sync by cng1985 · Pull Request #1 · cng1985/scribejava

cng1985 · 2020-01-18T06:26:06Z

No description provided.

…astInLoop rule

…ation rule

…s rule

…ray rule

…oneable rule

…atchClassName rule

…eMethod rule

…le rule

[readme] Change variable naming in example

sonatype-lift · 2023-06-22T12:28:52Z

scribejava-httpclient-ning/pom.xml

+        <dependency>
+            <groupId>com.ning</groupId>
+            <artifactId>async-http-client</artifactId>
+            <version>1.9.40</version>


Critical Vulnerability:

maven : com.ning/async-http-client : 1.9.40

2 Critical, 3 High, 2 Medium, 0 Low vulnerabilities have been found across 2 dependencies.
View the Lift console for details about these vulnerabilities.

ℹ️ Expand to see all @sonatype-lift commands

You can reply with the following commands. For example, reply with @sonatype-lift ignoreall to leave out all findings.

Command Usage

@sonatype-lift ignore Leave out the above finding from this PR

@sonatype-lift ignoreall Leave out all the existing findings from this PR

@sonatype-lift exclude <file|issue|path|tool> Exclude specified file|issue|path|tool from Lift findings by updating your config.toml file

Note: When talking to LiftBot, you need to refresh the page to see its response.
_{Click here to add LiftBot to another repo.}

sonatype-lift · 2023-06-22T12:28:57Z

scribejava-core/src/main/java/com/github/scribejava/core/httpclient/jdk/JDKHttpClient.java

+        final URL url = new URL(completeUrl);
+        final HttpURLConnection connection;
+        if (config.getProxy() == null) {
+            connection = (HttpURLConnection) url.openConnection();


URLCONNECTION_SSRF_FD: This web server request could be used by an attacker to expose internal services and filesystem.

ℹ️ Expand to see all @sonatype-lift commands

You can reply with the following commands. For example, reply with @sonatype-lift ignoreall to leave out all findings.

Command Usage

@sonatype-lift ignore Leave out the above finding from this PR

@sonatype-lift ignoreall Leave out all the existing findings from this PR

@sonatype-lift exclude <file|issue|path|tool> Exclude specified file|issue|path|tool from Lift findings by updating your config.toml file

Note: When talking to LiftBot, you need to refresh the page to see its response.
_{Click here to add LiftBot to another repo.}

sonatype-lift · 2023-06-22T12:28:58Z

scribejava-core/src/main/java/com/github/scribejava/core/httpclient/jdk/JDKHttpClient.java

+        if (config.getProxy() == null) {
+            connection = (HttpURLConnection) url.openConnection();
+        } else {
+            connection = (HttpURLConnection) url.openConnection(config.getProxy());


URLCONNECTION_SSRF_FD: This web server request could be used by an attacker to expose internal services and filesystem.

ℹ️ Expand to see all @sonatype-lift commands

You can reply with the following commands. For example, reply with @sonatype-lift ignoreall to leave out all findings.

Command Usage

@sonatype-lift ignore Leave out the above finding from this PR

@sonatype-lift ignoreall Leave out all the existing findings from this PR

@sonatype-lift exclude <file|issue|path|tool> Exclude specified file|issue|path|tool from Lift findings by updating your config.toml file

Note: When talking to LiftBot, you need to refresh the page to see its response.
_{Click here to add LiftBot to another repo.}

sonatype-lift · 2023-06-22T12:29:00Z

scribejava-apis/src/main/java/com/github/scribejava/apis/mailru/MailruOAuthService.java

+
+    public static String md5(String orgString) {
+        try {
+            final MessageDigest md = MessageDigest.getInstance("MD5");


WEAK_MESSAGE_DIGEST_MD5: This API MD5 (MDX) is not a recommended cryptographic hash function

ℹ️ Expand to see all @sonatype-lift commands

You can reply with the following commands. For example, reply with @sonatype-lift ignoreall to leave out all findings.

Command Usage

@sonatype-lift ignore Leave out the above finding from this PR

@sonatype-lift ignoreall Leave out all the existing findings from this PR

@sonatype-lift exclude <file|issue|path|tool> Exclude specified file|issue|path|tool from Lift findings by updating your config.toml file

Note: When talking to LiftBot, you need to refresh the page to see its response.
_{Click here to add LiftBot to another repo.}

sonatype-lift · 2023-06-22T12:29:02Z

...a-apis/src/main/java/com/github/scribejava/apis/odnoklassniki/OdnoklassnikiOAuthService.java

+
+    public static String md5(String orgString) {
+        try {
+            final MessageDigest md = MessageDigest.getInstance("MD5");


WEAK_MESSAGE_DIGEST_MD5: This API MD5 (MDX) is not a recommended cryptographic hash function

ℹ️ Expand to see all @sonatype-lift commands

You can reply with the following commands. For example, reply with @sonatype-lift ignoreall to leave out all findings.

