text": "@Statelesspublic class InterestRateBean implements InterestRateRemote {\n                     }"}, "#text_blocks": ["@Stateless", "public class InterestRateBean implements InterestRateRemote {", "private Document interestRateXMLDocument = null;", "private File interestRateFile = null;", "public InterestRateBean() {", "try {", "/* get XML document from the local filesystem */", "interestRateFile = new File(Constants.INTEREST_RATE_FILE);", "if (interestRateFile.exists())", "{", "DocumentBuilderFactory dbf = DocumentBuilderFactory.newInstance();", "DocumentBuilder db = dbf.newDocumentBuilder();", "interestRateXMLDocument = db.parse(interestRateFile);", "}", "} catch (IOException ex) {...}", "}", "public BigDecimal getInterestRate(Integer points) {", "return getInterestRateFromXML(points);", "}", "/* member function to retrieve interest rate from XML document on the local file system */", "private BigDecimal getInterestRateFromXML(Integer points) {...}", "}"]}, {"@Nature": "Good", "@Language": "Java", "xhtml:div": {"xhtml:br": null, "xhtml:div": {"@style": "margin-left:1em;", "xhtml:div": {"xhtml:br": [null, null, null, null, null, null, null, null], "xhtml:div": {"@style": "margin-left:1em;", "#text": "return getInterestRateFromXMLParser(points);"}, "xhtml:i": "/* member function to retrieve interest rate from XML document using an XML parser API */", "#text": "public InterestRateBean() {}\n                           public BigDecimal getInterestRate(Integer points) {}\n                           \n                           \n                           \n                           private BigDecimal getInterestRateFromXMLParser(Integer points) {...}"}}, "#text": "@Statelesspublic class InterestRateBean implements InterestRateRemote {}"}, "#text_blocks": ["@Stateless", "public class InterestRateBean implements InterestRateRemote {", "public InterestRateBean() {", "}", "public BigDecimal getInterestRate(Integer points) {", "return getInterestRateFromXMLParser(points);", "}", "/* member function to retrieve interest rate from XML document using an XML parser API */", "private BigDecimal getInterestRateFromXMLParser(Integer points) {...}", "}"]}], "Body_Text": ["This use of the Java I/O API within any kind of Enterprise JavaBean violates the EJB specification by using the java.io package for accessing files within the local filesystem.", "An Enterprise JavaBean should use a resource manager API for storing and accessing data. In the following example, the private member function getInterestRateFromXMLParser uses an XML parser API to retrieve the interest rates."]}}, "Taxonomy_Mappings": {"Taxonomy_Mapping": {"@Taxonomy_Name": "Software Fault Patterns", "Entry_ID": "SFP3", "Entry_Name": "Use of an improper API"}}, "Mapping_Notes": {"Usage": "Allowed", "Rationale": "This CWE entry is at the Variant level of abstraction, which is a preferred level of abstraction for mapping to the root causes of vulnerabilities.", "Comments": "Carefully read both the name and description to ensure that this mapping is an appropriate fit. Do not try to 'force' a mapping to a lower-level Base/Variant simply to comply with this preferred level of abstraction.", "Reasons": {"Reason": {"@Type": "Acceptable-Use"}}}, "Content_History": {"Submission": {"Submission_Name": "CWE Community", "Submission_Date": "2006-12-15", "Submission_Version": "Draft 5", "Submission_ReleaseDate": "2006-12-15", "Submission_Comment": "Submitted by members of the CWE community to extend early CWE versions"}, "Modification": [{"Modification_Name": "Eric Dalci", "Modification_Organization": "Cigital", "Modification_Date": "2008-07-01", "Modification_Version": "1.0", "Modification_ReleaseDate": "2008-09-09", "Modification_Comment": "updated Potential_Mitigations, Time_of_Introduction"}, {"Modification_Name": "CWE Content Team", "Modification_Organization": "MITRE", "Modification_Date": "2008-09-08", "Modification_Version": "1.0", "Modification_ReleaseDate": "2008-09-09", "Modification_Comment": "updated Relationships, Other_Notes"}, {"Modification_Name": "CWE Content Team", "Modification_Organization": "MITRE", "Modification_Date": "2009-10-29", "Modification_Version": "1.6", "Modification_ReleaseDate": "2009-10-29", "Modification_Comment": "updated Description, Other_Notes"}, {"Modification_Name": "CWE Content Team", "Modification_Organization": "MITRE", "Modification_Date": "2009-12-28", "Modification_Version": "1.7", "Modification_ReleaseDate": "2009-12-28", "Modification_Comment": "updated Demonstrative_Examples"}, {"Modification_Name": "CWE Content Team", "Modification_Organization": "MITRE", "Modification_Date": "2011-06-01", "Modification_Version": "1.13", "Modification_ReleaseDate": "2011-06-01", "Modification_Comment": "updated Common_Consequences"}, {"Modification_Name": "CWE Content Team", "Modification_Organization": "MITRE", "Modification_Date": "2011-06-27", "Modification_Version": "2.0", "Modification_ReleaseDate": "2011-06-27", "Modification_Comment": "updated Common_Consequences"}, {"Modification_Name": "CWE Content Team", "Modification_Organization": "MITRE", "Modification_Date": "2012-05-11", "Modification_Version": "2.2", "Modification_ReleaseDate": "2012-05-15", "Modification_Comment": "updated Relationships"}, {"Modification_Name": "CWE Content Team", "Modification_Organization": "MITRE", "Modification_Date": "2012-10-30", "Modification_Version": "2.3", "Modification_ReleaseDate": "2012-10-30", "Modification_Comment": "updated Potential_Mitigations"}, {"Modification_Name": "CWE Content Team", "Modification_Organization": "MITRE", "Modification_Date": "2014-07-30", "Modification_Version": "2.8", "Modification_ReleaseDate": "2014-07-31", "Modification_Comment": "updated Relationships, Taxonomy_Mappings"}, {"Modification_Name": "CWE Content Team", "Modification_Organization": "MITRE", "Modification_Date": "2020-02-24", "Modification_Version": "4.0", "Modification_ReleaseDate": "2020-02-24", "Modification_Comment": "updated Relationships"}, {"Modification_Name": "CWE Content Team", "Modification_Organization": "MITRE", "Modification_Date": "2023-01-31", "Modification_Version": "4.10", "Modification_ReleaseDate": "2023-01-31", "Modification_Comment": "updated Description"}, {"Modification_Name": "CWE Content Team", "Modification_Organization": "MITRE", "Modification_Date": "2023-04-27", "Modification_Version": "4.11", "Modification_ReleaseDate": "2023-04-27", "Modification_Comment": "updated Relationships, Time_of_Introduction"}, {"Modification_Name": "CWE Content Team", "Modification_Organization": "MITRE", "Modification_Date": "2023-06-29", "Modification_Version": "4.12", "Modification_ReleaseDate": "2023-06-29", "Modification_Comment": "updated Mapping_Notes"}, {"Modification_Name": "CWE Content Team", "Modification_Organization": "MITRE", "Modification_Date": "2025-12-11", "Modification_Version": "4.19", "Modification_ReleaseDate": "2025-12-11", "Modification_Comment": "updated Weakness_Ordinalities"}, {"Modification_Name": "CWE Content Team", "Modification_Organization": "MITRE", "Modification_Date": "2026-10-28", "Modification_Version": "5.0", "Modification_ReleaseDate": "2026-10-28", "Modification_Comment": "updated Detection_Factors"}]}, "entry_type": "Weakness"}