@zhuma4/cli 4.0.0-alpha.1

package/rules/rules_index.yaml.off

@@ -0,0 +1,477 @@
+# 逐码 ZhuMa V4.0 — 通用规则库清单
+# 自动生成 | 覆盖 CWE Top 25 (2024) Java 规则
+
+version: "4.0.0-alpha"
+total_rules: 54
+coverage:
+  cwe_top_25_p0: 14
+  cwe_top_25_p1: 10
+  cwe_crypto: 23
+  total_covered: 24
+
+rules:
+  # ============================================
+  # P0 — CWE Top 25 关键规则 (14条)
+  # ============================================
+
+  - id: zm-java-sqli-001
+    cwe: "CWE-89"
+    title: "JDBC Statement 字符串拼接 SQL 注入"
+    severity: CRITICAL
+    file: cwe-89-sqli.yaml
+    status: PASS
+
+  - id: zm-java-sqli-002
+    cwe: "CWE-89"
+    title: "MyBatis ${} 动态 SQL"
+    severity: CRITICAL
+    file: cwe-89-sqli.yaml
+    status: PASS
+
+  - id: zm-java-sqli-003
+    cwe: "CWE-89"
+    title: "JdbcTemplate 字符串拼接"
+    severity: HIGH
+    file: cwe-89-sqli.yaml
+    status: PASS
+
+  - id: zm-java-sqli-004
+    cwe: "CWE-89"
+    title: "String.format 构造 SQL"
+    severity: HIGH
+    file: cwe-89-sqli.yaml
+    status: PASS
+
+  - id: zm-java-xss-001
+    cwe: "CWE-79"
+    title: "response.getWriter 未转义输出 request.getParameter"
+    severity: HIGH
+    file: cwe-79-xss.yaml
+    status: PASS
+
+  - id: zm-java-xss-002
+    cwe: "CWE-79"
+    title: "request.getParameter 赋值后未转义直接输出"
+    severity: HIGH
+    file: cwe-79-xss.yaml
+    status: PASS
+
+  - id: zm-java-osci-001
+    cwe: "CWE-78"
+    title: "Runtime.exec 字符串拼接"
+    severity: CRITICAL
+    file: cwe-78-os-command-injection.yaml
+    status: PASS
+
+  - id: zm-java-osci-002
+    cwe: "CWE-78"
+    title: "ProcessBuilder 参数拼接"
+    severity: HIGH
+    file: cwe-78-os-command-injection.yaml
+    status: PASS
+
+  - id: zm-java-pt-001
+    cwe: "CWE-22"
+    title: "File/FileInputStream 拼接用户输入"
+    severity: HIGH
+    file: cwe-22-path-traversal.yaml
+    status: PASS
+
+  - id: zm-java-pt-002
+    cwe: "CWE-22"
+    title: "直接使用 request.getParameter 作为文件路径"
+    severity: MEDIUM
+    file: cwe-22-path-traversal.yaml
+    status: PASS
+
+  - id: zm-java-csrf-001
+    cwe: "CWE-352"
+    title: "Spring Security 显式禁用 CSRF"
+    severity: HIGH
+    file: cwe-352-csrf.yaml
+    status: PASS
+
+  - id: zm-java-xxe-001
+    cwe: "CWE-611"
+    title: "DocumentBuilderFactory 未禁用外部实体"
+    severity: HIGH
+    file: cwe-611-xxe.yaml
+    status: PASS
+
+  - id: zm-java-xxe-002
+    cwe: "CWE-611"
+    title: "SAXParserFactory 未禁用外部实体"
+    severity: HIGH
+    file: cwe-611-xxe.yaml
+    status: PASS
+
+  - id: zm-java-xxe-003
+    cwe: "CWE-611"
+    title: "XMLInputFactory 未禁用 DTD"
+    severity: HIGH
+    file: cwe-611-xxe.yaml
+    status: PASS
+
+  - id: zm-java-hc-001
+    cwe: "CWE-798"
+    title: "硬编码密码字面量"
+    severity: CRITICAL
+    file: cwe-798-hardcoded-credentials.yaml
+    status: PASS
+
+  - id: zm-java-hc-002
+    cwe: "CWE-798"