Command Usage

@sonatype-lift ignore Leave out the above finding from this PR

@sonatype-lift ignoreall Leave out all the existing findings from this PR

@sonatype-lift exclude <file|issue|path|tool> Exclude specified file|issue|path|tool from Lift findings by updating your config.toml file

Note: When talking to LiftBot, you need to refresh the page to see its response.
_{Click here to add LiftBot to another repo.}

sonatype-lift · 2023-06-22T12:29:04Z

scribejava-core/src/main/java/com/github/scribejava/core/services/RSASha1SignatureService.java

@@ -32,17 +33,13 @@ public String getSignature(String baseString, String apiSecret, String tokenSecr
            final Signature signature = Signature.getInstance(RSA_SHA1);


WEAK_MESSAGE_DIGEST_SHA1: This API SHA1 (SHA-1) is not a recommended cryptographic hash function

ℹ️ Expand to see all @sonatype-lift commands

You can reply with the following commands. For example, reply with @sonatype-lift ignoreall to leave out all findings.

Command Usage

@sonatype-lift ignore Leave out the above finding from this PR

@sonatype-lift ignoreall Leave out all the existing findings from this PR

@sonatype-lift exclude <file|issue|path|tool> Exclude specified file|issue|path|tool from Lift findings by updating your config.toml file

Note: When talking to LiftBot, you need to refresh the page to see its response.
_{Click here to add LiftBot to another repo.}

sonatype-lift · 2023-06-22T12:29:06Z

...is/src/main/java/com/github/scribejava/apis/instagram/InstagramAccessTokenJsonExtractor.java

+            FacebookAccessTokenJsonExtractor.instance().generateError(response);
+        } else {
+            throw new InstagramAccessTokenErrorResponse(
+                    errorNode.get("error_type").asText(),


NULL_DEREFERENCE: object returned by errorNode.get("error_type") could be null and is dereferenced at line 48.

ℹ️ Expand to see all @sonatype-lift commands

You can reply with the following commands. For example, reply with @sonatype-lift ignoreall to leave out all findings.

Command Usage

@sonatype-lift ignore Leave out the above finding from this PR

@sonatype-lift ignoreall Leave out all the existing findings from this PR

@sonatype-lift exclude <file|issue|path|tool> Exclude specified file|issue|path|tool from Lift findings by updating your config.toml file

Note: When talking to LiftBot, you need to refresh the page to see its response.
_{Click here to add LiftBot to another repo.}

sonatype-lift · 2023-06-22T12:29:09Z

...apis/src/main/java/com/github/scribejava/apis/facebook/FacebookAccessTokenErrorResponse.java

+        int hash = super.hashCode();
+        hash = 83 * hash + Objects.hashCode(errorMessage);
+        hash = 83 * hash + Objects.hashCode(type);
+        hash = 83 * hash + Objects.hashCode(codeInt);


ObjectsHashCodePrimitive: Objects.hashCode(Object o) should not be passed a primitive value

Suggested change

hash = 83 * hash + Objects.hashCode(codeInt);

hash = 83 * hash + Integer.hashCode(codeInt);

ℹ️ Expand to see all @sonatype-lift commands

You can reply with the following commands. For example, reply with @sonatype-lift ignoreall to leave out all findings.

Command Usage

@sonatype-lift ignore Leave out the above finding from this PR

@sonatype-lift ignoreall Leave out all the existing findings from this PR

@sonatype-lift exclude <file|issue|path|tool> Exclude specified file|issue|path|tool from Lift findings by updating your config.toml file

Note: When talking to LiftBot, you need to refresh the page to see its response.
_{Click here to add LiftBot to another repo.}

sonatype-lift · 2023-06-22T12:29:11Z

...is/src/main/java/com/github/scribejava/apis/instagram/InstagramAccessTokenErrorResponse.java

+        hash = 83 * hash + Objects.hashCode(response);
+        hash = 83 * hash + Objects.hashCode(errorMessage);
+        hash = 83 * hash + Objects.hashCode(errorType);
+        hash = 83 * hash + Objects.hashCode(code);


ObjectsHashCodePrimitive: Objects.hashCode(Object o) should not be passed a primitive value

Suggested change

hash = 83 * hash + Objects.hashCode(code);

hash = 83 * hash + Integer.hashCode(code);

ℹ️ Expand to see all @sonatype-lift commands

You can reply with the following commands. For example, reply with @sonatype-lift ignoreall to leave out all findings.

