GitHub Code Scanning in Java: Complete Guide

Introduction to GitHub Code Scanning

GitHub Code Scanning is a GitHub Advanced Security feature that helps identify security vulnerabilities and coding errors in your Java codebase. It uses CodeQL (GitHub's semantic code analysis engine) and third-party tools to analyze your code and detect potential issues.

System Architecture Overview

GitHub Code Scanning Pipeline ├── Trigger Events │ ├ - Push to main/develop │ ├ - Pull Requests │ ├ - Schedule (daily/weekly) │ └ - Manual Trigger ├── Analysis Tools │ ├ - CodeQL Analysis │ ├ - Third-party Scanners │ ├ - Custom Queries │ └ - Security Patterns ├── Scanning Process │ ├ - Code Extraction │ ├ - Database Creation │ ├ - Query Execution │ └ - Results Processing └── Results & Integration ├ - Security Alerts ├ - PR Comments ├ - SARIF Reports └ - Security Dashboard

Core Implementation

1. GitHub Actions Workflow Configuration

codeql-analysis.yml

name: "CodeQL Advanced Security" on: push: branches: [ "main", "develop" ] pull_request: branches: [ "main", "develop" ] schedule: - cron: '30 1 * * 0' # Weekly on Sunday at 1:30 AM jobs: analyze: name: Analyze Java Code runs-on: ubuntu-latest permissions: actions: read contents: read security-events: write strategy: fail-fast: false matrix: language: [ 'java' ] # CodeQL supports [ 'cpp', 'csharp', 'go', 'java', 'javascript', 'python', 'ruby' ] steps: - name: Checkout repository uses: actions/checkout@v4 with: fetch-depth: 0 # Full history for better analysis - name: Initialize CodeQL uses: github/codeql-action/init@v3 with: languages: ${{ matrix.language }} queries: security-and-quality, security-extended config-file: ./.github/codeql/codeql-config.yml - name: Set up JDK 17 uses: actions/setup-java@v4 with: java-version: '17' distribution: 'temurin' cache: 'maven' - name: Build with Maven (Autobuild) run: | mvn clean compile -DskipTests # Build the code to enable CodeQL to analyze it - name: Perform CodeQL Analysis uses: github/codeql-action/analyze@v3 with: category: "/language:${{matrix.language}}" output: codeql-results.sarif upload-database: true - name: Upload SARIF results uses: github/codeql-action/upload-sarif@v3 if: always() with: sarif_file: codeql-results.sarif wait-for-processing: true

advanced-security-scan.yml

name: "Advanced Security Scanning" on: push: branches: [ "main", "develop", "security/**" ] pull_request: branches: [ "main", "develop" ] workflow_dispatch: # Manual trigger jobs: security-scan: name: Comprehensive Security Scan runs-on: ubuntu-latest permissions: security-events: write actions: read contents: read steps: - name: Checkout code uses: actions/checkout@v4 with: fetch-depth: 0 - name: Set up JDK 17 uses: actions/setup-java@v4 with: java-version: '17' distribution: 'temurin' cache: 'maven' # CodeQL Analysis - name: Initialize CodeQL uses: github/codeql-action/init@v3 with: languages: java queries: +security-and-quality, security-extended, ../codeql-queries/java/ql/src/Security/CWE config-file: ./.github/codeql/codeql-config.yml - name: Build project run: mvn clean compile -DskipTests -DskipITs - name: Perform CodeQL Analysis uses: github/codeql-action/analyze@v3 with: category: "java-security" # Dependency Vulnerability Scanning - name: Run OWASP Dependency Check run: | mvn org.owasp:dependency-check-maven:check -DskipTests continue-on-error: true # Don't fail build on vulnerabilities - name: Upload Dependency Check Report uses: actions/upload-artifact@v4 with: name: dependency-check-report path: target/dependency-check-report.html retention-days: 30 # SpotBugs Security Analysis - name: Run SpotBugs Security Analysis run: | mvn com.github.spotbugs:spotbugs-maven-plugin:spotbugs -Dspotbugs.includeTests=false continue-on-error: true - name: Upload SpotBugs Report uses: actions/upload-artifact@v4 with: name: spotbugs-report path: target/spotbugs.xml retention-days: 30 # PMD Security Analysis - name: Run PMD Security Analysis run: | mvn pmd:pmd -Dpmd.includeTests=false continue-on-error: true - name: Upload PMD Report uses: actions/upload-artifact@v4 with: name: pmd-report path: target/pmd.xml retention-days: 30 # Custom Security Tools - name: Run Semgrep Security Scan uses: returntocorp/semgrep-action@v1 with: config: p/java-security output: semgrep-results.sarif - name: Upload Semgrep Results uses: github/codeql-action/upload-sarif@v3 with: sarif_file: semgrep-results.sarif

