48:I[660678,["/_next/static/chunks/13vqyfldau57p.js","/_next/static/chunks/1gbl-dcot4vlq.js","/_next/static/chunks/3w7s_-pxil6pv.js","/_next/static/chunks/3zorfbfh_a_pd.js","/_next/static/chunks/0cnrn8dx8wpm6.js","/_next/static/chunks/2e4udl7tfg2xd.js","/_next/static/chunks/1mbdq0lktamc7.js","/_next/static/chunks/0nq310uz96h4-.js","/_next/static/chunks/2i4xo8xu-dpuk.js","/_next/static/chunks/40fmu66fmb8tm.js","/_next/static/chunks/3vehc-g2atkra.js","/_next/static/chunks/2a4jc680f5x-9.js","/_next/static/chunks/2wyk4b1ao4pa_.js","/_next/static/chunks/1gth09_ur0iam.js","/_next/static/chunks/0ugk39ckud30x.js","/_next/static/chunks/0pp6seif9t0rh.js","/_next/static/chunks/3bhq66ea_v7by.js","/_next/static/chunks/44c_5nh0vyeb5.js","/_next/static/chunks/1jiredr0b6jr_.js","/_next/static/chunks/0r86cplnpkdza.js","/_next/static/chunks/2ghxk472-g0i6.js","/_next/static/chunks/1ra7jqz5hyzln.js","/_next/static/chunks/42kj-we3o-c3u.js","/_next/static/chunks/2vvl77bxv5nze.js","/_next/static/chunks/2dk9hti1hh4ut.js","/_next/static/chunks/2l8l4_a9-xhts.js","/_next/static/chunks/1qsa_rj-5yj90.js","/_next/static/chunks/0ewjxq-e6quq-.js","/_next/static/chunks/34y7-26s89h2f.js","/_next/static/chunks/0ojgzwcpt7vsk.js","/_next/static/chunks/3enqpgm3pn7at.js","/_next/static/chunks/3-906s1ue5fj3.js","/_next/static/chunks/2t_5zfez2-77k.js","/_next/static/chunks/2641m2aqdum9a.js","/_next/static/chunks/1cvej8ocaz0a2.js","/_next/static/chunks/1j29bqcxcpyur.js"],"HydrationBoundary"] 47:Tba7,{"@context":"https://schema.org","@graph":[{"@type":"WebSite","@id":"https://app.codemod.com/registry#website","url":"https://app.codemod.com/registry","name":"Codemod Registry"},{"@type":"Organization","@id":"https://app.codemod.com#org","name":"Alex Bit","url":"https://app.codemod.com","logo":"https://avatars.githubusercontent.com/u/78109534?v=4"},{"@type":"BreadcrumbList","@id":"https://app.codemod.com/registry/java-security-blocker-mining-bundle#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Registry","item":"https://app.codemod.com/registry"},{"@type":"ListItem","position":2,"name":"java-security-blocker-mining-bundle","item":"https://app.codemod.com/registry/java-security-blocker-mining-bundle"}]},{"@type":"WebPage","@id":"https://app.codemod.com/registry/java-security-blocker-mining-bundle#webpage","url":"https://app.codemod.com/registry/java-security-blocker-mining-bundle","name":"java-security-blocker-mining-bundle - Codemod Registry","description":"Read-only workflow bundle that runs all 19 Java security blocker-severity mining codemods (injection, hard-coded credentials/secrets, deserialization, XXE, and more) in one pass.","isPartOf":{"@id":"https://app.codemod.com/registry#website"},"author":{"@id":"https://app.codemod.com#org"},"breadcrumb":{"@id":"https://app.codemod.com/registry/java-security-blocker-mining-bundle#breadcrumb"},"mainEntity":{"@id":"https://app.codemod.com/registry/java-security-blocker-mining-bundle#sourcecode"}},{"@type":"SoftwareSourceCode","@id":"https://app.codemod.com/registry/java-security-blocker-mining-bundle#sourcecode","name":"java-security-blocker-mining-bundle","description":"Read-only workflow bundle that runs all 19 Java security blocker-severity mining codemods (injection, hard-coded credentials/secrets, deserialization, XXE, and more) in one pass.","url":"https://app.codemod.com/registry/java-security-blocker-mining-bundle","publisher":{"@id":"https://app.codemod.com#org"},"image":"https://avatars.githubusercontent.com/u/78109534?v=4","isAccessibleForFree":true,"license":"MIT","version":"0.1.0","keywords":["mining","metrics","java","security","vulnerability","bundle","recipe"],"datePublished":"2026-06-26 06:10:59.606589+00","dateModified":"2026-06-26 06:10:59.606589+00"},{"@type":"SoftwareApplication","@id":"https://app.codemod.com/registry/java-security-blocker-mining-bundle#app","name":"java-security-blocker-mining-bundle codemod","description":"Read-only workflow bundle that runs all 19 Java security blocker-severity mining codemods (injection, hard-coded credentials/secrets, deserialization, XXE, and more) in one pass.","url":"https://app.codemod.com/registry/java-security-blocker-mining-bundle","publisher":{"@id":"https://app.codemod.com#org"},"softwareVersion":"0.1.0","applicationCategory":"DeveloperApplication","operatingSystem":"Cross-platform","offers":{"@type":"Offer","price":"0","priceCurrency":"USD","availability":"https://schema.org/InStock"}}]}49:T10b9,# java-security-blocker-mining-bundle Read-only **workflow bundle** that runs all **19** Java security blocker-severity mining codemods in a single pass. It accumulates findings as metrics in the Codemod run output — **no files are written to the target repo**. Use it to baseline an entire Java codebase against the blocker-severity