Command Usage

@sonatype-lift ignore Leave out the above finding from this PR

@sonatype-lift ignoreall Leave out all the existing findings from this PR

@sonatype-lift exclude <file|issue|path|tool> Exclude specified file|issue|path|tool from Lift findings by updating your config.toml file

Note: When talking to LiftBot, you need to refresh the page to see its response.
_{Click here to add LiftBot to another repo.}

sonatype-lift · 2023-06-22T12:29:13Z

scribejava-core/src/main/java/com/github/scribejava/core/oauth2/OAuth2Error.java

+     */
+    SERVER_ERROR("server_error"),
+    /**
+     * @see <a href="https://tools.ietf.org/html/rfc6749#section-4.1.2.1">RFC 6749, 4.1.2.1 Error Response</a>


MissingSummary: A summary fragment is required; consider using the value of the @see block as a summary fragment instead.

Suggested change

* @see <a href="https://tools.ietf.org/html/rfc6749#section-4.1.2.1">RFC 6749, 4.1.2.1 Error Response</a>

*See {@link <a href="https:

❗❗ 17 similar findings have been found in this PR

🔎 Expand here to view all instances of this finding

File Path Line Number

scribejava-core/src/main/java/com/github/scribejava/core/oauth2/OAuth2Error.java 84

scribejava-core/src/main/java/com/github/scribejava/core/oauth2/OAuth2Error.java 49

scribejava-core/src/main/java/com/github/scribejava/core/oauth2/OAuth2Error.java 66

scribejava-core/src/main/java/com/github/scribejava/core/oauth2/OAuth2Error.java 71

scribejava-core/src/main/java/com/github/scribejava/core/oauth2/OAuth2Error.java 33

scribejava-core/src/main/java/com/github/scribejava/core/oauth2/OAuth2Error.java 22

scribejava-core/src/main/java/com/github/scribejava/core/oauth2/OAuth2Error.java 57

scribejava-core/src/main/java/com/github/scribejava/core/oauth2/OAuth2Error.java 53

scribejava-core/src/main/java/com/github/scribejava/core/oauth2/OAuth2Error.java 28

scribejava-core/src/main/java/com/github/scribejava/core/oauth2/OAuth2Error.java 61

Showing 10 of 17 findings. Visit the Lift Web Console to see all.

ℹ️ Expand to see all @sonatype-lift commands

You can reply with the following commands. For example, reply with @sonatype-lift ignoreall to leave out all findings.

Command Usage

@sonatype-lift ignore Leave out the above finding from this PR

@sonatype-lift ignoreall Leave out all the existing findings from this PR

@sonatype-lift exclude <file|issue|path|tool> Exclude specified file|issue|path|tool from Lift findings by updating your config.toml file

Note: When talking to LiftBot, you need to refresh the page to see its response.
_{Click here to add LiftBot to another repo.}

sonatype-lift · 2023-06-22T12:29:15Z

...ejava-core/src/main/java/com/github/scribejava/core/httpclient/multipart/MultipartUtils.java

+                    }
+                }
+
+                os.write("\r\n".getBytes());


DefaultCharset: Implicit use of the platform default charset, which can result in differing behaviour between JVM executions or incorrect behavior if the encoding of the data source doesn't match expectations.

Suggested change

os.write("\r\n".getBytes());

os.write("\r\n".getBytes(Charset.defaultCharset()));

❗❗ 9 similar findings have been found in this PR

🔎 Expand here to view all instances of this finding

File Path Line Number

scribejava-core/src/main/java/com/github/scribejava/core/httpclient/jdk/JDKHttpClient.java 164

scribejava-core/src/main/java/com/github/scribejava/core/httpclient/multipart/MultipartUtils.java 72

scribejava-core/src/main/java/com/github/scribejava/core/httpclient/multipart/MultipartUtils.java 59

scribejava-core/src/main/java/com/github/scribejava/core/httpclient/multipart/MultipartUtils.java 75

scribejava-apis/src/main/java/com/github/scribejava/apis/facebook/FacebookService.java 37

scribejava-core/src/main/java/com/github/scribejava/core/httpclient/multipart/MultipartUtils.java 51

scribejava-apis/src/main/java/com/github/scribejava/apis/facebook/FacebookService.java 32

scribejava-core/src/main/java/com/github/scribejava/core/httpclient/multipart/MultipartUtils.java 46

scribejava-core/src/main/java/com/github/scribejava/core/httpclient/multipart/MultipartUtils.java 78

Visit the Lift Web Console to find more details in your report.

ℹ️ Expand to see all @sonatype-lift commands

You can reply with the following commands. For example, reply with @sonatype-lift ignoreall to leave out all findings.

Command Usage

@sonatype-lift ignore Leave out the above finding from this PR

@sonatype-lift ignoreall Leave out all the existing findings from this PR

@sonatype-lift exclude <file|issue|path|tool> Exclude specified file|issue|path|tool from Lift findings by updating your config.toml file

Note: When talking to LiftBot, you need to refresh the page to see its response.
_{Click here to add LiftBot to another repo.}

sonatype-lift · 2023-06-22T12:29:18Z

scribejava-apis/src/main/java/com/github/scribejava/apis/instagram/InstagramService.java

+     * @param accessToken short-lived access token
+     * @return long-lived access token with filled expireIn and refreshToken
+     * @throws java.lang.InterruptedException
+     * @throws java.util.concurrent.ExecutionException


EmptyBlockTag: A block tag (@param, @return, @throws, @deprecated) has an empty description. Block tags without descriptions don't add much value for future readers of the code; consider removing the tag entirely or adding a description.