+    title: "password/passwd 变量赋字符串字面量"
+    severity: HIGH
+    file: cwe-798-hardcoded-credentials.yaml
+    status: PASS
+
+  - id: zm-java-hc-003
+    cwe: "CWE-798"
+    title: "JDBC 连接字符串硬编码密码"
+    severity: HIGH
+    file: cwe-798-hardcoded-credentials.yaml
+    status: PASS
+
+  - id: zm-java-ma-001
+    cwe: "CWE-306"
+    title: "@GetMapping/@PostMapping 无认证注解"
+    severity: MEDIUM
+    file: cwe-306-missing-authentication.yaml
+    status: PASS
+
+  - id: zm-java-ma-002
+    cwe: "CWE-306"
+    title: "Spring Security permitAll 无认证要求"
+    severity: MEDIUM
+    file: cwe-306-missing-authentication.yaml
+    status: PASS
+
+  - id: zm-java-ds-001
+    cwe: "CWE-502"
+    title: "ObjectInputStream.readObject 无过滤"
+    severity: CRITICAL
+    file: cwe-502-insecure-deserialization.yaml
+    status: PASS
+
+  - id: zm-java-ds-002
+    cwe: "CWE-502"
+    title: "ObjectInputStream 无类型过滤包装"
+    severity: MEDIUM
+    file: cwe-502-insecure-deserialization.yaml
+    status: PASS
+
+  - id: zm-java-sde-001
+    cwe: "CWE-200"
+    title: "日志输出敏感变量 (password/token/apiKey)"
+    severity: HIGH
+    file: cwe-200-sensitive-data-exposure.yaml
+    status: PASS
+
+  - id: zm-java-sde-002
+    cwe: "CWE-200"
+    title: "toString 暴露敏感字段"
+    severity: MEDIUM
+    file: cwe-200-sensitive-data-exposure.yaml
+    status: PASS
+
+  - id: zm-java-sde-003
+    cwe: "CWE-200"
+    title: "printStackTrace 泄漏堆栈信息"
+    severity: LOW
+    file: cwe-200-sensitive-data-exposure.yaml
+    status: PASS
+
+  - id: zm-java-ci-001
+    cwe: "CWE-94"
+    title: "ScriptEngine.eval 用户输入"
+    severity: CRITICAL
+    file: cwe-94-code-injection.yaml
+    status: PASS
+
+  - id: zm-java-ci-002
+    cwe: "CWE-94"
+    title: "GroovyShell 动态执行"
+    severity: CRITICAL
+    file: cwe-94-code-injection.yaml
+    status: PASS
+
+  - id: zm-java-ci-003
+    cwe: "CWE-94"
+    title: "Class.forName 动态加载"
+    severity: MEDIUM
+    file: cwe-94-code-injection.yaml
+    status: PASS
+
+  # ============================================
+  # P1 — CWE Top 25 扩展规则 (10条)
+  # ============================================
+
+  - id: zm-java-ssl-001
+    cwe: "CWE-295"
+    title: "X509TrustManager 信任所有证书"
+    severity: HIGH
+    file: cwe-295-ssl-verification-disabled.yaml
+    status: PASS
+
+  - id: zm-java-ssl-002
+    cwe: "CWE-295"
+    title: "HostnameVerifier 总是返回 true"
+    severity: HIGH
+    file: cwe-295-ssl-verification-disabled.yaml
+    status: PASS
+
+  - id: zm-java-ssl-003
+    cwe: "CWE-295"
+    title: "ALLOW_ALL_HOSTNAME_VERIFIER"
+    severity: HIGH
+    file: cwe-295-ssl-verification-disabled.yaml
+    status: PASS
+
+  - id: zm-java-ssrf-001
+    cwe: "CWE-918"
+    title: "HttpURLConnection URL 用户可控"
+    severity: HIGH
+    file: cwe-918-ssrf.yaml
+    status: PASS
+
+  - id: zm-java-ssrf-002
+    cwe: "CWE-918"