2. CodeQL Configuration

codeql-config.yml

# .github/codeql/codeql-config.yml name: "Custom Java Security Configuration" paths: - src/main/java - src/main/resources paths-ignore: - src/test - src/main/resources/static - target - .github - .mvn - '**/generated/**' - '**/test/**' queries: - uses: security-and-quality - uses: security-extended - name: custom-java-security-queries uses: ./.github/codeql/custom-queries - name: find-sql-injections uses: ./.github/codeql/java-sql-queries query-filters: - exclude: id: java/example/too-many-loops # Example of excluding specific queries packs: - codeql/java-queries libraries: - maven build-mode: automatic disable-default-queries: false query-timeout: 500 memory: 6144 threads: 0

Custom CodeQL Queries

// .github/codeql/custom-queries/java-security.ql import java import semmle.code.java.dataflow.DataFlow import semmle.code.java.security.QueryInjection /** * @name Potential SQL injection with JDBCTemplate * @description Detects potential SQL injection vulnerabilities when using Spring JDBCTemplate * @kind path-problem * @problem.severity warning * @security-severity 8.5 * @precision medium * @id java/sql-injection-jdbctemplate * @tags security * external/cwe/cwe-089 */ module JDBCTemplateInjection implements DataFlow::ConfigSig { predicate isSource(DataFlow::Node source) { exists(MethodAccess ma | ma.getMethod().hasName("query") and ma.getMethod().getDeclaringType().hasQualifiedName("org.springframework.jdbc.core", "JdbcTemplate") and source.asExpr() = ma.getArgument(0) ) } predicate isSink(DataFlow::Node sink) { exists(MethodAccess ma | ma.getMethod().hasName("execute") and ma.getMethod().getDeclaringType().hasQualifiedName("java.sql", "Statement") and sink.asExpr() = ma.getArgument(0) ) } } module JDBCTemplateInjectionFlow = TaintTracking::Global<JDBCTemplateInjection>; from JDBCTemplateInjectionFlow::PathNode source, JDBCTemplateInjectionFlow::PathNode sink where JDBCTemplateInjectionFlow::flow(source, sink) select sink, source, sink, "Potential SQL injection vulnerability in JDBCTemplate query execution"

3. Maven Security Configuration

pom.xml Security Plugins

<properties> <owasp.dependency.check.version>8.4.2</owasp.dependency.check.version> <spotbugs.version>4.7.3</spotbugs.version> <pmd.version>6.55.0</pmd.version> <jacoco.version>0.8.8</jacoco.version> <codeql.maven.plugin.version>1.0.0</codeql.maven.plugin.version> </properties> <build> <plugins> <!-- OWASP Dependency Check --> <plugin> <groupId>org.owasp</groupId> <artifactId>dependency-check-maven</artifactId> <version>${owasp.dependency.check.version}</version> <configuration> <format>HTML</format> <format>XML</format> <failBuildOnAnyVulnerability>true</failBuildOnAnyVulnerability> <failOnCVSS>7</failOnCVSS> <skipTestScope>true</skipTestScope> <skipRuntimeScope>false</skipRuntimeScope> <skipProvidedScope>false</skipProvidedScope> <skipSystemScope>false</skipSystemScope> <suppressionFiles> <suppressionFile>${project.basedir}/security/dependency-check-suppressions.xml</suppressionFile> </suppressionFiles> <analyzer> <assemblyEnabled>false</assemblyEnabled> </analyzer> </configuration> <executions> <execution> <goals> <goal>check</goal> </goals> </execution> </executions> </plugin> <!-- SpotBugs Security Configuration --> <plugin> <groupId>com.github.spotbugs</groupId> <artifactId>spotbugs-maven-plugin</artifactId> <version>${spotbugs.version}</version> <configuration> <effort>Max</effort> <threshold>Low</threshold> <failOnError>true</failOnError> <excludeFilterFile>${project.basedir}/security/spotbugs-security-exclude.xml</excludeFilterFile> <plugins> <plugin> <groupId>com.h3x3lf1t</groupId> <artifactId>findsecbugs</artifactId> <version>1.12.0</version> </plugin> </plugins> </configuration> <executions> <execution> <id>spotbugs-security-scan</id> <phase>verify</phase> <goals> <goal>check</goal> </goals> </execution> </executions> </plugin> <!-- PMD Security Rules --> <plugin> <groupId>org.apache.maven.plugins</groupId> <artifactId>maven-pmd-plugin</artifactId> <version>${pmd.version}</version> <configuration> <rulesets> <ruleset>${project.basedir}/security/pmd-security-ruleset.xml</ruleset> <ruleset>category/java/security.xml</ruleset> </rulesets> <failOnViolation>true</failOnViolation> <printFailingErrors>true</printFailingErrors> <linkXRef>false</linkXRef> </configuration> <executions> <execution> <id>pmd-security-scan</id> <phase>verify</phase> <goals> <goal>check</goal> </goals> </execution> </executions> </plugin> <!-- JaCoCo Code Coverage --> <plugin> <groupId>org.jacoco</groupId> <artifactId>jacoco-maven-plugin</artifactId> <version>${jacoco.version}</version> <executions> <execution> <id>prepare-agent</id> <goals> <goal>prepare-agent</goal> </goals> </execution> <execution> <id>report</id> <phase>verify</phase> <goals> <goal>report</goal> </goals> </execution> <execution> <id>check</id> <goals> <goal>check</goal> </goals> <configuration> <rules> <rule> <element>BUNDLE</element> <limits> <limit> <counter>INSTRUCTION</counter> <value>COVEREDRATIO</value> <minimum>0.80</minimum> </limit> <limit> <counter>BRANCH</counter> <value>COVEREDRATIO</value> <minimum>0.70</minimum> </limit> </limits> </rule> </rules> </configuration> </execution> </executions> </plugin> </plugins> </build> <profiles> <profile> <id>security-scan</id> <build> <plugins> <plugin> <groupId>org.owasp</groupId> <artifactId>dependency-check-maven</artifactId> <executions> <execution> <id>dependency-check</id> <phase>validate</phase> <goals> <goal>check</goal> </goals> </execution> </executions> </plugin> </plugins> </build> </profile> </profiles>

