1302
Applicable Platforms
Language : Java (Prevalence = Undetermined)
Common Consequences
Scope Impact Likelihood
Other Quality Degradation
Potential Mitigations
Phase: Architecture and Design
Do not use AWT/Swing when writing EJBs.
Demonstrative Examples
Example 1:
The following Java example is a simple converter class for converting US dollars to Yen. This
converter class demonstrates the improper practice of using a stateless session Enterprise
JavaBean that implements an AWT Component and AWT keyboard event listener to retrieve
keyboard input from the user for the amount of the US dollars to convert to Yen.
Example Language: Java (Bad)
@Stateless
public class ConverterSessionBean extends Component implements KeyListener, ConverterSessionRemote {
/* member variables for receiving keyboard input using AWT API */
...
private StringBuffer enteredText = new StringBuffer();
/* conversion rate on US dollars to Yen */
private BigDecimal yenRate = new BigDecimal("115.3100");
public ConverterSessionBean() {
super();
/* method calls for setting up AWT Component for receiving keyboard input */
...
addKeyListener(this);
}
public BigDecimal dollarToYen(BigDecimal dollars) {
BigDecimal result = dollars.multiply(yenRate);
return result.setScale(2, BigDecimal.ROUND_DOWN);
}
/* member functions for implementing AWT KeyListener interface */
public void keyTyped(KeyEvent event) {
...
}
public void keyPressed(KeyEvent e) {
}
public void keyReleased(KeyEvent e) {
}
/* member functions for receiving keyboard input and displaying output */
public void paint(Graphics g) {...}
...
}
This use of the AWT and Swing APIs within any kind of Enterprise JavaBean not only violates the
restriction of the EJB specification against using AWT or Swing within an EJB but also violates the
intended use of Enterprise JavaBeans to separate business logic from presentation logic.
The Stateless Session Enterprise JavaBean should contain only business logic. Presentation logic
should be provided by some other mechanism such as Servlets or Java Server Pages (JSP) as in
the following Java/JSP example.
Example Language: Java (Good)
@Stateless
CWE Version 4.14
CWE-575: EJB Bad Practices: Use of AWT Swing
CWE-575: EJB Bad Practices: Use of AWT Swing