Re: [Vtd-xml-users] vtd-xml-2.11 - Veracode Security Scan Flaw (Code Quality)

[<jz...@xi...>]

Thanks for the suggestions. will do so in the upcoming releases.. 

----- Original Message -----
From: "Batistil Rulix" 
To:"vtd...@li..." ,
"vtd...@li..." 
Cc:
Sent:Wed, 25 Mar 2015 18:53:34 +0000
Subject:[Vtd-xml-users] vtd-xml-2.11 - Veracode Security Scan Flaw
(Code Quality)

	Hi,

	  

	Nowadays software security has a high degree of importance among
other things. Though this library is very good, this also need to code
pass industry standard security checks.

 The vtd-xml-2.11.jar [1] failed on Veracode security scan as these 4
classes below contain a main method use only for testing or debugging.


	1. ContextBuffer.java [2]          - com/ximpleware/

	2. intHash.java [3]                     -
com/ximpleware/

	3. parser.java [4]                       -
com/ximpleware/xpath/

	4. Yylex.java [5]                         -
com/ximpleware/xpath/

	Note that java main method is an entry point and is very vulnerable
to be exploited by unscrupulous individuals.
 Test classes and methods should be handle Junit components of
equivalent.

	I suggest to make this library acceptable to a wider audience in the
software business, the stable release library should be free from
testing and debugging codes. 
 To the developers of the library, please remove the main method out
from these 4 classes.

 I`m looking forward for a new library release without this security
flaw. 

	Thanks,
 Rulix

	----------------

 Rulix Batistil
Lead Software Engineer
 Experian Decision Analytics

	 [6]

	2 Bloor St Suite 3501
 Toronto, ON, M4W 1A8
Tel - 416-840-1470 Ext 422

	   

Links:
------
[1] http://vtd-xml-2.11.jar
[2] http://ContextBuffer.java
[3] http://intHash.java
[4] http://parser.java
[5] http://Yylex.java
[6] http://www.experian.com/