594
} catch (SQLException ex) {...}
}
// Member functions for retrieving database connection and accessing database
...
}
The use of the DriverManager class to directly manage the connection to the database violates
the J2EE restriction against the direct management of connections. The J2EE application should
use the web application container's resource management facilities to obtain a connection to the
database as shown in the following example.
Example Language: (Good)
public class DatabaseConnection {
private static final String DB_DATASRC_REF = "jdbc:mysql://localhost:3306/mysqldb";
private Connection conn = null;
public DatabaseConnection() {
}
public void openDatabaseConnection() {
try {
InitialContext ctx = new InitialContext();
DataSource datasource = (DataSource) ctx.lookup(DB_DATASRC_REF);
conn = datasource.getConnection();
} catch (NamingException ex) {...}
} catch (SQLException ex) {...}
}
// Member functions for retrieving database connection and accessing database
...
}
MemberOf Relationships
This MemberOf relationships table shows additional CWE Catgeories and Views that reference this
weakness as a member. This information is often useful in understanding where a weakness fits
within the context of external information sources.
Nature Type ID Name Page
MemberOf 227 7PK - API Abuse 700 2313
MemberOf 1001 SFP Secondary Cluster: Use of an Improper API 888 2420
MemberOf 1412 Comprehensive Categorization: Poor Coding Practices 1400 2538
Taxonomy Mappings
Mapped Taxonomy Name Node ID Fit Mapped Node Name
7 Pernicious Kingdoms J2EE Bad Practices: getConnection()
Software Fault Patterns SFP3 Use of an improper API
References
[REF-6]Katrina Tsipenyuk, Brian Chess and Gary McGraw. "Seven Pernicious Kingdoms: A
Taxonomy of Software Security Errors". NIST Workshop on Software Security Assurance Tools
Techniques and Metrics. 2005 November 7. NIST. < https://samate.nist.gov/SSATTM_Content/
papers/Seven%20Pernicious%20Kingdoms%20-%20Taxonomy%20of%20Sw%20Security
%20Errors%20-%20Tsipenyuk%20-%20Chess%20-%20McGraw.pdf >.
CWE-246: J2EE Bad Practices: Direct Use of Sockets
Weakness ID : 246
Structure : Simple
Abstraction : Variant
Description
CWE Version 4.14
CWE-246: J2EE Bad Practices: Direct Use of Sockets
CWE-246: J2EE Bad Practices: Direct Use of Sockets