Remediate OWASP A09:2025 Security logging and alerting failures
Recipe ID
org.openrewrite.java.security.Owasp2025A09Artifactorg.openrewrite.recipe:rewrite-java-securityOWASP A09:2025 describes failures to detect, escalate, and alert on active attacks. Previously A09:2021 Security Logging and Monitoring Failures, renamed in 2025 to emphasize alerting. Coverage here focuses on the code-side prerequisites for effective detection: getting errors and stack traces into the log stream so SIEMs can see them, keeping user-controlled input from being able to forge log entries, and keeping secrets and other sensitive values out of the log.
Composite recipeCWE-532securityCWE-117CWE-778CWE-223Proprietary
Usage
This recipe has no required configuration options. You’ll need the Moderne CLI configured before running the command below.
mod run . --recipe org.openrewrite.java.security.Owasp2025A09If the recipe isn’t available locally, install it with:
mod config recipes jar install org.openrewrite.recipe:rewrite-java-security:RELEASEDefinition
This recipe runs the following recipes in order.
- Find log injection vulnerabilities
org.openrewrite.java.security.search.FindLogInjection - Find sensitive data in log statements
org.openrewrite.java.security.search.FindSensitiveDataInLogs - Find secrets
org.openrewrite.java.security.secrets.FindSecrets - Enhances logging of exceptions by including the full stack trace in addition to the exception message
org.openrewrite.java.logging.slf4j.CompleteExceptionLogging - Use logger instead of
printStackTrace()org.openrewrite.java.logging.PrintStackTraceToLogError - Use logger instead of
System.outprint statementsorg.openrewrite.java.logging.SystemOutToLogging - Use logger instead of
System.errprint statementsorg.openrewrite.java.logging.SystemErrToLogging
Data tables
Structured output this recipe can produce.
- Taint flowRecords taint flows from sources to sinks with their taint types.
org.openrewrite.analysis.java.taint.table.TaintFlowTable - Source files that had resultsSource files that were modified by the recipe run.
org.openrewrite.table.SourcesFileResults - Source files that had search resultsSearch results that were found during the recipe run.
org.openrewrite.table.SearchResults - Source files that errored on a recipeThe details of all errors produced by a recipe run.
org.openrewrite.table.SourcesFileErrors - Recipe performanceStatistics used in analyzing the performance of recipes.
org.openrewrite.table.RecipeRunStats