ShiftLeft Scan in Java: Complete SAST Security Scanning Guide

Table of Contents

Introduction to ShiftLeft Scan

ShiftLeft Scan is a Static Application Security Testing (SAST) tool that integrates security scanning into your CI/CD pipeline. It analyzes source code and dependencies to identify security vulnerabilities, secrets, and compliance issues early in the development lifecycle.

Key Features

Static Code Analysis: Identifies security vulnerabilities in source code
Dependency Scanning: Detects vulnerable third-party libraries
Secret Detection: Finds hardcoded secrets and credentials
Software Composition Analysis (SCA): Analyzes open-source dependencies
CI/CD Integration: Seamless integration with Jenkins, GitHub Actions, etc.
Custom Rules: Support for organization-specific security rules

Implementation Guide

Dependencies and Setup

Maven Configuration (pom.xml)

<?xml version="1.0" encoding="UTF-8"?>
<project xmlns="http://maven.apache.org/POM/4.0.0"
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 
http://maven.apache.org/xsd/maven-4.0.0.xsd">
<modelVersion>4.0.0</modelVersion>
<groupId>com.example</groupId>
<artifactId>shiftleft-scan-demo</artifactId>
<version>1.0.0</version>
<packaging>jar</packaging>
<properties>
<maven.compiler.source>11</maven.compiler.source>
<maven.compiler.target>11</maven.compiler.target>
<project.build.sourceEncoding>UTF-8</project.build.sourceEncoding>
<!-- ShiftLeft Scan Version -->
<shiftleft.scan.version>0.1.0</shiftleft.scan.version>
<!-- Security Testing Dependencies -->
<owasp.dependency.check.version>8.2.1</owasp.dependency.check.version>
<spotbugs.version>4.7.3</spotbugs.version>
<pmd.version>6.55.0</pmd.version>
<checkstyle.version>10.12.0</checkstyle.version>
</properties>
<dependencies>
<!-- Spring Boot for demo application -->
<dependency>
<groupId>org.springframework.boot</groupId>
<artifactId>spring-boot-starter-web</artifactId>
<version>2.7.0</version>
</dependency>
<dependency>
<groupId>org.springframework.boot</groupId>
<artifactId>spring-boot-starter-data-jpa</artifactId>
<version>2.7.0</version>
</dependency>
<dependency>
<groupId>com.h2database</groupId>
<artifactId>h2</artifactId>
<version>2.1.214</version>
<scope>runtime</scope>
</dependency>
<!-- Security libraries -->
<dependency>
<groupId>org.springframework.security</groupId>
<artifactId>spring-security-crypto</artifactId>
<version>5.7.1</version>
</dependency>
<dependency>
<groupId>com.auth0</groupId>
<artifactId>java-jwt</artifactId>
<version>4.2.1</version>
</dependency>
<!-- JSON Processing -->
<dependency>
<groupId>com.fasterxml.jackson.core</groupId>
<artifactId>jackson-databind</artifactId>
<version>2.13.3</version>
</dependency>
<!-- XML Processing -->
<dependency>
<groupId>javax.xml.bind</groupId>
<artifactId>jaxb-api</artifactId>
<version>2.3.1</version>
</dependency>
</dependencies>
<build>
<plugins>
<!-- Maven Compiler Plugin -->
<plugin>
<groupId>org.apache.maven.plugins</groupId>
<artifactId>maven-compiler-plugin</artifactId>
<version>3.11.0</version>
<configuration>
<source>11</source>
<target>11</target>
<compilerArgs>
<arg>-Xlint:all</arg>
<arg>-Werror</arg>
</compilerArgs>
</configuration>
</plugin>
<!-- ShiftLeft Scan Plugin -->
<plugin>
<groupId>com.shiftleft</groupId>
<artifactId>shiftleft-scan-maven</artifactId>
<version>${shiftleft.scan.version}</version>
<executions>
<execution>
<goals>
<goal>scan</goal>
</goals>
<phase>verify</phase>
</execution>
</executions>
<configuration>
<appName>${project.artifactId}</appName>
<appType>java</appType>
<failOnVulnerability>true</failOnVulnerability>
<severityThreshold>HIGH</severityThreshold>
<outputDirectory>${project.build.directory}/shiftleft-reports</outputDirectory>
<includePatterns>
<includePattern>**/*.java</includePattern>
</includePatterns>
<excludePatterns>
<excludePattern>**/test/**</excludePattern>
<excludePattern>**/generated/**</excludePattern>
</excludePatterns>
</configuration>
</plugin>
<!-- OWASP Dependency Check -->
<plugin>
<groupId>org.owasp</groupId>
<artifactId>dependency-check-maven</artifactId>
<version>${owasp.dependency.check.version}</version>
<executions>
<execution>
<goals>
<goal>check</goal>
</goals>
</execution>
</executions>
<configuration>
<failBuildOnAnyVulnerability>true</failBuildOnAnyVulnerability>
<suppressionFile>${project.basedir}/security/dependency-check-suppressions.xml</suppressionFile>
<format>HTML</format>
<formats>HTML,JSON,XML</formats>
</configuration>
</plugin>
<!-- SpotBugs for static analysis -->
<plugin>
<groupId>com.github.spotbugs</groupId>
<artifactId>spotbugs-maven-plugin</artifactId>
<version>${spotbugs.version}</version>
<executions>
<execution>
<goals>
<goal>check</goal>
</goals>
</execution>
</executions>
<configuration>
<effort>Max</effort>
<threshold>Low</threshold>
<failOnError>true</failOnError>
<excludeFilterFile>${project.basedir}/security/spotbugs-exclude.xml</excludeFilterFile>
</configuration>
</plugin>
<!-- PMD for code quality -->
<plugin>
<groupId>org.apache.maven.plugins</groupId>
<artifactId>maven-pmd-plugin</artifactId>
<version>${pmd.version}</version>
<executions>
<execution>
<goals>
<goal>check</goal>
</goals>
</execution>
</executions>
<configuration>
<failurePriority>3</failurePriority>
<rulesets>
<ruleset>${project.basedir}/security/pmd-ruleset.xml</ruleset>
</rulesets>
<printFailingErrors>true</printFailingErrors>
</configuration>
</plugin>
<!-- Checkstyle for coding standards -->
<plugin>
<groupId>org.apache.maven.plugins</groupId>
<artifactId>maven-checkstyle-plugin</artifactId>
<version>${checkstyle.version}</version>
<executions>
<execution>
<goals>
<goal>check</goal>
</goals>
</execution>
</executions>
<configuration>
<configLocation>google_checks.xml</configLocation>
<failsOnError>true</failsOnError>
<consoleOutput>true</consoleOutput>
</configuration>
</plugin>
<!-- Surefire for unit tests -->
<plugin>
<groupId>org.apache.maven.plugins</groupId>
<artifactId>maven-surefire-plugin</artifactId>
<version>3.0.0-M9</version>
<configuration>
<includes>
<include>**/*Test.java</include>
</includes>
<excludes>
<exclude>**/*IntegrationTest.java</exclude>
</excludes>
</configuration>
</plugin>
</plugins>
</build>
<reporting>
<plugins>
<plugin>
<groupId>com.github.spotbugs</groupId>
<artifactId>spotbugs-maven-plugin</artifactId>
<version>${spotbugs.version}</version>
</plugin>
<plugin>
<groupId>org.apache.maven.plugins</groupId>
<artifactId>maven-pmd-plugin</artifactId>
<version>${pmd.version}</version>
</plugin>
<plugin>
<groupId>org.apache.maven.plugins</groupId>
<artifactId>maven-checkstyle-plugin</artifactId>
<version>${checkstyle.version}</version>
</plugin>
</plugins>
</reporting>
</project>