4. Security Configuration Files

OWASP Dependency Check Suppressions

<?xml version="1.0" encoding="UTF-8"?> <!-- security/dependency-check-suppressions.xml --> <suppressions xmlns="https://jeremylong.github.io/DependencyCheck/dependency-suppression.1.3.xsd"> <!-- Suppress false positives for specific libraries --> <suppress> <notes><![CDATA[ False positive for logback-core - see https://github.com/jeremylong/DependencyCheck/issues/XXXX ]]></notes> <packageUrl regex="true">^pkg:maven/ch\.qos\.logback/logback\-core@.*$</packageUrl> <cve>CVE-2023-12345</cve> </suppress> <!-- Suppress specific CVE in test scope --> <suppress> <notes><![CDATA[ Suppress test dependencies with known vulnerabilities ]]></notes> <gav regex="true">^junit:junit:.*$</gav> <cve>CVE-2020-15250</cve> </suppress> <!-- Suppress vulnerabilities with CVSS score below threshold --> <suppress base="true"> <notes><![CDATA[ Suppress vulnerabilities with CVSS score less than 7.0 ]]></notes> <cvssBelow>7.0</cvssBelow> </suppress> </suppressions>

SpotBugs Security Exclusions

<!-- security/spotbugs-security-exclude.xml --> <FindBugsFilter> <Match> <!-- Exclude specific security patterns in test code --> <Class name="~.*Test.*"/> <Bug pattern="HARD_CODE_PASSWORD"/> </Match> <Match> <!-- Exclude intentional password fields in configuration --> <Class name="com.example.config.SecurityConfig"/> <Field name="defaultPassword"/> <Bug pattern="HARD_CODE_PASSWORD"/> </Match> <Match> <!-- Exclude specific false positives for serialization --> <Class name="~.*\.model\..*"/> <Bug pattern="SE_BAD_FIELD"/> </Match> <Match> <!-- Exclude specific cryptographic patterns --> <Class name="com.example.security.CryptoUtil"/> <Bug pattern="STATIC_IV"/> </Match> </FindBugsFilter>

PMD Security Ruleset

<?xml version="1.0"?> <!-- security/pmd-security-ruleset.xml --> <ruleset name="Security Rules" xmlns="http://pmd.sourceforge.net/ruleset/2.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://pmd.sourceforge.net/ruleset/2.0.0 https://pmd.sourceforge.io/ruleset_2_0_0.xsd"> <description>Custom security rules for Java applications</description> <!-- Import standard security rules --> <rule ref="category/java/security.xml"> <exclude name="InsecureCryptoIv"/> </rule> <!-- Custom security rules --> <rule ref="category/java/bestpractices.xml/AvoidUsingHardCodedIP"/> <rule ref="category/java/errorprone.xml/BeanMembersShouldSerialize"/> <!-- Custom rule configuration --> <rule ref="category/java/security.xml/HardCodedCryptoKey"> <properties> <property name="minimumLength" value="8"/> </properties> </rule> </ruleset>