+    title: "RestTemplate URL 用户可控"
+    severity: MEDIUM
+    file: cwe-918-ssrf.yaml
+    status: PASS
+
+  - id: zm-java-fu-001
+    cwe: "CWE-434"
+    title: "MultipartFile.transferTo 无扩展名校验"
+    severity: HIGH
+    file: cwe-434-unrestricted-file-upload.yaml
+    status: PASS
+
+  - id: zm-java-fu-002
+    cwe: "CWE-434"
+    title: "FileOutputStream 直接用用户文件名"
+    severity: MEDIUM
+    file: cwe-434-unrestricted-file-upload.yaml
+    status: PASS
+
+  - id: zm-java-maz-001
+    cwe: "CWE-862"
+    title: "敏感操作无授权检查"
+    severity: HIGH
+    file: cwe-862-missing-authorization.yaml
+    status: PASS
+
+  - id: zm-java-re-001
+    cwe: "CWE-770"
+    title: "while(true) 无超时退出条件"
+    severity: MEDIUM
+    file: cwe-770-resource-exhaustion.yaml
+    status: PASS
+
+  - id: zm-java-re-002
+    cwe: "CWE-770"
+    title: "无限制读取输入流"
+    severity: LOW
+    file: cwe-770-resource-exhaustion.yaml
+    status: PASS
+
+  - id: zm-java-oob-001
+    cwe: "CWE-787"
+    title: "数组索引无边界检查"
+    severity: MEDIUM
+    file: cwe-787-out-of-bounds-write.yaml
+    status: PASS
+
+  - id: zm-java-oob-002
+    cwe: "CWE-787"
+    title: "ByteBuffer put 无 capacity 检查"
+    severity: LOW
+    file: cwe-787-out-of-bounds-write.yaml
+    status: PASS
+
+  - id: zm-java-ip-001
+    cwe: "CWE-732"
+    title: "setWritable/readable/executable 过宽权限"
+    severity: MEDIUM
+    file: cwe-732-incorrect-permission.yaml
+    status: PASS
+
+  - id: zm-java-ip-002
+    cwe: "CWE-732"
+    title: "Runtime.exec chmod 777"
+    severity: HIGH
+    file: cwe-732-incorrect-permission.yaml
+    status: PASS
+
+  # ============================================
+  # P2 — 密码学规则 (CWE-327/326/328/329/295/798, 23条)
+  # ============================================
+
+  # CWE-327: 弱加密算法 (6条)
+  - id: zm-java-weakcrypto-001
+    cwe: "CWE-327"
+    title: "DES/3DES 加密算法"
+    severity: CRITICAL
+    file: cwe-327-weak-crypto.yaml
+    status: PASS
+
+  - id: zm-java-weakcrypto-002
+    cwe: "CWE-327"
+    title: "RC2/RC4/Blowfish 弱算法"
+    severity: CRITICAL
+    file: cwe-327-weak-crypto.yaml
+    status: PASS
+
+  - id: zm-java-weakcrypto-003
+    cwe: "CWE-327"
+    title: "ECB 模式 (无认证加密)"
+    severity: HIGH
+    file: cwe-327-weak-crypto.yaml
+    status: PASS
+
+  - id: zm-java-weakcrypto-004
+    cwe: "CWE-327"
+    title: "RSA 无OAEP填充或弱填充"
+    severity: HIGH
+    file: cwe-327-weak-crypto.yaml
+    status: PASS
+
+  - id: zm-java-weakcrypto-005
+    cwe: "CWE-327"
+    title: "JWT Algorithm=none"
+    severity: CRITICAL
+    file: cwe-327-weak-crypto.yaml
+    status: PASS
+
+  - id: zm-java-weakcrypto-006
+    cwe: "CWE-327"
+    title: "固定IV/Hardcoded IV"
+    severity: HIGH
+    file: cwe-327-weak-crypto.yaml
+    status: PASS
+
+  # CWE-326: 密钥强度不足 (3条)
+  - id: zm-java-weakkey-001
+    cwe: "CWE-326"
+    title: "AES 密钥长度 <128 位"
+    severity: CRITICAL
