slopbrick 0.29.0 → 0.31.0

package/dist/engine/worker.js

@@ -36971,6 +36971,211 @@ var goStructTagInconsistencyRule = createRule({
   }
 });
 
+// src/rules/java/command-injection.ts
+var COMMAND_INVOCATION_REGEX = /\b(?:Runtime\.exec|Runtime\.getRuntime\(\)\.exec|ProcessBuilder)\s*\(/;
+var STRING_CONCAT_REGEX = /["'][^"']*["']\s*\+/;
+var javaCommandInjectionRule = createRule({
+  id: "java/command-injection",
+  category: "security",
+  severity: "high",
+  aiSpecific: false,
+  description: "Runtime.exec() or ProcessBuilder with string concat \u2014 use List<String> args + validation",
+  create(_context) {
+    return {};
+  },
+  analyze(_context, facts) {
+    const issues = [];
+    const source = facts.v2?._source;
+    if (!source) return issues;
+    if (!/\.java$/i.test(facts.filePath)) return issues;
+    const lines = source.split("\n");
+    for (let i = 0; i < lines.length; i++) {
+      const line = lines[i];
+      if (!COMMAND_INVOCATION_REGEX.test(line)) continue;
+      if (!STRING_CONCAT_REGEX.test(line)) continue;
+      issues.push({
+        ruleId: "java/command-injection",
+        category: "security",
+        severity: "high",
+        aiSpecific: false,
+        message: `Command invocation with string concat at line ${i + 1}`,
+        line: i + 1,
+        column: 1,
+        advice: "Use ProcessBuilder with a List<String> of args (no shell parsing) and validate each arg against a whitelist. For shell commands, use bash -c only with a fixed string (no concatenation). String concat into Runtime.exec() is the canonical command-injection pattern \u2014 attackers can break out with `; rm -rf /` or `$(...)`. Reference: java/command-injection v0.30 (OWASP A03:2021)."
+      });
+    }
+    return issues;
+  }
+});
+
+// src/rules/java/hardcoded-credential.ts
+var KEY_REGEX = /\b(api[_-]?key|apikey|secret|token|password|auth|access[_-]?key|client[_-]?secret|private[_-]?key)\b\s*[=:]/i;
+var VALUE_REGEX = /["']([A-Za-z0-9_\-+/=.@*!]{16,})["']/;
+var FALSE_POSITIVES = /* @__PURE__ */ new Set([
+  "passwordless",
+  "tokenize",
+  "tokenizer",
+  "authorizationrequired",
+  "authenticated",
+  "authenticatortoken",
+  "authtoken",
+  "placeholder",
+  "changeme"
+]);
+var javaHardcodedCredentialRule = createRule({
+  id: "java/hardcoded-credential",
+  category: "security",
+  severity: "high",
+  aiSpecific: false,
+  description: "Hardcoded credential literal \u2014 use env vars or a secrets manager",
+  create(_context) {
+    return {};
+  },
+  analyze(_context, facts) {
+    const issues = [];
+    const source = facts.v2?._source;
+    if (!source) return issues;
+    if (!/\.java$/i.test(facts.filePath)) return issues;
+    if (/\/test\//i.test(facts.filePath) || /\/src\/test\//i.test(facts.filePath)) return issues;
+    const lines = source.split("\n");
+    for (let i = 0; i < lines.length; i++) {
+      const line = lines[i];
+      if (!KEY_REGEX.test(line)) continue;
+      const valueMatch = VALUE_REGEX.exec(line);
+      if (!valueMatch) continue;
+      const value = valueMatch[1];
+      if (FALSE_POSITIVES.has(value.toLowerCase())) continue;
+      if (!/[a-zA-Z]/.test(value) || !/[0-9]/.test(value)) continue;
+      if (value.startsWith("$")) continue;
+      issues.push({
+        ruleId: "java/hardcoded-credential",
+        category: "security",
+        severity: "high",
+        aiSpecific: false,
+        message: `Hardcoded credential at line ${i + 1}`,
+        line: i + 1,
+        column: 1,
+        advice: "Move the credential to an environment variable, a .env file that is .gitignore'd, or a secrets manager (Vault, AWS Secrets Manager, GCP Secret Manager). Hardcoded credentials are the #1 source of secret leaks on GitHub. Reference: java/hardcoded-credential v0.30 (OWASP A07:2021 \u2014 Identification and Authentication Failures)."