5. Secure Java Code Examples

Secure Authentication Service

/** * Secure authentication service implementation with security best practices. * * @author Security Team * @version 1.0 */ package com.example.security; import org.springframework.security.crypto.password.PasswordEncoder; import org.springframework.security.crypto.bcrypt.BCryptPasswordEncoder; import org.springframework.stereotype.Service; import org.springframework.beans.factory.annotation.Value; import javax.crypto.SecretKeyFactory; import javax.crypto.spec.PBEKeySpec; import java.security.NoSuchAlgorithmException; import java.security.SecureRandom; import java.security.spec.InvalidKeySpecException; import java.util.Arrays; import java.util.Base64; /** * Secure authentication service with protection against common vulnerabilities. */ @Service public class SecureAuthService { private static final SecureRandom SECURE_RANDOM = new SecureRandom(); private static final int ITERATIONS = 10000; private static final int KEY_LENGTH = 256; private static final int SALT_LENGTH = 32; @Value("${security.pepper:defaultPepperValue}") private String pepper; private final PasswordEncoder passwordEncoder; public SecureAuthService() { this.passwordEncoder = new BCryptPasswordEncoder(12); // Strong work factor } /** * Securely hash password with salt and pepper. * * @param password the plain text password * @return hashed password with salt */ public String hashPassword(String password) { if (password == null || password.trim().isEmpty()) { throw new IllegalArgumentException("Password cannot be null or empty"); } // Generate cryptographically secure salt byte[] salt = generateSalt(); // Combine password with pepper String pepperedPassword = password + pepper; // Hash using PBKDF2 byte[] hash = pbkdf2Hash(pepperedPassword.toCharArray(), salt); // Encode salt and hash together return encodeSaltAndHash(salt, hash); } /** * Verify password against stored hash. * * @param password the plain text password * @param storedHash the stored hash with salt * @return true if password matches */ public boolean verifyPassword(String password, String storedHash) { if (password == null || storedHash == null) { return false; } try { // Decode salt and hash from stored value String[] parts = storedHash.split(":"); if (parts.length != 2) { return false; } byte[] salt = Base64.getDecoder().decode(parts[0]); byte[] expectedHash = Base64.getDecoder().decode(parts[1]); // Combine password with pepper String pepperedPassword = password + pepper; // Compute hash for provided password byte[] testHash = pbkdf2Hash(pepperedPassword.toCharArray(), salt); // Constant-time comparison to prevent timing attacks return constantTimeEquals(expectedHash, testHash); } catch (IllegalArgumentException | ArrayIndexOutOfBoundsException e) { return false; } } /** * Generate cryptographically secure salt. * * @return secure random salt */ private byte[] generateSalt() { byte[] salt = new byte[SALT_LENGTH]; SECURE_RANDOM.nextBytes(salt); return salt; } /** * PBKDF2 password hashing. * * @param password the password as char array * @param salt the salt * @return hashed password */ private byte[] pbkdf2Hash(char[] password, byte[] salt) { try { PBEKeySpec spec = new PBEKeySpec(password, salt, ITERATIONS, KEY_LENGTH); SecretKeyFactory skf = SecretKeyFactory.getInstance("PBKDF2WithHmacSHA256"); return skf.generateSecret(spec).getEncoded(); } catch (NoSuchAlgorithmException | InvalidKeySpecException e) { throw new SecurityException("Password hashing failed", e); } finally { // Clear the password array Arrays.fill(password, '\0'); } } /** * Encode salt and hash for storage. * * @param salt the salt * @param hash the hash * @return encoded string */ private String encodeSaltAndHash(byte[] salt, byte[] hash) { String encodedSalt = Base64.getEncoder().encodeToString(salt); String encodedHash = Base64.getEncoder().encodeToString(hash); return encodedSalt + ":" + encodedHash; } /** * Constant-time array comparison to prevent timing attacks. * * @param a first array * @param b second array * @return true if arrays are equal */ private boolean constantTimeEquals(byte[] a, byte[] b) { if (a.length != b.length) { return false; } int result = 0; for (int i = 0; i < a.length; i++) { result |= a[i] ^ b[i]; } return result == 0; } /** * Generate secure random token for CSRF protection. * * @return secure random token */ public String generateCsrfToken() { byte[] tokenBytes = new byte[32]; SECURE_RANDOM.nextBytes(tokenBytes); return Base64.getUrlEncoder().withoutPadding().encodeToString(tokenBytes); } /** * Validate CSRF token. * * @param expected the expected token * @param actual the actual token * @return true if tokens match */ public boolean validateCsrfToken(String expected, String actual) { if (expected == null || actual == null) { return false; } return constantTimeEquals( expected.getBytes(java.nio.charset.StandardCharsets.UTF_8), actual.getBytes(java.nio.charset.StandardCharsets.UTF_8) ); } }