Suggested change

* @throws java.util.concurrent.ExecutionException

*

❗❗ 3 similar findings have been found in this PR

🔎 Expand here to view all instances of this finding

File Path Line Number

scribejava-apis/src/main/java/com/github/scribejava/apis/instagram/InstagramService.java 77

scribejava-core/src/main/java/com/github/scribejava/core/httpclient/jdk/JDKHttpFuture.java 12

scribejava-apis/src/main/java/com/github/scribejava/apis/instagram/InstagramService.java 75

Visit the Lift Web Console to find more details in your report.

ℹ️ Expand to see all @sonatype-lift commands

You can reply with the following commands. For example, reply with @sonatype-lift ignoreall to leave out all findings.

Command Usage

@sonatype-lift ignore Leave out the above finding from this PR

@sonatype-lift ignoreall Leave out all the existing findings from this PR

@sonatype-lift exclude <file|issue|path|tool> Exclude specified file|issue|path|tool from Lift findings by updating your config.toml file

Note: When talking to LiftBot, you need to refresh the page to see its response.
_{Click here to add LiftBot to another repo.}

sonatype-lift · 2023-06-22T12:29:20Z

scribejava-java8/src/main/java/com/github/scribejava/java8/base64/Java8Base64.java

+
+public class Java8Base64 {
+
+    private static final java.util.Base64.Encoder BASE64_ENCODER = java.util.Base64.getEncoder();


UnnecessarilyFullyQualified: This fully qualified name is unambiguous to the compiler if imported.

Suggested change

private static final java.util.Base64.Encoder BASE64_ENCODER = java.util.Base64.getEncoder();

private static final java.util.Base64.Encoder BASE64_ENCODER = Base64.getEncoder();

❗❗ 4 similar findings have been found in this PR

🔎 Expand here to view all instances of this finding

File Path Line Number

scribejava-java8/src/main/java/com/github/scribejava/java8/base64/Java8Base64.java 7

scribejava-java8/src/main/java/com/github/scribejava/java8/base64/Java8Base64.java 6

scribejava-java8/src/main/java/com/github/scribejava/java8/base64/Java8Base64.java 5

scribejava-core/src/main/java/com/github/scribejava/core/httpclient/AbstractAsyncOnlyHttpClient.java 32

Visit the Lift Web Console to find more details in your report.

ℹ️ Expand to see all @sonatype-lift commands

You can reply with the following commands. For example, reply with @sonatype-lift ignoreall to leave out all findings.

Command Usage

@sonatype-lift ignore Leave out the above finding from this PR

@sonatype-lift ignoreall Leave out all the existing findings from this PR

@sonatype-lift exclude <file|issue|path|tool> Exclude specified file|issue|path|tool from Lift findings by updating your config.toml file

Note: When talking to LiftBot, you need to refresh the page to see its response.
_{Click here to add LiftBot to another repo.}

sonatype-lift · 2023-06-22T12:29:22Z

scribejava-core/src/main/java/com/github/scribejava/core/oauth/OAuth20Service.java

+     */
+    public OAuth2AccessToken pollAccessTokenDeviceAuthorizationGrant(DeviceAuthorization deviceAuthorization)
+            throws InterruptedException, ExecutionException, IOException {
+        long intervalMillis = deviceAuthorization.getIntervalSeconds() * 1000;


IntLongMath: Expression of type int may overflow before being assigned to a long

Suggested change

long intervalMillis = deviceAuthorization.getIntervalSeconds() * 1000;

long intervalMillis = deviceAuthorization.getIntervalSeconds() * 1000L;

ℹ️ Expand to see all @sonatype-lift commands

You can reply with the following commands. For example, reply with @sonatype-lift ignoreall to leave out all findings.

Command Usage

@sonatype-lift ignore Leave out the above finding from this PR

@sonatype-lift ignoreall Leave out all the existing findings from this PR

@sonatype-lift exclude <file|issue|path|tool> Exclude specified file|issue|path|tool from Lift findings by updating your config.toml file

Note: When talking to LiftBot, you need to refresh the page to see its response.
_{Click here to add LiftBot to another repo.}

sonatype-lift · 2023-06-22T12:29:24Z

scribejava-apis/src/main/java/com/github/scribejava/apis/FrappeApi.java

+        this.authorizationBaseUrl = serverURL + "/api/method/frappe.integrations.oauth2.authorize";
+    }
+
+    public static FrappeApi instance(String serverUrl) {


InconsistentCapitalization: Found the field 'serverURL' with the same name as the parameter 'serverUrl' but with different capitalization.