+      });
+    }
+    return issues;
+  }
+});
+
+// src/rules/java/sql-string-concat.ts
+var SQL_KEYWORD_REGEX = /\b(?:SELECT|INSERT\s+INTO|UPDATE|DELETE\s+FROM|CREATE\s+TABLE|DROP\s+TABLE|ALTER\s+TABLE)\b/i;
+var UNSAFE_REGEX = /\+/;
+var SAFE_REGEX = /(?:PreparedStatement|setParameter|setString|setInt|setLong|createQuery.*:.*\b(?:set|bind)|:name\b|\?\s*,)/;
+var javaSqlStringConcatRule = createRule({
+  id: "java/sql-string-concat",
+  category: "security",
+  severity: "high",
+  aiSpecific: false,
+  description: "SQL query built via string concat \u2014 use PreparedStatement or setParameter()",
+  create(_context) {
+    return {};
+  },
+  analyze(_context, facts) {
+    const issues = [];
+    const source = facts.v2?._source;
+    if (!source) return issues;
+    if (!/\.java$/i.test(facts.filePath)) return issues;
+    const lines = source.split("\n");
+    for (let i = 0; i < lines.length; i++) {
+      const line = lines[i];
+      if (!SQL_KEYWORD_REGEX.test(line)) continue;
+      if (!UNSAFE_REGEX.test(line)) continue;
+      if (SAFE_REGEX.test(line)) continue;
+      issues.push({
+        ruleId: "java/sql-string-concat",
+        category: "security",
+        severity: "high",
+        aiSpecific: false,
+        message: `SQL query built via string concat at line ${i + 1}`,
+        line: i + 1,
+        column: 1,
+        advice: 'Use a PreparedStatement (JDBC), setParameter (jOOQ), or an ORM (Hibernate, MyBatis with #{} binding). String concatenation into a SQL query is the canonical SQL-injection pattern \u2014 even "trusted" inputs (signed JWT, internal config) can be influenced by an attacker. Reference: java/sql-string-concat v0.30 (OWASP A03:2021).'
+      });
+    }
+    return issues;
+  }
+});
+
+// src/rules/java/system-out-println.ts
+var SYSTEM_OUT_REGEX = /\bSystem\.out\.println\s*\(/g;
+var REAL_LOGGING_IMPORT_REGEX = /\bimport\s+(?:org\.slf4j\.|org\.apache\.logging\.log4j|org\.apache\.log4j|java\.util\.logging|com\.google\.common\.logging)/;
+var javaSystemOutPrintlnRule = createRule({
+  id: "java/system-out-println",
+  category: "logic",
+  severity: "low",
+  aiSpecific: false,
+  description: "System.out.println() in a file that imports SLF4J/Log4j2 \u2014 use the declared logger instead",
+  create(_context) {
+    return {};
+  },
+  analyze(_context, facts) {
+    const issues = [];
+    const source = facts.v2?._source;
+    if (!source) return issues;
+    if (!/\.java$/i.test(facts.filePath)) return issues;
+    if (/\/test\//i.test(facts.filePath) || /\/src\/test\//i.test(facts.filePath)) return issues;
+    if (!REAL_LOGGING_IMPORT_REGEX.test(source)) return issues;
+    let m;
+    SYSTEM_OUT_REGEX.lastIndex = 0;
+    while ((m = SYSTEM_OUT_REGEX.exec(source)) !== null) {
+      const line = source.slice(0, m.index).split("\n").length;
+      issues.push({
+        ruleId: "java/system-out-println",
+        category: "logic",
+        severity: "low",
+        aiSpecific: false,
+        message: `System.out.println() at line ${line} (file imports a real logger)`,
+        line,
+        column: 1,
+        advice: "The file imports a real logging library (SLF4J, Log4j2, or java.util.logging) but uses System.out.println here. Replace `System.out.println(x)` with `log.info(x)` (or log.debug/warn/error as appropriate). The log object is already declared at the top of the file. Reference: java/system-out-println v0.31 (refined from v0.30)."
