Close Open Privacy Scan
App Privacy Score
Medium risk · 420 finding(s)
Dependency score: 92 (Low risk)
bar_chart Score Breakdown
list Scan Summary
swap_horiz Potential data exfiltration in application code
External domains:
apache.orgapi-cd.vespa.ouryahoo.comapi-ctl.cd.vespa-cloud.comapi-ctl.vespa-cloud.comapi.github.comapi.openai.comapi.vespa.ouryahoo.comapi.voyageai.comconsole-cd.vespa.ouryahoo.comconsole.publiccd.cd-vespa-cloud.comconsole.vespa-cloud.comconsole.vespa.ouryahoo.comdata.vespa-cloud.comdefault-1.htmldefault-2.htmldefault-3.htmldefault-4.htmldocs.vespa.aidummy.examplegithub.comgo.devgolang.orgjsoup.orgopentelemetry.iopkg.go.devpublicsuffix.orgpurl.oclc.orgrelaxng.orgundefinedunicode.orgvespa.aiwww.ascc.netwww.iana.orgwww.ibm.comwww.oracle.comwww.thaiopensource.comwww.w3.orgxml.orgzts.athenz.ouroath.com
repo/vespaclient-java/src/main/java/com/yahoo/vespavisit/VdsVisit.java:840 → repo/vespaclient-java/src/main/java/com/yahoo/vespavisit/VdsVisit.java:844repo/vespaclient-java/src/main/java/com/yahoo/vespavisit/VdsVisit.java:840 → repo/vespaclient-java/src/main/java/com/yahoo/vespavisit/VdsVisit.java:900</> First-Party Code
first-party (java): vespaclient-java
java first-party System.err.print(Text.format("Resuming visitor already %.1f %% finished.\n",
visitorParameters.getResumeToken().percentFinished()));PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.
Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.
System.out.println(session.getTrace().toString());PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.
Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.
expand_more 14 low-confidence finding(s)
var in = Files.newInputStream(p);Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
var in = Files.newInputStream(path);Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
var in = Files.newInputStream(path);Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
inputStreams.add(new BufferedInputStream(new FileInputStream(fileName), BUFFER_SIZE));Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
return Files.newInputStream(inputPath);Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
int returnCode = program.execute(args, System.getenv());Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
return KeyUtils.fromBase58EncodedX25519PrivateKey(Files.readString(keyPath).strip());Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
return KeyUtils.fromBase58EncodedX25519PrivateKey(Files.readString(privKeyFilePath).strip());Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
super(new FileInputStream(f));Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
final BufferedInputStream inputSnooper = new BufferedInputStream(new FileInputStream(fileName));Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
? new ZstdInputStream(new FileInputStream(outputFile))Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
: new FileInputStream(outputFile)) {Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
FileInputStream fstream = new FileInputStream(fileName);Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
var progressFileContents = Files.readString(Path.of(visitorParameters.getResumeFileName()));Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
first-party (java): abi-check-plugin
java first-partyexpand_more 4 low-confidence finding(s)
try (FileReader reader = new FileReader(file, StandardCharsets.UTF_8)) {Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
if (System.getProperty(WRITE_SPEC_PROPERTY) != null) {Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
try (FileReader reader = new FileReader(file, StandardCharsets.UTF_8)) {Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
if (System.getProperty(WRITE_SPEC_PROPERTY) != null) {Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
first-party (java): application
java first-partyexpand_more 2 low-confidence finding(s)
Files.write(path, Utf8.toBytes(content));Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
Files.write(path, Utf8.toBytes(content));Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
first-party (java): bundle-plugin
java first-partyexpand_more 1 low-confidence finding(s)
return analyzeClass(new FileInputStream(classFile), jdkVersionCheck, artifactVersion);Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
first-party (java): cloud/cloud-tenant-cd
java first-partyexpand_more 2 low-confidence finding(s)
String configPath = System.getProperty("vespa.test.config");Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
return TestConfig.fromJson(Files.readAllBytes(Paths.get(path)));Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
first-party (java): cloud/hosted-api
java first-partyexpand_more 6 low-confidence finding(s)
var privateKey = unchecked(() -> KeyUtils.fromPemEncodedPrivateKey(Files.readString(privateKeyFile, UTF_8)));Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
var certificates = unchecked(() -> X509CertificateUtils.certificateListFromPem(Files.readString(certificateFile, UTF_8)));Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
this(endpoint, unchecked(() -> Files.readString(privateKeyFile, UTF_8)), id);Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
return Files.newInputStream(path);Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
return System.getProperty("user.name");Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
return Optional.ofNullable(System.getProperty(name)).filter(value -> ! value.isBlank());Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
first-party (java): cloud/tenant-cd-commons
java first-partyexpand_more 2 low-confidence finding(s)
X509Certificate certificate = X509CertificateUtils.fromPem(new String(Files.readAllBytes(certificateFile), StandardCharsets.UTF_8));Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
PrivateKey privateKey = KeyUtils.fromPemEncodedPrivateKey(new String(Files.readAllBytes(privateKeyFile), StandardCharsets.UTF_8));Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
first-party (java): cloud/vespa-maven-plugin
java first-partyexpand_more 6 low-confidence finding(s)
Path cliApiKeyFile = Optional.ofNullable(System.getenv("VESPA_CLI_HOME"))Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
.orElseGet(() -> Paths.get(System.getProperty("user.home"), ".vespa"))Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
String xml = Files.readString(deploymentXml);Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
Files.write(output, effectiveServices(services, zone, CloudName.from(cloud), ApplicationName.from(application), InstanceName.from(instance), tagz).getBytes(StandardCharsets.UTF_8));Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
Files.write(descriptorFile, descriptor.toJson().getBytes(UTF_8));Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
try (InputStream in = Files.newInputStream(classFile)) {Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
first-party (java): config
java first-partyexpand_more 8 low-confidence finding(s)
String configSources = System.getenv("VESPA_CONFIG_SOURCES");Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
String[] def = {"tcp/localhost:" + System.getProperty("vespa.config.port", "19090")};Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
String[] sourceSet = checkSourcesSyntax(System.getProperty("configsources"));Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
return Files.readAllLines(file.toPath());Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
BufferedReader br = new BufferedReader(new InputStreamReader(new FileInputStream(configsList), StandardCharsets.UTF_8));Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
reader = new BufferedReader(new FileReader(verificationFile, java.nio.charset.StandardCharsets.UTF_8));Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
return getCompressionType(System.getenv(VESPA_CONFIG_PROTOCOL_COMPRESSION),Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
System.getProperty(VESPA_CONFIG_PROTOCOL_COMPRESSION));Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
first-party (java): config-application-package
java first-partyexpand_more 4 low-confidence finding(s)
FileInputStream is = new FileInputStream(path);Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
return new FileInputStream(file);Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
uncheck(() -> Files.write(file.toPath(), data));Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
private static final String schemaDirBase = System.getProperty("java.io.tmpdir", File.separator + "tmp" + File.separator + "vespa");Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
first-party (java): config-model
java first-partyexpand_more 4 low-confidence finding(s)
String checkIpProperty = System.getProperty("config_model.ip_check", "true");Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
return System.getProperty("vespa.local", "false").equals("true") // set by Application when running locallyReads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
Class<? extends Dispatcher> dispatcherClass = System.getProperty("vespa.local", "false").equals("true")Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
Optional<String> statusFile = Optional.ofNullable(System.getenv(HOSTED_VESPA_STATUS_FILE_SETTING));Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
first-party (java): config-proxy
java first-partyexpand_more 4 low-confidence finding(s)
String[] inputConfigSources = System.getProperty("proxyconfigsources",
DEFAULT_PROXY_CONFIG_SOURCES).split(",");Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
String env = System.getenv("VESPA_KEEP_FILE_REFERENCES_DAYS");Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
String env = System.getenv("VESPA_KEEP_FILE_REFERENCES_COUNT");Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
String env = System.getenv("VESPA_CONFIGSERVERS");Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
first-party (java): configgen
java first-partyexpand_more 8 low-confidence finding(s)