Suggested change

public static FrappeApi instance(String serverUrl) {

public static FrappeApi instance(String serverURL) {

ℹ️ Expand to see all @sonatype-lift commands

You can reply with the following commands. For example, reply with @sonatype-lift ignoreall to leave out all findings.

Command Usage

@sonatype-lift ignore Leave out the above finding from this PR

@sonatype-lift ignoreall Leave out all the existing findings from this PR

@sonatype-lift exclude <file|issue|path|tool> Exclude specified file|issue|path|tool from Lift findings by updating your config.toml file

Note: When talking to LiftBot, you need to refresh the page to see its response.
_{Click here to add LiftBot to another repo.}

sonatype-lift · 2023-06-22T12:29:26Z

scribejava-core/src/main/java/com/github/scribejava/core/oauth/OAuthService.java

+     * @param messagePattern messagePattern
+     * @param params params
+     */
+    public void log(String messagePattern, Object... params) {


AnnotateFormatMethod: This method passes a pair of parameters through to String.format, but the enclosing method wasn't annotated @FormatMethod. Doing so gives compile-time rather than run-time protection against malformed format strings.

ℹ️ Expand to see all @sonatype-lift commands

You can reply with the following commands. For example, reply with @sonatype-lift ignoreall to leave out all findings.

Command Usage

@sonatype-lift ignore Leave out the above finding from this PR

@sonatype-lift ignoreall Leave out all the existing findings from this PR

@sonatype-lift exclude <file|issue|path|tool> Exclude specified file|issue|path|tool from Lift findings by updating your config.toml file

Note: When talking to LiftBot, you need to refresh the page to see its response.
_{Click here to add LiftBot to another repo.}

sonatype-lift · 2023-06-22T12:29:28Z

...va-core/src/main/java/com/github/scribejava/core/httpclient/AbstractAsyncOnlyHttpClient.java

+        return response;
+    }
+
+    private class OAuthAsyncRequestThrowableHolderCallback implements OAuthAsyncRequestCallback<Response> {


ClassCanBeStatic: Inner class is non-static but does not reference enclosing class

Suggested change

private class OAuthAsyncRequestThrowableHolderCallback implements OAuthAsyncRequestCallback<Response> {

private static class OAuthAsyncRequestThrowableHolderCallback implements OAuthAsyncRequestCallback<Response> {

ℹ️ Expand to see all @sonatype-lift commands

You can reply with the following commands. For example, reply with @sonatype-lift ignoreall to leave out all findings.

Command Usage

@sonatype-lift ignore Leave out the above finding from this PR

@sonatype-lift ignoreall Leave out all the existing findings from this PR

@sonatype-lift exclude <file|issue|path|tool> Exclude specified file|issue|path|tool from Lift findings by updating your config.toml file

Note: When talking to LiftBot, you need to refresh the page to see its response.
_{Click here to add LiftBot to another repo.}

sonatype-lift · 2023-06-22T12:29:30Z

scribejava-core/src/main/java/com/github/scribejava/core/oauth/OAuth20Service.java

+     */
+    public OAuth2AccessToken pollAccessTokenDeviceAuthorizationGrant(DeviceAuthorization deviceAuthorization)
+            throws InterruptedException, ExecutionException, IOException {
+        long intervalMillis = deviceAuthorization.getIntervalSeconds() * 1000;


NarrowCalculation: This product of integers could overflow before being implicitly cast to a long.

Suggested change

long intervalMillis = deviceAuthorization.getIntervalSeconds() * 1000;

long intervalMillis = deviceAuthorization.getIntervalSeconds() * 1000L;

ℹ️ Expand to see all @sonatype-lift commands

You can reply with the following commands. For example, reply with @sonatype-lift ignoreall to leave out all findings.

Command Usage

@sonatype-lift ignore Leave out the above finding from this PR

@sonatype-lift ignoreall Leave out all the existing findings from this PR

@sonatype-lift exclude <file|issue|path|tool> Exclude specified file|issue|path|tool from Lift findings by updating your config.toml file

Note: When talking to LiftBot, you need to refresh the page to see its response.
_{Click here to add LiftBot to another repo.}

sonatype-lift · 2023-06-22T12:29:32Z

...apis/src/main/java/com/github/scribejava/apis/facebook/FacebookAccessTokenErrorResponse.java

+    }
+
+    @Override
+    public String toString() {


OverrideThrowableToString: To return a custom message with a Throwable class, one should override getMessage() instead of toString().

Suggested change

public String toString() {

public String getMessage() {

ℹ️ Expand to see all @sonatype-lift commands

You can reply with the following commands. For example, reply with @sonatype-lift ignoreall to leave out all findings.