Security Configuration Files

ShiftLeft Configuration (shiftleft.yml)

# ShiftLeft Scan Configuration
version: 1
scan:
# Application configuration
app:
name: "shiftleft-scan-demo"
type: "java"
version: "1.0.0"
# Analysis configuration
analysis:
language: "java"
build-tool: "maven"
java-version: "11"
# Security thresholds
security:
fail-on-severity: "HIGH"
max-critical: 0
max-high: 5
max-medium: 10
max-low: 20
# Scan targets
targets:
source:
directories:
- "src/main/java"
exclude:
- "**/test/**"
- "**/generated/**"
dependencies:
enabled: true
include-optional: false
secrets:
enabled: true
custom-patterns:
- name: "AWS Access Key"
pattern: "AKIA[0-9A-Z]{16}"
- name: "Generic API Key"
pattern: "(?i)(api[_-]?key|secret)[\\s]*[=:][\\s]*['\\\"]([0-9a-zA-Z]{32,})['\\\"]"
# Reporting
reporting:
formats:
- "json"
- "html"
- "sarif"
output-directory: "target/shiftleft-reports"
# CI/CD Integration
ci:
fail-on-vulnerability: true
upload-results: true
branch: "${GIT_BRANCH}"
commit: "${GIT_COMMIT}"
build-url: "${BUILD_URL}"
# Custom rules
custom-rules:
- id: "CUSTOM-SQL-INJECTION"
pattern: "Statement.executeQuery.*\\$.*"
message: "Potential SQL Injection with string concatenation"
severity: "HIGH"
category: "sql-injection"
- id: "CUSTOM-HARDCODED-SECRET"
pattern: "(?i)password.*=.*['\\\"].{4,}['\\\"]"
message: "Potential hardcoded password"
severity: "HIGH"
category: "hardcoded-secret"

OWASP Dependency Check Suppression (security/dependency-check-suppressions.xml)

<?xml version="1.0" encoding="UTF-8"?>
<suppressions xmlns="https://jeremylong.github.io/DependencyCheck/dependency-suppression.1.3.xsd">
<!-- Suppress false positives for Spring Framework -->
<suppress>
<notes><![CDATA[
False positive for Spring Framework CVE
]]></notes>
<cve>CVE-2018-1258</cve>
</suppress>
<!-- Suppress false positives for Jackson -->
<suppress>
<notes><![CDATA[
False positive for Jackson CVE
]]></notes>
<cve>CVE-2020-36518</cve>
</suppress>
<!-- Suppress specific dependencies -->
<suppress>
<notes><![CDATA[
Suppress vulnerabilities in test dependencies
]]></notes>
<filePath regex="true">.*test.*\.jar$</filePath>
</suppress>
<!-- Suppress low severity vulnerabilities -->
<suppress base="true">
<notes><![CDATA[
Suppress low severity vulnerabilities
]]></notes>
<severity>LOW</severity>
</suppress>
</suppressions>

SpotBugs Exclusions (security/spotbugs-exclude.xml)

<?xml version="1.0" encoding="UTF-8"?>
<FindBugsFilter>
<!-- Exclude generated code -->
<Match>
<Class name="~.*\.R\$.*"/>
</Match>
<!-- Exclude test code -->
<Match>
<Class name="~.*\.*Test.*"/>
</Match>
<!-- Exclude specific false positives -->
<Match>
<Bug pattern="EI_EXPOSE_REP,EI_EXPOSE_REP2"/>
<Class name="com.example.shiftleft.model.*"/>
</Match>
<!-- Exclude serialization issues in DTOs -->
<Match>
<Bug pattern="SE_NO_SERIALVERSIONID"/>
<Class name="~.*\.dto\..*"/>
</Match>
<!-- Exclude specific methods -->
<Match>
<Class name="com.example.shiftleft.controller.UserController"/>
<Method name="getUserPassword"/>
<Bug pattern="HARD_CODE_PASSWORD"/>
</Match>
</FindBugsFilter>