+    file: cwe-326-weak-key-size.yaml
+    status: PASS
+
+  - id: zm-java-weakkey-002
+    cwe: "CWE-326"
+    title: "RSA 密钥 <2048 位"
+    severity: CRITICAL
+    file: cwe-326-weak-key-size.yaml
+    status: PASS
+
+  - id: zm-java-weakkey-003
+    cwe: "CWE-326"
+    title: "EC 密钥 <256 位"
+    severity: HIGH
+    file: cwe-326-weak-key-size.yaml
+    status: PASS
+
+  # CWE-328: 弱哈希函数 (4条)
+  - id: zm-java-weakhash-001
+    cwe: "CWE-328"
+    title: "MD2/MD4/MD5 哈希算法"
+    severity: CRITICAL
+    file: cwe-328-weak-hash.yaml
+    status: PASS
+
+  - id: zm-java-weakhash-002
+    cwe: "CWE-328"
+    title: "PBKDF2 迭代次数不足"
+    severity: CRITICAL
+    file: cwe-328-weak-hash.yaml
+    status: PASS
+
+  - id: zm-java-weakhash-003
+    cwe: "CWE-328"
+    title: "SHA-1 在安全场景使用"
+    severity: HIGH
+    file: cwe-328-weak-hash.yaml
+    status: PASS
+
+  - id: zm-java-weakhash-004
+    cwe: "CWE-328"
+    title: "无盐哈希存储"
+    severity: MEDIUM
+    file: cwe-328-weak-hash.yaml
+    status: PASS
+
+  # CWE-329: CBC Padding Oracle (2条)
+  - id: zm-java-cbcmode-001
+    cwe: "CWE-329"
+    title: "AES/CBC/PKCS5Padding (Padding Oracle风险)"
+    severity: HIGH
+    file: cwe-329-cbc-mode.yaml
+    status: PASS
+
+  - id: zm-java-cbcmode-002
+    cwe: "CWE-329"
+    title: "Cipher.doFinal() 未检查 BadPaddingException"
+    severity: MEDIUM
+    file: cwe-329-cbc-mode.yaml
+    status: PASS
+
+  # CWE-295: SSL/TLS 证书绕过 (4条扩展)
+  - id: zm-java-sslverify-001
+    cwe: "CWE-295"
+    title: "X509TrustManager 空校验 (checkServerTrusted)"
+    severity: CRITICAL
+    file: cwe-295-ssl-bypass.yaml
+    status: PASS
+
+  - id: zm-java-sslverify-002
+    cwe: "CWE-295"
+    title: "HostnameVerifier 全部接受 (return true)"
+    severity: HIGH
+    file: cwe-295-ssl-bypass.yaml
+    status: PASS
+
+  - id: zm-java-sslverify-003
+    cwe: "CWE-295"
+    title: "allowAllHostnames() 调用"
+    severity: HIGH
+    file: cwe-295-ssl-bypass.yaml
+    status: PASS
+
+  - id: zm-java-sslverify-004
+    cwe: "CWE-295"
+    title: "SSLContext.init 空 TrustManager"
+    severity: CRITICAL
+    file: cwe-295-ssl-bypass.yaml
+    status: PASS
+
+  # CWE-798: 硬编码凭证扩展 (4条)
+  - id: zm-java-hardcoded-003
+    cwe: "CWE-798"
+    title: "OAuth Client Secret 硬编码"
+    severity: CRITICAL
+    file: cwe-798-hardcoded-creds.yaml
+    status: PASS
+
+  - id: zm-java-hardcoded-004
+    cwe: "CWE-798"
+    title: "SMTP/Email 密码硬编码"
+    severity: HIGH
+    file: cwe-798-hardcoded-creds.yaml
+    status: PASS
+
+  - id: zm-java-hardcoded-005
+    cwe: "CWE-798"
+    title: "数据库密码在 JDBC URL 中"
+    severity: CRITICAL
+    file: cwe-798-hardcoded-creds.yaml
+    status: PASS
+
+  - id: zm-java-hardcoded-006
+    cwe: "CWE-798"
+    title: "云 AK/SK 硬编码 (AWS/阿里云/腾讯云)"
+    severity: CRITICAL
+    file: cwe-798-hardcoded-creds.yaml
+    status: PASS

