Skip to main content

Find sensitive API endpoints

org.openrewrite.java.security.search.FindSensitiveApiEndpoints

Find data models exposed by REST APIs that contain sensitive information like PII and secrets.

Recipe source​

This recipe is only available to users of Moderne.

This recipe is available under the Moderne Proprietary License.

Options​

TypeNameDescriptionExample
ListfieldNamesField names to search for.password,dateOfBirth,dob,ssn
BooleantransitiveOptional. Find model objects that contain other model objects that contain sensitive data.

Example​

Parameters​
ParameterValue
fieldNamesList.of("birthdate")
transitivetrue
Before​
import com.arakelian.faker.model.Person;
import com.arakelian.faker.service.RandomPerson;
import org.springframework.web.bind.annotation.GetMapping;
import org.springframework.web.bind.annotation.RequestMapping;

@RequestMapping("/person")
class PersonController {
    @GetMapping("/random")
    public Person randomPerson() {
        return RandomPerson.get().next();
    }
}
After​
import com.arakelian.faker.model.Person;
import com.arakelian.faker.service.RandomPerson;
import org.springframework.web.bind.annotation.GetMapping;
import org.springframework.web.bind.annotation.RequestMapping;

@RequestMapping("/person")
class PersonController {
    @GetMapping("/random")
    public /*~~(com.arakelian.faker.model.Person#getBirthdate)~~>*/Person randomPerson() {
        return RandomPerson.get().next();
    }
}

Usage​

This recipe has required configuration parameters and can only be run by users of Moderne. To run this recipe, you will need to provide the Moderne CLI run command with the required options. Or, if you'd like to create a declarative recipe, please see the below example of a rewrite.yml file:

rewrite.yml
---
type: specs.openrewrite.org/v1beta/recipe
name: com.yourorg.FindSensitiveApiEndpointsExample
displayName: Find sensitive API endpoints example
recipeList:
  - org.openrewrite.java.security.search.FindSensitiveApiEndpoints: 
      fieldNames: password,dateOfBirth,dob,ssn

You will need to have configured the Moderne CLI on your machine before you can run the following command.

shell
mod run . --recipe FindSensitiveApiEndpoints --recipe-option "fieldNames=password,dateOfBirth,dob,ssn"

If the recipe is not available locally, then you can install it using:

mod config recipes jar install org.openrewrite.recipe:rewrite-java-security:3.11.0

See how this recipe works across multiple open-source repositories​

Run this recipe on OSS repos at scale with the Moderne SaaS.

The community edition of the Moderne platform enables you to easily run recipes across thousands of open-source repositories.

Please contact Moderne for more information about safely running the recipes on your own codebase in a private SaaS.

Data Tables​

Sensitive API endpoints​

org.openrewrite.java.security.table.SensitiveApiEndpoints

The API endpoints that expose sensitive data.

Column NameDescription
Source pathThe path to the source file containing the API endpoint definition.
Method nameThe name of the method that defines the API endpoint.
MethodThe HTTP method of the API endpoint.
PathThe path of the API endpoint.
Sensitive fieldThe piece of sensitive data that is included.
Sensitive data pathThe sensitive data exposed by the API endpoint.

Contributors​

Jonathan Schneider, Tim te Beek