PMD Ruleset (security/pmd-ruleset.xml)

<?xml version="1.0"?>
<ruleset name="Custom Security Rules"
xmlns="http://pmd.sourceforge.net/ruleset/2.0.0"
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
xsi:schemaLocation="http://pmd.sourceforge.net/ruleset/2.0.0 
https://pmd.sourceforge.io/ruleset_2_0_0.xsd">
<description>Custom PMD rules for security scanning</description>
<!-- Import standard rules -->
<rule ref="category/java/security.xml">
<exclude name="InsecureCryptoUsage"/>
</rule>
<rule ref="category/java/bestpractices.xml">
<exclude name="GuardLogStatement"/>
</rule>
<rule ref="category/java/errorprone.xml">
<exclude name="BeanMembersShouldSerialize"/>
</rule>
<!-- Custom security rules -->
<rule name="AvoidSystemOutPrint"
language="java"
message="Avoid using System.out.print, use logger instead"
class="net.sourceforge.pmd.lang.rule.XPathRule">
<description>
System.out.print should be avoided in production code
</description>
<priority>3</priority>
<properties>
<property name="xpath">
<value>
<![CDATA[
//PrimaryExpression[
PrimaryPrefix/Name[
@Image='System.out.print' or 
@Image='System.out.println' or
@Image='System.err.print' or
@Image='System.err.println'
]
]
]]>
</value>
</property>
</properties>
</rule>
<rule name="AvoidHardCodedCredentials"
language="java"
message="Avoid hardcoded credentials"
class="net.sourceforge.pmd.lang.rule.XPathRule">
<description>
Hardcoded credentials should be avoided
</description>
<priority>1</priority>
<properties>
<property name="xpath">
<value>
<![CDATA[
//Literal[
matches(@Image, '(?i).*password.*|.*secret.*|.*key.*') and
string-length(@Image) > 10
]
]]>
</value>
</property>
</properties>
</rule>
</ruleset>

Sample Application Code for Scanning

Secure User Controller

package com.example.shiftleft.controller;
import com.example.shiftleft.model.User;
import com.example.shiftleft.service.UserService;
import com.example.shiftleft.util.SecurityValidator;
import org.slf4j.Logger;
import org.slf4j.LoggerFactory;
import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.http.ResponseEntity;
import org.springframework.web.bind.annotation.*;
import javax.validation.Valid;
import java.util.List;
/**
* User controller with security best practices
* This class demonstrates secure coding patterns
*/
@RestController
@RequestMapping("/api/users")
public class UserController {
private static final Logger logger = LoggerFactory.getLogger(UserController.class);
@Autowired
private UserService userService;
@Autowired
private SecurityValidator securityValidator;
/**
* Get user by ID - Secure implementation
*/
@GetMapping("/{id}")
public ResponseEntity<User> getUser(@PathVariable String id, 
@RequestHeader("Authorization") String authHeader) {
// Validate input
if (!securityValidator.isValidUserId(id)) {
logger.warn("Invalid user ID provided: {}", id);
return ResponseEntity.badRequest().build();
}
// Validate authentication
if (!securityValidator.isValidAuthHeader(authHeader)) {
logger.warn("Invalid authentication header");
return ResponseEntity.status(401).build();
}
try {
User user = userService.findUserById(id);
if (user == null) {
return ResponseEntity.notFound().build();
}
// Sanitize sensitive data before returning
user.sanitizeSensitiveData();
return ResponseEntity.ok(user);
} catch (Exception e) {
logger.error("Error fetching user: {}", id, e);
return ResponseEntity.internalServerError().build();
}
}
/**
* Create user - Secure implementation
*/
@PostMapping
public ResponseEntity<User> createUser(@Valid @RequestBody User user,
@RequestHeader("Authorization") String authHeader) {
// Validate authentication
if (!securityValidator.isValidAuthHeader(authHeader)) {
return ResponseEntity.status(401).build();
}
// Validate user data
if (!securityValidator.isValidUser(user)) {
return ResponseEntity.badRequest().build();
}
try {
User createdUser = userService.createUser(user);
createdUser.sanitizeSensitiveData();
logger.info("User created successfully: {}", createdUser.getId());
return ResponseEntity.ok(createdUser);
} catch (Exception e) {
logger.error("Error creating user", e);
return ResponseEntity.internalServerError().build();
}
}
/**
* Search users - Secure implementation with input validation
*/
@GetMapping("/search")
public ResponseEntity<List<User>> searchUsers(@RequestParam String query,
@RequestHeader("Authorization") String authHeader) {
// Validate authentication
if (!securityValidator.isValidAuthHeader(authHeader)) {
return ResponseEntity.status(401).build();
}
// Validate and sanitize search query
String sanitizedQuery = securityValidator.sanitizeSearchQuery(query);
if (sanitizedQuery == null) {
return ResponseEntity.badRequest().build();
}
try {
List<User> users = userService.searchUsers(sanitizedQuery);
users.forEach(User::sanitizeSensitiveData);
return ResponseEntity.ok(users);
} catch (Exception e) {
logger.error("Error searching users with query: {}", sanitizedQuery, e);
return ResponseEntity.internalServerError().build();
}
}
}