DefParser parser = new DefParser(name, new FileReader(specFile, StandardCharsets.UTF_8));Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
this(System.getProperty("config.dest"),Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
System.getProperty("config.spec"),Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
System.getProperty("config.lang"),Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
System.getProperty("config.subdir"),Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
System.getProperty("config.dumpTree"),Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
System.getProperty("config.useFramework"),Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
System.getProperty("config.packagePrefix"));Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
first-party (java): configserver
java first-partyexpand_more 4 low-confidence finding(s)
throw new IllegalStateException("Unable to write vespa model to config server(s) " + System.getProperty("configsources") + "\n" +Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
try (FileChannel sourceChannel = new FileInputStream(source).getChannel();Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
private static final Path tempFilereferencedataDir = Paths.get(System.getProperty("java.io.tmpdir"));Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
Boolean.parseBoolean(Optional.ofNullable(System.getenv("VESPA_SKIP_UPGRADE_CHECK")).orElse("false")));Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
first-party (java): container-disc
java first-partyexpand_more 17 low-confidence finding(s)
this.access = new VespaDocumentAccess(documentmanagerConfig, System.getProperty("config.id"), messagebusConfig);Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
String preserve = System.getProperty("jdisc.container.preserveStackTrace");Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
var in_gz = Files.newInputStream(log);Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
return Files.newInputStream(log);Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
input = new FileInputStream(file);Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
this.configId = System.getProperty("config.id");Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
var value = System.getenv(envName);Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
private static final Duration TIMEOUT = Duration.ofSeconds(Integer.parseInt(System.getProperty("ThreadedRequestHandler.timeout", "300")));Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
byte[] data = Files.readAllBytes(p);Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
"version", System.getProperty("java.runtime.version"),Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
"home", System.getProperty("java.home"),Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
"vendor", System.getProperty("java.vm.vendor"),Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
"arch", System.getProperty("os.arch")));Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
String hostname = Files.readString(hostnameFile).trim();Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
FileInputStream in = new FileInputStream(oldFile.toFile())) {Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
FileInputStream inputStream = new FileInputStream(oldFile.toFile())) {Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
return Files.readString(Paths.get(filename), StandardCharsets.UTF_8);Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
first-party (java): container-llama
java first-partyexpand_more 1 low-confidence finding(s)
if (SKIP_VALUE.equals(System.getProperty(skipAll))) {Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
first-party (java): container-messagebus
java first-partyexpand_more 1 low-confidence finding(s)
this(net, mbusConfig, System.getProperty("config.id")); //:Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
first-party (java): container-onnxruntime
java first-partyexpand_more 3 low-confidence finding(s)
if (SKIP_VALUE.equals(System.getProperty(skipAll))) {Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
if (SKIP_VALUE.equals(System.getProperty(skipProp))) {Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
if (SKIP_VALUE.equals(System.getProperty(skipProp))) {Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
first-party (java): container-search
java first-partyexpand_more 3 low-confidence finding(s)
return new String(Files.readAllBytes(path), StandardCharsets.UTF_8);Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
fw.write(System.getProperty("line.separator"));Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
List<String> lines = Files.readAllLines(f.toPath());Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
first-party (java): defaults
java first-partyexpand_more 4 low-confidence finding(s)
Optional<String> vespaHomeEnv = Optional.ofNullable(System.getenv("VESPA_HOME"));Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
Optional<String> vespaHostEnv = Optional.ofNullable(System.getenv("VESPA_HOSTNAME"));Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
Optional<String> vespaUserEnv = Optional.ofNullable(System.getenv("VESPA_USER"));Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
Optional<String> port = Optional.ofNullable(System.getenv(varName));Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
first-party (java): document
java first-partyexpand_more 2 low-confidence finding(s)
private static final boolean replaceInvalidUnicode = System.getProperty("vespa.replace_invalid_unicode", "false").equals("true");Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
this(new FileInputStream(fileName), docTypeManager);Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
first-party (java): documentapi
java first-partyexpand_more 1 low-confidence finding(s)
if (System.getProperty("vespa.local", "false").equals("true")) { // set by Application when running locallyReads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
first-party (java): filedistribution
java first-partyexpand_more 11 low-confidence finding(s)
private static final boolean forceDownload = Boolean.parseBoolean(System.getenv("VESPA_FORCE_DOWNLOAD_OF_FILE_REFERENCES"));Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
var backOff = System.getenv("VESPA_FILE_DOWNLOAD_BACKOFF_INITIAL_TIME_MS");Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
Files.write(file.toPath(), part, WRITE, file.exists() ? APPEND : CREATE);Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
try (FileInputStream inputStream = new FileInputStream(file)) {Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
case gzip -> new GZIPInputStream(new FileInputStream(inputFile));Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
case lz4 -> new LZ4BlockInputStream(new FileInputStream(inputFile));Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
case none -> new FileInputStream(inputFile);Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
case zstd -> new ZstdInputStream(new FileInputStream(inputFile));Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
case file -> new FileInputStream(inputFile);Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
Optional.ofNullable(System.getenv("VESPA_FILE_DOWNLOAD_MAX_TIMEOUTS_BEFORE_CLOSE"))Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
var timeoutString = Optional.ofNullable(System.getenv("VESPA_FILE_DOWNLOAD_RPC_TIMEOUT"));Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
first-party (java): flags
java first-partyexpand_more 2 low-confidence finding(s)
return Optional.of(Files.readAllBytes(path));Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
uncheck(() -> Files.write(path, bytes));Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
first-party (java): fsa
java first-partyexpand_more 3 low-confidence finding(s)
return new FileInputStream(filename);Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
try (FileInputStream file = new FileInputStream(filename)) {Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
file = new FileInputStream(domain + ".dat");Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
first-party (java): indexinglanguage
java first-partyexpand_more 1 low-confidence finding(s)
Boolean.parseBoolean(System.getenv("VESPA_DISABLE_LINGUISTICS_BINARY_CHECK"));Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
first-party (java): integration/logstash-plugins/logstash-output-vespa
java first-partyexpand_more 8 low-confidence finding(s)
Files.write(Path.of(outputPath), pem.getBytes(StandardCharsets.UTF_8));Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
String userHome = System.getProperty("user.home");Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
resolutionStream = Files.newInputStream(Paths.get(config.getTypeConflictResolutionFile()));Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
String schema = Files.readString(schemaPath, StandardCharsets.UTF_8);Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
Files.write(filePath, servicesXml.getBytes(StandardCharsets.UTF_8));Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
Files.write(filePath, schema.getBytes(StandardCharsets.UTF_8));Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
PluginConfigSpec.stringSetting("application_package_dir", System.getProperty("java.io.tmpdir") + File.separator + "vespa_app");Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
mappingStream = Files.newInputStream(Paths.get(config.getTypeMappingsFile()));Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
first-party (java): integration/schema-language-server/language-server
java first-partyexpand_more 4 low-confidence finding(s)
Files.write(destination, content.getBytes(StandardCharsets.UTF_8), StandardOpenOption.CREATE);Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
Files.write(writePath, markdown.getBytes(StandardCharsets.UTF_8), StandardOpenOption.CREATE);Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
boolean isWindows = System.getProperty("os.name").toLowerCase(Locale.ROOT).startsWith("windows");Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
