JSecPy v2.1.0

Java SAST hardened by an adversarial red-team pass.

JSecPy parses Java to an AST and tracks attacker-controlled data from sources (servlet params, headers, request bodies, CLI args) to dangerous sinks (SQL, OS commands, file paths, URLs, LDAP, XPath). It reports SQL injection when input actually reaches a query, not every line that mentions Statement.

Hardening in this release

A red-team pass generated 43 adversarial Java cases plus an engine-correctness review. Running them against the real engine (not the red-team's guesses) surfaced the true defects, all now fixed:

• Fixed: taint through chained builder calls (sb.append(...).append(source).toString()) was dropped.
• Fixed: receiver-aware source matching, so config.getParameter(...) is no longer mistaken for request.getParameter.
• Fixed: String.valueOf no longer treated as a sanitizer (it preserves taint).
• Fixed: ternary data flow (x = cond ? tainted : safe).
• Fixed: concat-smell false positives on numeric-typed and sanitizer-cleaned values.
• Fixed: inline-source flow traces + this./super. receiver resolution.

Result on the corpus

• 0 missed detections, 0 false positives across the 43 cases.
• The 4 remaining intra-procedural gaps (taint through maps, cross-method flow, field storage, Random subclass) are encoded as strict xfail tests, so they stay visible and flip to failures the day they are closed.
• Test count: 32 to 72 passing.

What JSecPy is

14 rules mapped to CWE and OWASP Top 10 (2021); SARIF/JSON/CLI reporters; YAML rule engine for custom sinks; GitHub Action; Docker; STRIDE threat model. Intra-procedural taint analysis: a high-signal CI gate, not a proof of correctness.

Install: pip install "jsecpy @ git+https://github.com/lohith80/JSecPy@v2.1.0"

MIT licensed. Detection-gap reports (a snippet JSecPy misses, or safe code it wrongly flags) are the most welcome contribution.