Find non-constant-time comparisons of authentication headers

Proprietary

Report potential timing-sensitive String comparisons reached by a known authentication header from a resolved servlet request, including a taint source and sink. This search does not establish exploitability or change comparison behavior.

org.openrewrite.java.security.search.FindNonConstantTimeAuthenticationHeaderComparison

mod run . --recipe=org.openrewrite.java.security.search.FindNonConstantTimeAuthenticationHeaderComparison

Install it once from Recipe actions, then run it on every repository under the current directory. New to the Moderne CLI? Set it up.