J2EE Bad Practices: Direct Management of Connections

Draft Variant
Structure: Simple
Description

This vulnerability occurs when a J2EE application handles database connections directly instead of using the container's built-in connection management system.

Extended Description

J2EE standards explicitly prohibit applications from managing their own database connections. Instead, developers must use the container's resource management facilities to obtain connections. Every major J2EE container provides robust, pooled connection management as part of its core framework—bypassing this system violates the platform's fundamental architecture. Recreating connection pooling within an application is both complex and prone to critical errors like connection leaks, improper cleanup, and performance bottlenecks. Using the container's proven management layer eliminates these risks while ensuring optimal resource utilization, which is precisely why direct connection management is considered a bad practice and security vulnerability.

Common Consequences 1
Scope: Other

Impact: Quality Degradation

Detection Methods 1
Automated Static AnalysisHigh
Automated static analysis, commonly referred to as Static Application Security Testing (SAST), can find some instances of this weakness by analyzing source code (or binary/compiled code) without having to execute it. Typically, this is done by building a model of data flow and control flow, then searching for potentially-vulnerable patterns that connect "sources" (origins of input) with "sinks" (destinations where the data interacts with external components, a lower layer such as the OS, etc.)
Demonstrative Examples 1
In the following example, the class DatabaseConnection opens and manages a connection to a database for a J2EE application. The method openDatabaseConnection opens a connection to the database using a DriverManager to create the Connection object conn to the database specified in the string constant CONNECT_STRING.

Code Example:

Bad
Java
java
The use of the DriverManager class to directly manage the connection to the database violates the J2EE restriction against the direct management of connections. The J2EE application should use the web application container's resource management facilities to obtain a connection to the database as shown in the following example.

Code Example:

Good
Java
java
References 1
Seven Pernicious Kingdoms: A Taxonomy of Software Security Errors
Katrina Tsipenyuk, Brian Chess, and Gary McGraw
NIST Workshop on Software Security Assurance Tools Techniques and MetricsNIST
07-11-2005
ID: REF-6
Applicable Platforms
Languages:
Java : Undetermined
Modes of Introduction
Implementation
Related Weaknesses
Taxonomy Mapping
  • 7 Pernicious Kingdoms
  • Software Fault Patterns