User Service with Security Measures

package com.example.shiftleft.service;
import com.example.shiftleft.model.User;
import com.example.shiftleft.repository.UserRepository;
import com.example.shiftleft.util.PasswordHasher;
import org.slf4j.Logger;
import org.slf4j.LoggerFactory;
import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.dao.DataAccessException;
import org.springframework.stereotype.Service;
import org.springframework.transaction.annotation.Transactional;
import java.sql.SQLException;
import java.util.List;
import java.util.regex.Pattern;
/**
* User service with security best practices
* Demonstrates secure coding patterns for ShiftLeft scanning
*/
@Service
public class UserService {
private static final Logger logger = LoggerFactory.getLogger(UserService.class);
// SQL injection prevention pattern
private static final Pattern SQL_INJECTION_PATTERN = 
Pattern.compile("([';]+|(--)+|(\\|\\|)+|(&&)+)", Pattern.CASE_INSENSITIVE);
@Autowired
private UserRepository userRepository;
@Autowired
private PasswordHasher passwordHasher;
/**
* Find user by ID - Secure implementation
*/
public User findUserById(String id) {
// Validate input
if (id == null || id.trim().isEmpty()) {
throw new IllegalArgumentException("User ID cannot be null or empty");
}
// Check for potential SQL injection
if (containsSqlInjection(id)) {
logger.warn("Potential SQL injection attempt detected in user ID: {}", id);
throw new SecurityException("Invalid user ID format");
}
try {
return userRepository.findById(id)
.orElse(null);
} catch (DataAccessException e) {
logger.error("Database error while fetching user: {}", id, e);
throw new RuntimeException("Unable to fetch user", e);
}
}
/**
* Create user with secure password handling
*/
@Transactional
public User createUser(User user) {
// Validate user object
if (user == null) {
throw new IllegalArgumentException("User cannot be null");
}
// Hash password before storage
if (user.getPassword() != null) {
String hashedPassword = passwordHasher.hashPassword(user.getPassword());
user.setPassword(hashedPassword);
}
try {
User savedUser = userRepository.save(user);
logger.info("User created with ID: {}", savedUser.getId());
return savedUser;
} catch (DataAccessException e) {
logger.error("Database error while creating user", e);
throw new RuntimeException("Unable to create user", e);
}
}
/**
* Search users with input sanitization
*/
public List<User> searchUsers(String query) {
// Validate and sanitize query
if (query == null || query.trim().isEmpty()) {
throw new IllegalArgumentException("Search query cannot be null or empty");
}
String sanitizedQuery = sanitizeSearchQuery(query);
if (sanitizedQuery == null) {
throw new SecurityException("Invalid search query");
}
try {
return userRepository.findByUsernameContaining(sanitizedQuery);
} catch (DataAccessException e) {
logger.error("Database error while searching users with query: {}", sanitizedQuery, e);
throw new RuntimeException("Unable to search users", e);
}
}
/**
* Authenticate user securely
*/
public boolean authenticateUser(String username, String password) {
if (username == null || password == null) {
return false;
}
try {
User user = userRepository.findByUsername(username);
if (user == null) {
// Use constant time comparison to prevent timing attacks
passwordHasher.dummyHashComparison();
return false;
}
return passwordHasher.verifyPassword(password, user.getPassword());
} catch (DataAccessException e) {
logger.error("Database error during authentication for user: {}", username, e);
return false;
}
}
/**
* Check for SQL injection patterns
*/
private boolean containsSqlInjection(String input) {
return SQL_INJECTION_PATTERN.matcher(input).find();
}
/**
* Sanitize search query
*/
private String sanitizeSearchQuery(String query) {
if (query == null) return null;
// Remove potentially dangerous characters
String sanitized = query.replaceAll("[';\"\\\\]", "");
// Limit length
if (sanitized.length() > 100) {
sanitized = sanitized.substring(0, 100);
}
return sanitized.trim();
}
}

Security Utility Classes

package com.example.shiftleft.util;
import org.springframework.security.crypto.bcrypt.BCryptPasswordEncoder;
import org.springframework.security.crypto.encrypt.Encryptors;
import org.springframework.security.crypto.encrypt.TextEncryptor;
import org.springframework.stereotype.Component;
import java.security.SecureRandom;
import java.util.Base64;
import java.util.regex.Pattern;
/**
* Security utilities for password hashing and validation
*/
@Component
public class PasswordHasher {
private final BCryptPasswordEncoder bcryptEncoder;
private final SecureRandom secureRandom;
// Do NOT hardcode this in production - use environment variables
private static final String ENCRYPTION_PASSWORD = System.getenv("ENCRYPTION_PASSWORD");
private static final String ENCRYPTION_SALT = System.getenv("ENCRYPTION_SALT");
public PasswordHasher() {
this.bcryptEncoder = new BCryptPasswordEncoder(12);
this.secureRandom = new SecureRandom();
}
/**
* Hash password using bcrypt
*/
public String hashPassword(String plainPassword) {
if (plainPassword == null || plainPassword.trim().isEmpty()) {
throw new IllegalArgumentException("Password cannot be null or empty");
}
if (plainPassword.length() < 8) {
throw new IllegalArgumentException("Password must be at least 8 characters long");
}
return bcryptEncoder.encode(plainPassword);
}
/**
* Verify password against hash
*/
public boolean verifyPassword(String plainPassword, String hashedPassword) {
if (plainPassword == null || hashedPassword == null) {
return false;
}
return bcryptEncoder.matches(plainPassword, hashedPassword);
}
/**
* Dummy hash comparison to prevent timing attacks
*/
public void dummyHashComparison() {
// Perform a dummy hash to prevent timing attacks
String dummyPassword = generateRandomString(16);
bcryptEncoder.encode(dummyPassword);
}
/**
* Generate secure random string
*/
private String generateRandomString(int length) {
byte[] bytes = new byte[length];
secureRandom.nextBytes(bytes);
return Base64.getEncoder().encodeToString(bytes);
}
}
/**
* Security validator for input validation
*/
@Component
public class SecurityValidator {
private static final Pattern USER_ID_PATTERN = Pattern.compile("^[a-zA-Z0-9-_]{1,50}$");
private static final Pattern USERNAME_PATTERN = Pattern.compile("^[a-zA-Z0-9_]{3,30}$");
private static final Pattern EMAIL_PATTERN = Pattern.compile("^[A-Za-z0-9+_.-]+@(.+)$");
private static final Pattern AUTH_HEADER_PATTERN = Pattern.compile("^Bearer [a-zA-Z0-9-_]+\\.[a-zA-Z0-9-_]+\\.[a-zA-Z0-9-_]+$");
/**
* Validate user ID format
*/
public boolean isValidUserId(String userId) {
return userId != null && USER_ID_PATTERN.matcher(userId).matches();
}
/**
* Validate username format
*/
public boolean isValidUsername(String username) {
return username != null && USERNAME_PATTERN.matcher(username).matches();
}
/**
* Validate email format
*/
public boolean isValidEmail(String email) {
return email != null && EMAIL_PATTERN.matcher(email).matches();
}
/**
* Validate authentication header format
*/
public boolean isValidAuthHeader(String authHeader) {
return authHeader != null && AUTH_HEADER_PATTERN.matcher(authHeader).matches();
}
/**
* Validate user object
*/
public boolean isValidUser(User user) {
if (user == null) return false;
return isValidUsername(user.getUsername()) &&
isValidEmail(user.getEmail()) &&
(user.getPassword() == null || user.getPassword().length() >= 8);
}
/**
* Sanitize search query
*/
public String sanitizeSearchQuery(String query) {
if (query == null) return null;
// Remove potentially dangerous characters
String sanitized = query.replaceAll("[';\"\\\\<>]", "");
// Limit length
if (sanitized.length() > 100) {
sanitized = sanitized.substring(0, 100);
}
return sanitized.trim();
}
/**
* Check for potential XSS in input
*/
public boolean containsXss(String input) {
if (input == null) return false;
Pattern xssPattern = Pattern.compile(
"(<script|javascript:|onload=|onerror=|onclick=)", 
Pattern.CASE_INSENSITIVE
);
return xssPattern.matcher(input).find();
}
}

