Remediate OWASP A08:2021 Software and data integrity failures

Usage

This recipe has no required configuration options. You’ll need the Moderne CLI configured before running the command below.

mod run . --recipe org.openrewrite.java.security.OwaspA08

If the recipe isn’t available locally, install it with:

mod config recipes jar install org.openrewrite.recipe:rewrite-java-security:3.36.0

Definition

This recipe runs the following recipes in order.

• Insecure JMS deserializationorg.openrewrite.java.security.marshalling.InsecureJmsDeserialization
• Restrict deserialized classes for JMS ObjectMessageorg.openrewrite.java.security.marshalling.FixInsecureJmsDeserialization
• Secure the use of SnakeYAML's constructororg.openrewrite.java.security.marshalling.SecureSnakeYamlConstructor
• Secure the use of Jackson default typingorg.openrewrite.java.security.marshalling.SecureJacksonDefaultTyping
• Find Jackson default type mapping enablementorg.openrewrite.java.security.search.FindJacksonDefaultTypeMapping
• Find vulnerable uses of Jackson @JsonTypeInfoorg.openrewrite.java.security.search.FindVulnerableJacksonJsonTypeInfo
• Use secure temporary file creationorg.openrewrite.java.security.SecureTempFileCreation
• Find text-direction changesorg.openrewrite.java.security.FindTextDirectionChanges
• Use Files#createTempDirectoryorg.openrewrite.java.security.UseFilesCreateTempDirectory
• Enable CSRF attack preventionorg.openrewrite.java.security.spring.CsrfProtection
• Secure Spring service exportersorg.openrewrite.java.security.spring.InsecureSpringServiceExporter
• Find Apache Commons BeanUtils property assignmentsorg.openrewrite.java.security.search.FindBeanPropertyAssignment

Data tables

Structured output this recipe can produce.

• Method callsThe text of matching method invocations.org.openrewrite.java.table.MethodCalls
• Source files that had resultsSource files that were modified by the recipe run.org.openrewrite.table.SourcesFileResults
• Source files that had search resultsSearch results that were found during the recipe run.org.openrewrite.table.SearchResults
• Source files that errored on a recipeThe details of all errors produced by a recipe run.org.openrewrite.table.SourcesFileErrors
• Recipe performanceStatistics used in analyzing the performance of recipes.org.openrewrite.table.RecipeRunStats