SonarSource vulnerability rules (injection, hard-coded credentials/secrets, unsafe deserialization, XXE, and more) before prioritizing remediation. As with every miner in this suite, results are high-signal review candidates surfaced by AST pattern matching — not proven vulnerabilities. ## Bundled codemods | Step | Codemod | Rule | CWE | | ---- | -------------------------------------------- | -------------------- | ------- | | 1 | `java-db-empty-password-mining` | `java:S2115` | CWE-521 | | 2 | `java-hardcoded-credentials-mining` | `java:S6437` | CWE-798 | | 3 | `java-hardcoded-secrets-mining` | `java:S6418` | CWE-798 | | 4 | `java-sql-injection-mining` | `javasecurity:S3649` | CWE-89 | | 5 | `java-nosql-injection-mining` | `javasecurity:S5147` | CWE-943 | | 6 | `java-ldap-injection-mining` | `javasecurity:S2078` | CWE-90 | | 7 | `java-xpath-injection-mining` | `javasecurity:S2091` | CWE-643 | | 8 | `java-os-command-injection-mining` | `javasecurity:S2076` | CWE-78 | | 9 | `java-dynamic-code-execution-mining` | `javasecurity:S5334` | CWE-95 | | 10 | `java-server-side-template-injection-mining` | `javasecurity:S5496` | CWE-94 | | 11 | `java-deserialization-injection-mining` | `javasecurity:S5135` | CWE-502 | | 12 | `java-path-injection-mining` | `javasecurity:S2083` | CWE-22 | | 13 | `java-zip-slip-mining` | `javasecurity:S6096` | CWE-22 | | 14 | `java-open-redirect-mining` | `javasecurity:S5146` | CWE-601 | | 15 | `java-reflected-xss-mining` | `javasecurity:S5131` | CWE-79 | | 16 | `java-webview-cross-app-scripting-mining` | `javasecurity:S7606` | CWE-79 | | 17 | `java-android-intent-redirection-mining` | `javasecurity:S6384` | CWE-20 | | 18 | `java-xxe-mining` | `java:S2755` | CWE-611 | | 19 | `java-xml-arbitrary-file-inclusion-mining` | `java:S6373` | CWE-611 | Each step emits a metric named after its codemod (e.g. `java-sql-injection-mining`). Every record shares the base cardinality `rule`, `cwe`, `severity` (always `blocker`), `sink`, `package_name`, `class_name`, `method_name`, `file`, `line`; injection miners add `arg_kind`, the XXE miners add `hardened`, and the secrets miner adds `secret_name`. See each child codemod's `README.md` for the full metric and security-standard details. ## Workflows - [`workflow.yaml`](./workflow.yaml) — references each miner by its **published registry name** (`source: 'java-sql-injection-mining'`). Use this once the child codemods are published. - [`workflow.local.yaml`](./workflow.local.yaml) — references each miner by its **sibling path** (`source: '../java-sql-injection-mining'`) for local development and smoke testing in this monorepo. ## Run locally ```bash cd codemods/java-security-blocker-mining/java-security-blocker-mining-bundle # Validate both workflow definitions npm test # Smoke-test against the bundled sample repo using sibling miners (read-only) npm run test:workflow # Run the published bundle against your own project (read-only; emits metrics) npx codemod@latest workflow run \ -w codemods/java-security-blocker-mining/java-security-blocker-mining-bundle/workflow.yaml \ --target /path/to/java/project ``` ## Need a deeper assessment? These miners are a strong portfolio-wide baseline, but they do not replace a full taint-analysis engine and cannot prove an end-to-end source→sink data flow. **Reach out to the [Codemod team](https://codemod.com)** if you want tailored analyzers for your stack: custom sink/source libraries, framework-aware taint tracking, and dashboards wired to your security remediation milestones. 19:[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$47"}}],["$","$L48",null,{"state":{"mutations":[],"queries":[{"state":{"data":{"json":{"id":"1e8e59e9-234c-4f2f-985a-9f66369e19d0","name":"java-security-blocker-mining-bundle","displayName":"java-security-blocker-mining-bundle","description":"Read-only workflow bundle that runs all 19 Java security blocker-severity mining codemods (injection, hard-coded credentials/secrets, deserialization, XXE, and more) in one pass.","scope":null,"visibility":"public","downloadCount":24,"executionCount":1,"createdAt":"2026-06-26 06:10:59.606589+00","updatedAt":"2026-06-26 06:10:59.606589+00","latestVersion":"0.1.0","keywords":["mining","metrics","java","security","vulnerability","bundle","recipe"],"starCount":0,"author":"Alex Bit ","homepage":null,"repository":null,"license":"MIT","access":"public","documentation":null,"bugsUrl":null,"readme":"$49","organization":{"id":null,"name":null,"slug":null,"avatarUrl":null},"owner":{"id":"4519f7a8-2ebc-4eaf-8c0a-e01be4c05878","username":"alexbit-codemod","name":"Alex Bit","avatarUrl":"https://avatars.githubusercontent.com/u/78109534?v=4"},"isLegacy":false,"versions":[{"version":{"id":"b26e4fa7-e50b-40cd-b4ec-7e895ebcab8d","packageId":"1e8e59e9-234c-4f2f-985a-9f66369e19d0","version":"0.1.0","description":"Read-only