CWE-245: J2EE Bad Practices: Direct Management of Connections
J2EE Bad Practices: Direct Management of Connections
Weakness ID: 245 (Weakness Variant)
Status: Draft
Description
Description Summary
The J2EE application directly manages connections, instead of using the container's connection management facilities.
Time of Introduction
Architecture and Design
Implementation
Applicable Platforms
Languages
Java
Common Consequences
Scope
Effect
Other
Technical Impact: Quality degradation
Demonstrative Examples
Example 1
In the following example, the class DatabaseConnection opens and
manages a connection to a database for a J2EE application. The method
openDatabaseConnection opens a connection to the database using a
DriverManager to create the Connection object conn to the database specified
in the string constant CONNECT_STRING.
(Bad Code)
Example
Language: Java
public class DatabaseConnection {
private static final String CONNECT_STRING =
"jdbc:mysql://localhost:3306/mysqldb";
// Member functions for retrieving database connection and
accessing database
...
}
The use of the DriverManager class to directly manage the connection
to the database violates the J2EE restriction against the direct
management of connections. The J2EE application should use the web
application container's resource management facilities to obtain a
connection to the database as shown in the following example.
(Good Code)
public class DatabaseConnection {
private static final String DB_DATASRC_REF =
"jdbc:mysql://localhost:3306/mysqldb";
// Member functions for retrieving database connection and
accessing database
...
}
Other Notes
The J2EE standard forbids the direct management of connections. It
requires that applications use the container's resource management
facilities to obtain connections to resources. For example, a J2EE
application should obtain a database connection as follows: ctx = new
InitialContext(); datasource = (DataSource)ctx.lookup(DB_DATASRC_REF); conn
= datasource.getConnection(); and should avoid obtaining a connection in
this way: conn = DriverManager.getConnection(CONNECT_STRING); Every major
web application container provides pooled database connection management as
part of its resource management framework. Duplicating this functionality in
an application is difficult and error prone, which is part of the reason it
is forbidden under the J2EE standard.
Weakness Ordinalities
Ordinality
Description
Primary
(where
the weakness exists independent of other weaknesses)
Description