package/rules/semgrep-registry/anonymous-ldap-bind.yaml

@@ -0,0 +1,34 @@
+rules:
+- id: anonymous-ldap-bind
+  metadata:
+    cwe:
+    - 'CWE-287: Improper Authentication'
+    owasp:
+    - A02:2017 - Broken Authentication
+    - A07:2021 - Identification and Authentication Failures
+    - A07:2025 - Authentication Failures
+    source-rule-url: https://find-sec-bugs.github.io/bugs.htm#LDAP_ANONYMOUS
+    category: security
+    technology:
+    - java
+    references:
+    - https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures
+    cwe2022-top25: true
+    cwe2021-top25: true
+    subcategory:
+    - audit
+    likelihood: LOW
+    impact: HIGH
+    confidence: LOW
+  message: >-
+    Detected anonymous LDAP bind.
+    This permits anonymous users to execute LDAP statements. Consider enforcing
+    authentication for LDAP. See https://docs.oracle.com/javase/tutorial/jndi/ldap/auth_mechs.html
+    for more information.
+  severity: WARNING
+  pattern: |
+    $ENV.put($CTX.SECURITY_AUTHENTICATION, "none");
+    ...
+    $DCTX = new InitialDirContext($ENV, ...);
+  languages:
+  - java

package/rules/semgrep-registry/bad-hexa-conversion.yaml

@@ -0,0 +1,32 @@
+rules:
+- id: bad-hexa-conversion
+  metadata:
+    cwe:
+    - 'CWE-704: Incorrect Type Conversion or Cast'
+    owasp: 'A03:2017 - Sensitive Data Exposure'
+    source-rule-url: https://find-sec-bugs.github.io/bugs.htm#BAD_HEXA_CONVERSION
+    category: security
+    technology:
+    - java
+    references:
+    - https://cwe.mitre.org/data/definitions/704.html
+    subcategory:
+    - audit
+    likelihood: LOW
+    impact: LOW
+    confidence: LOW
+  message: >-
+    'Integer.toHexString()' strips leading zeroes from each byte if read byte-by-byte.
+    This mistake weakens the hash value computed since it introduces more collisions.
+    Use 'String.format("%02X", ...)' instead.
+  severity: WARNING
+  languages: [java]
+  pattern: |-
+    $X $METHOD(...) {
+      ...
+      MessageDigest $MD = ...;
+      ...
+      $MD.digest(...);
+      ...
+      Integer.toHexString(...);
+    }

package/rules/semgrep-registry/blowfish-insufficient-key-size.yaml

@@ -0,0 +1,39 @@
+rules:
+- id: blowfish-insufficient-key-size
+  metadata:
+    cwe:
+    - 'CWE-326: Inadequate Encryption Strength'
+    owasp:
+    - A03:2017 - Sensitive Data Exposure
+    - A02:2021 - Cryptographic Failures
+    - A04:2025 - Cryptographic Failures
+    source-rule-url: https://find-sec-bugs.github.io/bugs.htm#BLOWFISH_KEY_SIZE
+    asvs:
+      section: V6 Stored Cryptography Verification Requirements
+      control_id: 6.2.5 Insecure Algorithm
+      control_url: https://github.com/OWASP/ASVS/blob/master/4.0/en/0x14-V6-Cryptography.md#v62-algorithms
+      version: '4'
+    category: security
+    technology:
+    - java
+    references:
+    - https://owasp.org/Top10/A02_2021-Cryptographic_Failures
+    subcategory:
+    - audit
+    likelihood: HIGH
+    impact: MEDIUM
+    confidence: HIGH
+  message: >-
+    Using less than 128 bits for Blowfish is considered insecure. Use 128 bits
+    or more, or switch to use AES instead.
+  severity: WARNING
+  languages:
+  - java
+  patterns:
+  - pattern: |
+      $KEYGEN = KeyGenerator.getInstance("Blowfish");
+      ...
+      $KEYGEN.init($SIZE);
+  - metavariable-comparison:
+      metavariable: $SIZE
+      comparison: $SIZE < 128

package/rules/semgrep-registry/cbc-padding-oracle.yaml

@@ -0,0 +1,38 @@
+rules:
+- id: cbc-padding-oracle
+  message: >-
+    Using CBC with PKCS5Padding is susceptible to padding oracle attacks. A malicious
+    actor
+    could discern the difference between plaintext with valid or invalid padding.
+    Further,
+    CBC mode does not include any integrity checks.
+    Use 'AES/GCM/NoPadding' instead.
+  metadata:
+    cwe:
+    - 'CWE-327: Use of a Broken or Risky Cryptographic Algorithm'
+    owasp:
+    - A03:2017 - Sensitive Data Exposure
+    - A02:2021 - Cryptographic Failures
+    - A04:2025 - Cryptographic Failures
+    source-rule-url: https://find-sec-bugs.github.io/bugs.htm#PADDING_ORACLE
+    references:
+    - https://capec.mitre.org/data/definitions/463.html
+    - https://cheatsheetseries.owasp.org/cheatsheets/Cryptographic_Storage_Cheat_Sheet.html#cipher-modes
+    - https://find-sec-bugs.github.io/bugs.htm#CIPHER_INTEGRITY
+    category: security
+    technology:
+    - java
+    subcategory:
+    - audit
+    likelihood: HIGH
+    impact: MEDIUM
+    confidence: HIGH
+  severity: WARNING
+  fix: |
+    "AES/GCM/NoPadding"
+  languages:
+  - java
+  patterns:
+  - pattern-inside: Cipher.getInstance("=~/.*\/CBC\/PKCS5Padding/")
+  - pattern: |
+      "=~/.*\/CBC\/PKCS5Padding/"