Data Models with Security Considerations

package com.example.shiftleft.model;
import com.fasterxml.jackson.annotation.JsonIgnore;
import com.fasterxml.jackson.annotation.JsonProperty;
import javax.persistence.*;
import javax.validation.constraints.Email;
import javax.validation.constraints.NotBlank;
import javax.validation.constraints.Size;
import java.time.LocalDateTime;
/**
* User entity with security considerations
*/
@Entity
@Table(name = "users")
public class User {
@Id
@GeneratedValue(strategy = GenerationType.UUID)
private String id;
@NotBlank(message = "Username is required")
@Size(min = 3, max = 30, message = "Username must be between 3 and 30 characters")
@Column(unique = true, nullable = false)
private String username;
@NotBlank(message = "Email is required")
@Email(message = "Email should be valid")
@Column(unique = true, nullable = false)
private String email;
@NotBlank(message = "Password is required")
@Size(min = 8, message = "Password must be at least 8 characters long")
@JsonProperty(access = JsonProperty.Access.WRITE_ONLY) // Never serialize password
@Column(nullable = false)
private String password;
@Column(name = "created_at")
private LocalDateTime createdAt;
@Column(name = "updated_at")
private LocalDateTime updatedAt;
// Security-sensitive fields that should not be exposed
@JsonIgnore
@Column(name = "password_reset_token")
private String passwordResetToken;
@JsonIgnore
@Column(name = "failed_login_attempts")
private Integer failedLoginAttempts;
// Constructors
public User() {
this.createdAt = LocalDateTime.now();
this.updatedAt = LocalDateTime.now();
this.failedLoginAttempts = 0;
}
public User(String username, String email, String password) {
this();
this.username = username;
this.email = email;
this.password = password;
}
// Getters and setters
public String getId() { return id; }
public void setId(String id) { this.id = id; }
public String getUsername() { return username; }
public void setUsername(String username) { this.username = username; }
public String getEmail() { return email; }
public void setEmail(String email) { this.email = email; }
public String getPassword() { return password; }
public void setPassword(String password) { this.password = password; }
public LocalDateTime getCreatedAt() { return createdAt; }
public void setCreatedAt(LocalDateTime createdAt) { this.createdAt = createdAt; }
public LocalDateTime getUpdatedAt() { return updatedAt; }
public void setUpdatedAt(LocalDateTime updatedAt) { this.updatedAt = updatedAt; }
@JsonIgnore
public String getPasswordResetToken() { return passwordResetToken; }
public void setPasswordResetToken(String passwordResetToken) { 
this.passwordResetToken = passwordResetToken; 
}
@JsonIgnore
public Integer getFailedLoginAttempts() { return failedLoginAttempts; }
public void setFailedLoginAttempts(Integer failedLoginAttempts) { 
this.failedLoginAttempts = failedLoginAttempts; 
}
/**
* Sanitize sensitive data before serialization
*/
public void sanitizeSensitiveData() {
this.password = null;
this.passwordResetToken = null;
}
@PreUpdate
public void preUpdate() {
this.updatedAt = LocalDateTime.now();
}
@Override
public String toString() {
return String.format("User{id='%s', username='%s', email='%s'}", 
id, username, email);
}
}

Security Vulnerabilities Examples (for testing)

