Java security best practices

Usage

This recipe has no required configuration options. You’ll need the Moderne CLI configured before running the command below.

mod run . --recipe org.openrewrite.java.security.JavaSecurityBestPractices

If the recipe isn’t available locally, install it with:

mod config recipes jar install org.openrewrite.recipe:rewrite-java-security:3.36.0

Definition

This recipe runs the following recipes in order.

• XML parser XXE vulnerabilityorg.openrewrite.java.security.XmlParserXXEVulnerability
• Use Files#createTempDirectoryorg.openrewrite.java.security.UseFilesCreateTempDirectory
• Use secure temporary file creationorg.openrewrite.java.security.SecureTempFileCreation
• Zip sliporg.openrewrite.java.security.ZipSlip
• Replace Runtime.exec(String) with Runtime.exec(String[])org.openrewrite.java.security.FixCommandInjectionLiteral
• Fix permissive X509TrustManager implementationsorg.openrewrite.java.security.FixPermissiveTrustManager
• Fix permissive HostnameVerifier implementationsorg.openrewrite.java.security.FixPermissiveHostnameVerifier
• Replace SQL string concatenation with a PreparedStatementorg.openrewrite.java.security.FixSqlInjectionConcat
• SecureRandom seeds are not constant or predictableorg.openrewrite.java.security.SecureRandomPrefersDefaultSeed
• Restrict deserialized classes for JMS ObjectMessageorg.openrewrite.java.security.marshalling.FixInsecureJmsDeserialization
• Modernize BufferedWriter creation & prevent file descriptor leaksorg.openrewrite.staticanalysis.BufferedWriterCreationRecipes
• Use comparison rather than equality checks in for conditionsorg.openrewrite.staticanalysis.NoEqualityInForCondition

Data tables

Structured output this recipe can produce.

• Source files that had resultsSource files that were modified by the recipe run.org.openrewrite.table.SourcesFileResults
• Source files that had search resultsSearch results that were found during the recipe run.org.openrewrite.table.SearchResults
• Source files that errored on a recipeThe details of all errors produced by a recipe run.org.openrewrite.table.SourcesFileErrors
• Recipe performanceStatistics used in analyzing the performance of recipes.org.openrewrite.table.RecipeRunStats