feat(model-grounded-detection): Java web sinks, and the post-closure-fix ceiling

Java shipped with injection, deserialization and crypto sinks only, so the path
and output_encoding families had nothing routing to them by CWE and any Java
pair in either was unreadable -- the gap hutool-cve-2018-17297 reported as "no
path spec for java". Adds the JDK filesystem entry points, the servlet response
writers, the outbound/redirect APIs, and the ESAPI / canonical-path sanitizers
the OWASP suite itself uses. Documented APIs, provenance per entry.

Post-closure-fix ceiling: 41.3% entailed (38/92) and 26.1% distinguished, up
from 39.1% / 23.9%. path went 0/8 to 1/8 with its first distinguished pair;
injection 29->31 entailed and 18->19 distinguished. Two points -- real, and the
mechanism is understood, but the remaining gaps are data rather than machinery.

Carrying a correction: the measurement harness routed config_secrets through
TAINT rather than the constant-abstraction arm, so its 0/10 in this artifact
measures the wrong arbiter and did so in both full runs. The harness is fixed;
that family's real number is the earlier targeted re-measure, and this
artifact's config row should not be read.

Co-Authored-By: Claude Opus 5 (1M context) <[email protected]>
Claude-Session: https://claude.ai/code/session_01T7XD7x5KonMdmGRkp63EQG

src/openultrasast/ruleset/semantic/java.toml

@@ -29,3 +29,39 @@ cwe = "CWE-327"
 calls = ["getInstance"]
 rule_ids = ["java-weak-hash"]
 weak_literals = ["MD5", "SHA-1", "SHA1"]
+
+# --- model-grounded-detection: Java web sinks --------------------------------------------------------------
+# Java shipped with injection, deserialization and crypto sinks only, so the path and output_encoding families
+# had nothing routing to them by CWE and a Java pair in either was unreadable (hutool-cve-2018-17297 reported
+# "no path spec for java"). Documented dangerous APIs of the JDK and the servlet API, provenance per entry.
+
+[[sink]]
+# CWE-22. The JDK's filesystem entry points that accept a caller-supplied path.
+id = "file.open"
+cwe = "CWE-22"
+calls = ["File", "FileInputStream", "FileOutputStream", "FileReader", "FileWriter", "RandomAccessFile", "Paths.get", "Files.newInputStream", "Files.readAllBytes"]
+rule_ids = []
+
+[[sink]]
+# CWE-79. Servlet response writers: what reaches these reaches the browser unescaped.
+id = "response.write"
+cwe = "CWE-79"
+calls = ["println", "print", "write", "getWriter", "setHeader", "addHeader"]
+rule_ids = []
+
+[[sink]]
+# CWE-918 / CWE-601: outbound requests and redirects to a caller-supplied destination.
+id = "outbound.request"
+cwe = "CWE-918"
+calls = ["openConnection", "openStream", "sendRedirect", "getForObject", "exchange"]
+rule_ids = []
+
+[[sanitizer]]
+# CWE-22 / CWE-79. The documented normalising and encoding APIs; ESAPI is what the OWASP suite itself uses.
+id = "java.escape"
+calls = ["getCanonicalPath", "normalize", "ESAPI.encoder", "encodeForHTML", "encodeForURL", "StringEscapeUtils.escapeHtml4", "URLEncoder.encode"]
+
+[[sanitizer]]
+id = "parameterized_statement"
+calls = ["prepareStatement", "setString", "setInt"]
+parameterized = true