java-framework-audit

Search for SpEL injection sinks like SpelExpressionParser and parseExpression, check management.endpoints.web.exposure.include for exposed Actuator endpoints, and verify @ModelAttribute bindings use setAllowedFields whitelists. Compare dependency versions against known CVEs such as CVE-2022-22965.

Search for JSON.parseObject or JSON.parse calls processing untrusted input, then check the FastJSON version in pom.xml and whether safeMode or autotype whitelists are configured. Versions before 1.2.83 have known autotype bypass chains.

#{} uses PreparedStatement parameter binding and is safe from SQL injection, while ${} performs direct string concatenation equivalent to String.format. Any ${} usage in Mapper XML or @Select annotations is a SQL injection entry point unless protected by whitelist validation.

Shiro 1.2.4 and earlier ship a hardcoded AES key (CVE-2016-4437), but newer versions remain vulnerable if developers set custom but predictable or leaked cipher keys via setCipherKey. Audit by extracting the key value and comparing against known key dictionaries.

Shiro's URL matching rules differ from Spring's path resolution, so payloads like /admin/;.js or /toLogin;/../admin pass Shiro filters but route to protected Spring endpoints. Audit by comparing ShiroFilterFactoryBean URL mappings against actual Spring routes.

This approach detects known vulnerability patterns and framework misuse but cannot find zero-day flaws in framework internals. It also requires accurate dependency version identification, since CVE applicability depends entirely on exact version numbers in build files.