Avoid Direct Database Connection

ID

java.avoid_direct_database_connection

Severity

low

Resource

Api

Language

Java

Tags

CWE:245, NIST.SP.800-53, PCI-DSS:6.5.6

Description

Improper direct management of database connections within a J2EE application.

Rationale

The J2EE standard mandates that applications utilize the container’s resource management capabilities to acquire connections to resources, typically using javax.sql.DataSource accessed through JNDI.

This rule identifies non-recommended methods of obtaining a connection, such as using JDBC DriverManager.getConnection().

Remediation

The J2EE application should use the web application container’s resource management facilities to obtain a connection to the database as shown in the following example.