1305
try {
/* get XML document from the local filesystem */
interestRateFile = new File(Constants.INTEREST_RATE_FILE);
if (interestRateFile.exists())
{
DocumentBuilderFactory dbf = DocumentBuilderFactory.newInstance();
DocumentBuilder db = dbf.newDocumentBuilder();
interestRateXMLDocument = db.parse(interestRateFile);
}
} catch (IOException ex) {...}
}
public BigDecimal getInterestRate(Integer points) {
return getInterestRateFromXML(points);
}
/* member function to retrieve interest rate from XML document on the local file system */
private BigDecimal getInterestRateFromXML(Integer points) {...}
}
This use of the Java I/O API within any kind of Enterprise JavaBean violates the EJB specification
by using the java.io package for accessing files within the local filesystem.
An Enterprise JavaBean should use a resource manager API for storing and accessing data. In
the following example, the private member function getInterestRateFromXMLParser uses an XML
parser API to retrieve the interest rates.
Example Language: Java (Good)
@Stateless
public class InterestRateBean implements InterestRateRemote {
public InterestRateBean() {
}
public BigDecimal getInterestRate(Integer points) {
return getInterestRateFromXMLParser(points);
}
/* member function to retrieve interest rate from XML document using an XML parser API */
private BigDecimal getInterestRateFromXMLParser(Integer points) {...}
}
MemberOf Relationships
This MemberOf relationships table shows additional CWE Catgeories and Views that reference this
weakness as a member. This information is often useful in understanding where a weakness fits
within the context of external information sources.
Nature Type ID Name Page
MemberOf 1001 SFP Secondary Cluster: Use of an Improper API 888 2420
MemberOf 1412 Comprehensive Categorization: Poor Coding Practices 1400 2538
Taxonomy Mappings
Mapped Taxonomy Name Node ID Fit Mapped Node Name
Software Fault Patterns SFP3 Use of an improper API
CWE-577: EJB Bad Practices: Use of Sockets
Weakness ID : 577
Structure : Simple
Abstraction : Variant
Description
The product violates the Enterprise JavaBeans (EJB) specification by using sockets.
Extended Description
CWE Version 4.14
CWE-577: EJB Bad Practices: Use of Sockets
CWE-577: EJB Bad Practices: Use of Sockets