String markdown = Files.readString(markdownPath);Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
first-party (java): integration/schema-language-server/lemminx-vespa
java first-partyexpand_more 2 low-confidence finding(s)
Files.write(writePath, content.getBytes(StandardCharsets.UTF_8), StandardOpenOption.CREATE);Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
String content = Files.readString(readPath);Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
first-party (java): jdisc_core
java first-partyexpand_more 15 low-confidence finding(s)
String val = System.getProperty(SYSTEM_PROPERTY_NAME_DEBUG);Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
in = new FileInputStream(fileName);Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
static final String BUNDLE_PATH = System.getProperty("jdisc.bundle.path", ".") + "/";Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
ret.append(System.getProperty(str.substring(from + 2, to), ""));Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
System.getProperty("jdisc.logger.tag"),Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
System.getProperty("jdisc.logger.level"));Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
try (JarInputStream jar = new JarInputStream(new FileInputStream(jarFile))) {Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
String cachePath = System.getProperty("jdisc.cache.path");Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
.setLoggerEnabled(Boolean.valueOf(System.getProperty("jdisc.logger.enabled", "true")));Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
for (String str : ContainerBuilder.safeStringSplit(System.getProperty("jdisc.export.packages"), ",")) {Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
String configFile = System.getProperty("jdisc.config.file");Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
var additionalLocations = System.getProperty("bundle.additionalLocations");Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
var mainBundleName = System.getProperty("main.bundle");Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
var mainClassName = System.getProperty("main.class");Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
var denylistProperty = System.getProperty("bundle.denylist");Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
first-party (java): linguistics
java first-partyexpand_more 2 low-confidence finding(s)
new ZstdInputStream(new FileInputStream(path.toFile())) :Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
new FileInputStream(path.toFile());Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
first-party (java): linguistics-components
java first-partyexpand_more 2 low-confidence finding(s)
var handle = TokenizersLibrary.LIB.createTokenizerFromString(uncheck(() -> Files.readString(path)));Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
try (BufferedReader reader = new BufferedReader(new InputStreamReader(new FileInputStream(path.toFile()),Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
first-party (java): logserver
java first-partyexpand_more 5 low-confidence finding(s)
int rpcPort = Integer.parseInt(System.getProperty(APPNAME + ".rpcListenPort", Integer.toString(DEFAULT_RPC_LISTEN_PORT)));Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
String queueSizeStr = System.getProperty("logserver.queue.size");Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
FileInputStream inputStream = new FileInputStream(oldFile))Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
FileInputStream in = new FileInputStream(oldFile))Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
return System.getProperty(prefix + key, defaultValue);Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
first-party (java): metrics-proxy
java first-partyexpand_more 2 low-confidence finding(s)
s = Files.readString(Path.of("/proc/" + pid + "/statm"));Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
return System.getProperty("os.name");Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
first-party (java): model-evaluation
java first-partyexpand_more 1 low-confidence finding(s)
? Utf8.toString(IOUtils.readBytes(new LZ4FrameInputStream(new FileInputStream(file)), 65536))Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
first-party (java): model-integration
java first-partyexpand_more 8 low-confidence finding(s)
String promptTemplate = new String(Files.readAllBytes(path), StandardCharsets.UTF_8);Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
try (var bis = new BufferedInputStream(Files.newInputStream(model))) {Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
var in = Files.newInputStream(Paths.get(path.get()))) {Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
try (FileInputStream inputStream = new FileInputStream(modelPath)) {Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
try (FileInputStream inputStream = new FileInputStream(modelPath)) {Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
try (FileInputStream fileStream = new FileInputStream(filePath);Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
try (FileInputStream fileStream = new FileInputStream(filePath);Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
configStr = Files.readString(configPath);Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
first-party (java): predicate-search
java first-partyexpand_more 3 low-confidence finding(s)
try (DataInputStream in = new DataInputStream(new BufferedInputStream(new FileInputStream(args.indexFile)))) {Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
return Files.lines(Paths.get(queryFile))Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
try (DataInputStream in = new DataInputStream(new BufferedInputStream(new FileInputStream(args.indexFile)))) {Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
first-party (java): searchlib
java first-partyexpand_more 1 low-confidence finding(s)
return parseXmlStream(new FileInputStream(fileName));Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
first-party (java): security-utils
java first-partyexpand_more 16 low-confidence finding(s)
KeyUtils.fromPemEncodedPrivateKey(Files.readString(privateKey)),Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
X509CertificateUtils.certificateListFromPem(Files.readString(certificateChain)))Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
try (InputStream in = new BufferedInputStream(Files.newInputStream(this.inputFile))) {Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
X509CertificateUtils.certificateListFromPem(new String(Files.readAllBytes(pemEncodedCaCertificates), StandardCharsets.UTF_8));Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
PrivateKey privateKey = KeyUtils.fromPemEncodedPrivateKey(new String(Files.readAllBytes(privateKeyPemFile), StandardCharsets.UTF_8));Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
List<X509Certificate> certificates = X509CertificateUtils.certificateListFromPem(new String(Files.readAllBytes(certificatesPemFile), StandardCharsets.UTF_8));Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
.withCertificateEntries("cert", X509CertificateUtils.certificateListFromPem(new String(Files.readAllBytes(caCertificateFile), StandardCharsets.UTF_8)))Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
KeyUtils.fromPemEncodedPrivateKey(new String(Files.readAllBytes(privateKeyFile), StandardCharsets.UTF_8)),Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
X509CertificateUtils.certificateListFromPem(new String(Files.readAllBytes(certificatesFile), StandardCharsets.UTF_8)))Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
try (InputStream in = Files.newInputStream(file)) {Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
return isTransportSecurityEnabled(System.getenv());Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
return getInsecureMixedMode(System.getenv());Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
return getInsecureAuthorizationMode(System.getenv());Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
return getEnvironmentVariable(System.getenv(), CAPABILITIES_ENV_VAR)Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
return getConfigFile(System.getenv());Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
return getOptions(System.getenv());Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
first-party (java): standalone-container
java first-partyexpand_more 20 low-confidence finding(s)
Files.write(servicesXmlFile, Utf8.toBytes(content));Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
return Optional.ofNullable(System.getenv("VESPA_CONFIGSERVER_RPC_PORT"))Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
return Optional.ofNullable(System.getenv("VESPA_CONFIGSERVER_MULTITENANT"))Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
return Optional.ofNullable(System.getenv("VESPA_CONFIGSERVERS"))Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
return Optional.ofNullable(System.getenv("VESPA_CONFIGSERVER_ZOOKEEPER_IDS"))Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
return Optional.ofNullable(System.getenv("VESPA_CONFIGSERVER_ZOOKEEPER_BARRIER_TIMEOUT"))Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
return Optional.ofNullable(System.getenv("VESPA_CONFIGSERVER_APPLICATION_LOCK_TIMEOUT_SECONDS"))Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
return Optional.ofNullable(System.getenv("VESPA_CONFIGSERVER_ZOOKEEPER_JUTE_MAX_BUFFER"))Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
return Optional.ofNullable(System.getenv("VESPA_ENVIRONMENT"));Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
return Optional.ofNullable(System.getenv("VESPA_REGION"));Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
return Optional.ofNullable(System.getenv("VESPA_SYSTEM"));Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
return Optional.ofNullable(System.getenv("VESPA_CLOUD"));Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
