Breadcrumbs

Scala

Note:

  • This capability is in open beta.

  • This capability is disabled by default. Reach out to your CSM at Mend.io to enable it.

This article covers Scala support and vulnerability detection for Mend SAST.

Mend SAST-supported Scala file types

File Type

.scala

.sc

Mend SAST-supported Scala frameworks

Framework

Java NIO

Scala standard library

fs2

better-files

sttp/Tapir

OS-Lib

Ammonite

ZIO

Apache Commons Exec

eu.monniot scala-process library

de.halcony process library

Java Servlet API

Spring Framework

http4s

Play Framework

Cask

Apache Pekko HTTP

Twitter Finagle/Finatra

OWASP Java HTML Sanitizer

ScalikeJDBC

Anorm

Sql2o

Doobie

Slick

Skunk

Hibernate

Apache Spark SQL

UnboundID LDAP SDK

JNDI

Apache Directory API

Spring LDAP

pt.tecnico akka-ldap

Scala reflection/compiler API

MVEL

Java Scripting API

Groovy

Java EL

sbt Eval utility

Redis clients (Jedis, Lettuce)

Java RMI

gRPC

Apache Kafka client

Play Framework DB pool

ZIO JDBC

jose4j

Auth0 java-jwt

Apache HttpClient

OkHttp

Netty

AsyncHttpClient

Akka HTTP

RabbitMQ client

Typesafe/Lightbend config

Nimbus JOSE+JWT

pdi.jwt (jwt-scala)

authentikat-jwt

TSec

http4s-jwt-auth

Play-Silhouette

Bobcats

scalacrypt

Bouncy Castle

Apache Commons Codec

Guava

Lift Framework

pt.kcry

Hasher

Apache Commons Lang3

cats-effect

Akka

Apache Pekko actors

ClassGraph

Objenesis

Jackson

SnakeYAML

Kryo

XStream

Google Protocol Buffers

Apache Avro

Akka serialization

BooPickle

Scalatra

Jakarta Servlet

JAX-RS

dom4j

SAX

akka-http-session

fs2-data

kantan.xpath

scales.xml

jjwt

sttp

ZIO HTTP

scalaj-http

MongoDB Scala/Java driver

ReactiveMongo

DataStax Cassandra driver

AWS SDK DynamoDB

Quill

elastic4s

Neo4j

Neotypes

Couchbase

Play JSON

Mend SAST-supported Scala vulnerability types

Mend SAST detects multiple vulnerability types in Scala code. The Low Probability Impact column documents additional low probability sources, sanitizers, skipped sanitizers, and sinks where applicable.

High severity

CWE

Vulnerability Type

Low Probability Impact

CWE-22

Path Traversal

  • Additional Low Probability Sources:
    CLI args, stdin, DB+file reads, env vars, system properties, broader HTTP-response extraction

CWE-78

Command Injection

  • Additional Low Probability Sources:
    CLI args, stdin, DB reads, env vars, file reads, HTTP-response extraction, system properties

CWE-79

Cross-Site Scripting (XSS)

  • Additional Low Probability Sources:
    CLI args, stdin, DB reads, env vars, file reads, HTTP-response extraction, system properties

CWE-88

Argument Injection

  • Additional Low Probability Sources:
    CLI args, stdin, DB reads, env vars, file reads, HTTP-response extraction, system properties

CWE-89

SQL Injection

  • Additional Low Probability Sources:
    CLI args, stdin, DB reads, env vars, file reads, HTTP-response extraction, system properties

CWE-94

Code Injection

  • Additional Low Probability Sources:
    CLI args, stdin, DB reads, env vars, file reads, HTTP-response extraction, system properties

CWE-287

Improper Authentication (JWT none-algorithm acceptance)

  • UNAFFECTED

CWE-502

Deserialization of Untrusted Data

  • Additional Low Probability Sources:
    CLI args, stdin, DB reads, env vars, file reads, HTTP-response extraction, system properties

CWE-639

IDOR

  • Additional Low Probability Sources:
    CLI args, stdin, DB reads, env vars, file reads, HTTP-response extraction, system properties

CWE-643

XPath Injection

  • Additional Low Probability Sources:
    CLI args, stdin, DB reads, env vars, file reads, HTTP-response extraction, system properties

CWE-918

Server-Side Request Forgery (SSRF)

  • Additional Low Probability Sources:
    CLI args, stdin, DB reads, env vars, file reads, HTTP-response extraction, system properties

CWE-943

NoSQL Injection

  • Additional Low Probability Sources:
    CLI args, stdin, DB reads, env vars, file reads, HTTP-response extraction, system properties

Medium severity

CWE

Vulnerability Type

Low Probability Impact

CWE-90

LDAP Injection

  • Additional Low Probability Sources:
    CLI args, stdin, DB reads, env vars, file reads, HTTP-response extraction, system properties

CWE-99

Resource Injection

  • Additional Low Probability Sources:
    CLI args, stdin, DB reads, env vars, file reads, HTTP-response extraction, system properties

CWE-295

Improper Certificate Validation

  • Additional Low Probability Sources:
    CLI args, stdin, DB reads, env vars, file reads, HTTP-response extraction, system properties (applies only to the certificate-validation taint-flow check — the CWE's separate non-taint trust-manager structural check has no low-probability counterpart)

CWE-321

Hard-Coded Cryptographic Key

  • UNAFFECTED

CWE-327

Weak Crypto

  • Additional Low Probability Sources:
    Applies only to the JCE-cipher taint-flow check — CLI args, stdin, DB reads, env vars, file reads, HTTP-response extraction, system properties (the CWE's other, pure algorithm-name-only check has no taint source and no low variant)

CWE-338

Weak Random

  • UNAFFECTED

CWE-347

Improper Signature Verification (JWT signature skipped)

  • UNAFFECTED

CWE-400

Sleep DoS

  • Additional Low Probability Sources:
    CLI args, stdin, DB reads, env vars, file reads, HTTP-response extraction, system properties

CWE-470

Unsafe Reflection

  • Additional Low Probability Sources:
    CLI args, stdin, DB reads, env vars, file reads, HTTP-response extraction, system properties

CWE-611

XML External Entity (XXE)

  • Additional Low Probability Sources:
    CLI args, stdin, DB reads, env vars, file reads, HTTP-response extraction, system properties

CWE-798

Hard-Coded Credentials

  • Additional Low Probability Sinks:
    Assignment-based: string literal assigned to a credential-named variable/field, or a credential-shaped literal value. Comparison-based: equality comparison between a credential-named variable and a non-empty string literal. Both are brand-new heuristics with no high-probability counterpart.

Low severity

CWE

Vulnerability Type

Low Probability Impact

CWE-328

Weak Hash

  • UNAFFECTED

CWE-601

Open Redirect

  • Additional Low Probability Sources:
    CLI args, stdin, DB reads, env vars, file reads, HTTP-response extraction, system properties

CWE-614

Sensitive Cookie Without Secure Attribute

  • UNAFFECTED

CWE-1004

Insecure Cookie (Without HttpOnly)

  • UNAFFECTED

CWE-1333

Regular Expression Denial of Service (ReDoS)

  • Additional Low Probability Sources:
    CLI args, stdin, DB reads, env vars, file reads, HTTP-response extraction, system properties