java-security-blocker-mining-bundle

Read-only workflow bundle that runs all 19 Java security blocker-severity
mining codemods in a single pass. It accumulates findings as metrics in the
Codemod run output — no files are written to the target repo.

Use it to baseline an entire Java codebase against the blocker-severity
SonarSource vulnerability rules (injection, hard-coded credentials/secrets,
unsafe deserialization, XXE, and more) before prioritizing remediation. As with
every miner in this suite, results are high-signal review candidates surfaced by
AST pattern matching — not proven vulnerabilities.

Bundled codemods

Each step emits a metric named after its codemod (e.g. java-sql-injection-mining).
Every record shares the base cardinality rule, cwe, severity (always
blocker), sink, package_name, class_name, method_name, file, line;
injection miners add arg_kind, the XXE miners add hardened, and the secrets
miner adds secret_name. See each child codemod's README.md for the full
metric and security-standard details.

Workflows

• workflow.yaml — references each miner by its published
  registry name (source: 'java-sql-injection-mining'). Use this once the
  child codemods are published.
• workflow.local.yaml — references each miner by its
  sibling path (source: '../java-sql-injection-mining') for local
  development and smoke testing in this monorepo.

Run locally

bash
Copy
cd codemods/java-security-blocker-mining/java-security-blocker-mining-bundle

# Validate both workflow definitions
npm test

# Smoke-test against the bundled sample repo using sibling miners (read-only)
npm run test:workflow

# Run the published bundle against your own project (read-only; emits metrics)
npx codemod@latest workflow run \
  -w codemods/java-security-blocker-mining/java-security-blocker-mining-bundle/workflow.yaml \
  --target /path/to/java/project

Need a deeper assessment?

These miners are a strong portfolio-wide baseline, but they do not replace a full
taint-analysis engine and cannot prove an end-to-end source→sink data flow.

Reach out to the Codemod team if you want tailored
analyzers for your stack: custom sink/source libraries, framework-aware taint
tracking, and dashboards wired to your security remediation milestones.