java-xxe-mining

Read-only mining codemod for SonarSource rule java:S2755 — XML parsers should not be vulnerable to XXE attacks.

It scans Java source and emits metrics only; it never modifies code (return null).
Findings are high-signal review candidates surfaced by AST pattern matching — they are
not proven vulnerabilities. A static mining pass cannot prove an end-to-end taint flow
from an untrusted source to the sink, so confirm data flow before remediating.

What it detects

XML parser factory instantiations, flagging whether the file applies XXE hardening.

Sinks:

• DocumentBuilderFactory / SAXParserFactory / XMLInputFactory / TransformerFactory / SchemaFactory.newInstance
• XMLReaderFactory.createXMLReader
• new SAXBuilder / SAXReader

Emission rule: Emits for every parser factory site; hardened=true when the file contains hardening such as disallow-doctype-decl, FEATURE_SECURE_PROCESSING, ACCESS_EXTERNAL_*, or setExpandEntityReferences.

Metric: java-xxe-mining

Security standards

• CWE-611 (XML External Entity Injection)
• CWE-827 (Improper Control of Document Type Definition)
• OWASP ASVS 4.0: 5.5.2
• OWASP Top 10 2021: A5
• OWASP Top 10: A4
• PCI DSS 3.2: 6.5.1
• PCI DSS 4.0: 6.2.4
• STIG ASD V5R3: V-222608

Run locally

bash
Copy
cd codemods/java-security-blocker-mining/java-xxe-mining
npm test

# Scan a target project (read-only; emits metrics, leaves source unchanged)
npx codemod@latest workflow run \
  -w codemods/java-security-blocker-mining/java-xxe-mining/workflow.yaml \
  --target /path/to/java/project

Part of the java-security-blocker-mining suite covering 19 blocker-severity
Java vulnerability rules. Each codemod is read-only and emits a single named metric.