Command Usage

@sonatype-lift ignore Leave out the above finding from this PR

@sonatype-lift ignoreall Leave out all the existing findings from this PR

@sonatype-lift exclude <file|issue|path|tool> Exclude specified file|issue|path|tool from Lift findings by updating your config.toml file

Note: When talking to LiftBot, you need to refresh the page to see its response.
_{Click here to add LiftBot to another repo.}

sonatype-lift · 2023-06-22T12:29:34Z

...is/src/main/java/com/github/scribejava/apis/instagram/InstagramAccessTokenErrorResponse.java

+    }
+
+    @Override
+    public String toString() {


OverrideThrowableToString: To return a custom message with a Throwable class, one should override getMessage() instead of toString().

Suggested change

public String toString() {

public String getMessage() {

ℹ️ Expand to see all @sonatype-lift commands

You can reply with the following commands. For example, reply with @sonatype-lift ignoreall to leave out all findings.

Command Usage

@sonatype-lift ignore Leave out the above finding from this PR

@sonatype-lift ignoreall Leave out all the existing findings from this PR

@sonatype-lift exclude <file|issue|path|tool> Exclude specified file|issue|path|tool from Lift findings by updating your config.toml file

Note: When talking to LiftBot, you need to refresh the page to see its response.
_{Click here to add LiftBot to another repo.}

sonatype-lift · 2023-06-22T12:29:36Z

scribejava-apis/src/main/java/com/github/scribejava/apis/mailru/MailruOAuthService.java

+
+    public static String md5(String orgString) {
+        try {
+            final MessageDigest md = MessageDigest.getInstance("MD5");


opt.semgrep.java.lang.security.audit.crypto.weak-hash.use-of-md5: Detected MD5 hash algorithm which is considered insecure. MD5 is not
collision resistant and is therefore not suitable as a cryptographic
signature. Use SHA256 or SHA3 instead.

ℹ️ Expand to see all @sonatype-lift commands

You can reply with the following commands. For example, reply with @sonatype-lift ignoreall to leave out all findings.

Command Usage

@sonatype-lift ignore Leave out the above finding from this PR

@sonatype-lift ignoreall Leave out all the existing findings from this PR

@sonatype-lift exclude <file|issue|path|tool> Exclude specified file|issue|path|tool from Lift findings by updating your config.toml file

Note: When talking to LiftBot, you need to refresh the page to see its response.
_{Click here to add LiftBot to another repo.}

sonatype-lift · 2023-06-22T12:29:38Z

...a-apis/src/main/java/com/github/scribejava/apis/odnoklassniki/OdnoklassnikiOAuthService.java

+
+    public static String md5(String orgString) {
+        try {
+            final MessageDigest md = MessageDigest.getInstance("MD5");


opt.semgrep.java.lang.security.audit.crypto.weak-hash.use-of-md5: Detected MD5 hash algorithm which is considered insecure. MD5 is not
collision resistant and is therefore not suitable as a cryptographic
signature. Use SHA256 or SHA3 instead.

ℹ️ Expand to see all @sonatype-lift commands

You can reply with the following commands. For example, reply with @sonatype-lift ignoreall to leave out all findings.

Command Usage

@sonatype-lift ignore Leave out the above finding from this PR

@sonatype-lift ignoreall Leave out all the existing findings from this PR

@sonatype-lift exclude <file|issue|path|tool> Exclude specified file|issue|path|tool from Lift findings by updating your config.toml file

Note: When talking to LiftBot, you need to refresh the page to see its response.
_{Click here to add LiftBot to another repo.}

sonatype-lift · 2023-06-22T12:29:40Z

scribejava-apis/src/main/java/com/github/scribejava/apis/ImgurApi.java

-    public static boolean isOob(OAuthConfig config) {
-        return "oob".equals(config.getCallback());
+    public static boolean isOob(String callback) {
+        return OAuthConstants.OOB.equals(callback);


YodaCondition: The non-constant portion of an equals check generally comes first.

Suggested change

return OAuthConstants.OOB.equals(callback);

return Objects.equals(callback, OAuthConstants.OOB);

ℹ️ Expand to see all @sonatype-lift commands

You can reply with the following commands. For example, reply with @sonatype-lift ignoreall to leave out all findings.

Command Usage

@sonatype-lift ignore Leave out the above finding from this PR

@sonatype-lift ignoreall Leave out all the existing findings from this PR

@sonatype-lift exclude <file|issue|path|tool> Exclude specified file|issue|path|tool from Lift findings by updating your config.toml file

Note: When talking to LiftBot, you need to refresh the page to see its response.
_{Click here to add LiftBot to another repo.}

sonatype-lift · 2023-06-22T12:29:42Z

scribejava-core/src/main/java/com/github/scribejava/core/model/Response.java

+        if (stream == null) {
+            return null;
+        }
        if ("gzip".equals(getHeader("Content-Encoding"))) {


YodaCondition: The non-constant portion of an equals check generally comes first.

