Scala Rules
SAST rules for Scala that identify insecure patterns in application code.
Scala Rule Catalog
| ID | Title | Severity | Category |
|---|---|---|---|
CODE-0042 | OS Command Injection | CRITICAL | Injection |
CODE-0057 | Hard-coded Password in Database Connection String | CRITICAL | Secrets |
CODE-0058 | Hard-coded Database Password | CRITICAL | Secrets |
CODE-0074 | Template Injection | CRITICAL | Injection |
CODE-0011 | HTTP Response Splitting | HIGH | Injection |
CODE-0012 | HTTP Response Splitting Vulnerability | HIGH | Injection |
CODE-0013 | HTTP Response Splitting Vulnerability | HIGH | Injection |
CODE-0015 | Permissive Cross-domain Policy with Untrusted Domains | HIGH | Web |
CODE-0033 | Unencrypted Server Socket | HIGH | Crypto |
CODE-0034 | Unvalidated Redirect | HIGH | Web |
CODE-0035 | Improper Certificate Validation | HIGH | Crypto |
CODE-0036 | Path Traversal in File Upload | HIGH | AccessControl |
CODE-0039 | AWS Query Injection | HIGH | Injection |
CODE-0040 | Bean Property Injection | HIGH | Injection |
CODE-0041 | CRLF Injection in Logs | HIGH | Logging |
CODE-0043 | SQL Injection Vulnerability | HIGH | Injection |
CODE-0044 | SQL Injection Vulnerability | HIGH | Injection |
CODE-0045 | Expression Language Injection | HIGH | Injection |
CODE-0046 | Server-side redirect path constructed with user input | HIGH | Injection |
CODE-0047 | HTTP Parameter Pollution | HIGH | Web |
CODE-0051 | Path Traversal Vulnerability | HIGH | Injection |
CODE-0052 | Path Traversal Vulnerability | HIGH | Injection |
CODE-0053 | Path Traversal | HIGH | Injection |
CODE-0054 | SQL Injection | HIGH | Injection |
CODE-0056 | LDAP Entry Poisoning | HIGH | Injection |
CODE-0059 | Hard-coded Password | HIGH | Secrets |
CODE-0060 | Insecure inherited permissions | HIGH | AccessControl |
CODE-0061 | Overly Permissive File Permission | HIGH | InsecureConfig |
CODE-0063 | Improper Control of Generation of Code ('Code Injection') | HIGH | Injection |
CODE-0065 | Insecure SMTP SSL Configuration | HIGH | InsecureConfig |
CODE-0066 | SMTP Header Injection | HIGH | Injection |
CODE-0068 | Server-Side Request Forgery (SSRF) | HIGH | Web |
CODE-0070 | Use of Externally-Controlled Format String | HIGH | Injection |
CODE-0075 | External Control of System or Configuration Setting | HIGH | InsecureConfig |
CODE-0078 | Deserialization of Untrusted Data | HIGH | Deserialization |
CODE-0080 | Deserialization of Untrusted Data | HIGH | Deserialization |
CODE-0083 | Cross-Site Scripting (XSS) via Improper Input Neutralization | HIGH | Web |
CODE-0087 | Cross-site Scripting (XSS) Vulnerability | HIGH | Web |
CODE-0089 | XML External Entity (XXE) Vulnerability | HIGH | Injection |
CODE-0009 | Sensitive Cookie in HTTPS Session Without 'Secure' Attribute | MEDIUM | Web |
CODE-0010 | Sensitive Cookie in HTTPS Session Without 'Secure' Attribute | MEDIUM | Web |
CODE-0014 | Trust Boundary Violation | MEDIUM | Web |
CODE-0017 | Inadequate Encryption Strength | MEDIUM | Crypto |
CODE-0018 | Inadequate Encryption Strength | MEDIUM | Crypto |
CODE-0019 | Inadequate Encryption Strength | MEDIUM | Crypto |
CODE-0020 | Inadequate Encryption Strength | MEDIUM | Crypto |
CODE-0021 | Missing Support for Integrity Check | MEDIUM | Crypto |
CODE-0022 | Padding Oracle Vulnerability in CBC Mode with PKCS5Padding | MEDIUM | Crypto |
CODE-0023 | Use of Custom MessageDigest | MEDIUM | Crypto |
CODE-0024 | Inadequate encryption strength | MEDIUM | InsecureConfig |
CODE-0025 | Inadequate Encryption Strength | MEDIUM | Crypto |
CODE-0026 | Inadequate Encryption Strength | MEDIUM | Crypto |
CODE-0027 | Use of a Broken or Risky Cryptographic Algorithm | MEDIUM | Crypto |
CODE-0028 | Use of RSA Algorithm without OAEP | MEDIUM | Crypto |
CODE-0029 | Inadequate Encryption Strength | MEDIUM | Crypto |
CODE-0030 | Improper Certificate Validation | MEDIUM | Crypto |
CODE-0031 | Insecure JAX-RS Endpoint | MEDIUM | Web |
CODE-0032 | Insecure JAX-WS Endpoint | MEDIUM | Web |
CODE-0037 | Path Traversal Vulnerability | MEDIUM | AccessControl |
CODE-0038 | Improper Input Validation in Form | MEDIUM | Web |
CODE-0048 | LDAP Injection | MEDIUM | Injection |
CODE-0049 | Expression injection (OGNL) | MEDIUM | Injection |
CODE-0050 | Path Traversal Vulnerability | MEDIUM | Injection |
CODE-0055 | LDAP Anonymous Authentication | MEDIUM | Auth |
CODE-0062 | Overly Permissive File Permission | MEDIUM | InsecureConfig |
CODE-0064 | Improper Control of Generation of Code ('Code Injection') | MEDIUM | Injection |
CODE-0067 | Server-Side Request Forgery (SSRF) | MEDIUM | Web |
CODE-0069 | Incorrect Type Conversion or Cast | MEDIUM | Generic |
CODE-0071 | Improper Handling of Unicode Encoding | MEDIUM | Generic |
CODE-0072 | Modification After Validation | MEDIUM | Injection |
CODE-0073 | Normalize strings before validating them | MEDIUM | Injection |
CODE-0077 | Exposure of sensitive system information | MEDIUM | Secrets |
CODE-0079 | Ignoring XML comments in SAML | MEDIUM | Auth |
CODE-0082 | XPath Injection | MEDIUM | Injection |
CODE-0084 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | MEDIUM | Web |
CODE-0085 | Cross-Site Scripting (XSS) via Disabling HTML Escaping | MEDIUM | Web |
CODE-0086 | Servlet Reflected Cross Site Scripting Vulnerability | MEDIUM | Web |
CODE-0088 | XML External Entity (XXE) Injection | MEDIUM | Injection |
CODE-0090 | XML External Entity (XXE) Vulnerability | MEDIUM | Injection |
CODE-0091 | XML External Entity (XXE) Vulnerability | MEDIUM | Injection |
CODE-0092 | XML External Entity (XXE) Vulnerability | MEDIUM | Injection |
CODE-0093 | XML External Entity (XXE) Vulnerability | MEDIUM | Injection |
CODE-0007 | Sensitive Cookie Without 'HttpOnly' Flag | LOW | Web |
CODE-0008 | Insecure Cookie Creation | LOW | Web |
CODE-0076 | Information Exposure Through an Error Message | LOW | ErrorHandling |
CODE-0676 | Stack trace exposure via output | LOW | ErrorHandling |
Total Rules: 86
Click on any rule ID to view detailed information, examples, and remediation guidance.