Skip to content

Java: Promote Insecure Spring Boot Actuator Configuration query from experimental #20006

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
jcogs33 merged 23 commits into from
Aug 26, 2025
Merged

Java: Promote Insecure Spring Boot Actuator Configuration query from experimental #20006

Changes from 1 commit
Commits
Show all changes
23 commits
Select commit Hold shift + click to select a range
a39cb40
Java: copy out of experimental
Jul 9, 2025
0dbddbd
Java: remove experimental files
Jul 9, 2025
38260e7
Java: remove deprecation
Jul 10, 2025
fc930d9
Java: update tests for non-experimental directory
Jul 10, 2025
ed8da5e
Java: convert tests to inline expectations
Jul 14, 2025
b479f5c
Java: fix integration tests
Jul 14, 2025
1b90a30
Java: move code to .qll file
Jul 15, 2025
3823186
Java: split tests by versions
Jul 15, 2025
2bfc4b4
Java: fix test case for version 1.4
Jul 15, 2025
ae163a9
Java: add overlay annotations
Jul 16, 2025
0d2a422
Java: add related location to alert message
Jul 16, 2025
afa6610
Java: update qhelp
Jul 17, 2025
ea35fbb
Java: support version 3.x
Jul 17, 2025
7d5e939
Java: minor refactoring
Jul 17, 2025
ea529b0
Java: adjust metadata and alert msg
Jul 17, 2025
70d5150
Java: rename to align with 'java/spring-boot-exposed-actuators' query
Jul 17, 2025
8decc13
Java: add change note
Jul 17, 2025
685f68d
Java: support 'management.endpoints.web.expose' property
Jul 18, 2025
7250265
Java: consider all endpoints except for health and info as sensitive …
Jul 18, 2025
0dd33b2
Java: remove version debugging from alert message
Jul 19, 2025
c9692a6
Java: fix test failures cause by alert msg change
Jul 19, 2025
f0542dd
Java: add summary to change note
Aug 22, 2025
3675e4b
Merge branch 'main' into jcogs33/java/insecure-spring-actuator-config…
jcogs33 Aug 26, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
Prev Previous commit
Next Next commit
Java: remove deprecation
  • Loading branch information
Jami Cogswell Jami Cogswell
Jami Cogswell authored and Jami Cogswell committed Jul 17, 2025
commit 38260e76bfa271483123f330a644153b7ae5ef26
14 changes: 6 additions & 8 deletions .../ql/src/Security/CWE/CWE-200/InsecureSpringActuatorConfig/InsecureSpringActuatorConfig.ql
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -111,11 +111,9 @@ predicate hasConfidentialEndPointExposed(SpringBootPom pom, ApplicationPropertie
)
}

deprecated query predicate problems(Dependency d, string message) {
exists(SpringBootPom pom |
hasConfidentialEndPointExposed(pom, _) and
d = pom.getADependency() and
d.getArtifact().getValue() = "spring-boot-starter-actuator"
) and
message = "Insecure configuration of Spring Boot Actuator exposes sensitive endpoints."
}
from SpringBootPom pom, ApplicationProperties ap, Dependency d
where
hasConfidentialEndPointExposed(pom, ap) and
d = pom.getADependency() and
d.getArtifact().getValue() = "spring-boot-starter-actuator"
select d, "Insecure configuration of Spring Boot Actuator exposes sensitive endpoints."