+      });
+    }
+    return issues;
+  }
+});
+
+// src/rules/java/thread-sleep-in-loop.ts
+var THREAD_SLEEP_REGEX = /\bThread\.sleep\s*\(/g;
+var javaThreadSleepInLoopRule = createRule({
+  id: "java/thread-sleep-in-loop",
+  category: "perf",
+  severity: "medium",
+  aiSpecific: false,
+  description: "Thread.sleep() in a loop \u2014 use ScheduledExecutorService or BlockingQueue",
+  create(_context) {
+    return {};
+  },
+  analyze(_context, facts) {
+    const issues = [];
+    const source = facts.v2?._source;
+    if (!source) return issues;
+    if (!/\.java$/i.test(facts.filePath)) return issues;
+    if (!/\bThread\.sleep\s*\(/.test(source)) return issues;
+    if (!/\b(?:for|while|do)\b/.test(source)) return issues;
+    let m;
+    THREAD_SLEEP_REGEX.lastIndex = 0;
+    while ((m = THREAD_SLEEP_REGEX.exec(source)) !== null) {
+      const line = source.slice(0, m.index).split("\n").length;
+      issues.push({
+        ruleId: "java/thread-sleep-in-loop",
+        category: "perf",
+        severity: "medium",
+        aiSpecific: false,
+        message: `Thread.sleep() at line ${line}`,
+        line,
+        column: 1,
+        advice: 'Use ScheduledExecutorService for periodic work, or BlockingQueue.take() for event-driven work. Thread.sleep in a loop is the classic "polling with sleep" anti-pattern \u2014 the thread blocks for the sleep duration each iteration. In server contexts this ties up Tomcat/Jetty/Netty threads. Reference: java/thread-sleep-in-loop v0.30.'
+      });
+    }
+    return issues;
+  }
+});
+
 // src/rules/kotlin/coroutine-global-scope.ts
 var GLOBAL_SCOPE_REGEX = /GlobalScope\s*\.\s*(?:launch|async|runBlocking)\s*[({]/g;
 var kotlinCoroutineGlobalScopeRule = createRule({
@@ -37103,9 +37308,9 @@ var kotlinForceUnwrapRule = createRule({
 });
 
 // src/rules/kotlin/hardcoded-credential.ts
-var KEY_REGEX = /\b(api[_-]?key|apikey|secret|token|password|auth|access[_-]?key|client[_-]?secret|private[_-]?key)\b\s*[=:]/i;
-var VALUE_REGEX = /["']([A-Za-z0-9_\-+/=.@*!]{16,})["']/;
-var FALSE_POSITIVES = /* @__PURE__ */ new Set([
+var KEY_REGEX2 = /\b(api[_-]?key|apikey|secret|token|password|auth|access[_-]?key|client[_-]?secret|private[_-]?key)\b\s*[=:]/i;
+var VALUE_REGEX2 = /["']([A-Za-z0-9_\-+/=.@*!]{16,})["']/;
+var FALSE_POSITIVES2 = /* @__PURE__ */ new Set([
   "passwordless",
   "tokenize",
   "tokenizer",
@@ -37135,11 +37340,11 @@ var kotlinHardcodedCredentialRule = createRule({
     const lines = source.split("\n");
     for (let i = 0; i < lines.length; i++) {
       const line = lines[i];
-      if (!KEY_REGEX.test(line)) continue;
-      const valueMatch = VALUE_REGEX.exec(line);
+      if (!KEY_REGEX2.test(line)) continue;
+      const valueMatch = VALUE_REGEX2.exec(line);
       if (!valueMatch) continue;
       const value = valueMatch[1];