return Optional.ofNullable(System.getenv("VESPA_CONFIGSERVER_USE_VERSION_IN_CONFIG_REQUEST"))Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
return Optional.ofNullable(System.getenv("VESPA_CONFIGSERVER_HOSTED"))Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
String vespaZookeeperSnapshotMethod = System.getenv("VESPA_ZOOKEEPER_SNAPSHOT_METHOD");Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
Optional.ofNullable(System.getenv(name.replace(".", "__")))Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
.orElseGet(() -> System.getProperty(name)));Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
basePath = Paths.get(System.getProperty("java.io.tmpdir"));Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
Optional<String> fromEnv = Optional.ofNullable(System.getenv((name.replace(".", "__"))));Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
return Optional.ofNullable(System.getProperty(name)); // for unit testingReads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
first-party (java): vespa-application-maven-plugin
java first-partyexpand_more 2 low-confidence finding(s)
try (FileInputStream sourceStream = new FileInputStream(source);Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
try (FileInputStream fileInput = new FileInputStream(child)) {Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
first-party (java): vespa-enforcer-extensions
java first-partyexpand_more 2 low-confidence finding(s)
var guessProperty = Optional.ofNullable(System.getProperty(GUESS_VERSION))Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
try (Stream<String> s = Files.lines(specFile)) {Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
first-party (java): vespa-feed-client-api
java first-partyexpand_more 1 low-confidence finding(s)
String preferredImplementation = System.getProperty(PREFERRED_IMPLEMENTATION_PROPERTY, defaultImplementation);Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
first-party (java): vespa-feed-client-cli
java first-partyexpand_more 3 low-confidence finding(s)
try (InputStream in = new BufferedInputStream(Files.newInputStream(logConfigFile))) {Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
: cliArgs.inputFile().isPresent() ? Files.newInputStream(cliArgs.inputFile().get())Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
if (System.getenv("VESPA_EXTENDED_STATS") != null) {Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
first-party (java): vespaclient-container-plugin
java first-partyexpand_more 1 low-confidence finding(s)
var windowSize = System.getenv(WINDOW_SIZE_ENV);Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
first-party (java): vespajlib
java first-partyexpand_more 15 low-confidence finding(s)
String hzEnv = System.getenv("VESPA_TIMER_HZ");Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
return new BufferedReader(new InputStreamReader(new FileInputStream(filename), encoding));Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
return new BufferedReader(new InputStreamReader(new FileInputStream(filename), encoding));Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
return new BufferedReader(new FileReader(filename, utf8Charset));Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
try (FileChannel sourceChannel = new FileInputStream(inFile).getChannel();Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
in = new FileInputStream(sourceLocation);Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
return Files.readString(file.toPath(), utf8Charset);Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
try (InputStream in = new FileInputStream(file)) {Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
disabled = System.getenv().containsKey(DISABLE_NATIVE_IO);Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
dropFileFromCache(new FileInputStream(file).getFD());Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
Optional<String> vespaHostEnv = Optional.ofNullable(System.getenv("VESPA_HOSTNAME"));Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
return new FileReader(file, UTF_8);Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
return new FileReader(file, UTF_8);Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
byte[] tmpBytes = Files.readAllBytes(tmpPath);Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
byte[] oldBytes = Files.readAllBytes(outPath);Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
first-party (java): vespalog
java first-partyexpand_more 12 low-confidence finding(s)
String logLevel = System.getProperty("vespa.log.level");Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
String logTarget = System.getProperty("vespa.log.target");Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
String logService = System.getProperty("vespa.service.name");Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
String logControlDir = System.getProperty("vespa.log.control.dir");Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
String logControlFile = System.getProperty("vespa.log.control.file");Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
if (logTarget == null) logTarget = System.getenv("VESPA_LOG_TARGET");Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
if (logService == null) logService = System.getenv("VESPA_SERVICE_NAME");Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
if (logControlDir == null) logControlDir = System.getenv("VESPA_LOG_CONTROL_DIR");Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
if (logControlFile == null) logControlFile = System.getenv("VESPA_LOG_CONTROL_FILE");Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
if (logLevel == null) logLevel = System.getenv("VESPA_LOG_LEVEL");Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
if (logService == null) logService = System.getProperty("config.id");Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
String zookeeperLogFile = System.getProperty("zookeeper_log_file_prefix");Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
first-party (java): zookeeper-server/zookeeper-server-common
java first-partyexpand_more 2 low-confidence finding(s)
return Files.exists(configFilePath) ? Files.readAllLines(configFilePath).stream()Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
Exceptions.uncheck(() -> Files.readString(path)));Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
</> Dependencies
com.thaiopensource:jing
java dependencyexpand_more 2 low-confidence finding(s)
protected String eol = System.getProperty("line.separator", "\n");Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
this.lineSeparator = System.getProperty("line.separator");Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
org.apache.zookeeper:zookeeper
java dependencyexpand_more 167 low-confidence finding(s)
put(l, "java.version", System.getProperty("java.version", "<NA>"));Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
put(l, "java.vendor", System.getProperty("java.vendor", "<NA>"));Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
put(l, "java.home", System.getProperty("java.home", "<NA>"));Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
put(l, "java.class.path", System.getProperty("java.class.path", "<NA>"));Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
put(l, "java.library.path", System.getProperty("java.library.path", "<NA>"));Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
put(l, "java.io.tmpdir", System.getProperty("java.io.tmpdir", "<NA>"));Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
put(l, "java.compiler", System.getProperty("java.compiler", "<NA>"));Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
put(l, "os.name", System.getProperty("os.name", "<NA>"));Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
put(l, "os.arch", System.getProperty("os.arch", "<NA>"));Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
put(l, "os.version", System.getProperty("os.version", "<NA>"));Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
put(l, "user.name", System.getProperty("user.name", "<NA>"));Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
put(l, "user.home", System.getProperty("user.home", "<NA>"));Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
put(l, "user.dir", System.getProperty("user.dir", "<NA>"));Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
public static final String SYSTEM_USER = System.getProperty("user.name", "<NA>");Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
+ System.getProperty("java.security.login.auth.config")Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
+ System.getProperty(ZooKeeperSaslServer.LOGIN_CONTEXT_NAME_KEY, ZooKeeperSaslServer.DEFAULT_LOGIN_CONTEXT_NAME)Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
public static final boolean WINDOWS /* borrowed from Path.WINDOWS */ = System.getProperty("os.name").startsWith("Windows");Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
errMsg.append(System.getProperty("line.separator"));Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
String auditLoggerClass = System.getProperty(AUDIT_IMPL_CLASS);Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
try (FileInputStream inConfig = new FileInputStream(cl.getOptionValue("file"))) {Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
setProperty(ZOOKEEPER_REQUEST_TIMEOUT, System.getProperty(ZOOKEEPER_REQUEST_TIMEOUT));Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
setProperty(ZOOKEEPER_SERVER_PRINCIPAL, System.getProperty(ZOOKEEPER_SERVER_PRINCIPAL));Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
setProperty(ZK_SASL_CLIENT_USERNAME, System.getProperty(ZK_SASL_CLIENT_USERNAME));Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
setProperty(ZK_SASL_CLIENT_CANONICALIZE_HOSTNAME, System.getProperty(ZK_SASL_CLIENT_CANONICALIZE_HOSTNAME));Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
setProperty(LOGIN_CONTEXT_NAME_KEY, System.getProperty(LOGIN_CONTEXT_NAME_KEY));Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
setProperty(ENABLE_CLIENT_SASL_KEY, System.getProperty(ENABLE_CLIENT_SASL_KEY));Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
