SV.UMC.JDBC

The DataSource interface, new in the JDBC 2.0 API, provides a better way to connect to a data source. Calling DriverManager.getConnection(...) should be avoided.

Vulnerability and risk

Acquiring and releasing database connections by means of the database manager, using JDBC 1.0, will impact the performance of the application. That impact is due to the overhead in creating and destroying those objects by the database resource manager process.

Klocwork security vulnerability (SV) checkers identify calls that create potentially dangerous data; these calls are considered unsafe sources. An unsafe source can be any data provided by the user, since the user could be an attacker or has the potential for introducing human error.

Mitigation and prevention

The use of a DataSource object is the preferred means of connecting to a data source.

Example 1

18     protected void doPost(HttpServletRequest req,
19                           HttpServletResponse resp) throws ServletException {
20         String name = req.getParameter("userName");
21         String pswd = req.getParameter("passwd");
22         Connection conn = doGetConnection(name, pswd);
23         // ...
24     }
25     private Connection doGetConnection(String name,
26                                        String pswd) {
27         Connection conn = null;
28         try {
29             return DriverManager.getConnection("localhost:3300",
30                                                name, pswd);
31         } catch (SQLException e) {
32             // ...
33         }
34         return conn;
35     }

SV.UMC.JDBC is reported for call on line 29: Application should avoid calling DriverManager.getConnection() directly.

Security guidelines

• CWE-245: J2EE Bad Practices: Direct Management of Connections