package com.example.shiftleft.vulnerabilities;
import java.sql.*;
import java.util.regex.Pattern;
/**
* This class contains intentional security vulnerabilities
* for testing ShiftLeft Scan detection capabilities
* DO NOT USE IN PRODUCTION
*/
public class VulnerableCodeExamples {
// ❌ VULNERABLE: Hardcoded credentials
private static final String DB_PASSWORD = "mysecretpassword123";
private static final String API_KEY = "sk_live_1234567890abcdef";
private static final String AWS_ACCESS_KEY = "AKIAIOSFODNN7EXAMPLE";
/**
* ❌ VULNERABLE: SQL Injection vulnerable method
*/
public static void vulnerableSqlInjection(String userInput) {
try {
Connection conn = DriverManager.getConnection(
"jdbc:mysql://localhost:3306/mydb", "user", DB_PASSWORD);
// Vulnerable: direct string concatenation
String query = "SELECT * FROM users WHERE username = '" + userInput + "'";
Statement stmt = conn.createStatement();
ResultSet rs = stmt.executeQuery(query); // SQL Injection vulnerability
while (rs.next()) {
System.out.println(rs.getString("username"));
}
} catch (SQLException e) {
e.printStackTrace();
}
}
/**
* ❌ VULNERABLE: Command Injection vulnerable method
*/
public static void vulnerableCommandInjection(String filename) {
try {
// Vulnerable: direct command execution
Runtime.getRuntime().exec("ls -la " + filename); // Command Injection vulnerability
} catch (Exception e) {
e.printStackTrace();
}
}
/**
* ❌ VULNERABLE: XSS vulnerable method
*/
public static String vulnerableXss(String userInput) {
// Vulnerable: no input sanitization
return "<div>" + userInput + "</div>"; // XSS vulnerability
}
/**
* ❌ VULNERABLE: Insecure deserialization
*/
public static void vulnerableDeserialization(byte[] data) {
try {
// Vulnerable: no validation of serialized data
java.io.ObjectInputStream ois = new java.io.ObjectInputStream(
new java.io.ByteArrayInputStream(data));
Object obj = ois.readObject(); // Insecure deserialization vulnerability
} catch (Exception e) {
e.printStackTrace();
}
}
/**
* ❌ VULNERABLE: Weak random number generation
*/
public static int vulnerableRandom() {
// Vulnerable: using insecure random
return new java.util.Random().nextInt(); // Weak randomness
}
/**
* ✅ SECURE: SQL Injection protected method
*/
public static void secureSqlInjection(String userInput, Connection conn) {
try {
// Secure: using prepared statements
String query = "SELECT * FROM users WHERE username = ?";
PreparedStatement stmt = conn.prepareStatement(query);
stmt.setString(1, userInput); // Parameterized query
ResultSet rs = stmt.executeQuery();
while (rs.next()) {
System.out.println(rs.getString("username"));
}
} catch (SQLException e) {
e.printStackTrace();
}
}
/**
* ✅ SECURE: Command Injection protected method
*/
public static void secureCommandInjection(String filename) {
try {
// Secure: validate and sanitize input
if (!isValidFilename(filename)) {
throw new IllegalArgumentException("Invalid filename");
}
String[] command = {"ls", "-la", filename};
Runtime.getRuntime().exec(command); // Safe command execution
} catch (Exception e) {
e.printStackTrace();
}
}
/**
* ✅ SECURE: XSS protected method
*/
public static String secureXss(String userInput) {
// Secure: sanitize input
String sanitized = userInput.replaceAll("<", "&lt;")
.replaceAll(">", "&gt;")
.replaceAll("\"", "&quot;")
.replaceAll("'", "&#x27;");
return "<div>" + sanitized + "</div>";
}
private static boolean isValidFilename(String filename) {
return Pattern.matches("^[a-zA-Z0-9._-]+$", filename);
}
}

CI/CD Integration

GitHub Actions Workflow (.github/workflows/shiftleft-scan.yml)

name: ShiftLeft Security Scan
on:
push:
branches: [ main, develop ]
pull_request:
branches: [ main ]
jobs:
security-scan:
name: ShiftLeft Security Scan
runs-on: ubuntu-latest
steps:
- name: Checkout code
uses: actions/checkout@v3
with:
fetch-depth: 0
- name: Set up Java
uses: actions/setup-java@v3
with:
java-version: '11'
distribution: 'temurin'
cache: 'maven'
- name: Cache Maven packages
uses: actions/cache@v3
with:
path: ~/.m2
key: ${{ runner.os }}-m2-${{ hashFiles('**/pom.xml') }}
restore-keys: ${{ runner.os }}-m2
- name: Run ShiftLeft Scan
uses: shiftleftsecurity/scan-action@v2
with:
output: reports
fail-on-vulnerability: true
severity-threshold: HIGH
env:
SHIFTLEFT_ACCESS_TOKEN: ${{ secrets.SHIFTLEFT_ACCESS_TOKEN }}
- name: Run OWASP Dependency Check
run: mvn dependency-check:check
- name: Run SpotBugs
run: mvn spotbugs:check
- name: Run PMD
run: mvn pmd:check
- name: Run Checkstyle
run: mvn checkstyle:check
- name: Upload Security Reports
uses: actions/upload-artifact@v3
with:
name: security-reports
path: |
target/shiftleft-reports/
target/dependency-check-report.html
target/spotbugs.xml
target/pmd.xml
target/checkstyle-result.xml
- name: Security Scan Summary
run: |
echo "## Security Scan Results" >> $GITHUB_STEP_SUMMARY
echo "" >> $GITHUB_STEP_SUMMARY
echo "### ShiftLeft Scan" >> $GITHUB_STEP_SUMMARY
echo "- ✅ Static Code Analysis Completed" >> $GITHUB_STEP_SUMMARY
echo "" >> $GITHUB_STEP_SUMMARY
echo "### OWASP Dependency Check" >> $GITHUB_STEP_SUMMARY
echo "- ✅ Dependency Vulnerability Scan Completed" >> $GITHUB_STEP_SUMMARY
echo "" >> $GITHUB_STEP_SUMMARY
echo "### Static Analysis Tools" >> $GITHUB_STEP_SUMMARY
echo "- ✅ SpotBugs Analysis Completed" >> $GITHUB_STEP_SUMMARY
echo "- ✅ PMD Analysis Completed" >> $GITHUB_STEP_SUMMARY
echo "- ✅ Checkstyle Analysis Completed" >> $GITHUB_STEP_SUMMARY