setProperty(ZOOKEEPER_SERVER_REALM, System.getProperty(ZOOKEEPER_SERVER_REALM));Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
setProperty(DISABLE_AUTO_WATCH_RESET, System.getProperty(DISABLE_AUTO_WATCH_RESET));Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
setProperty(ZOOKEEPER_CLIENT_CNXN_SOCKET, System.getProperty(ZOOKEEPER_CLIENT_CNXN_SOCKET));Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
setProperty(SECURE_CLIENT, System.getProperty(SECURE_CLIENT));Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
return Boolean.parseBoolean(System.getProperty(ZKClientConfig.ENABLE_CLIENT_SASL_KEY, ZKClientConfig.ENABLE_CLIENT_SASL_DEFAULT));Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
Files.readAllBytes(Paths.get(pathToFile)), StandardCharsets.UTF_8);Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
try (InputStream inputStream = new FileInputStream(new File(keyStorePath))) {Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
try (InputStream inputStream = new FileInputStream(new File(trustStorePath))) {Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
if (System.getProperty(REJECT_CLIENT_RENEGOTIATION_PROPERTY) == null) {Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
return getDefaultCipherSuitesForJavaVersion(System.getProperty("java.specification.version"));Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
properties.put(JUTE_MAXBUFFER, System.getProperty(JUTE_MAXBUFFER));Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
properties.put(KINIT_COMMAND, System.getProperty(KINIT_COMMAND));Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
properties.put(JGSS_NATIVE, System.getProperty(JGSS_NATIVE));Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
properties.put(clientX509Util.getSslAuthProviderProperty(), System.getProperty(clientX509Util.getSslAuthProviderProperty()));Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
properties.put(clientX509Util.getSslProviderProperty(), System.getProperty(clientX509Util.getSslProviderProperty()));Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
properties.put(x509Util.getSslProtocolProperty(), System.getProperty(x509Util.getSslProtocolProperty()));Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
properties.put(x509Util.getSslEnabledProtocolsProperty(), System.getProperty(x509Util.getSslEnabledProtocolsProperty()));Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
properties.put(x509Util.getSslCipherSuitesProperty(), System.getProperty(x509Util.getSslCipherSuitesProperty()));Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
properties.put(x509Util.getSslKeystoreLocationProperty(), System.getProperty(x509Util.getSslKeystoreLocationProperty()));Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
properties.put(x509Util.getSslKeystorePasswdProperty(), System.getProperty(x509Util.getSslKeystorePasswdProperty()));Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
properties.put(x509Util.getSslKeystorePasswdPathProperty(), System.getProperty(x509Util.getSslKeystorePasswdPathProperty()));Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
properties.put(x509Util.getSslKeystoreTypeProperty(), System.getProperty(x509Util.getSslKeystoreTypeProperty()));Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
properties.put(x509Util.getSslTruststoreLocationProperty(), System.getProperty(x509Util.getSslTruststoreLocationProperty()));Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
properties.put(x509Util.getSslTruststorePasswdProperty(), System.getProperty(x509Util.getSslTruststorePasswdProperty()));Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
properties.put(x509Util.getSslTruststorePasswdPathProperty(), System.getProperty(x509Util.getSslTruststorePasswdPathProperty()));Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
properties.put(x509Util.getSslTruststoreTypeProperty(), System.getProperty(x509Util.getSslTruststoreTypeProperty()));Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
properties.put(x509Util.getSslContextSupplierClassProperty(), System.getProperty(x509Util.getSslContextSupplierClassProperty()));Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
properties.put(x509Util.getSslClientHostnameVerificationEnabledProperty(), System.getProperty(x509Util.getSslClientHostnameVerificationEnabledProperty()));Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
properties.put(x509Util.getSslHostnameVerificationEnabledProperty(), System.getProperty(x509Util.getSslHostnameVerificationEnabledProperty()));Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
properties.put(x509Util.getSslAllowReverseDnsLookupProperty(), System.getProperty(x509Util.getSslAllowReverseDnsLookupProperty()));Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
properties.put(x509Util.getSslCrlEnabledProperty(), System.getProperty(x509Util.getSslCrlEnabledProperty()));Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
properties.put(x509Util.getSslOcspEnabledProperty(), System.getProperty(x509Util.getSslOcspEnabledProperty()));Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
properties.put(x509Util.getSslClientAuthProperty(), System.getProperty(x509Util.getSslClientAuthProperty()));Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
properties.put(x509Util.getSslHandshakeDetectionTimeoutMillisProperty(), System.getProperty(x509Util.getSslHandshakeDetectionTimeoutMillisProperty()));Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
properties.put(x509Util.getFipsModeProperty(), System.getProperty(x509Util.getFipsModeProperty()));Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
return System.getProperty(Environment.JAAS_CONF_KEY);Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
FileInputStream in = new FileInputStream(configFile);Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
String mbean = System.getProperty("zookeeper.jmx.log4j.mbean", "log4j:hierarchy=default");Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
if (Boolean.parseBoolean(System.getProperty(SESSION_REQUIRE_CLIENT_SASL_AUTH, "false"))) {Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
Boolean.parseBoolean(System.getProperty(ENFORCE_AUTH_ENABLED, "false"));Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
String enforceAuthSchemesProp = System.getProperty(ENFORCE_AUTH_SCHEMES);Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
String val = System.getProperty(name);Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
String authProviderProp = System.getProperty(x509Util.getSslAuthProviderProperty(), "x509");Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
String authProviderProp = System.getProperty(x509Util.getSslAuthProviderProperty());Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
System.getProperty(x509Util.getSslAuthProviderProperty(), "x509"));Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
private static volatile boolean staleConnectionCheck = Boolean.parseBoolean(System.getProperty("zookeeper.request_stale_connection_check", "true"));Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
private static volatile boolean staleLatencyCheck = Boolean.parseBoolean(System.getProperty("zookeeper.request_stale_latency_check", "false"));Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
private static volatile boolean dropStaleRequests = Boolean.parseBoolean(System.getProperty("zookeeper.request_throttle_drop_stale", "true"));Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
String serverCnxnFactoryName = System.getProperty(ZOOKEEPER_SERVER_CNXN_FACTORY);Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
String serverSection = System.getProperty(ZooKeeperSaslServer.LOGIN_CONTEXT_NAME_KEY, ZooKeeperSaslServer.DEFAULT_LOGIN_CONTEXT_NAME);Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
String jaasFile = System.getProperty(Environment.JAAS_CONF_KEY);Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
String loginContextName = System.getProperty(ZooKeeperSaslServer.LOGIN_CONTEXT_NAME_KEY);Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
String newLine = System.getProperty("line.separator");Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
FileChannel fc = new FileInputStream(args[0]).getChannel();Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
System.getProperty(SNAPSHOT_SIZE_FACTOR,
Double.toString(DEFAULT_SNAPSHOT_SIZE_FACTOR)));Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
System.getProperty(COMMIT_LOG_COUNT,
Integer.toString(DEFAULT_COMMIT_LOG_COUNT)));Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
skipACL = System.getProperty(SKIP_ACL, "no").equals("yes");Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
enforceQuota = Boolean.parseBoolean(System.getProperty(ENFORCE_QUOTA, "false"));Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
digestEnabled = Boolean.parseBoolean(System.getProperty(ZOOKEEPER_DIGEST_ENABLED, "true"));Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
System.getProperty(CLOSE_SESSION_TXN_ENABLED, "true"));Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
System.getProperty(ZOOKEEPER_SERIALIZE_LAST_PROCESSED_ZXID_ENABLED, "true")));Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
if (!"false".equals(System.getProperty("zookeeper.admin.enableServer"))) {Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
private static final long rateLimiterInterval = Integer.parseInt(System.getProperty(ADMIN_RATE_LIMITER_INTERVAL, "300000"));Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
final boolean restoreEnabled = Boolean.parseBoolean(System.getProperty(ADMIN_RESTORE_ENABLED, "true"));Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
final boolean snapshotEnabled = Boolean.parseBoolean(System.getProperty(ADMIN_SNAPSHOT_ENABLED, "true"));Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
response.setInputStream(new FileInputStream(snapshotFile));Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
System.getProperty("zookeeper.admin.serverAddress", DEFAULT_ADDRESS),Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