Suggested change

if ("gzip".equals(getHeader("Content-Encoding"))) {

if (Objects.equals(getHeader("Content-Encoding"), "gzip")) {

ℹ️ Expand to see all @sonatype-lift commands

You can reply with the following commands. For example, reply with @sonatype-lift ignoreall to leave out all findings.

Command Usage

@sonatype-lift ignore Leave out the above finding from this PR

@sonatype-lift ignoreall Leave out all the existing findings from this PR

@sonatype-lift exclude <file|issue|path|tool> Exclude specified file|issue|path|tool from Lift findings by updating your config.toml file

Note: When talking to LiftBot, you need to refresh the page to see its response.
_{Click here to add LiftBot to another repo.}

sonatype-lift · 2023-06-22T12:29:44Z

🛠 Lift Auto-fix

Some of the Lift findings in this PR can be automatically fixed. You can download and apply these changes in your local project directory of your branch to review the suggestions before committing.¹

# Download the patch
curl https://lift.sonatype.com/api/patch/github.com/cng1985/scribejava/1.diff -o lift-autofixes.diff

# Apply the patch with git
git apply lift-autofixes.diff

# Review the changes
git diff

Want it all in a single command? Open a terminal in your project's directory and copy and paste the following command:

curl https://lift.sonatype.com/api/patch/github.com/cng1985/scribejava/1.diff | git apply

Once you're satisfied, commit and push your changes in your project.

You can preview the patch by opening the patch URL in the browser. ↩

kullfar added 30 commits April 4, 2019 12:41

introduce PMD/category/java/design.xml/LogicInversion rule

8362b17

introduce PMD/category/java/design.xml/SimplifiedTernary rule

90cde59

introduce PMD/category/java/design.xml/SimplifyBooleanAssertion rule

054dde3

introduce PMD/category/java/design.xml/SimplifyBooleanExpressions rule

da3a03e

introduce PMD/category/java/design.xml/SimplifyBooleanReturns rule

5cfa245

introduce PMD/category/java/design.xml/SimplifyConditional rule

88966d4

introduce PMD/category/java/design.xml/UseUtilityClass rule

851051d

introduce PMD/category/java/errorprone.xml/AvoidAssertAsIdentifier rule

8d5ef48

introduce PMD/category/java/errorprone.xml/AvoidBranchingStatementAsL…

26a420b

…astInLoop rule

introduce PMD/category/java/errorprone.xml/AvoidCallingFinalize rule

5c0cccb

introduce PMD/category/java/errorprone.xml/AvoidEnumAsIdentifier rule

1a4d255

introduce PMD/category/java/errorprone.xml/AvoidLosingExceptionInform…

6f3eb2b

…ation rule

introduce PMD/category/java/errorprone.xml/AvoidMultipleUnaryOperator…

f1ab512

…s rule

introduce PMD/category/java/errorprone.xml/BrokenNullCheck rule

224248e

introduce PMD/category/java/errorprone.xml/ClassCastExceptionWithToAr…

01a6e80

…ray rule

introduce PMD/category/java/errorprone.xml/CloneMethodMustBePublic rule

860e8d7

introduce PMD/category/java/errorprone.xml/CloneMethodMustImplementCl…

3cf8249

…oneable rule

introduce PMD/category/java/errorprone.xml/CloneMethodReturnTypeMustM…

9137ca6

…atchClassName rule

introduce PMD/category/java/errorprone.xml/ConstructorCallsOverridabl…

a4ff03f

…eMethod rule

introduce PMD/category/java/errorprone.xml/DoNotExtendJavaLangThrowab…

c4898b9

…le rule

introduce PMD/category/java/errorprone.xml/DontImportSun rule

6ee14a8

introduce PMD/category/java/errorprone.xml/EmptyFinalizer rule

daebd4d

introduce PMD/category/java/errorprone.xml/EmptyFinallyBlock rule

245682f

introduce PMD/category/java/errorprone.xml/EmptyIfStmt rule

1b1846c

introduce PMD/category/java/errorprone.xml/EmptyInitializer rule

667eef0

introduce PMD/category/java/errorprone.xml/EmptyStatementBlock rule

ac9eae5

introduce PMD/category/java/errorprone.xml/EmptyStatementNotInLoop rule

6b22afb

introduce PMD/category/java/errorprone.xml/EmptySwitchStatements rule

ec92064

introduce PMD/category/java/errorprone.xml/EmptyTryBlock rule

b98d84a

introduce PMD/category/java/errorprone.xml/EmptyWhileStmt rule

09a5aba

kullfar added 4 commits November 15, 2022 18:24

[maven-release-plugin] prepare release scribejava-8.3.3

763a959

[maven-release-plugin] prepare for next development iteration

314d431

update changelog and README.md to reflect already released v8.3.3

9112e0b

Merge pull request #1040 from tipsy/patch-1

b62f73a

[readme] Change variable naming in example

sonatype-lift bot reviewed Jun 22, 2023

View reviewed changes

Update donate.md

8970e8e

Command	Usage
`@sonatype-lift ignore`	Leave out the above finding from this PR
`@sonatype-lift ignoreall`	Leave out all the existing findings from this PR
`@sonatype-lift exclude <file\|issue\|path\|tool>`	Exclude specified `file\|issue\|path\|tool` from Lift findings by updating your config.toml file

