Open_Ultra_SAST/src/openultrasast/ruleset/semantic/java.toml

version = "1"
language = "java"

[[source]]
id = "servlet"
framework = "jakarta-servlet"
patterns = ["getParameter", "getHeader", "getCookies", "getQueryString"]

# A request body or a console read line by line: the reader, not the servlet API.
[[source]]
id = "servlet"
patterns = ["readLine"]

[[sink]]
id = "exec"
cwe = "CWE-78"
calls = ["exec"]
rule_ids = ["java-command-exec"]

[[sink]]
id = "executeQuery"
cwe = "CWE-89"
calls = ["executeQuery", "execute", "prepareCall"]
rule_ids = ["java-sql-injection"]

[[sink]]
id = "readObject"
cwe = "CWE-502"
calls = ["readObject"]
rule_ids = ["java-deserialization"]

[[sink]]
id = "MessageDigest"
cwe = "CWE-327"
calls = ["getInstance"]
rule_ids = ["java-weak-hash"]
weak_literals = ["MD5", "SHA-1", "SHA1"]

# --- model-grounded-detection: Java web sinks --------------------------------------------------------------
# Java shipped with injection, deserialization and crypto sinks only, so the path and output_encoding families
# had nothing routing to them by CWE and a Java pair in either was unreadable (hutool-cve-2018-17297 reported
# "no path spec for java"). Documented dangerous APIs of the JDK and the servlet API, provenance per entry.

[[sink]]
# CWE-22. The JDK's filesystem entry points that accept a caller-supplied path.
id = "file.open"
cwe = "CWE-22"
calls = ["File", "FileInputStream", "FileOutputStream", "FileReader", "FileWriter", "RandomAccessFile", "Paths.get", "Files.newInputStream", "Files.readAllBytes"]
rule_ids = []

[[sink]]
# CWE-79. Servlet response writers: what reaches these reaches the browser unescaped.
id = "response.write"
framework = "jakarta-servlet"
cwe = "CWE-79"
calls = ["println", "print", "write", "getWriter", "setHeader", "addHeader"]
rule_ids = []

[[sink]]
# CWE-918 / CWE-601: outbound requests and redirects to a caller-supplied destination.
id = "outbound.request"
cwe = "CWE-918"
calls = ["openConnection", "openStream"]
rule_ids = []

[[sink]]
id = "outbound.request"
framework = "jakarta-servlet"
cwe = "CWE-918"
calls = ["sendRedirect"]
rule_ids = []

[[sink]]
id = "outbound.request"
framework = "spring"
cwe = "CWE-918"
calls = ["getForObject", "exchange"]
rule_ids = []

[[sanitizer]]
# CWE-22 / CWE-79. The documented normalising and encoding APIs; ESAPI is what the OWASP suite itself uses.
id = "java.escape"
calls = ["getCanonicalPath", "normalize", "URLEncoder.encode"]

[[sanitizer]]
id = "java.escape"
library = "esapi"
calls = ["ESAPI.encoder", "encodeForHTML", "encodeForURL"]

[[sanitizer]]
id = "java.escape"
library = "commons-text"
calls = ["StringEscapeUtils.escapeHtml4"]

[[sanitizer]]
id = "parameterized_statement"
calls = ["prepareStatement", "setString", "setInt"]
parameterized = true