java-security-blocker-mining-bundle
Read-only workflow bundle that runs all 19 Java security blocker-severity
mining codemods in a single pass. It accumulates findings as metrics in the
Codemod run output — no files are written to the target repo.
Use it to baseline an entire Java codebase against the blocker-severity
SonarSource vulnerability rules (injection, hard-coded credentials/secrets,
unsafe deserialization, XXE, and more) before prioritizing remediation. As with
every miner in this suite, results are high-signal review candidates surfaced by
AST pattern matching — not proven vulnerabilities.
Bundled codemods
| Step | Codemod | Rule | CWE |
|---|---|---|---|
| 1 | java-db-empty-password-mining | java:S2115 | CWE-521 |
| 2 | java-hardcoded-credentials-mining | java:S6437 | CWE-798 |
| 3 | java-hardcoded-secrets-mining | java:S6418 | CWE-798 |
| 4 | java-sql-injection-mining | javasecurity:S3649 | CWE-89 |
| 5 | java-nosql-injection-mining | javasecurity:S5147 | CWE-943 |
| 6 | java-ldap-injection-mining | javasecurity:S2078 | CWE-90 |
| 7 | java-xpath-injection-mining | javasecurity:S2091 | CWE-643 |
| 8 | java-os-command-injection-mining | javasecurity:S2076 | CWE-78 |
| 9 | java-dynamic-code-execution-mining | javasecurity:S5334 | CWE-95 |
| 10 | java-server-side-template-injection-mining | javasecurity:S5496 | CWE-94 |
| 11 | java-deserialization-injection-mining | javasecurity:S5135 | CWE-502 |
| 12 | java-path-injection-mining | javasecurity:S2083 | CWE-22 |
| 13 | java-zip-slip-mining | javasecurity:S6096 | CWE-22 |
| 14 | java-open-redirect-mining | javasecurity:S5146 | CWE-601 |
| 15 | java-reflected-xss-mining | javasecurity:S5131 | CWE-79 |
| 16 | java-webview-cross-app-scripting-mining | javasecurity:S7606 | CWE-79 |
| 17 | java-android-intent-redirection-mining | javasecurity:S6384 | CWE-20 |
| 18 | java-xxe-mining | java:S2755 | CWE-611 |
| 19 | java-xml-arbitrary-file-inclusion-mining | java:S6373 | CWE-611 |
Each step emits a metric named after its codemod (e.g. java-sql-injection-mining).
Every record shares the base cardinality rule, cwe, severity (always
blocker), sink, package_name, class_name, method_name, file, line;
injection miners add arg_kind, the XXE miners add hardened, and the secrets
miner adds secret_name. See each child codemod's README.md for the full
metric and security-standard details.
Workflows
workflow.yaml— references each miner by its published
registry name (source: 'java-sql-injection-mining'). Use this once the
child codemods are published.workflow.local.yaml— references each miner by its
sibling path (source: '../java-sql-injection-mining') for local
development and smoke testing in this monorepo.
Run locally
Need a deeper assessment?
These miners are a strong portfolio-wide baseline, but they do not replace a full
taint-analysis engine and cannot prove an end-to-end source→sink data flow.
Reach out to the Codemod team if you want tailored
analyzers for your stack: custom sink/source libraries, framework-aware taint
tracking, and dashboards wired to your security remediation milestones.