SQL Injection Protected Repository

/** * Secure repository implementation with SQL injection protection. */ @Repository public class SecureOrderRepository { private final JdbcTemplate jdbcTemplate; private final NamedParameterJdbcTemplate namedParameterJdbcTemplate; public SecureOrderRepository(DataSource dataSource) { this.jdbcTemplate = new JdbcTemplate(dataSource); this.namedParameterJdbcTemplate = new NamedParameterJdbcTemplate(dataSource); } /** * Find orders by customer ID using parameterized query. * * @param customerId the customer ID * @return list of orders */ public List<Order> findByCustomerId(String customerId) { String sql = "SELECT id, customer_id, amount, status, created_at " + "FROM orders WHERE customer_id = ? AND status = 'ACTIVE'"; return jdbcTemplate.query(sql, new Object[]{customerId}, (rs, rowNum) -> new Order( rs.getString("id"), rs.getString("customer_id"), rs.getBigDecimal("amount"), rs.getString("status"), rs.getTimestamp("created_at").toLocalDateTime() ) ); } /** * Search orders with multiple parameters safely. * * @param criteria search criteria * @return list of orders */ public List<Order> searchOrders(OrderSearchCriteria criteria) { String sql = "SELECT id, customer_id, amount, status, created_at " + "FROM orders WHERE 1=1"; MapSqlParameterSource params = new MapSqlParameterSource(); if (criteria.getCustomerId() != null) { sql += " AND customer_id = :customerId"; params.addValue("customerId", criteria.getCustomerId()); } if (criteria.getMinAmount() != null) { sql += " AND amount >= :minAmount"; params.addValue("minAmount", criteria.getMinAmount()); } if (criteria.getMaxAmount() != null) { sql += " AND amount <= :maxAmount"; params.addValue("maxAmount", criteria.getMaxAmount()); } if (criteria.getStatus() != null) { sql += " AND status = :status"; params.addValue("status", criteria.getStatus()); } sql += " ORDER BY created_at DESC"; return namedParameterJdbcTemplate.query(sql, params, (rs, rowNum) -> new Order( rs.getString("id"), rs.getString("customer_id"), rs.getBigDecimal("amount"), rs.getString("status"), rs.getTimestamp("created_at").toLocalDateTime() ) ); } /** * Batch insert orders safely. * * @param orders list of orders to insert */ public void batchInsert(List<Order> orders) { String sql = "INSERT INTO orders (id, customer_id, amount, status, created_at) " + "VALUES (?, ?, ?, ?, ?)"; jdbcTemplate.batchUpdate(sql, new BatchPreparedStatementSetter() { @Override public void setValues(PreparedStatement ps, int i) throws SQLException { Order order = orders.get(i); ps.setString(1, order.getId()); ps.setString(2, order.getCustomerId()); ps.setBigDecimal(3, order.getAmount()); ps.setString(4, order.getStatus()); ps.setTimestamp(5, Timestamp.valueOf(order.getCreatedAt())); } @Override public int getBatchSize() { return orders.size(); } }); } /** * UNSAFE METHOD - Demonstrates SQL injection vulnerability. * This method would be caught by CodeQL analysis. * * @deprecated This method is vulnerable to SQL injection */ @Deprecated public List<Order> unsafeFindByCustomerId(String customerId) { // UNSAFE: String concatenation in SQL query String sql = "SELECT * FROM orders WHERE customer_id = '" + customerId + "'"; return jdbcTemplate.query(sql, (rs, rowNum) -> new Order( rs.getString("id"), rs.getString("customer_id"), rs.getBigDecimal("amount"), rs.getString("status"), rs.getTimestamp("created_at").toLocalDateTime() ) ); } }