-      if (FALSE_POSITIVES.has(value.toLowerCase())) continue;
+      if (FALSE_POSITIVES2.has(value.toLowerCase())) continue;
       if (!/[a-zA-Z]/.test(value) || !/[0-9]/.test(value)) continue;
       if (value.startsWith("$")) continue;
       if (/\/test\//i.test(facts.filePath) || /\.test\.kts?$/i.test(facts.filePath)) continue;
@@ -37210,7 +37415,7 @@ var kotlinObjectSingletonMisuseRule = createRule({
 
 // src/rules/kotlin/println-as-log.ts
 var PRINTLN_REGEX = /\bprintln\s*\(/g;
-var REAL_LOGGING_IMPORT_REGEX = /\bimport\s+(?:android\.util\.Log|org\.slf4j\.|io\.github\.oshai\.kotlinlogging|kotlin\.logging|co\.touchlab\.kermit|com\.github\.ajalt\.timber|org\.apache\.logging\.log4j)/;
+var REAL_LOGGING_IMPORT_REGEX2 = /\bimport\s+(?:android\.util\.Log|org\.slf4j\.|io\.github\.oshai\.kotlinlogging|kotlin\.logging|co\.touchlab\.kermit|com\.github\.ajalt\.timber|org\.apache\.logging\.log4j)/;
 var kotlinPrintlnAsLogRule = createRule({
   id: "kotlin/println-as-log",
   category: "logic",
@@ -37226,7 +37431,7 @@ var kotlinPrintlnAsLogRule = createRule({
     if (!source) return issues;
     if (!/\.kts?$/i.test(facts.filePath)) return issues;
     if (/\/test\//i.test(facts.filePath) || /\.test\.kts?$/i.test(facts.filePath)) return issues;
-    if (REAL_LOGGING_IMPORT_REGEX.test(source)) return issues;
+    if (REAL_LOGGING_IMPORT_REGEX2.test(source)) return issues;
     let m;
     PRINTLN_REGEX.lastIndex = 0;
     while ((m = PRINTLN_REGEX.exec(source)) !== null) {
@@ -37326,9 +37531,9 @@ var kotlinRunBlockingMisuseRule = createRule({
 });
 
 // src/rules/kotlin/sql-string-concat.ts
-var SQL_KEYWORD_REGEX = /\b(?:SELECT|INSERT\s+INTO|UPDATE|DELETE\s+FROM|CREATE\s+TABLE|DROP\s+TABLE|ALTER\s+TABLE)\b/i;
-var UNSAFE_REGEX = /(?:\+|\$\{)/;
-var SAFE_REGEX = /(?:PreparedStatement|setParameter|setString|setInt|setLong|bind|:name|:\\?\\?|\?\\s*,)/;
+var SQL_KEYWORD_REGEX2 = /\b(?:SELECT|INSERT\s+INTO|UPDATE|DELETE\s+FROM|CREATE\s+TABLE|DROP\s+TABLE|ALTER\s+TABLE)\b/i;
+var UNSAFE_REGEX2 = /(?:\+|\$\{)/;
+var SAFE_REGEX2 = /(?:PreparedStatement|setParameter|setString|setInt|setLong|bind|:name|:\\?\\?|\?\\s*,)/;
 var kotlinSqlStringConcatRule = createRule({
   id: "kotlin/sql-string-concat",
   category: "security",
@@ -37346,9 +37551,9 @@ var kotlinSqlStringConcatRule = createRule({
     const lines = source.split("\n");
     for (let i = 0; i < lines.length; i++) {
       const line = lines[i];
-      if (!SQL_KEYWORD_REGEX.test(line)) continue;
-      if (!UNSAFE_REGEX.test(line)) continue;
-      if (SAFE_REGEX.test(line)) continue;
+      if (!SQL_KEYWORD_REGEX2.test(line)) continue;
+      if (!UNSAFE_REGEX2.test(line)) continue;
+      if (SAFE_REGEX2.test(line)) continue;
       issues.push({
         ruleId: "kotlin/sql-string-concat",
         category: "security",
