java-db-empty-password-mining

Read-only mining codemod for SonarSource rule java:S2115 — A secure password should be used when connecting to a database.

It scans Java source and emits metrics only; it never modifies code (return null).
Findings are high-signal review candidates surfaced by AST pattern matching — they are
not proven vulnerabilities. A static mining pass cannot prove an end-to-end taint flow
from an untrusted source to the sink, so confirm data flow before remediating.

What it detects

Database connection APIs invoked with an empty or blank password literal.

Sinks:

• DriverManager.getConnection(url, user, "") (and DataSource/Hikari/pool variants)
• setPassword("") / password("")

Emission rule: Emits when the password argument is an empty or whitespace-only string literal.

Metric: java-db-empty-password-mining

Security standards

• CWE-521 (Weak Password Requirements)
• OWASP ASVS 4.0: 9.2.2, 9.2.3
• OWASP Top 10 2021: A7
• OWASP Top 10: A2, A3
• PCI DSS 3.2: 6.5.10
• PCI DSS 4.0: 6.2.4

Run locally

bash
Copy
cd codemods/java-security-blocker-mining/java-db-empty-password-mining
npm test

# Scan a target project (read-only; emits metrics, leaves source unchanged)
npx codemod@latest workflow run \
  -w codemods/java-security-blocker-mining/java-db-empty-password-mining/workflow.yaml \
  --target /path/to/java/project

Part of the java-security-blocker-mining suite covering 19 blocker-severity
Java vulnerability rules. Each codemod is read-only and emits a single named metric.