Remediate OWASP A04:2025 Cryptographic failures

Usage

This recipe has no required configuration options. You’ll need the Moderne CLI configured before running the command below.

mod run . --recipe org.openrewrite.java.security.Owasp2025A04

If the recipe isn’t available locally, install it with:

mod config recipes jar install org.openrewrite.recipe:rewrite-java-security:3.36.0

Definition

This recipe runs the following recipes in order.

• Remediate OWASP A02:2021 Cryptographic failuresorg.openrewrite.java.security.OwaspA02
• Find weak cryptographic algorithmsorg.openrewrite.java.security.search.FindWeakCryptoAlgorithm
• Find insecure cipher modes and padding schemesorg.openrewrite.java.security.search.FindInsecureCipherMode
• Find weak password hashingorg.openrewrite.java.security.search.FindWeakPasswordHashing
• Find RSA encryption without OAEP paddingorg.openrewrite.java.security.search.FindRsaWithoutOaep
• Find inadequate cryptographic key sizesorg.openrewrite.java.security.search.FindInadequateKeySize
• Upgrade inadequate cryptographic key sizesorg.openrewrite.java.security.UpgradeInadequateKeySize
• Find hardcoded initialization vectorsorg.openrewrite.java.security.search.FindHardcodedIv
• Find predictable cryptographic saltsorg.openrewrite.java.security.search.FindPredictableSalt
• Secure randomorg.openrewrite.java.security.SecureRandom
• Fix CWE-338 with SecureRandomorg.openrewrite.java.security.FixCwe338
• Find secretsorg.openrewrite.java.security.secrets.FindSecrets

Data tables

Structured output this recipe can produce.

• Method callsThe text of matching method invocations.org.openrewrite.java.table.MethodCalls
• Source files that had resultsSource files that were modified by the recipe run.org.openrewrite.table.SourcesFileResults
• Source files that had search resultsSearch results that were found during the recipe run.org.openrewrite.table.SearchResults
• Source files that errored on a recipeThe details of all errors produced by a recipe run.org.openrewrite.table.SourcesFileErrors
• Recipe performanceStatistics used in analyzing the performance of recipes.org.openrewrite.table.RecipeRunStats