6. Security Headers Configuration

Security Configuration Class

/** * Security configuration for HTTP headers and protection. */ @Configuration @EnableWebSecurity public class SecurityConfig { @Value("${security.csp.policy:default-src 'self'}") private String cspPolicy; /** * Main security configuration. */ @Bean public SecurityFilterChain filterChain(HttpSecurity http) throws Exception { http // CSRF protection .csrf(csrf -> csrf .csrfTokenRepository(CookieCsrfTokenRepository.withHttpOnlyFalse()) .ignoringRequestMatchers("/api/public/**") ) // Security headers .headers(headers -> headers .contentSecurityPolicy(csp -> csp.policyDirectives(cspPolicy)) .frameOptions(frame -> frame.deny()) .xssProtection(xss -> xss.block(true)) .contentTypeOptions(contentType -> {}) ) // Session management .sessionManagement(session -> session .sessionCreationPolicy(SessionCreationPolicy.IF_REQUIRED) .maximumSessions(1) .maxSessionsPreventsLogin(true) ) // Authorization .authorizeHttpRequests(authz -> authz .requestMatchers("/api/public/**").permitAll() .requestMatchers("/api/admin/**").hasRole("ADMIN") .requestMatchers("/api/**").authenticated() .anyRequest().permitAll() ) // Authentication .formLogin(form -> form .loginPage("/login") .permitAll() ) .logout(logout -> logout .logoutSuccessUrl("/") .permitAll() ); return http.build(); } /** * Password encoder with strong hashing. */ @Bean public PasswordEncoder passwordEncoder() { return new BCryptPasswordEncoder(12); } /** * Custom security headers filter. */ @Bean public FilterRegistrationBean<SecurityHeadersFilter> securityHeadersFilter() { FilterRegistrationBean<SecurityHeadersFilter> registrationBean = new FilterRegistrationBean<>(); registrationBean.setFilter(new SecurityHeadersFilter()); registrationBean.addUrlPatterns("/*"); return registrationBean; } } /** * Custom security headers filter. */ @Component public class SecurityHeadersFilter implements Filter { @Value("${security.headers.csp:default-src 'self'}") private String cspPolicy; @Override public void doFilter(ServletRequest request, ServletResponse response, FilterChain chain) throws IOException, ServletException { HttpServletResponse httpResponse = (HttpServletResponse) response; // Security headers httpResponse.setHeader("Content-Security-Policy", cspPolicy); httpResponse.setHeader("X-Content-Type-Options", "nosniff"); httpResponse.setHeader("X-Frame-Options", "DENY"); httpResponse.setHeader("X-XSS-Protection", "1; mode=block"); httpResponse.setHeader("Strict-Transport-Security", "max-age=31536000; includeSubDomains"); httpResponse.setHeader("Referrer-Policy", "strict-origin-when-cross-origin"); httpResponse.setHeader("Permissions-Policy", "geolocation=(), microphone=(), camera=()"); chain.doFilter(request, response); } }

7. GitHub Security Dashboard Configuration

security.md

# Security Policy ## Supported Versions | Version | Supported | | ------- | ------------------ | | 1.0.x | :white_check_mark: | | < 1.0 | :x: | ## Reporting a Vulnerability We take the security of our software seriously. If you believe you've found a security vulnerability, please report it to us. ### Private Reporting Please **DO NOT** disclose security-related issues publicly until we've had a chance to address them. 1. **Email**: [email protected] 2. **Encryption**: Use our [PGP key](https://example.com/security/pgp-key.asc) 3. **Response Time**: We aim to respond within 48 hours ### Public Reporting For non-sensitive security issues, you can: 1. Create a GitHub issue 2. Use the security advisory feature ## Security Scanning Our project uses automated security scanning: ### Tools Used - **GitHub CodeQL**: Static analysis for security vulnerabilities - **OWASP Dependency Check**: Dependency vulnerability scanning - **SpotBugs**: Bug patterns including security issues - **PMD**: Static analysis for code quality ### Scan Frequency - **On every push**: CodeQL analysis - **Daily**: Full security scan - **On release**: Comprehensive security audit ## Security Practices ### Code Security - All code undergoes security review - Automated security testing in CI/CD - Regular dependency updates - Security headers enforcement ### Data Protection - Encryption at rest and in transit - Secure password hashing (PBKDF2/BCrypt) - Principle of least privilege - Regular security audits ## Dependency Security We monitor dependencies for vulnerabilities: ### Automatic Updates - Dependabot security updates enabled - Weekly dependency scanning - Manual review of major updates ### Vulnerability Response 1. **Critical**: Fix within 24 hours 2. **High**: Fix within 72 hours 3. **Medium**: Fix within 1 week 4. **Low**: Fix in next release cycle

