Hi dev@, This is a monthly snapshot of apache_nutch on SonarCloud: https://sonarcloud.io/project/overview?id=apache_nutch
- SonarCloud analysis for apache_nutch is already public. This mail is a monthly digest of those results, not a confidential disclosure. - The Nutch PMC is responsible for resolving these issues. The ASF Security Team is available to provide help and advice, but the responsibility to do the work lies with the PMC. Ratings Quality gate: OK Passes on new code; overall ratings still reflect long-lived findings. Reliability: E (5.0) — 151 open bugs Security: D (4.0) — 4 vulnerabilities, 19 unreviewed hotspots Maintainability: A (1.0) — 2916 code smells Coverage: 36.5% Open HIGH / BLOCKER: 1882 / 44 Highest-priority classes (SECURITY, then RELIABILITY, then other): 1. java:S4790 — 2 findings https://sonarcloud.io/project/issues?id=apache_nutch&resolved=false&rules=java%3AS4790 Quality: SECURITY Severity: CRITICAL Risk: Make sure this weak hash algorithm is not used in a sensitive context here. Fix: To hash passwords or other sensitive data, use a slow, memory-hard algorithm specifically designed for that purpose. 2. java:S2245 — 1 findings https://sonarcloud.io/project/issues?id=apache_nutch&resolved=false&rules=java%3AS2245 Quality: SECURITY Severity: MAJOR Risk: Make sure that using this pseudorandom number generator is safe here. Fix: Use a cryptographically secure pseudorandom number generator (CSPRNG) instead of a non-cryptographic PRNG. 3. java:S2095 — 7 findings https://sonarcloud.io/project/issues?id=apache_nutch&resolved=false&rules=java%3AS2095 Quality: RELIABILITY Severity: BLOCKER Risk: Use try-with-resources or close this "PrintStream" in a "finally" clause. Fix: See SonarCloud rule documentation. 4. java:S2276 — 2 findings https://sonarcloud.io/project/issues?id=apache_nutch&resolved=false&rules=java%3AS2276 Quality: RELIABILITY Severity: BLOCKER Risk: Replace the call to "Thread.sleep(...)" with a call to "wait(...)". Fix: Call wait(…) on the monitor object instead of using Thread.sleep(…) . 5. java:S2189 — 1 findings https://sonarcloud.io/project/issues?id=apache_nutch&resolved=false&rules=java%3AS2189 Quality: RELIABILITY Severity: BLOCKER Risk: Add an end condition to this loop. Fix: See SonarCloud rule documentation. 6. java:S2119 — 16 findings https://sonarcloud.io/project/issues?id=apache_nutch&resolved=false&rules=java%3AS2119 Quality: RELIABILITY Severity: CRITICAL Risk: Save and re-use this "Random". Fix: Define and reuse the Random object. 7. javabugs:S3518 — 3 findings https://sonarcloud.io/project/issues?id=apache_nutch&resolved=false&rules=javabugs%3AS3518 Quality: RELIABILITY Severity: CRITICAL Risk: Fix this code that may throw an 'ArithmeticException' because of a division by zero. Fix: See SonarCloud rule documentation. 8. javabugs:S6466 — 3 findings https://sonarcloud.io/project/issues?id=apache_nutch&resolved=false&rules=javabugs%3AS6466 Quality: RELIABILITY Severity: CRITICAL Risk: Fix this access on a collection that may throw an 'ArrayIndexOutOfBoundsException' when executed. Fix: The following examples contain out-of-bounds accesses to arrays, resulting in ArrayIndexOutOfBounds exceptions. 9. java:S1175 — 2 findings https://sonarcloud.io/project/issues?id=apache_nutch&resolved=false&rules=java%3AS1175 Quality: RELIABILITY Severity: CRITICAL Risk: Rename this method to avoid any possible confusion with Object.finalize(). Fix: See SonarCloud rule documentation. 10. java:S5845 — 2 findings https://sonarcloud.io/project/issues?id=apache_nutch&resolved=false&rules=java%3AS5845 Quality: RELIABILITY Severity: CRITICAL Risk: Change the assertion arguments to not compare dissimilar types. Fix: See SonarCloud rule documentation. This report was generated automatically by [email protected]. Use that address to report any issues or provide feedback.