workflow bundle that runs all 19 Java security blocker-severity mining codemods (injection, hard-coded credentials/secrets, deserialization, XXE, and more) in one pass.","manifest":{"name":"java-security-blocker-mining-bundle","author":"Alex Bit ","license":"MIT","targets":{"versions":{},"languages":["java"],"frameworks":[]},"version":"0.1.0","category":"analysis","keywords":["mining","metrics","java","security","vulnerability","bundle","recipe"],"registry":{"access":"public","visibility":"public"},"workflow":"workflow.yaml","description":"Read-only workflow bundle that runs all 19 Java security blocker-severity mining codemods (injection, hard-coded credentials/secrets, deserialization, XXE, and more) in one pass.","dependencies":[],"schema_version":"1.0"},"checksum":"916e50392405ddd3da41a9038a7cd71df62897a9757d43d51c55f3caaa1fa88c","size":3515,"downloadUrl":"https://registry-cdn.codemod.com/prod/packages/java-security-blocker-mining-bundle/0.1.0/public.tar.gz","aiGenerated":false,"sourceArchiveS3Key":null,"targets":{"languages":["typescript"],"frameworks":[]},"dependencies":[],"languages":[],"stepTypes":["codemod"],"workflowMetadata":{"nodes":[{"id":"java-security-blocker-mining-bundle","name":"Java security blocker mining (full registry bundle)","steps":[{"name":"1. S2115 — Empty/blank database passwords","type":"codemod"},{"name":"2. S6437 — Hard-coded credentials","type":"codemod"},{"name":"3. S6418 — Hard-coded secrets","type":"codemod"},{"name":"4. S3649 — SQL injection","type":"codemod"},{"name":"5. S5147 — NoSQL injection","type":"codemod"},{"name":"6. S2078 — LDAP injection","type":"codemod"},{"name":"7. S2091 — XPath injection","type":"codemod"},{"name":"8. S2076 — OS command injection","type":"codemod"},{"name":"9. S5334 — Dynamic code execution","type":"codemod"},{"name":"10. S5496 — Server-side template injection","type":"codemod"},{"name":"11. S5135 — Unsafe deserialization","type":"codemod"},{"name":"12. S2083 — Path injection","type":"codemod"},{"name":"13. S6096 — Zip slip","type":"codemod"},{"name":"14. S5146 — Open redirect","type":"codemod"},{"name":"15. S5131 — Reflected XSS","type":"codemod"},{"name":"16. S7606 — WebView cross-app scripting","type":"codemod"},{"name":"17. S6384 — Android intent redirection","type":"codemod"},{"name":"18. S2755 — XXE","type":"codemod"},{"name":"19. S6373 — XML arbitrary file inclusion","type":"codemod"}]}]},"validated":false,"validationErrors":null,"publishedBy":"4519f7a8-2ebc-4eaf-8c0a-e01be4c05878","deprecated":false,"deprecationMessage":null,"downloadCount":24,"cachedTestCases":null,"defaultWorkflowName":"default","createdAt":"2026-06-26T06:10:59.606Z","updatedAt":"2026-09-05 16:17:11.825724+00"},"publishedBy":{"id":"4519f7a8-2ebc-4eaf-8c0a-e01be4c05878","username":"alexbit-codemod","name":"Alex Bit"},"insightsTemplate":{"packageVersionId":"b26e4fa7-e50b-40cd-b4ec-7e895ebcab8d","status":"ready","generatedAt":"2026-07-23T00:50:09.230Z"},"workflows":[{"name":"default","path":"workflow.yaml","description":null,"isDefault":true,"languages":[],"stepTypes":["codemod"],"workflowMetadata":{"nodes":[{"id":"java-security-blocker-mining-bundle","name":"Java security blocker mining (full registry bundle)","steps":[{"name":"1. S2115 — Empty/blank database passwords","type":"codemod"},{"name":"2. S6437 — Hard-coded credentials","type":"codemod"},{"name":"3. S6418 — Hard-coded secrets","type":"codemod"},{"name":"4. S3649 — SQL injection","type":"codemod"},{"name":"5. S5147 — NoSQL injection","type":"codemod"},{"name":"6. S2078 — LDAP injection","type":"codemod"},{"name":"7. S2091 — XPath injection","type":"codemod"},{"name":"8. S2076 — OS command injection","type":"codemod"},{"name":"9. S5334 — Dynamic code execution","type":"codemod"},{"name":"10. S5496 — Server-side template injection","type":"codemod"},{"name":"11. S5135 — Unsafe deserialization","type":"codemod"},{"name":"12. S2083 — Path injection","type":"codemod"},{"name":"13. S6096 — Zip slip","type":"codemod"},{"name":"14. S5146 — Open redirect","type":"codemod"},{"name":"15. S5131 — Reflected XSS","type":"codemod"},{"name":"16. S7606 — WebView cross-app scripting","type":"codemod"},{"name":"17. S6384 — Android intent redirection","type":"codemod"},{"name":"18. S2755 — XXE","type":"codemod"},{"name":"19. S6373 — XML arbitrary file inclusion","type":"codemod"}]}]}}],"packageBehavior":"workflow-only","isBundle":true,"bundleChildren":[{"id":"d7cbfe1c-f28a-4c57-a883-f064ba6cf73d","parentWorkflowName":"default","parentNodeId":"java-security-blocker-mining-bundle","parentStepId":null,"parentStepName":"1. S2115 — Empty/blank database passwords","childSourceRaw":"java-db-empty-password-mining","childWorkflowName":null,"resolutionKind":"registry","resolutionReason":null,"resolutionMessage":null,"isDirect":true,"createdAt":"2026-06-26T06:11:00.080Z","updatedAt":"2026-06-26 