System.getProperty("zookeeper.admin.commandURL", DEFAULT_COMMAND_URL),Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
String privateKeyType = System.getProperty(x509Util.getSslKeystoreTypeProperty(), "");Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
String privateKeyPath = System.getProperty(x509Util.getSslKeystoreLocationProperty(), "");Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
String certAuthType = System.getProperty(x509Util.getSslTruststoreTypeProperty(), "");Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
String certAuthPath = System.getProperty(x509Util.getSslTruststoreLocationProperty(), "");Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
String value = System.getProperty(propertyName, "");Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
final String pathValue = System.getProperty(pathPropertyName, "");Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
private static final String DIGEST_ALGORITHM = System.getProperty(DIGEST_ALGORITHM_KEY, DEFAULT_DIGEST_ALGORITHM);Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
private static final String superDigest = System.getProperty("zookeeper.DigestAuthenticationProvider.superDigest");Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
boolean enabled = Boolean.parseBoolean(System.getProperty(DIGEST_AUTH_ENABLED, "true"));Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
String namesCSV = System.getProperty(ENSEMBLE_PROPERTY);Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
if ((System.getProperty("zookeeper.requireKerberosConfig") != null)Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
&& (System.getProperty("zookeeper.requireKerberosConfig").equals("true"))) {Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
String ruleString = System.getProperty("zookeeper.security.auth_to_local", "DEFAULT");Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
String className = System.getProperty(authKey);Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
String readAccessUser = System.getProperty("zookeeper.letAnySaslUserDoX");Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
if ("super".equals(this.userName) && System.getProperty(SYSPROP_SUPER_PASSWORD) != null) {Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
pc.setPassword(System.getProperty(SYSPROP_SUPER_PASSWORD).toCharArray());Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
return "true".equals(System.getProperty(propertyName));Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
if (System.getProperty(ZOOKEEPER_X509AUTHENTICATIONPROVIDER_SUPERUSER) != null) {Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
return id.equals(System.getProperty(ZOOKEEPER_X509AUTHENTICATIONPROVIDER_SUPERUSER))Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
if (clientId.equals(System.getProperty(ZOOKEEPER_X509AUTHENTICATIONPROVIDER_SUPERUSER))) {Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
String commands = System.getProperty(ZOOKEEPER_4LW_COMMANDS_WHITELIST);Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
if (System.getProperty("readonlymode.enabled", "false").equals("true")) {Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
setControllerAddress(System.getProperty(key));Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
setClientAddress(System.getProperty(key));Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
String size = System.getProperty("zookeeper.preAllocSize");Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
private final boolean forceSync = !System.getProperty("zookeeper.forceSync", "yes").equals("no");Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
is = new BufferedInputStream(new FileInputStream(file));Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
inputStream = new PositionInputStream(new BufferedInputStream(new FileInputStream(logFile)));Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
System.getProperty(ZOOKEEPER_DATADIR_AUTOCREATE, ZOOKEEPER_DATADIR_AUTOCREATE_DEFAULT));Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
System.getProperty(ZOOKEEPER_DB_AUTOCREATE, ZOOKEEPER_DB_AUTOCREATE_DEFAULT));Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
System.getProperty(ZOOKEEPER_SHAPSHOT_STREAM_MODE,
StreamMode.DEFAULT_MODE.getName()));Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
FileInputStream fis = new FileInputStream(file);Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
try (FileInputStream fis = new FileInputStream(f)) {Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
try (FileInputStream fis = new FileInputStream(f)) {Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
try (InputStream is = new BufferedInputStream(new FileInputStream(txnLogFile));Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
txnFis = new FileInputStream(txnLogFile);Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
private static final boolean nodelay = System.getProperty("leader.nodelay", "true").equals("true");Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
String initialZxid = System.getProperty("zookeeper.testingonly.initialZxid");Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
if (!System.getProperty("zookeeper.leaderServes", "yes").equals("no")) {Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
private static final boolean nodelay = System.getProperty("follower.nodelay", "true").equals("true");Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
String cnxToValue = System.getProperty("zookeeper.cnxTimeout");Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
System.getProperty(QuorumPeer.CONFIG_KEY_MULTI_ADDRESS_ENABLED, QuorumPeer.CONFIG_DEFAULT_MULTI_ADDRESS_ENABLED));Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
System.getProperty(
CONFIG_KEY_KERBEROS_CANONICALIZE_HOST_NAMES,
CONFIG_DEFAULT_KERBEROS_CANONICALIZE_HOST_NAMES));Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
if (System.getProperty(SYNC_ENABLED) != null) {Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
BufferedReader br = new BufferedReader(new FileReader(file));Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
System.getProperty(QuorumPeer.CONFIG_KEY_MULTI_ADDRESS_ENABLED, QuorumPeer.CONFIG_DEFAULT_MULTI_ADDRESS_ENABLED));Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
Boolean.parseBoolean(System.getProperty(QuorumPeer.CONFIG_KEY_MULTI_ADDRESS_REACHABILITY_CHECK_ENABLED, "true"));Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
Integer.parseInt(System.getProperty(QuorumPeer.CONFIG_KEY_MULTI_ADDRESS_REACHABILITY_CHECK_TIMEOUT_MS,
String.valueOf(MultipleAddresses.DEFAULT_TIMEOUT.toMillis())));Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
try (FileInputStream in = new FileInputStream(configFile)) {Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
initialConfig = new String(Files.readAllBytes(configFile.toPath()));Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
try (FileInputStream inConfig = new FileInputStream(dynamicConfigFileStr)) {Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
try (FileInputStream inConfigNext = new FileInputStream(nextDynamicConfigFile)) {Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
+ System.getProperty(clientX509Util.getSslAuthProviderProperty(), "x509");Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
if (System.getProperty(sslAuthProp) == null) {Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
+ System.getProperty(clientX509Util.getSslAuthProviderProperty())Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
try (InputStream input = new FileInputStream(new File(configFileStr))) {Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
try (FileInputStream in = new FileInputStream(configFile)) {Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
BufferedReader br = new BufferedReader(new FileReader(myIdFile));Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
FileInputStream in = new FileInputStream(configFile);Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
fr = new FileReader(FilenameUtils.getFullPath(oracle) + FilenameUtils.getName(oracle));Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
String newKeyValue = System.getProperty(newPropertyKey);Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
String oldKeyValue = System.getProperty(oldPropertyKey);Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
try (InputStream is = new BufferedInputStream(new FileInputStream(txnLog)); OutputStream os = new BufferedOutputStream(new FileOutputStream(choppedLog))) {Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
private static final boolean ibmvendor = System.getProperty("java.vendor").contains("IBM");Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
private static final boolean windows = System.getProperty("os.name").startsWith("Windows");Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
private static final boolean linux = System.getProperty("os.name").startsWith("Linux");Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
REQUEST_PREPROCESS_SAMPLE_RATE = Float.parseFloat(System.getProperty(PATH_STATS_SAMPLE_RATE, "0.1"));Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
String watchManagerName = System.getProperty(ZOOKEEPER_WATCH_MANAGER_NAME);Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
String contents = new String(Files.readAllBytes(certificateChainFile.toPath()), US_ASCII);Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
String privateKey = new String(Files.readAllBytes(privateKeyFile.toPath()), US_ASCII);Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
String publicKey = new String(Files.readAllBytes(publicKeyFile.toPath()), US_ASCII);Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
String serverRealm = System.getProperty("zookeeper.server.realm", clientKerberosName.getRealm());Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
org.jsoup:jsoup
java dependencyexpand_more 4 low-confidence finding(s)
UnsetUrl = new URL("http://undefined/");Data is sent to a hardcoded external endpoint; review what leaves the process.
Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
return Boolean.parseBoolean(System.getProperty(SharedConstants.UseRe2j, "true"));Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
boolean useHttpClient = Boolean.parseBoolean(System.getProperty(SharedConstants.UseHttpClient, "true"));Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
String property = System.getProperty(XPathFactoryProperty);Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.
Fix: Usually benign; confirm any secret read here is not later sent externally.
Skipped dependencies
Production
- github.com/klauspost/compress prod — module zip exceeds byte cap
- org.apache.maven.plugin-tools:maven-plugin-annotations prod — no version pinned
- org.ow2.asm:asm prod — no version pinned
- com.fasterxml.jackson.core:jackson-databind prod — no version pinned
- org.junit.jupiter:junit-jupiter-api prod — no sources jar (404)
- org.hamcrest:hamcrest prod — no version pinned
- junit:junit prod — no version pinned
- com.yahoo.vespa:standalone-container prod — no sources jar (404)
- com.yahoo.vespa:config-provisioning prod — no sources jar (404)
- com.yahoo.vespa:config-model prod — no sources jar (404)
- com.yahoo.vespa:config-model-api prod — no sources jar (404)
- com.yahoo.vespa:http-utils prod — no sources jar (404)
- com.yahoo.vespa:model-integration prod — no sources jar (404)
- com.yahoo.vespa:jrt prod — no sources jar (404)
- com.yahoo.vespa:container-dev prod — no sources jar (404)
- com.yahoo.vespa:vespajlib prod — no sources jar (404)
- com.ibm.icu:icu4j prod — no version pinned
- org.antlr:antlr-runtime prod — no version pinned
- org.antlr:antlr4-runtime prod — no version pinned
- org.apache.felix:org.apache.felix.framework prod — no version pinned
- org.apache.felix:org.apache.felix.log prod — no version pinned
- org.apache.opennlp:opennlp-tools prod — no version pinned
- com.huaban:jieba-analysis prod — no version pinned
- org.apache.commons:commons-lang3 prod — no version pinned
- org.hdrhistogram:HdrHistogram prod — no version pinned
- xerces:xercesImpl prod — no version pinned
- org.apache.commons:commons-math3 prod — no version pinned
- jakarta.inject:jakarta.inject-api prod — no version pinned
- io.micrometer:micrometer-core prod — no version pinned
- com.fasterxml.jackson.dataformat:jackson-dataformat-cbor prod — no version pinned
- io.opentelemetry:opentelemetry-api prod — no version pinned
- org.eclipse.jetty:jetty-alpn-java-server prod — no version pinned
- org.eclipse.jetty:jetty-alpn-server prod — no version pinned
- org.eclipse.jetty:jetty-client prod — no version pinned
- org.eclipse.jetty:jetty-http prod — no version pinned
- org.eclipse.jetty.http2:jetty-http2-common prod — no version pinned
- org.eclipse.jetty.http2:jetty-http2-server prod — no version pinned
- org.eclipse.jetty:jetty-io prod — no version pinned
- org.eclipse.jetty:jetty-jmx prod — no version pinned
- org.eclipse.jetty:jetty-server prod — no version pinned
- org.eclipse.jetty:jetty-util prod — no version pinned
- com.yahoo.vespa:container-apache-http-client-bundle prod — no sources jar (404)
- com.microsoft.onnxruntime:onnxruntime prod — no version pinned
- com.google.guava:guava prod — no version pinned
- org.apache.maven:maven-archiver prod — no version pinned
- org.apache.maven.plugins:maven-shade-plugin prod — no sources jar (404)
- org.twdata.maven:mojo-executor prod — no version pinned
- com.yahoo.vespa:annotations prod — no sources jar (404)
- com.fasterxml.jackson.core:jackson-core prod — no version pinned
- com.yahoo.vespa:config prod — no sources jar (404)
- com.yahoo.vespa.bundle-plugin:main prod — no sources jar (404)
- com.yahoo.vespa.bundle-plugin:artifact-version-for-exports prod — no sources jar (404)
- com.yahoo.vespa.bundle-plugin:export-packages-lib prod — no sources jar (404)
- com.yahoo.vespa.bundle-plugin:non-public-api-usage prod — no sources jar (404)
- com.yahoo.vespa.bundle-plugin:artifact-version-for-exports-dep prod — no sources jar (404)
- javax.xml.bind:jaxb-api prod — no version pinned
- com.yahoo.vespa.bundle-plugin:vespa-jar-using-non-public-api prod — no sources jar (404)
- com.yahoo.vespa:tenant-cd-api prod — no version pinned
- com.yahoo.vespa:security-utils prod — no version pinned
- com.yahoo.vespa:hosted-zone-api prod — no sources jar (404)
- org.slf4j:slf4j-api prod — no version pinned
- com.yahoo.vespa:hosted-api prod — no version pinned
- com.yahoo.vespa:tenant-cd-commons prod — no version pinned
- com.yahoo.vespa:jdisc_core prod — no sources jar (404)
- org.apache.commons:commons-compress prod — no sources jar (404)
- org.opentest4j:opentest4j prod — no sources jar (404)
- org.apiguardian:apiguardian-api prod — no version pinned
- org.junit.platform:junit-platform-commons prod — no sources jar (404)
- com.yahoo.vespa:vespa-feed-client-api prod — no version pinned
- com.yahoo.vespa:vespa-feed-client prod — no version pinned
- com.yahoo.vespa:component prod — no version pinned
- com.yahoo.vespa:config-application-package prod — no version pinned
- com.yahoo.vespa:zookeeper-server-common prod — no sources jar (404)
- com.yahoo.vespa:vespalog prod — no sources jar (404)
- com.yahoo.vespa:defaults prod — no sources jar (404)
- com.yahoo.vespa:vdslib prod — no sources jar (404)
- com.yahoo.vespa:zookeeper-client-common prod — no sources jar (404)
- com.yahoo.vespa:config-bundle prod — no sources jar (404)
- com.yahoo.vespa:config-lib prod — no sources jar (404)
- at.yawk.lz4:lz4-java prod — no version pinned
- com.yahoo.vespa:configgen prod — no sources jar (404)
- com.yahoo.vespa:configdefinitions prod — no sources jar (404)
- com.yahoo.vespa:provided-dependencies prod — no sources jar (404)
- com.yahoo.vespa:container-onnxruntime prod — no sources jar (404)
- com.google.protobuf:protobuf-java prod — no sources jar (404)
- com.yahoo.vespa:metrics prod — no sources jar (404)
- com.yahoo.vespa:metrics-proxy prod — no sources jar (404)
- com.yahoo.vespa:container-disc prod — no sources jar (404)
- com.yahoo.vespa:container-documentapi prod — no sources jar (404)
- com.yahoo.vespa:messagebus prod — no sources jar (404)
