java-server-side-template-injection-mining

Read-only mining codemod for SonarSource rule javasecurity:S5496 — Server-side templates should not be vulnerable to injection attacks.

It scans Java source and emits metrics only; it never modifies code (return null).
Findings are high-signal review candidates surfaced by AST pattern matching — they are
not proven vulnerabilities. A static mining pass cannot prove an end-to-end taint flow
from an untrusted source to the sink, so confirm data flow before remediating.

What it detects

Server-side template engine sinks built from dynamic templates/expressions.

Sinks:

• SpelExpressionParser.parseExpression(...)
• Velocity.evaluate / VelocityEngine.evaluateString
• TemplateEngine.process / createTemplate (Thymeleaf/Groovy)

Emission rule: Only emits when a template/expression argument is dynamic.

Metric: java-server-side-template-injection-mining

Security standards

• CWE-77 (Command Injection)
• CWE-94 (Code Injection)
• OWASP ASVS 4.0: 5.2.5, 5.2.8
• OWASP Top 10 2021: A3
• OWASP Top 10: A1
• PCI DSS 3.2: 6.5.1
• PCI DSS 4.0: 6.2.4
• STIG ASD V5R3: V-222609

Run locally

bash
Copy
cd codemods/java-security-blocker-mining/java-server-side-template-injection-mining
npm test

# Scan a target project (read-only; emits metrics, leaves source unchanged)
npx codemod@latest workflow run \
  -w codemods/java-security-blocker-mining/java-server-side-template-injection-mining/workflow.yaml \
  --target /path/to/java/project

Part of the java-security-blocker-mining suite covering 19 blocker-severity
Java vulnerability rules. Each codemod is read-only and emits a single named metric.