		@@ -32,17 +33,13 @@ public String getSignature(String baseString, String apiSecret, String tokenSecr
		final Signature signature = Signature.getInstance(RSA_SHA1);

	hash = 83 * hash + Objects.hashCode(codeInt);
	hash = 83 * hash + Integer.hashCode(codeInt);

	* @see <a href="https://tools.ietf.org/html/rfc6749#section-4.1.2.1">RFC 6749, 4.1.2.1 Error Response</a>
	*See {@link <a href="https:

	os.write("\r\n".getBytes());
	os.write("\r\n".getBytes(Charset.defaultCharset()));


		public class Java8Base64 {

		private static final java.util.Base64.Encoder BASE64_ENCODER = java.util.Base64.getEncoder();

	long intervalMillis = deviceAuthorization.getIntervalSeconds() * 1000;
	long intervalMillis = deviceAuthorization.getIntervalSeconds() * 1000L;

	public static FrappeApi instance(String serverUrl) {
	public static FrappeApi instance(String serverURL) {

	private class OAuthAsyncRequestThrowableHolderCallback implements OAuthAsyncRequestCallback<Response> {
	private static class OAuthAsyncRequestThrowableHolderCallback implements OAuthAsyncRequestCallback<Response> {

	return OAuthConstants.OOB.equals(callback);
	return Objects.equals(callback, OAuthConstants.OOB);

	if ("gzip".equals(getHeader("Content-Encoding"))) {
	if (Objects.equals(getHeader("Content-Encoding"), "gzip")) {

Conversation

cng1985 commented Jan 18, 2020

Uh oh!

sonatype-lift bot Jun 22, 2023

Choose a reason for hiding this comment

maven : com.ning/async-http-client : 1.9.40

Uh oh!

sonatype-lift bot Jun 22, 2023

Choose a reason for hiding this comment

Uh oh!

sonatype-lift bot Jun 22, 2023

Choose a reason for hiding this comment

Uh oh!

sonatype-lift bot Jun 22, 2023

Choose a reason for hiding this comment

Uh oh!

sonatype-lift bot Jun 22, 2023

Choose a reason for hiding this comment

Uh oh!

sonatype-lift bot Jun 22, 2023

Choose a reason for hiding this comment

Uh oh!

sonatype-lift bot Jun 22, 2023

Choose a reason for hiding this comment

Uh oh!

sonatype-lift bot Jun 22, 2023

Choose a reason for hiding this comment

Uh oh!

sonatype-lift bot Jun 22, 2023

Choose a reason for hiding this comment

Uh oh!

sonatype-lift bot Jun 22, 2023

Choose a reason for hiding this comment

Uh oh!

sonatype-lift bot Jun 22, 2023

Choose a reason for hiding this comment

Uh oh!

sonatype-lift bot Jun 22, 2023

Choose a reason for hiding this comment

Uh oh!

sonatype-lift bot Jun 22, 2023

Choose a reason for hiding this comment

Uh oh!

sonatype-lift bot Jun 22, 2023

Choose a reason for hiding this comment

Uh oh!

sonatype-lift bot Jun 22, 2023

Choose a reason for hiding this comment

Uh oh!

sonatype-lift bot Jun 22, 2023

Choose a reason for hiding this comment

Uh oh!

sonatype-lift bot Jun 22, 2023

Choose a reason for hiding this comment

Uh oh!

sonatype-lift bot Jun 22, 2023

Choose a reason for hiding this comment

Uh oh!

sonatype-lift bot Jun 22, 2023

Choose a reason for hiding this comment

Uh oh!

sonatype-lift bot Jun 22, 2023

Choose a reason for hiding this comment

Uh oh!

sonatype-lift bot Jun 22, 2023

Choose a reason for hiding this comment

Uh oh!

sonatype-lift bot Jun 22, 2023

Choose a reason for hiding this comment

Uh oh!

sonatype-lift bot Jun 22, 2023

Choose a reason for hiding this comment

Uh oh!

sonatype-lift bot Jun 22, 2023

Choose a reason for hiding this comment

Uh oh!

sonatype-lift bot commented Jun 22, 2023

🛠 Lift Auto-fix

Footnotes

Uh oh!