CWE-245: J2EE Bad Practices: Direct Management of Connections
J2EE Bad Practices: Direct Management of Connections
Weakness ID: 245 (Weakness Variant)
Status: Draft
Description
Description Summary
The J2EE application directly manages connections, instead of
using the container's connection management facilities.
Time of Introduction
Architecture and Design
Implementation
Applicable Platforms
Languages
Java
Other Notes
The J2EE standard forbids the direct management of connections. It
requires that applications use the container's resource management
facilities to obtain connections to resources. For example, a J2EE
application should obtain a database connection as follows: ctx = new
InitialContext(); datasource = (DataSource)ctx.lookup(DB_DATASRC_REF); conn
= datasource.getConnection(); and should avoid obtaining a connection in
this way: conn = DriverManager.getConnection(CONNECT_STRING); Every major
web application container provides pooled database connection management as
part of its resource management framework. Duplicating this functionality in
an application is difficult and error prone, which is part of the reason it
is forbidden under the J2EE standard.
Weakness Ordinalities
Ordinality
Description
Primary
(where the
weakness exists independent of other weaknesses)