Jenkins Pipeline (Jenkinsfile)

pipeline {
agent any
environment {
SHIFTLEFT_ACCESS_TOKEN = credentials('shiftleft-access-token')
JAVA_HOME = '/usr/lib/jvm/java-11-openjdk'
}
stages {
stage('Checkout') {
steps {
checkout scm
}
}
stage('Build') {
steps {
sh 'mvn clean compile -DskipTests'
}
}
stage('Unit Tests') {
steps {
sh 'mvn test'
}
post {
always {
junit 'target/surefire-reports/*.xml'
}
}
}
stage('Security Scan') {
parallel {
stage('ShiftLeft Scan') {
steps {
sh '''
mvn com.shiftleft:shiftleft-scan-maven:scan \
-DappName=${JOB_NAME} \
-DfailOnVulnerability=true \
-DseverityThreshold=HIGH \
-DoutputDirectory=target/shiftleft-reports
'''
}
post {
always {
publishHTML([
allowMissing: false,
alwaysLinkToLastBuild: true,
keepAll: true,
reportDir: 'target/shiftleft-reports',
reportFiles: 'report.html',
reportName: 'ShiftLeft Scan Report'
])
}
}
}
stage('OWASP Dependency Check') {
steps {
sh 'mvn dependency-check:check'
}
post {
always {
publishHTML([
allowMissing: false,
alwaysLinkToLastBuild: true,
keepAll: true,
reportDir: 'target',
reportFiles: 'dependency-check-report.html',
reportName: 'OWASP Dependency Check Report'
])
}
}
}
stage('Static Analysis') {
steps {
sh '''
mvn spotbugs:check pmd:check checkstyle:check
'''
}
post {
always {
recordIssues(
tools: [
spotBugs(pattern: 'target/spotbugs.xml'),
pmdParser(pattern: 'target/pmd.xml'),
checkStyle(pattern: 'target/checkstyle-result.xml')
]
)
}
}
}
}
}
stage('Integration Tests') {
steps {
sh 'mvn verify -DskipUnitTests'
}
post {
always {
junit 'target/failsafe-reports/*.xml'
}
}
}
}
post {
always {
archiveArtifacts artifacts: 'target/*.jar', fingerprint: true
cleanWs()
}
success {
emailext (
subject: "SUCCESS: Job '${env.JOB_NAME} [${env.BUILD_NUMBER}]'",
body: "The build completed successfully.\n\nCheck console output at ${env.BUILD_URL}",
to: "${env.BUILD_USER_EMAIL}"
)
}
failure {
emailext (
subject: "FAILED: Job '${env.JOB_NAME} [${env.BUILD_NUMBER}]'",
body: "The build failed. Security vulnerabilities were detected.\n\nCheck console output at ${env.BUILD_URL}",
to: "${env.BUILD_USER_EMAIL}"
)
}
}
}

Security Test Cases

package com.example.shiftleft.security;
import org.junit.jupiter.api.Test;
import org.springframework.boot.test.context.SpringBootTest;
import org.springframework.test.context.ActiveProfiles;
import static org.junit.jupiter.api.Assertions.*;
/**
* Security test cases for ShiftLeft scanning
*/
@SpringBootTest
@ActiveProfiles("test")
public class SecurityTests {
@Test
public void testSqlInjectionPrevention() {
SecurityValidator validator = new SecurityValidator();
// Test valid inputs
assertTrue(validator.isValidUserId("user123"));
assertTrue(validator.isValidUserId("user-123"));
assertTrue(validator.isValidUserId("user_123"));
// Test SQL injection attempts
assertFalse(validator.isValidUserId("user' OR '1'='1"));
assertFalse(validator.isValidUserId("admin'; DROP TABLE users; --"));
assertFalse(validator.isValidUserId("test\" OR \"1\"=\"1"));
}
@Test
public void testXssPrevention() {
SecurityValidator validator = new SecurityValidator();
// Test XSS attempts
assertTrue(validator.containsXss("<script>alert('XSS')</script>"));
assertTrue(validator.containsXss("javascript:alert('XSS')"));
assertTrue(validator.containsXss("onload=\"maliciousCode()\""));
assertTrue(validator.containsXss("onerror=\"alert(1)\""));
// Test safe inputs
assertFalse(validator.containsXss("Hello World"));
assertFalse(validator.containsXss("user123"));
assertFalse(validator.containsXss("[email protected]"));
}
@Test
public void testInputSanitization() {
SecurityValidator validator = new SecurityValidator();
// Test search query sanitization
String maliciousQuery = "test'; DROP TABLE users; --";
String sanitized = validator.sanitizeSearchQuery(maliciousQuery);
assertFalse(sanitized.contains("'"));
assertFalse(sanitized.contains(";"));
assertFalse(sanitized.contains("--"));
}
@Test
public void testPasswordHashing() {
PasswordHasher hasher = new PasswordHasher();
String password = "SecurePassword123!";
String hashed = hasher.hashPassword(password);
assertNotNull(hashed);
assertNotEquals(password, hashed);
// Verify password
assertTrue(hasher.verifyPassword(password, hashed));
assertFalse(hasher.verifyPassword("WrongPassword", hashed));
}
@Test
public void testAuthenticationHeaderValidation() {
SecurityValidator validator = new SecurityValidator();
// Valid JWT token format
assertTrue(validator.isValidAuthHeader(
"Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiaWF0IjoxNTE2MjM5MDIyfQ.SflKxwRJSMeKKF2QT4fwpMeJf36POk6yJV_adQssw5c"
));
// Invalid formats
assertFalse(validator.isValidAuthHeader("Basic dXNlcjpwYXNz"));
assertFalse(validator.isValidAuthHeader("Bearer invalid.token.format"));
assertFalse(validator.isValidAuthHeader(""));
assertFalse(validator.isValidAuthHeader(null));
}
}