8. Advanced Security Workflows

scheduled-security-scan.yml

name: "Scheduled Security Deep Scan" on: schedule: - cron: '0 2 * * 1' # Every Monday at 2 AM workflow_dispatch: # Manual trigger jobs: deep-security-scan: name: Deep Security Analysis runs-on: ubuntu-latest timeout-minutes: 120 steps: - name: Checkout code uses: actions/checkout@v4 with: fetch-depth: 0 - name: Set up JDK 17 uses: actions/setup-java@v4 with: java-version: '17' distribution: 'temurin' cache: 'maven' # Comprehensive CodeQL Analysis - name: Initialize CodeQL uses: github/codeql-action/init@v3 with: languages: java queries: security-and-quality, security-extended, ../codeql-queries/java/ql/src/Security/CWE build-mode: manual - name: Build with detailed compilation run: | mvn clean compile -DskipTests -Dmaven.compiler.debug=true -Dmaven.compiler.debuglevel=lines,vars,source - name: Advanced CodeQL Analysis uses: github/codeql-action/analyze@v3 with: output: advanced-codeql-results.sarif upload-database: true # SAST Tools Suite - name: Run SonarQube Analysis uses: SonarSource/sonarcloud-github-action@v2 env: GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }} - name: Run Snyk Security Scan uses: snyk/actions/maven@master env: SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }} with: args: --severity-threshold=high # Dependency Analysis - name: Run OWASP Dependency Check run: mvn org.owasp:dependency-check-maven:aggregate -DskipTests - name: Run License Compliance Check run: mvn org.codehaus.mojo:license-maven-plugin:aggregate-add-third-party # Security Report Generation - name: Generate Security Report run: | echo "# Security Scan Report - $(date)" > security-report.md echo "## Summary" >> security-report.md echo "- CodeQL Issues: TODO" >> security-report.md echo "- Dependency Vulnerabilities: TODO" >> security-report.md echo "- License Compliance: TODO" >> security-report.md echo "## Detailed Findings" >> security-report.md - name: Upload Security Reports uses: actions/upload-artifact@v4 with: name: security-reports-$(date +%Y%m%d) path: | target/dependency-check-report.html security-report.md target/site/ retention-days: 90 - name: Notify Security Team if: failure() uses: 8398a7/action-slack@v3 with: status: failure text: Security scan failed. Please review the findings. env: SLACK_WEBHOOK_URL: ${{ secrets.SLACK_SECURITY_WEBHOOK }}

9. Security Testing

Security Test Suite

/** * Security test suite for vulnerability detection. */ @SpringBootTest class SecurityTestSuite { @Autowired private SecureAuthService authService; @Autowired private WebApplicationContext context; private MockMvc mockMvc; @BeforeEach void setup() { this.mockMvc = MockMvcBuilders.webAppContextSetup(this.context).build(); } /** * Test for SQL injection vulnerabilities. */ @Test void testSqlInjectionProtection() throws Exception { String sqlInjectionPayload = "admin' OR '1'='1"; mockMvc.perform(get("/api/orders") .param("customerId", sqlInjectionPayload)) .andExpect(status().isBadRequest()) // Should reject malicious input .andExpect(content().string(not(containsString("admin")))); } /** * Test for XSS protection. */ @Test void testXssProtection() throws Exception { String xssPayload = "<script>alert('XSS')</script>"; mockMvc.perform(post("/api/orders") .contentType(MediaType.APPLICATION_JSON) .content("{\"customerId\": \"" + xssPayload + "\"}")) .andExpect(header().string("X-XSS-Protection", "1; mode=block")) .andExpect(content().string(not(containsString("<script>")))); } /** * Test CSRF protection. */ @Test void testCsrfProtection() throws Exception { mockMvc.perform(post("/api/orders") .contentType(MediaType.APPLICATION_JSON) .content("{}")) .andExpect(status().isForbidden()); // Should require CSRF token } /** * Test secure password hashing. */ @Test void testPasswordHashingSecurity() { String password = "MySecurePassword123!"; String hash1 = authService.hashPassword(password); String hash2 = authService.hashPassword(password); // Hashes should be different due to random salt assertNotEquals(hash1, hash2); // But both should verify correctly assertTrue(authService.verifyPassword(password, hash1)); assertTrue(authService.verifyPassword(password, hash2)); // Wrong password should not verify assertFalse(authService.verifyPassword("WrongPassword", hash1)); } /** * Test timing attack protection. */ @Test void testTimingAttackProtection() { String password = "testPassword"; String hash = authService.hashPassword(password); // Measure verification time for correct and incorrect passwords long correctTime = measureVerificationTime(password, hash); long incorrectTime = measureVerificationTime("wrongPassword", hash); // Times should be similar (within reasonable margin) long timeDifference = Math.abs(correctTime - incorrectTime); assertTrue(timeDifference < 100, "Verification times should not differ significantly to prevent timing attacks"); } private long measureVerificationTime(String password, String hash) { long startTime = System.nanoTime(); authService.verifyPassword(password, hash); return System.nanoTime() - startTime; } /** * Test security headers. */ @Test void testSecurityHeaders() throws Exception { mockMvc.perform(get("/api/public/health")) .andExpect(header().string("X-Content-Type-Options", "nosniff")) .andExpect(header().string("X-Frame-Options", "DENY")) .andExpect(header().string("X-XSS-Protection", "1; mode=block")) .andExpect(header().exists("Strict-Transport-Security")); } }

