General Cleanup & Improvements - Githubissues

openrewrite / rewrite-java-security

OpenRewrite recipes for patching Java security vulnerabilities.

Apache License 2.0

17 stars 15 forks source link

General Cleanup & Improvements #120

Closed JLLeitschuh closed 8 months ago

JLLeitschuh commented 8 months ago

Adds several missing CWE tags
Adds some missing duration estimates
Removes no-op ImproperPrivilegeManagement from owasp
Adds ZipSlip to JavaSecurityBestPractices
Closes #113

Signed-off-by: Jonathan Leitschuh Jonathan.Leitschuh@gmail.com

What's changed?

See above

What's your motivation?

The OWASP recipe had some problems, miss-labeling, and the inclusion of a recipe that doesn't actually fix the vulnerability.

Also, there were several recipes missing CWE's

Anything in particular you'd like reviewers to focus on?

Do the duration estimates make sense? Is it fine that I removed those recipes from the OWASP one.

Anyone you would like to review specifically?

@jkschneider

Have you considered any alternatives or workarounds?

Any additional context

Checklist

[x] I've added unit tests to cover both positive and negative cases
[x] I've read and applied the recipe conventions and best practices
[x] I've used the IntelliJ IDEA auto-formatter on affected files