@@ -37365,7 +37570,7 @@ var kotlinSqlStringConcatRule = createRule({
 });
 
 // src/rules/kotlin/string-concat-loop.ts
-var STRING_CONCAT_REGEX = /\b(\w+)\s*=\s*\1\s*\+\s*[^;}]+[;}\n]/g;
+var STRING_CONCAT_REGEX2 = /\b(\w+)\s*=\s*\1\s*\+\s*[^;}]+[;}\n]/g;
 var kotlinStringConcatLoopRule = createRule({
   id: "kotlin/string-concat-loop",
   category: "perf",
@@ -37382,8 +37587,8 @@ var kotlinStringConcatLoopRule = createRule({
     if (!/\.kts?$/i.test(facts.filePath)) return issues;
     if (!/\b(?:for|while|repeat|forEach)\b/.test(source)) return issues;
     let m;
-    STRING_CONCAT_REGEX.lastIndex = 0;
-    while ((m = STRING_CONCAT_REGEX.exec(source)) !== null) {
+    STRING_CONCAT_REGEX2.lastIndex = 0;
+    while ((m = STRING_CONCAT_REGEX2.exec(source)) !== null) {
       const line = source.slice(0, m.index).split("\n").length;
       const lineText = source.slice(0, m.index).split("\n").pop() ?? "";
       if (/\.append\s*\(/.test(lineText)) continue;
@@ -42924,6 +43129,11 @@ var builtinRules = [
   goErrorWrapWithoutContextRule,
   goNilSliceVsEmptyRule,
   goStructTagInconsistencyRule,
+  javaCommandInjectionRule,
+  javaHardcodedCredentialRule,
+  javaSqlStringConcatRule,
+  javaSystemOutPrintlnRule,
+  javaThreadSleepInLoopRule,
   kotlinCoroutineGlobalScopeRule,
   kotlinDataClassDefaultsOveruseRule,
   kotlinForceUnwrapRule,
@@ -45231,6 +45441,86 @@ var signal_strength_default = {
     _v9Precision: 0.0271,
     defaultOff: true
   },
+  "java/sql-string-concat": {
+    recall: 0.01116,
+    fpRate: 0.01892,
+    ratio: 0.59,
+    precision: 0.0691,
+    lastCalibratedAt: "2026-07-03T00:00:00Z",
+    verdict: "DORMANT",
+    _calibrationNote: "v0.30: v9 Java calibration (81891 neg, 10305 pos). ratio=0.59 \u2014 fires 1.7x more on pre-2022 (neg) than post-2024 (pos). Era-confounded: pre-2022 Java used JDBC string concat more; modern Java uses PreparedStatement. Same direction as kotlin/sql-string-concat. 1664 total fires \u2014 Java uses ORMs (Hibernate) heavily so SQL concat is rare in both arms. defaultOff.",
+    aiSpecific: false,
+    _v9Verdict: "DORMANT",
+    _v9Lift: 0.59,
+    _v9Recall: 0.01116,
+    _v9FpRate: 0.01892,
+    _v9Precision: 0.0691,
+    defaultOff: true
+  },
+  "java/hardcoded-credential": {
+    recall: 0,
+    fpRate: 4e-5,
+    ratio: 0,
+    precision: 0,
+    lastCalibratedAt: "2026-07-03T00:00:00Z",
+    verdict: "DORMANT",
+    _calibrationNote: "v0.30: v9 Java calibration (81891 neg, 10305 pos). 3 fires total \u2014 only in pre-2022 (neg). Real secrets are in env vars / config files, not source. INSUFFICIENT_DATA: needs different corpus (CI configs, .env samples, leaked-secret datasets). defaultOff.",
+    aiSpecific: false,
+    _v9Verdict: "DORMANT",
+    _v9Lift: 0,
+    _v9Recall: 0,
+    _v9FpRate: 4e-5,
+    _v9Precision: 0,