Best Practices

1. Security-First Development

// Secure by default - always validate input public class InputValidator { public static String sanitizeInput(String input) { if (input == null) return null; // Remove potential XSS vectors return input.replaceAll("<", "&lt;") .replaceAll(">", "&gt;") .replaceAll("\"", "&quot;") .replaceAll("'", "&#x27;"); } public static boolean isValidCustomerId(String customerId) { return customerId != null && customerId.matches("[a-zA-Z0-9-]{1,50}"); // Strict pattern } }

2. Continuous Security Monitoring

# Security dashboard configuration security_metrics: code_quality: max_critical_issues: 0 max_high_issues: 5 max_medium_issues: 20 dependencies: max_critical_vulnerabilities: 0 max_high_vulnerabilities: 3 update_frequency: weekly coverage: min_security_test_coverage: 80 min_overall_coverage: 70

3. Incident Response

public class SecurityIncidentLogger { private static final Logger SECURITY_LOGGER = LoggerFactory.getLogger("SECURITY"); public static void logSecurityIncident(String event, String details) { SECURITY_LOGGER.warn("SECURITY_INCIDENT: {} - {}", event, details); // Additional security monitoring integration notifySecurityTeam(event, details); } }

Conclusion

This comprehensive GitHub Code Scanning implementation provides:

Automated security scanning with CodeQL and multiple tools
Continuous vulnerability detection integrated into development workflow
Security-focused code examples demonstrating best practices
Comprehensive testing for security vulnerabilities
Security monitoring and reporting with actionable insights

Key benefits:

Early vulnerability detection before production deployment
Security compliance through automated checks
Developer education with immediate feedback
Risk reduction through continuous monitoring
Compliance reporting with detailed security metrics

The setup enables organizations to maintain high security standards while accelerating development through automated security controls and continuous monitoring.

Advanced Java Supply Chain Security, Kubernetes Hardening & Runtime Threat Detection

Sigstore Rekor in Java – https://macronepal.com/blog/sigstore-rekor-in-java/
Explains integrating Sigstore Rekor into Java systems to create a transparent, tamper-proof log of software signatures and metadata for verifying supply chain integrity.

Securing Java Applications with Chainguard Wolfi – https://macronepal.com/blog/securing-java-applications-with-chainguard-wolfi-a-comprehensive-guide/
Explains using Chainguard Wolfi minimal container images to reduce vulnerabilities and secure Java applications with hardened, lightweight runtime environments.

Cosign Image Signing in Java Complete Guide – https://macronepal.com/blog/cosign-image-signing-in-java-complete-guide/
Explains how to digitally sign container images using Cosign in Java-based workflows to ensure authenticity and prevent unauthorized modifications.

Secure Supply Chain Enforcement Kyverno Image Verification for Java Containers – https://macronepal.com/blog/secure-supply-chain-enforcement-kyverno-image-verification-for-java-containers/
Explains enforcing Kubernetes policies with Kyverno to verify container image signatures and ensure only trusted Java container images are deployed.

Pod Security Admission in Java Securing Kubernetes Deployments for JVM Applications – https://macronepal.com/blog/pod-security-admission-in-java-securing-kubernetes-deployments-for-jvm-applications/
Explains Kubernetes Pod Security Admission policies that enforce security rules like restricted privileges and safe configurations for Java workloads.

Securing Java Applications at Runtime Kubernetes Security Context – https://macronepal.com/blog/securing-java-applications-at-runtime-a-guide-to-kubernetes-security-context/
Explains how Kubernetes security contexts control runtime permissions, user IDs, and access rights for Java containers to improve isolation.

Process Anomaly Detection in Java Behavioral Monitoring – https://macronepal.com/blog/process-anomaly-detection-in-java-comprehensive-behavioral-monitoring-2/
Explains detecting abnormal runtime behavior in Java applications to identify potential security threats using process monitoring techniques.

Achieving Security Excellence CIS Benchmark Compliance for Java Applications – https://macronepal.com/blog/achieving-security-excellence-implementing-cis-benchmark-compliance-for-java-applications/
Explains applying CIS security benchmarks to Java environments to standardize hardening and improve overall system security posture.

Process Anomaly Detection in Java Behavioral Monitoring – https://macronepal.com/blog/process-anomaly-detection-in-java-comprehensive-behavioral-monitoring/
Explains behavioral monitoring of Java processes to detect anomalies and improve runtime security through continuous observation and analysis.

JAVA CODE COMPILER

FREE ONLINE JAVA CODE COMPILER