06:11:00.080034+00","childPackage":{"id":"8cc10242-0329-4790-bc8a-086502c33075","name":"java-db-empty-password-mining","displayName":"java-db-empty-password-mining","description":"Mine database connection calls that use an empty or blank password (java:S2115); read-only metrics for security review","scope":null,"visibility":"public","access":"public","latestVersion":"0.1.0","author":"Alex Bit "},"childPackageVersion":{"id":"0652eea6-f945-4aff-b6e7-8929988e6ea5","packageId":"8cc10242-0329-4790-bc8a-086502c33075","version":"0.1.0"}},{"id":"19d1c2f4-4f73-45dc-8bf2-2d7ff51cc4a3","parentWorkflowName":"default","parentNodeId":"java-security-blocker-mining-bundle","parentStepId":null,"parentStepName":"2. S6437 — Hard-coded credentials","childSourceRaw":"java-hardcoded-credentials-mining","childWorkflowName":null,"resolutionKind":"registry","resolutionReason":null,"resolutionMessage":null,"isDirect":true,"createdAt":"2026-06-26T06:11:00.080Z","updatedAt":"2026-06-26 06:11:00.080034+00","childPackage":{"id":"d6757c3c-9599-4fd3-8f03-6e7f7bdd1abf","name":"java-hardcoded-credentials-mining","displayName":"java-hardcoded-credentials-mining","description":"Mine credential-setting APIs called with hard-coded string literals (java:S6437); read-only metrics for security review","scope":null,"visibility":"public","access":"public","latestVersion":"0.1.0","author":"Alex Bit "},"childPackageVersion":{"id":"6685d6b2-f0aa-45c9-94e8-cbdec5f79a2d","packageId":"d6757c3c-9599-4fd3-8f03-6e7f7bdd1abf","version":"0.1.0"}},{"id":"cd7e89c1-9ce7-4d7b-81de-5fcf012ca229","parentWorkflowName":"default","parentNodeId":"java-security-blocker-mining-bundle","parentStepId":null,"parentStepName":"3. S6418 — Hard-coded secrets","childSourceRaw":"java-hardcoded-secrets-mining","childWorkflowName":null,"resolutionKind":"registry","resolutionReason":null,"resolutionMessage":null,"isDirect":true,"createdAt":"2026-06-26T06:11:00.080Z","updatedAt":"2026-06-26 06:11:00.080034+00","childPackage":{"id":"92f41a0c-709e-45bc-a430-6a28bc79fed6","name":"java-hardcoded-secrets-mining","displayName":"java-hardcoded-secrets-mining","description":"Mine secret-like variables and fields assigned hard-coded string literals (java:S6418); read-only metrics for security review","scope":null,"visibility":"public","access":"public","latestVersion":"0.1.0","author":"Alex Bit "},"childPackageVersion":{"id":"e5be869c-deef-41dc-a965-85d4c18d7676","packageId":"92f41a0c-709e-45bc-a430-6a28bc79fed6","version":"0.1.0"}},{"id":"395543eb-206d-4e17-a2d6-b53fcbdac400","parentWorkflowName":"default","parentNodeId":"java-security-blocker-mining-bundle","parentStepId":null,"parentStepName":"4. S3649 — SQL injection","childSourceRaw":"java-sql-injection-mining","childWorkflowName":null,"resolutionKind":"registry","resolutionReason":null,"resolutionMessage":null,"isDirect":true,"createdAt":"2026-06-26T06:11:00.080Z","updatedAt":"2026-06-26 06:11:00.080034+00","childPackage":{"id":"8221cd39-fa2e-4e48-a8b4-9aa1d1f56b04","name":"java-sql-injection-mining","displayName":"java-sql-injection-mining","description":"Mine JDBC/JPA query sinks built from dynamic (non-literal) SQL that may be vulnerable to SQL injection (javasecurity:S3649); read-only metrics for security review","scope":null,"visibility":"public","access":"public","latestVersion":"0.1.0","author":"Alex Bit "},"childPackageVersion":{"id":"82693e1b-f2e5-4a32-ac5f-050dda4fa076","packageId":"8221cd39-fa2e-4e48-a8b4-9aa1d1f56b04","version":"0.1.0"}},{"id":"74c3ccff-7630-405a-a10a-5428d1b80477","parentWorkflowName":"default","parentNodeId":"java-security-blocker-mining-bundle","parentStepId":null,"parentStepName":"5. S5147 — NoSQL injection","childSourceRaw":"java-nosql-injection-mining","childWorkflowName":null,"resolutionKind":"registry","resolutionReason":null,"resolutionMessage":null,"isDirect":true,"createdAt":"2026-06-26T06:11:00.080Z","updatedAt":"2026-06-26 06:11:00.080034+00","childPackage":{"id":"864d3d0b-d6ca-45db-bfef-7cd314baadfc","name":"java-nosql-injection-mining","displayName":"java-nosql-injection-mining","description":"Mine MongoDB/NoSQL query sinks built from dynamic input that may enable NoSQL injection (javasecurity:S5147); read-only metrics for security review","scope":null,"visibility":"public","access":"public","latestVersion":"0.1.0","author":"Alex Bit "},"childPackageVersion":{"id":"cad17313-353a-40f1-b73e-4697e40e7866","packageId":"864d3d0b-d6ca-45db-bfef-7cd314baadfc","version":"0.1.0"}},{"id":"2a83ab77-0b49-4ebc-b87d-e10f16f899e2","parentWorkflowName":"default","parentNodeId":"java-security-blocker-mining-bundle","parentStepId":null,"parentStepName":"6. S2078 — LDAP