search

Redth / ZXing.Net.Mobile

Barcode Scanner for Xamarin.iOS, Xamarin.Android, UWP and Tizen
MIT License
1.07k stars 701 forks source link

Fortify findings #141

Closed FrankhHan closed 9 years ago

FrankhHan commented 9 years ago

Hi,

The listed below is the issues that we found in the fortify scan. Can anybody be able to address the issues?

Code Correctness: Class Does Not Implement Equals /psf/dropbox/GitHub/Zxing.Net.Mobile/src/ZXing.Net/client/result/ExpandedProductParsedResult.cs 121 NULL NULL CWE ID 398 NULL

Code Correctness: Class Does Not Implement Equals /psf/dropbox/GitHub/Zxing.Net.Mobile/src/ZXing.Net/client/result/ExpandedProductParsedResult.cs 134 NULL NULL CWE ID 398 NULL

Code Correctness: Class Does Not Implement Equals /psf/dropbox/GitHub/Zxing.Net.Mobile/src/ZXing.Net/common/reedsolomon/GenericGFPoly.cs 184 NULL NULL CWE ID 398 NULL

Code Correctness: Class Does Not Implement Equals /psf/dropbox/GitHub/Zxing.Net.Mobile/src/ZXing.Net/common/reedsolomon/GenericGFPoly.cs 148 NULL NULL CWE ID 398 NULL

Code Correctness: Class Does Not Implement Equals /psf/dropbox/GitHub/Zxing.Net.Mobile/src/ZXing.Net/common/reedsolomon/GenericGFPoly.cs 249 NULL NULL CWE ID 398 NULL

Code Correctness: Class Does Not Implement Equals /psf/dropbox/GitHub/Zxing.Net.Mobile/src/ZXing.Net/oned/rss/expanded/ExpandedPair.cs 79 NULL NULL CWE ID 398 NULL

Code Correctness: Class Does Not Implement Equals /psf/dropbox/GitHub/Zxing.Net.Mobile/src/ZXing.Net/oned/rss/expanded/ExpandedRow.cs 45 NULL NULL CWE ID 398 NULL

Code Correctness: Class Does Not Implement Equals /psf/dropbox/GitHub/Zxing.Net.Mobile/src/ZXing.Net/oned/rss/expanded/ExpandedRow.cs 63 NULL NULL CWE ID 398 NULL

Code Correctness: Class Does Not Implement Equals /psf/dropbox/GitHub/Zxing.Net.Mobile/src/ZXing.Net/pdf417/decoder/ec/ModulusPoly.cs 144 NULL NULL CWE ID 398 NULL

Code Correctness: Class Does Not Implement Equals /psf/dropbox/GitHub/Zxing.Net.Mobile/src/ZXing.Net/pdf417/decoder/ec/ModulusPoly.cs 184 NULL NULL CWE ID 398 NULL

Code Correctness: Class Does Not Implement Equals /psf/dropbox/GitHub/Zxing.Net.Mobile/src/ZXing.Net/pdf417/decoder/ec/ModulusPoly.cs 201 NULL NULL CWE ID 398 NULL

Code Correctness: Class Does Not Implement Equals /psf/dropbox/GitHub/Zxing.Net.Mobile/src/ZXing.Net/pdf417/decoder/ec/ModulusPoly.cs 293 NULL NULL CWE ID 398 NULL

Code Correctness: Class Does Not Implement Equals /psf/dropbox/GitHub/Zxing.Net.Mobile/src/ZXing.Net/qrcode/encoder/Encoder.cs 594 NULL NULL CWE ID 398 NULL

Code Correctness: Class Does Not Implement Equals /psf/dropbox/GitHub/Zxing.Net.Mobile/src/ZXing.Net/qrcode/encoder/Encoder.cs 597 NULL NULL CWE ID 398 NULL

Code Correctness: Class Does Not Implement Equals /psf/dropbox/GitHub/Zxing.Net.Mobile/src/ZXing.Net/qrcode/encoder/Encoder.cs 600 NULL NULL CWE ID 398 NULL

Code Correctness: Class Does Not Implement Equals /psf/dropbox/GitHub/Zxing.Net.Mobile/src/ZXing.Net/qrcode/encoder/Encoder.cs 603 NULL NULL CWE ID 398 NULL