+    defaultOff: true
+  },
+  "java/thread-sleep-in-loop": {
+    recall: 0.0228,
+    fpRate: 0.02343,
+    ratio: 0.97,
+    precision: 0.1091,
+    lastCalibratedAt: "2026-07-03T00:00:00Z",
+    verdict: "DORMANT",
+    _calibrationNote: "v0.30: v9 Java calibration (81891 neg, 10305 pos). ratio=0.97 (just below 1.0) \u2014 fires equally on both arms. Borderline era-confound: pre-2022 Java had more Thread.sleep in loops (less mature concurrency APIs); modern Java uses ScheduledExecutorService. Same direction as kotlin/runblocking-misuse (0.50). 2154 total fires \u2014 high absolute count, meaningful measurement. defaultOff.",
+    aiSpecific: false,
+    _v9Verdict: "DORMANT",
+    _v9Lift: 0.97,
+    _v9Recall: 0.0228,
+    _v9FpRate: 0.02343,
+    _v9Precision: 0.1091,
+    defaultOff: true
+  },
+  "java/system-out-println": {
+    recall: 116e-5,
+    fpRate: 67e-5,
+    ratio: 1.73,
+    precision: 0.1791,
+    lastCalibratedAt: "2026-07-03T00:00:00Z",
+    verdict: "OK",
+    _calibrationNote: "v0.31: v9 Java calibration REFINED \u2014 rule now requires the file to import a real logger (SLF4J, Log4j2, java.util.logging) AND have System.out.println calls. This is the 'set up but didn't use' anti-pattern. ratio=1.73 (\u22651.5) \u2014 second positive-signal rule in v9 history. v0.30.0 unrefined version had ratio=3.29 but precision=29.3% (over 5800 fires diluted by legitimate System.out in non-slf4j files). v0.31.0 refined version: 12 TP, 55 FP \u2014 much more selective, but absolute count is too small for production-grade measurement. precision=17.91% (still below 50% USEFUL threshold). The refinement succeeded: the fires dropped 99% (5866\u219267) and precision went 29.3%\u219217.9% (a tradeoff \u2014 fewer fires but more targeted). The direction is preserved: post-2024 Java has slightly more 'slf4j import + System.out call' than pre-2022. defaultOff: still set true (precision below 50%).",
+    aiSpecific: false,
+    _v9Verdict: "OK",
+    _v9Lift: 1.73,
+    _v9Recall: 116e-5,
+    _v9FpRate: 67e-5,
+    _v9Precision: 0.1791,
+    defaultOff: true
+  },
+  "java/command-injection": {
+    recall: 0,
+    fpRate: 1e-4,
+    ratio: 0,
+    precision: 0,
+    lastCalibratedAt: "2026-07-03T00:00:00Z",
+    verdict: "DORMANT",
+    _calibrationNote: "v0.30: v9 Java calibration (81891 neg, 10305 pos). 8 fires total, all in neg. Command injection is rare in modern Java \u2014 most apps use ProcessBuilder with List<String> args, not Runtime.exec with concat. INSUFFICIENT_DATA: needs different corpus (security benchmarks, CVE samples). defaultOff.",
+    aiSpecific: false,
+    _v9Verdict: "DORMANT",
+    _v9Lift: 0,
+    _v9Recall: 0,
+    _v9FpRate: 1e-4,
+    _v9Precision: 0,
+    defaultOff: true
+  },
   "swift/force-unwrap": {
     recall: 0,
     fpRate: 0,