Skip to main content

Find Security.setProperty(..) calls for certain properties

io.moderne.cryptography.FindSecuritySetProperties

There is a defined set of properties that should not be set using Security.setProperty(..) as they can lead to security vulnerabilities.

Recipe source​

GitHub, Issue Tracker, Maven Central

This recipe is available under the Apache License Version 2.0.

Options​

TypeNameDescriptionExample
ListpropertiesOptional. A list of the properties we want to prevent being set with Security.setProperty(..).crypto.policy

Used by​

This recipe is used as part of the following composite recipes:

Example​

Parameters​
ParameterValue
propertiesList.of("crypto.policy")
Before​
import java.security.Security;

class C {
    void update() {
        String key = "crypto.policy";
        Security.setProperty(key, "unlimited");
    }
}
After​
import java.security.Security;

class C {
    void update() {
        String key = /*~~>*/"crypto.policy";
        Security.setProperty(key, "unlimited");
    }
}

Usage​

This recipe has no required configuration options. It can be activated by adding a dependency on io.moderne.recipe:rewrite-cryptography in your build file or by running a shell command (in which case no build changes are needed):

  1. Add the following to your build.gradle file:
build.gradle
plugins {
    id("org.openrewrite.rewrite") version("latest.release")
}

rewrite {
    activeRecipe("io.moderne.cryptography.FindSecuritySetProperties")
    setExportDatatables(true)
}

repositories {
    mavenCentral()
}

dependencies {
    rewrite("io.moderne.recipe:rewrite-cryptography:0.8.1")
}
  1. Run gradle rewriteRun to run the recipe.

See how this recipe works across multiple open-source repositories​

Run this recipe on OSS repos at scale with the Moderne SaaS.

The community edition of the Moderne platform enables you to easily run recipes across thousands of open-source repositories.

Please contact Moderne for more information about safely running the recipes on your own codebase in a private SaaS.

Data Tables​

Insecure Security.setProperty(..) uses.​

io.moderne.cryptography.table.InsecureSetProperties

An itemization of the properties used in such calls

Column NameDescription
Source filePath to the file where the result was found
Source codeThe source code where the insecure property is defined, which may not contain a Security.setProperty(..) call directly if the property was defined somewhere and through data flow analysis we've concluded that it is later used in a Security.setProperty(..) call.
PropertyThe property that is set insecurely, e.g. crypto.policy.