Code Correctness: Missing [Serializable] Attribute /psf/dropbox/GitHub/Zxing.Net.Mobile/src/ZXing.Net/NotFoundException.cs 27 NULL NULL CWE ID 730 APP6080 CAT II

Code Correctness: Missing [Serializable] Attribute /psf/dropbox/GitHub/Zxing.Net.Mobile/src/ZXing.Net/ReaderException.cs 52 NULL NULL CWE ID 730 APP6080 CAT II

Code Correctness: Missing [Serializable] Attribute /psf/dropbox/GitHub/Zxing.Net.Mobile/src/ZXing.Net/WriterException.cs 51 NULL NULL CWE ID 730 APP6080 CAT II

Null Dereference /psf/dropbox/GitHub/Zxing.Net.Mobile/src/ZXing.Net/aztec/encoder/HighLevelEncoder.cs 245 NULL NULL CWE ID 476 APP6080 CAT II

Poor Error Handling: Empty Catch Block /psf/dropbox/GitHub/Zxing.Net.Mobile/src/ZXing.Net.Mobile/WindowsPhone/SimpleCameraReader.cs 171 NULL NULL CWE ID 391 APP3120 CAT II

Poor Error Handling: Empty Catch Block /psf/dropbox/GitHub/Zxing.Net.Mobile/src/ZXing.Net.Mobile/WindowsPhone/SimpleCameraReader.cs 198 NULL NULL CWE ID 391 APP3120 CAT II

Poor Error Handling: Empty Catch Block /psf/dropbox/GitHub/Zxing.Net.Mobile/src/ZXing.Net.Mobile/WindowsPhone/SimpleCameraReader.cs 254 NULL NULL CWE ID 391 APP3120 CAT II

Poor Error Handling: Empty Catch Block /psf/dropbox/GitHub/Zxing.Net.Mobile/src/ZXing.Net.Mobile/WindowsPhone/SimpleCameraReader.cs 186 NULL NULL CWE ID 391 APP3120 CAT II

Poor Error Handling: Empty Catch Block /psf/dropbox/GitHub/Zxing.Net.Mobile/src/ZXing.Net/pdf417/decoder/PDF417ScanningDecoder.cs 409 NULL NULL CWE ID 391 APP3120 CAT II

Poor Error Handling: Overly Broad Catch /psf/dropbox/GitHub/Zxing.Net.Mobile/src/ZXing.Net.Mobile/WindowsPhone/SimpleCameraReader.cs 254 NULL NULL CWE ID 396 APP3120 CAT II

Poor Error Handling: Overly Broad Catch /psf/dropbox/GitHub/Zxing.Net.Mobile/src/ZXing.Net.Mobile/WindowsPhone/SimpleCameraReader.cs 171 NULL NULL CWE ID 396 APP3120 CAT II

Poor Error Handling: Overly Broad Catch /psf/dropbox/GitHub/Zxing.Net.Mobile/src/ZXing.Net/client/result/VCardResultParser.cs 322 NULL NULL CWE ID 396 APP3120 CAT II

Poor Error Handling: Overly Broad Catch /psf/dropbox/GitHub/Zxing.Net.Mobile/src/ZXing.Net/qrcode/decoder/DecodedBitStreamParser.cs 299 NULL NULL CWE ID 396 APP3120 CAT II

Poor Error Handling: Overly Broad Catch /psf/dropbox/GitHub/Zxing.Net.Mobile/src/ZXing.Net/qrcode/decoder/DecodedBitStreamParser.cs 378 NULL NULL CWE ID 396 APP3120 CAT II

Poor Error Handling: Overly Broad Catch /psf/dropbox/GitHub/Zxing.Net.Mobile/src/ZXing.Net/qrcode/decoder/DecodedBitStreamParser.cs 238 NULL NULL CWE ID 396 APP3120 CAT II

Poor Error Handling: Overly Broad Catch /psf/dropbox/GitHub/Zxing.Net.Mobile/src/ZXing.Net/qrcode/encoder/Encoder.cs 261 NULL NULL CWE ID 396 APP3120 CAT II

Redth commented 9 years ago

Thanks but I don't work with Fortify and have no plans on making changes to make it happy. If you would like to submit a pull request to fix some of these warnings, and the changes don't impact the operation of the code I'll consider pulling them in.

But, also be aware some of these warnings exist in ZXing.Net, the upstream project which I pull in to use in ZXing.Net.Mobile so some of your changes would have to be a patch/pull request to the upstream project.