Configuration for Different Environments

application-security.yml

# Security configuration for different environments
spring:
profiles: default
security:
encryption:
password: ${ENCRYPTION_PASSWORD:default-dev-password}
salt: ${ENCRYPTION_SALT:default-dev-salt}
shiftleft:
scan:
enabled: true
fail-on-vulnerability: false
severity-threshold: MEDIUM
---
spring:
profiles: test
security:
encryption:
password: ${ENCRYPTION_PASSWORD:test-password}
salt: ${ENCRYPTION_SALT:test-salt}
shiftleft:
scan:
enabled: true
fail-on-vulnerability: true
severity-threshold: HIGH
---
spring:
profiles: production
security:
encryption:
password: ${ENCRYPTION_PASSWORD}
salt: ${ENCRYPTION_SALT}
shiftleft:
scan:
enabled: true
fail-on-vulnerability: true
severity-threshold: HIGH

Best Practices

1. Secure Coding Guidelines

/**
* Security best practices for Java development
*/
public class SecurityBestPractices {
// ✅ Use environment variables for secrets
private static final String DB_PASSWORD = System.getenv("DB_PASSWORD");
// ✅ Use secure random for cryptographic operations
private final SecureRandom secureRandom = new SecureRandom();
// ✅ Use prepared statements for database operations
public void secureDatabaseOperation(Connection conn, String userInput) {
String query = "SELECT * FROM users WHERE username = ?";
try (PreparedStatement stmt = conn.prepareStatement(query)) {
stmt.setString(1, userInput);
ResultSet rs = stmt.executeQuery();
// Process results
} catch (SQLException e) {
// Log properly, don't expose stack traces
logger.error("Database error occurred", e);
}
}
// ✅ Validate and sanitize all inputs
public String sanitizeInput(String input) {
if (input == null) return null;
// Remove potentially dangerous characters
return input.replaceAll("[<>\"']", "");
}
// ✅ Use proper password hashing
public String hashPassword(String password) {
return BCrypt.hashpw(password, BCrypt.gensalt(12));
}
// ✅ Implement proper error handling
public void handleError(Exception e) {
// Log error for internal use
logger.error("An error occurred", e);
// Return generic error message to user
throw new RuntimeException("An unexpected error occurred");
}
}

2. Regular Security Scanning

#!/bin/bash
# security-scan.sh
echo "Starting comprehensive security scan..."
# ShiftLeft Scan
echo "Running ShiftLeft Scan..."
mvn com.shiftleft:shiftleft-scan-maven:scan
# OWASP Dependency Check
echo "Running OWASP Dependency Check..."
mvn dependency-check:check
# Static Analysis
echo "Running SpotBugs..."
mvn spotbugs:check
echo "Running PMD..."
mvn pmd:check
echo "Running Checkstyle..."
mvn checkstyle:check
# Generate report
echo "Generating security report..."
./generate-security-report.sh
echo "Security scan completed!"

Conclusion

This comprehensive ShiftLeft Scan implementation provides:

Complete SAST integration with Maven builds
Multiple security scanning tools (ShiftLeft, OWASP, SpotBugs, PMD, Checkstyle)
CI/CD pipeline integration with GitHub Actions and Jenkins
Security-focused code examples with both vulnerable and secure implementations
Custom security configurations for different environments
Comprehensive testing for security controls

Key benefits include early vulnerability detection, automated security testing in CI/CD, comprehensive coverage of security issues, and integration with development workflows.

Remember to:

Run security scans regularly in your CI/CD pipeline
Address high-severity vulnerabilities immediately
Keep security tools and dependencies updated
Educate developers on secure coding practices
Use environment variables for sensitive configuration
Review and update security rules regularly

Secure Java Dependency Management, Vulnerability Scanning & Software Supply Chain Protection (SBOM, SCA, CI Security & License Compliance)

https://macronepal.com/blog/github-code-scanning-in-java-complete-guide/
Explains GitHub Code Scanning for Java using tools like CodeQL to automatically analyze source code and detect security vulnerabilities directly inside CI/CD pipelines before deployment.

https://macronepal.com/blog/license-compliance-in-java-comprehensive-guide/
Explains software license compliance in Java projects, ensuring dependencies follow legal requirements (MIT, Apache, GPL, etc.) and preventing license violations in enterprise software.

https://macronepal.com/blog/container-security-for-java-uncovering-vulnerabilities-with-grype/
Explains using Grype to scan Java container images and filesystems for known CVEs in OS packages and application dependencies to improve container security.

https://macronepal.com/blog/syft-sbom-generation-in-java-comprehensive-software-bill-of-materials-for-jvm-applications/
Explains using Syft to generate SBOMs (Software Bill of Materials) for Java applications, listing all dependencies, libraries, and components for supply chain transparency.

https://macronepal.com/blog/comprehensive-dependency-analysis-generating-and-scanning-sboms-with-trivy-for-java/
Explains using Trivy to generate SBOMs and scan Java dependencies and container images for vulnerabilities, integrating security checks into CI/CD pipelines.

https://macronepal.com/blog/dependabot-for-java-in-java/
Explains GitHub Dependabot for Java projects, which automatically detects vulnerable dependencies and creates pull requests to update them securely.

https://macronepal.com/blog/parasoft-jtest-in-java-comprehensive-guide-to-code-analysis-and-testing/
Explains Parasoft Jtest, a static analysis and testing tool for Java that helps detect bugs, security issues, and code quality problems early in development.

https://macronepal.com/blog/snyk-open-source-in-java-comprehensive-dependency-vulnerability-management-2/
Explains Snyk Open Source for Java, which continuously scans dependencies for vulnerabilities and provides automated fix suggestions and monitoring.

https://macronepal.com/blog/owasp-dependency-check-in-java-complete-vulnerability-scanning-guide/
Explains OWASP Dependency-Check, which scans Java dependencies against the National Vulnerability Database (NVD) to detect known security vulnerabilities.

https://macronepal.com/blog/securing-your-dependencies-a-java-developers-guide-to-whitesource-mend-bolt/
Explains Mend (WhiteSource) Bolt for Java, a dependency management and SCA tool that provides vulnerability detection, license compliance, and security policy enforcement in enterprise environments.