- com.yahoo.vespa:document prod — no sources jar (404)
- com.yahoo.vespa:linguistics prod — no sources jar (404)
- com.yahoo.vespa:container-messagebus prod — no sources jar (404)
- com.yahoo.vespa:searchlib prod — no sources jar (404)
- com.yahoo.vespa:docproc prod — no sources jar (404)
- com.yahoo.vespa:container-search prod — no sources jar (404)
- com.yahoo.vespa:container-search-and-docproc prod — no sources jar (404)
- com.yahoo.vespa:logd prod — no sources jar (404)
- com.yahoo.vespa:searchcore prod — no sources jar (404)
- com.yahoo.vespa:storage prod — no sources jar (404)
- com.yahoo.vespa:vsm prod — no sources jar (404)
- com.yahoo.vespa:vespaclient-core prod — no sources jar (404)
- com.yahoo.vespa:indexinglanguage prod — no sources jar (404)
- com.yahoo.vespa:fat-model-dependencies prod — no sources jar (404)
- com.yahoo.vespa:searchsummary prod — no sources jar (404)
- org.apache.httpcomponents.client5:httpclient5 prod — no version pinned
- org.apache.httpcomponents.core5:httpcore5 prod — no version pinned
- org.slf4j:slf4j-jdk14 prod — no version pinned
- io.airlift:aircompressor prod — no version pinned
- com.google.inject:guice prod — no version pinned
- org.apache.httpcomponents:httpclient prod — no version pinned
- org.apache.httpcomponents:httpmime prod — no version pinned
- commons-codec:commons-codec prod — no version pinned
- org.apache.httpcomponents.core5:httpcore5-h2 prod — no version pinned
- javax.servlet:javax.servlet-api prod — no version pinned
- net.java.dev.jna:jna prod — no version pinned
- com.yahoo.vespa:filedistribution prod — no sources jar (404)
- com.yahoo.vespa:model-evaluation prod — no sources jar (404)
- com.yahoo.vespa:vespa-3party-bundles prod — no sources jar (404)
- com.yahoo.vespa:opennlp-linguistics prod — no sources jar (404)
- com.yahoo.vespa:predicate-search-core prod — no sources jar (404)
- com.yahoo.vespa:fileacquirer prod — no sources jar (404)
- io.opentelemetry:opentelemetry-sdk prod — no version pinned
- io.opentelemetry:opentelemetry-exporter-otlp prod — no version pinned
- io.modelcontextprotocol.sdk:mcp prod — no sources jar (404)
- com.fasterxml.jackson.datatype:jackson-datatype-jsr310 prod — no version pinned
- com.fasterxml.jackson.datatype:jackson-datatype-jdk8 prod — no version pinned
- com.yahoo.vespa:documentapi prod — no sources jar (404)
- com.yahoo.vespa:documentapi-dependencies prod — no sources jar (404)
- io.github.arnej27959:jllama prod — no version pinned
- io.opentelemetry:opentelemetry-context prod — no version pinned
- io.opentelemetry:opentelemetry-common prod — no version pinned
- io.opentelemetry:opentelemetry-sdk-common prod — no version pinned
- io.opentelemetry:opentelemetry-sdk-trace prod — no version pinned
- io.opentelemetry:opentelemetry-sdk-metrics prod — no version pinned
- io.opentelemetry:opentelemetry-sdk-logs prod — no version pinned
- io.opentelemetry:opentelemetry-exporter-common prod — no version pinned
- io.opentelemetry:opentelemetry-exporter-otlp-common prod — no version pinned
- io.opentelemetry:opentelemetry-exporter-sender-jdk prod — no version pinned
- com.yahoo.vespa:fsa prod — no sources jar (404)
- com.google.re2j:re2j prod — no version pinned
- org.apache.aries.spifly:org.apache.aries.spifly.dynamic.bundle prod — no version pinned
- com.yahoo.vespa:application prod — no sources jar (404)
- org.bouncycastle:bcpkix-jdk18on prod — no version pinned
- com.yahoo.vespa:vespaclient-container-plugin prod — no sources jar (404)
- io.airlift:airline prod — no version pinned
- net.openhft:zero-allocation-hashing prod — no version pinned
- org.json:json prod — no version pinned
- org.apache.logging.log4j:log4j-api prod — no sources jar (404)
- org.apache.logging.log4j:log4j-core prod — no sources jar (404)
- org.yaml:snakeyaml prod — no sources jar (404)
- org.eclipse.lemminx:org.eclipse.lemminx prod — no sources jar (404)
- org.testcontainers:testcontainers prod — no sources jar (404)
- javax.ws.rs:javax.ws.rs-api prod — no version pinned
- com.sun.xml.bind:jaxb-core prod — no version pinned
- com.sun.xml.bind:jaxb-impl prod — no version pinned
- com.sun.activation:javax.activation prod — no version pinned
- aopalliance:aopalliance prod — no version pinned
- org.apache.felix:org.apache.felix.resolver prod — no sources jar (404)
- org.apache.felix:org.apache.felix.bundlerepository prod — no sources jar (404)
- org.slf4j:jcl-over-slf4j prod — no version pinned
- org.slf4j:log4j-over-slf4j prod — no version pinned
- ai.djl.huggingface:tokenizers prod — no version pinned
- org.apache.lucene:lucene-core prod — no version pinned
- org.apache.lucene:lucene-analysis-common prod — no version pinned
- io.prometheus:simpleclient prod — no version pinned
- io.prometheus:simpleclient_common prod — no version pinned
- org.apache.velocity:velocity-engine-core prod — no version pinned
- com.openai:openai-java prod — no sources jar (404)
- com.fasterxml.jackson.module:jackson-module-kotlin prod — no sources jar (404)
- com.squareup.okhttp3:okhttp prod — no sources jar (404)
- io.grpc:grpc-netty-shaded prod — no sources jar (404)
- io.grpc:grpc-protobuf prod — no sources jar (404)
- io.grpc:grpc-stub prod — no sources jar (404)
- com.dev-smart:ubjson prod — no version pinned
- org.eclipse.collections:eclipse-collections prod — no version pinned
- org.eclipse.collections:eclipse-collections-api prod — no version pinned
- org.apache.datasketches:datasketches-java prod — no sources jar (404)
- org.apache.datasketches:datasketches-memory prod — no sources jar (404)
- com.google.jimfs:jimfs prod — no version pinned
- org.apache.maven.shared:maven-dependency-tree prod — no version pinned
- org.eclipse.jetty.http2:jetty-http2-client-transport prod — no version pinned
- commons-cli:commons-cli prod — no version pinned
- org.apache.curator:curator-recipes prod — no version pinned
- com.yahoo.vespa:${zookeeper.client.artifactId} prod — no sources jar (404)
- com.yahoo.vespa:zookeeper-common prod — no sources jar (404)
- org.slf4j:slf4j-simple prod — no sources jar (404)
- io.dropwizard.metrics:metrics-core prod — no version pinned
- org.xerial.snappy:snappy-java prod — no version pinned