package/rules/semgrep-registry/command-injection-formatted-runtime-call.yaml

@@ -0,0 +1,90 @@
+rules:
+- id: command-injection-formatted-runtime-call
+  patterns:
+  - metavariable-pattern:
+      metavariable: $RUNTIME
+      patterns:
+      - pattern-either:
+        - pattern: (java.lang.Runtime $R)
+        - pattern: java.lang.Runtime.getRuntime(...)
+  - pattern-either:
+    - pattern: $RUNTIME.exec($X + $Y);
+    - pattern: $RUNTIME.exec(String.format(...));
+    - pattern: $RUNTIME.loadLibrary($X + $Y);
+    - pattern: $RUNTIME.loadLibrary(String.format(...));
+    - patterns:
+      - pattern-either:
+        - pattern: | 
+            $RUNTIME.exec("=~/(sh|bash|ksh|csh|tcsh|zsh)/", "-c", $ARG,...)
+        - pattern: |
+            $RUNTIME.exec(Arrays.asList("=~/(sh|bash|ksh|csh|tcsh|zsh)/","-c",$ARG,...),...)
+        - pattern: |
+            $RUNTIME.exec(new String[]{"=~/(sh|bash|ksh|csh|tcsh|zsh)/","-c",$ARG,...},...)
+        - patterns:
+          - pattern-either:
+            - pattern: |
+                $RUNTIME.exec($CMD,"-c",$ARG,...)
+            - pattern: |
+                $RUNTIME.exec(Arrays.asList($CMD,"-c",$ARG,...),...)
+            - pattern: |
+                $RUNTIME.exec(new String[]{$CMD,"-c",$ARG,...},...)
+          - pattern-inside: |
+              $CMD = "=~/(sh|bash|ksh|csh|tcsh|zsh)/";
+              ...
+        - patterns:
+          - pattern-either:
+            - pattern: |
+                $RUNTIME.exec($CMD, $EXECUTE, $ARG, ...)
+          - pattern-inside: |
+              $CMD = new String[]{"=~/(sh|bash|ksh|csh|tcsh|zsh)/", ...};
+              ...
+        - patterns:
+            - pattern-either:
+                - pattern: | 
+                    $RUNTIME.exec("=~/(sh|bash|ksh|csh|tcsh|zsh)/", $BASH, $ARG,...)
+                - pattern: |
+                    $RUNTIME.exec(Arrays.asList("=~/(sh|bash|ksh|csh|tcsh|zsh)/",$BASH,$ARG,...),...)
+                - pattern: |
+                    $RUNTIME.exec(new String[]{"=~/(sh|bash|ksh|csh|tcsh|zsh)/",$BASH,$ARG,...},...)
+            - pattern-inside: |
+                $BASH = new String[]{"=~/(-c)/", ...};
+                ...
+      - pattern-not-inside: |
+          $ARG = "...";
+          ...
+      - pattern-not: |
+          $RUNTIME.exec("...","...","...",...)
+      - pattern-not: |
+          $RUNTIME.exec(new String[]{"...","...","...",...},...)
+      - pattern-not: |
+          $RUNTIME.exec(Arrays.asList("...","...","...",...),...)
+  message: >-
+    A formatted or concatenated string was detected as input to a java.lang.Runtime
+    call.
+    This is dangerous if a variable is controlled by user input and could result in
+    a
+    command injection. Ensure your variables are not controlled by users or sufficiently
+    sanitized.
+  metadata:
+    cwe:
+    - "CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')"
+    owasp:
+    - A01:2017 - Injection
+    - A03:2021 - Injection
+    - A05:2025 - Injection
+    source-rule-url: https://find-sec-bugs.github.io/bugs.htm#COMMAND_INJECTION.
+    category: security
+    technology:
+    - java
+    references:
+    - https://owasp.org/Top10/A03_2021-Injection
+    cwe2022-top25: true
+    cwe2021-top25: true
+    subcategory:
+    - audit
+    likelihood: LOW
+    impact: HIGH
+    confidence: LOW
+  severity: ERROR
+  languages:
+  - java