injection","childSourceRaw":"java-ldap-injection-mining","childWorkflowName":null,"resolutionKind":"registry","resolutionReason":null,"resolutionMessage":null,"isDirect":true,"createdAt":"2026-06-26T06:11:00.080Z","updatedAt":"2026-06-26 06:11:00.080034+00","childPackage":{"id":"4d22dd40-ba0c-4fc5-b277-e20c84232df8","name":"java-ldap-injection-mining","displayName":"java-ldap-injection-mining","description":"Mine LDAP search sinks built from dynamic filters/DNs that may enable LDAP injection (javasecurity:S2078); read-only metrics for security review","scope":null,"visibility":"public","access":"public","latestVersion":"0.1.0","author":"Alex Bit "},"childPackageVersion":{"id":"7bc78bc3-3228-4e72-bbf1-0b82c05e83d1","packageId":"4d22dd40-ba0c-4fc5-b277-e20c84232df8","version":"0.1.0"}},{"id":"78b51ca3-5302-438d-87d2-7b9eff2bb53c","parentWorkflowName":"default","parentNodeId":"java-security-blocker-mining-bundle","parentStepId":null,"parentStepName":"7. S2091 — XPath injection","childSourceRaw":"java-xpath-injection-mining","childWorkflowName":null,"resolutionKind":"registry","resolutionReason":null,"resolutionMessage":null,"isDirect":true,"createdAt":"2026-06-26T06:11:00.080Z","updatedAt":"2026-06-26 06:11:00.080034+00","childPackage":{"id":"b741b86a-97f7-442c-8ca7-c28354f317f0","name":"java-xpath-injection-mining","displayName":"java-xpath-injection-mining","description":"Mine XPath compile/evaluate sinks built from dynamic input that may enable XPath injection (javasecurity:S2091); read-only metrics for security review","scope":null,"visibility":"public","access":"public","latestVersion":"0.1.0","author":"Alex Bit "},"childPackageVersion":{"id":"35349097-e7b9-492c-b46a-13c05073fe0f","packageId":"b741b86a-97f7-442c-8ca7-c28354f317f0","version":"0.1.0"}},{"id":"3524a79b-c827-4a8f-8cd1-22c9625c3f5d","parentWorkflowName":"default","parentNodeId":"java-security-blocker-mining-bundle","parentStepId":null,"parentStepName":"8. S2076 — OS command injection","childSourceRaw":"java-os-command-injection-mining","childWorkflowName":null,"resolutionKind":"registry","resolutionReason":null,"resolutionMessage":null,"isDirect":true,"createdAt":"2026-06-26T06:11:00.080Z","updatedAt":"2026-06-26 06:11:00.080034+00","childPackage":{"id":"273027b2-66a6-4d26-b53f-2974e39b21c7","name":"java-os-command-injection-mining","displayName":"java-os-command-injection-mining","description":"Mine OS command sinks (Runtime.exec, ProcessBuilder) built from dynamic input that may enable command injection (javasecurity:S2076); read-only metrics for security review","scope":null,"visibility":"public","access":"public","latestVersion":"0.1.0","author":"Alex Bit "},"childPackageVersion":{"id":"eb05b1da-52d0-4ee6-8555-0166a98cf20b","packageId":"273027b2-66a6-4d26-b53f-2974e39b21c7","version":"0.1.0"}},{"id":"a3f79593-3d68-4895-b51f-de6bbac0880a","parentWorkflowName":"default","parentNodeId":"java-security-blocker-mining-bundle","parentStepId":null,"parentStepName":"9. S5334 — Dynamic code execution","childSourceRaw":"java-dynamic-code-execution-mining","childWorkflowName":null,"resolutionKind":"registry","resolutionReason":null,"resolutionMessage":null,"isDirect":true,"createdAt":"2026-06-26T06:11:00.080Z","updatedAt":"2026-06-26 06:11:00.080034+00","childPackage":{"id":"b4472b7c-0149-43d0-88ce-9cb9c60c68c7","name":"java-dynamic-code-execution-mining","displayName":"java-dynamic-code-execution-mining","description":"Mine dynamic code evaluation sinks (ScriptEngine.eval, GroovyShell, SpEL) fed by dynamic input (javasecurity:S5334); read-only metrics for security review","scope":null,"visibility":"public","access":"public","latestVersion":"0.1.0","author":"Alex Bit "},"childPackageVersion":{"id":"3cc7b0a7-2c00-4e83-b8a4-34187e105054","packageId":"b4472b7c-0149-43d0-88ce-9cb9c60c68c7","version":"0.1.0"}},{"id":"3858d23d-1a2e-4a43-89cd-ab88c5b95c5c","parentWorkflowName":"default","parentNodeId":"java-security-blocker-mining-bundle","parentStepId":null,"parentStepName":"10. S5496 — Server-side template injection","childSourceRaw":"java-server-side-template-injection-mining","childWorkflowName":null,"resolutionKind":"registry","resolutionReason":null,"resolutionMessage":null,"isDirect":true,"createdAt":"2026-06-26T06:11:00.080Z","updatedAt":"2026-06-26 06:11:00.080034+00","childPackage":{"id":"bcd6e057-94e0-4a7b-9777-52d25c04c52c","name":"java-server-side-template-injection-mining","displayName":"java-server-side-template-injection-mining","description":"Mine server-side template engine sinks (FreeMarker, Velocity, Thymeleaf, SpEL) built from dynamic templates (javasecurity:S5496); read-only metrics for security review","scope":null,"visibility":"public","access":"public","latestVersion":"0.1.0","author":"Alex Bit "},"childPackageVersion":{"id":"f284bb11-15b2-4895-a5ec-8e53c50e694b","packageId":"bcd6e057-94e0-4a7b-9777-52d25c04c52c","version":"0.1.0"}},{"id":"5226427c-b57a-46d1-ad75-0c9274fd32a4","parentWorkflowName":"default","parentNodeId":"java-security-blocker-mining-bundle","parentStepId":null,"parentStepName":"11. S5135 — Unsafe deserialization","childSourceRaw":"java-deserialization-injection-mining","childWorkflowName":null,"resolutionKind":"registry","resolutionReason":null,"resolutionMessage":null,"isDirect":true,"createdAt":"2026-06-26T06:11:00.080Z","updatedAt":"2026-06-26 06:11:00.080034+00","childPackage":{"id":"18cc9fec-3a93-4d1c-aca3-6b4f21158c0e","name":"java-deserialization-injection-mining","displayName":"java-deserialization-injection-mining","description":"Mine deserialization sinks (ObjectInputStream, XMLDecoder, XStream, SnakeYAML) that may deserialize untrusted data (javasecurity:S5135); read-only metrics for security review","scope":null,"visibility":"public","access":"public","latestVersion":"0.1.0","author":"Alex Bit "},"childPackageVersion":{"id":"7702b378-b556-4aa6-9083-556c3344743b","packageId":"18cc9fec-3a93-4d1c-aca3-6b4f21158c0e","version":"0.1.0"}},{"id":"ec4728a5-5754-4873-bfc5-00bbd9930c77","parentWorkflowName":"default","parentNodeId":"java-security-blocker-mining-bundle","parentStepId":null,"parentStepName":"12. S2083 — Path injection","childSourceRaw":"java-path-injection-mining","childWorkflowName":null,"resolutionKind":"registry","resolutionReason":null,"resolutionMessage":null,"isDirect":true,"createdAt":"2026-06-26T06:11:00.080Z","updatedAt":"2026-06-26 06:11:00.080034+00","childPackage":{"id":"b8c7bf23-6906-4723-bdcf-fbf4d31c4d72","name":"java-path-injection-mining","displayName":"java-path-injection-mining","description":"Mine filesystem I/O sinks built from dynamic paths that may enable path traversal injection (javasecurity:S2083); read-only metrics for security review","scope":null,"visibility":"public","access":"public","latestVersion":"0.1.0","author":"Alex Bit "},"childPackageVersion":{"id":"e6ce82ab-1ef9-4bf5-9527-3a4403461c61","packageId":"b8c7bf23-6906-4723-bdcf-fbf4d31c4d72","version":"0.1.0"}},{"id":"7313f320-c222-4c3f-b468-2bb371a91c08","parentWorkflowName":"default","parentNodeId":"java-security-blocker-mining-bundle","parentStepId":null,"parentStepName":"13. S6096 — Zip slip","childSourceRaw":"java-zip-slip-mining","childWorkflowName":null,"resolutionKind":"registry","resolutionReason":null,"resolutionMessage":null,"isDirect":true,"createdAt":"2026-06-26T06:11:00.080Z","updatedAt":"2026-06-26 06:11:00.080034+00","childPackage":{"id":"315cc241-5c72-4561-b272-3e632298e161","name":"java-zip-slip-mining","displayName":"java-zip-slip-mining","description":"Mine archive extraction code that builds filesystem paths from archive entry names (zip slip) (javasecurity:S6096); read-only metrics for security review","scope":null,"visibility":"public","access":"public","latestVersion":"0.1.0","author":"Alex Bit "},"childPackageVersion":{"id":"20e4a9ec-c919-4e72-b16c-41a2a45d6db4","packageId":"315cc241-5c72-4561-b272-3e632298e161","version":"0.1.0"}},{"id":"0c3079d6-723c-413d-b41e-25f14610c026","parentWorkflowName":"default","parentNodeId":"java-security-blocker-mining-bundle","parentStepId":null,"parentStepName":"14. S5146 — Open redirect","childSourceRaw":"java-open-redirect-mining","childWorkflowName":null,"resolutionKind":"registry","resolutionReason":null,"resolutionMessage":null,"isDirect":true,"createdAt":"2026-06-26T06:11:00.080Z","updatedAt":"2026-06-26 06:11:00.080034+00","childPackage":{"id":"5c83b186-4e10-4573-a656-632707375ba1","name":"java-open-redirect-mining","displayName":"java-open-redirect-mining","description":"Mine HTTP redirect sinks fed by dynamic input that may enable open redirection (javasecurity:S5146); read-only metrics for security review","scope":null,"visibility":"public","access":"public","latestVersion":"0.1.0","author":"Alex Bit "},"childPackageVersion":{"id":"f941c1f0-78f4-47a6-a4c7-afa37d29f3d6","packageId":"5c83b186-4e10-4573-a656-632707375ba1","version":"0.1.0"}},{"id":"4eee2d34-332e-489d-a585-103c3e0b13eb","parentWorkflowName":"default","parentNodeId":"java-security-blocker-mining-bundle","parentStepId":null,"parentStepName":"15. S5131 — Reflected XSS","childSourceRaw":"java-reflected-xss-mining","childWorkflowName":null,"resolutionKind":"registry","resolutionReason":null,"resolutionMessage":null,"isDirect":true,"createdAt":"2026-06-26T06:11:00.080Z","updatedAt":"2026-06-26 06:11:00.080034+00","childPackage":{"id":"13f0098d-0c30-4ee7-b9fc-26acb70d7812","name":"java-reflected-xss-mining","displayName":"java-reflected-xss-mining","description":"Mine servlet response writes fed by dynamic input that may enable reflected cross-site scripting (javasecurity:S5131); read-only metrics for security