CWE: 789 Uncontrolled Memory Allocation BadSource: Environment Read data from an environment variable GoodSource: A hardcoded non-zero, non-min, non-max, even number BadSink: ArrayList Create an ArrayList using data as the initial size Flow Variant: 03 Control flow: if(5==5) and if(5!=5)

CWE: 789 Uncontrolled Memory Allocation BadSource: Environment Read data from an environment variable GoodSource: A hardcoded non-zero, non-min, non-max, even number BadSink: ArrayList Create an ArrayList using data as the initial size Flow Variant: 02 Control flow: if(true) and if(false)

CWE: 789 Uncontrolled Memory Allocation BadSource: Environment Read data from an environment variable GoodSource: A hardcoded non-zero, non-min, non-max, even number BadSink: ArrayList Create an ArrayList using data as the initial size Flow Variant: 01 Baseline

Missing Release of File Descriptor or Handle After Effective Lifetime. ZipFile is not closed.

Missing Release of File Descriptor or Handle After Effective Lifetime. Performs some, but not all, necessary resource cleanup (BufferedReader is not closed).

Missing Release of Resource After Effective Lifetime. Performs some, but not all, necessary resource cleanup (DB connection is not closed).

Missing Release of Resource After Effective Lifetime. Performs some, but not all, necessary resource cleanup (InputStreamReader is not closed).

Demonstrates use of unlock() more times than lock() in multithreaded code that accesses a shared variable.

Demonstrates use of unlock() more times than lock() in a Servlet that updates a shared variable. Servlets are inherently multithreaded, so we dont need to actually start threads in the bad() and goodX() functions.

Demonstrates use of lock() more times than unlock() in multithreaded code that accesses a shared variable.

Demonstrates use of lock() more times than unlock() in a Servlet that updates a shared variable. Servlets are inherently multithreaded, so we dont need to actually start threads in the bad() and goodX() functions.

CWE: 760 Use of one-way hash with a predictable salt Sinks: GoodSink: SHA512 with a sufficiently random salt BadSink : SHA512 with a predictable salt Flow Variant: 17 Control flow: for loops

CWE: 760 Use of one-way hash with a predictable salt Sinks: GoodSink: SHA512 with a sufficiently random salt BadSink : SHA512 with a predictable salt Flow Variant: 16 Control flow: while(true)

CWE: 760 Use of one-way hash with a predictable salt Sinks: GoodSink: SHA512 with a sufficiently random salt BadSink : SHA512 with a predictable salt Flow Variant: 15 Control flow: switch(7)

CWE: 760 Use of one-way hash with a predictable salt Sinks: GoodSink: SHA512 with a sufficiently random salt BadSink : SHA512 with a predictable salt Flow Variant: 14 Control flow: if(IO.staticFive==5) and if(IO.staticFive!=5)

CWE: 760 Use of one-way hash with a predictable salt Sinks: GoodSink: SHA512 with a sufficiently random salt BadSink : SHA512 with a predictable salt Flow Variant: 13 Control flow: if(IO.STATIC_FINAL_FIVE==5) and if(IO.STATIC_FINAL_FIVE!=5)

CWE: 760 Use of one-way hash with a predictable salt Sinks: GoodSink: SHA512 with a sufficiently random salt BadSink : SHA512 with a predictable salt Flow Variant: 12 Control flow: if(IO.staticReturnsTrueOrFalse())

CWE: 760 Use of one-way hash with a predictable salt Sinks: GoodSink: SHA512 with a sufficiently random salt BadSink : SHA512 with a predictable salt Flow Variant: 11 Control flow: if(IO.staticReturnsTrue()) and if(IO.staticReturnsFalse())

CWE: 760 Use of one-way hash with a predictable salt Sinks: GoodSink: SHA512 with a sufficiently random salt BadSink : SHA512 with a predictable salt Flow Variant: 10 Control flow: if(IO.staticTrue) and if(IO.staticFalse)

CWE: 760 Use of one-way hash with a predictable salt Sinks: GoodSink: SHA512 with a sufficiently random salt BadSink : SHA512 with a predictable salt Flow Variant: 09 Control flow: if(IO.STATIC_FINAL_TRUE) and if(IO.STATIC_FINAL_FALSE)

CWE: 760 Use of one-way hash with a predictable salt Sinks: GoodSink: SHA512 with a sufficiently random salt BadSink : SHA512 with a predictable salt Flow Variant: 08 Control flow: if(privateReturnsTrue()) and if(privateReturnsFalse())

CWE: 760 Use of one-way hash with a predictable salt Sinks: GoodSink: SHA512 with a sufficiently random salt BadSink : SHA512 with a predictable salt Flow Variant: 07 Control flow: if(privateFive==5) and if(privateFive!=5)

CWE: 760 Use of one-way hash with a predictable salt Sinks: GoodSink: SHA512 with a sufficiently random salt BadSink : SHA512 with a predictable salt Flow Variant: 06 Control flow: if(PRIVATE_STATIC_FINAL_FIVE==5) and if(PRIVATE_STATIC_FINAL_FIVE!=5)

CWE: 760 Use of one-way hash with a predictable salt Sinks: GoodSink: SHA512 with a sufficiently random salt BadSink : SHA512 with a predictable salt Flow Variant: 05 Control flow: if(privateTrue) and if(privateFalse)

CWE: 760 Use of one-way hash with a predictable salt Sinks: GoodSink: SHA512 with a sufficiently random salt BadSink : SHA512 with a predictable salt Flow Variant: 04 Control flow: if(PRIVATE_STATIC_FINAL_TRUE) and if(PRIVATE_STATIC_FINAL_FALSE)