review","scope":null,"visibility":"public","access":"public","latestVersion":"0.1.0","author":"Alex Bit "},"childPackageVersion":{"id":"1e32eec6-9dfd-4bc4-b2c8-fe815877a150","packageId":"13f0098d-0c30-4ee7-b9fc-26acb70d7812","version":"0.1.0"}},{"id":"b18baf29-bb59-4860-9985-aa2576eddab5","parentWorkflowName":"default","parentNodeId":"java-security-blocker-mining-bundle","parentStepId":null,"parentStepName":"16. S7606 — WebView cross-app scripting","childSourceRaw":"java-webview-cross-app-scripting-mining","childWorkflowName":null,"resolutionKind":"registry","resolutionReason":null,"resolutionMessage":null,"isDirect":true,"createdAt":"2026-06-26T06:11:00.080Z","updatedAt":"2026-06-26 06:11:00.080034+00","childPackage":{"id":"2cacec4e-0c17-4579-8143-506a06dc063e","name":"java-webview-cross-app-scripting-mining","displayName":"java-webview-cross-app-scripting-mining","description":"Mine Android WebView load/evaluate sinks fed by dynamic input that may enable cross-app scripting (javasecurity:S7606); read-only metrics for security review","scope":null,"visibility":"public","access":"public","latestVersion":"0.1.0","author":"Alex Bit "},"childPackageVersion":{"id":"6528f9fd-f4e0-4185-8efa-ad2818b90407","packageId":"2cacec4e-0c17-4579-8143-506a06dc063e","version":"0.1.0"}},{"id":"5614a6ae-faf7-4b6d-8ebd-c2a159c9726d","parentWorkflowName":"default","parentNodeId":"java-security-blocker-mining-bundle","parentStepId":null,"parentStepName":"17. S6384 — Android intent redirection","childSourceRaw":"java-android-intent-redirection-mining","childWorkflowName":null,"resolutionKind":"registry","resolutionReason":null,"resolutionMessage":null,"isDirect":true,"createdAt":"2026-06-26T06:11:00.080Z","updatedAt":"2026-06-26 06:11:00.080034+00","childPackage":{"id":"6565cc03-fe66-41f4-a77a-005a2d6af613","name":"java-android-intent-redirection-mining","displayName":"java-android-intent-redirection-mining","description":"Mine Android component launches fed by externally supplied Intents that may enable intent redirection (javasecurity:S6384); read-only metrics for security review","scope":null,"visibility":"public","access":"public","latestVersion":"0.1.0","author":"Alex Bit "},"childPackageVersion":{"id":"50bdc6f5-f1e8-4c47-95ba-342d093083bf","packageId":"6565cc03-fe66-41f4-a77a-005a2d6af613","version":"0.1.0"}},{"id":"880b15bd-2d60-4507-95c7-2529c59f3aac","parentWorkflowName":"default","parentNodeId":"java-security-blocker-mining-bundle","parentStepId":null,"parentStepName":"18. S2755 — XXE","childSourceRaw":"java-xxe-mining","childWorkflowName":null,"resolutionKind":"registry","resolutionReason":null,"resolutionMessage":null,"isDirect":true,"createdAt":"2026-06-26T06:11:00.080Z","updatedAt":"2026-06-26 06:11:00.080034+00","childPackage":{"id":"d34acc3e-6b37-4951-a166-3857dd4f58c4","name":"java-xxe-mining","displayName":"java-xxe-mining","description":"Mine XML parser factory instantiations not hardened against XXE (secure processing / disallow-doctype-decl) (java:S2755); read-only metrics for security review","scope":null,"visibility":"public","access":"public","latestVersion":"0.1.0","author":"Alex Bit "},"childPackageVersion":{"id":"c29be2a6-af55-439a-9ede-2c33d090f08f","packageId":"d34acc3e-6b37-4951-a166-3857dd4f58c4","version":"0.1.0"}},{"id":"64bb378d-fbd4-4dcb-bef1-b72e51c38f82","parentWorkflowName":"default","parentNodeId":"java-security-blocker-mining-bundle","parentStepId":null,"parentStepName":"19. S6373 — XML arbitrary file inclusion","childSourceRaw":"java-xml-arbitrary-file-inclusion-mining","childWorkflowName":null,"resolutionKind":"registry","resolutionReason":null,"resolutionMessage":null,"isDirect":true,"createdAt":"2026-06-26T06:11:00.080Z","updatedAt":"2026-06-26 06:11:00.080034+00","childPackage":{"id":"f642fccf-86f1-4a02-a5c8-ea6d0420af8f","name":"java-xml-arbitrary-file-inclusion-mining","displayName":"java-xml-arbitrary-file-inclusion-mining","description":"Mine XML parser factory instantiations that are not hardened against external DTD/file inclusion (java:S6373); read-only metrics for security review","scope":null,"visibility":"public","access":"public","latestVersion":"0.1.0","author":"Alex Bit "},"childPackageVersion":{"id":"ef82768a-2ced-4f2b-9948-f3e26b79be16","packageId":"f642fccf-86f1-4a02-a5c8-ea6d0420af8f","version":"0.1.0"}}],"parentBundles":[]}],"distTags":{"latest":"0.1.0"},"latestPackageBehavior":"workflow-only","cachedTestCases":null},"meta":{"values":{"versions.0.version.createdAt":["Date"],"versions.0.insightsTemplate.generatedAt":["Date"],"versions.0.bundleChildren.0.createdAt":["Date"],"versions.0.bundleChildren.1.createdAt":["Date"],"versions.0.bundleChildren.2.createdAt":["Date"],"versions.0.bundleChildren.3.createdAt":["Date"],"versions.0.bundleChildren.4.createdAt":["Date"],"versions.0.bundleChildren.5.createdAt":["Date"],"versions.0.bundleChildren.6.createdAt":["Date"],"versions.0.bundleChildren.7.createdAt":["Date"],"versions.0.bundleChildren.8.createdAt":["Date"],"versions.0.bundleChildren.9.createdAt":["Date"],"versions.0.bundleChildren.10.createdAt":["Date"],"versions.0.bundleChildren.11.createdAt":["Date"],"versions.0.bundleChildren.12.createdAt":["Date"],"versions.0.bundleChildren.13.createdAt":["Date"],"versions.0.bundleChildren.14.createdAt":["Date"],"versions.0.bundleChildren.15.createdAt":["Date"],"versions.0.bundleChildren.16.createdAt":["Date"],"versions.0.bundleChildren.17.createdAt":["Date"],"versions.0.bundleChildren.18.createdAt":["Date"]}}},"dataUpdateCount":1,"dataUpdatedAt":1789140200784,"error":null,"errorUpdateCount":0,"errorUpdatedAt":0,"fetchFailureCount":0,"fetchFailureReason":null,"fetchMeta":null,"isInvalidated":false,"status":"success","fetchStatus":"idle"},"queryKey":[["registry","getPackage"],{"input":{"name":"java-security-blocker-mining-bundle","scope":"$undefined"},"type":"query"}],"queryHash":"[[\"registry\",\"getPackage\"],{\"input\":{\"name\":\"java-security-blocker-mining-bundle\"},\"type\":\"query\"}]"}]},"children":"$L4a"}]] 1c:null 20:[["$","title","0",{"children":"java-security-blocker-mining-bundle - Codemod Registry"}],["$","meta","1",{"name":"description","content":"Read-only workflow bundle that runs all 19 Java security blocker-severity mining codemods (injection, hard-coded credentials/secrets, deserialization, XXE, and more) in one pass."}],["$","meta","2",{"name":"author","content":"Alex Bit"}],["$","meta","3",{"name":"keywords","content":"java-security-blocker-mining-bundle, codemod, code transformation, automated refactoring, package, registry, mining, metrics, java, security, vulnerability, bundle, recipe"}],["$","meta","4",{"name":"creator","content":"Alex Bit"}],["$","meta","5",{"name":"publisher","content":"Codemod"}],["$","meta","6",{"name":"robots","content":"index, follow"}],["$","meta","7",{"name":"googlebot","content":"index, follow, max-video-preview:-1, max-image-preview:large, max-snippet:-1"}],["$","meta","8",{"name":"application-name","content":"Codemod Registry"}],["$","meta","9",{"name":"apple-mobile-web-app-title","content":"Codemod"}],["$","meta","10",{"name":"apple-mobile-web-app-capable","content":"yes"}],["$","meta","11",{"name":"apple-mobile-web-app-status-bar-style","content":"default"}],["$","meta","12",{"name":"format-detection","content":"telephone=no"}],["$","meta","13",{"name":"mobile-web-app-capable","content":"yes"}],["$","meta","14",{"name":"msapplication-config","content":"/browserconfig.xml"}],["$","meta","15",{"name":"msapplication-TileColor","content":"#000000"}],["$","meta","16",{"name":"msapplication-tap-highlight","content":"no"}],["$","meta","17",{"name":"theme-color","content":"#000000"}],["$","meta","18",{"name":"viewport","content":"width=device-width, initial-scale=1, maximum-scale=1, user-scalable=no"}],["$","link","19",{"rel":"canonical","href":"https://app.codemod.com/registry/java-security-blocker-mining-bundle"}],["$","meta","20",{"property":"og:title","content":"java-security-blocker-mining-bundle - Codemod Registry"}],["$","meta","21",{"property":"og:description","content":"Read-only workflow bundle that runs all 19 Java security blocker-severity mining codemods (injection, hard-coded credentials/secrets, deserialization, XXE, and more) in one pass."}],["$","meta","22",{"property":"og:url","content":"https://app.codemod.com/registry/java-security-blocker-mining-bundle"}],["$","meta","23",{"property":"og:site_name","content":"Codemod Registry"}],["$","meta","24",{"property":"og:locale","content":"en_US"}],["$","meta","25",{"property":"og:image","content":"https://app.codemod.com/api/og/registry/java-security-blocker-mining-bundle"}],["$","meta","26",{"property":"og:image:width","content":"1200"}],["$","meta","27",{"property":"og:image:height","content":"630"}],["$","meta","28",{"property":"og:image:alt","content":"java-security-blocker-mining-bundle package"}],["$","meta","29",{"property":"og:type","content":"website"}],["$","meta","30",{"name":"twitter:card","content":"summary_large_image"}],["$","meta","31",{"name":"twitter:site","content":"@codemod"}],["$","meta","32",{"name":"twitter:creator","content":"@codemod"}],["$","meta","33",{"name":"twitter:title","content":"java-security-blocker-mining-bundle - Codemod Registry"}],["$","meta","34",{"name":"twitter:description","content":"Read-only workflow bundle that runs all 19 Java security blocker-severity mining codemods (injection, hard-coded credentials/secrets, deserialization, XXE, and more) in one pass."}],["$","meta","35",{"name":"twitter:image","content":"https://app.codemod.com/api/og/registry/java-security-blocker-mining-bundle"}]]