Package com.tnsai.quality.security.harness

Class BuiltInMatchers

java.lang.Object
com.tnsai.quality.security.harness.BuiltInMatchers
public final class BuiltInMatchers extends Object
Factory for the framework's built-in CWE matchers (TNS-291).

Each matcher targets one CWE with a small set of conservative regexes — the goal is "candidate signal for an agent", not "definitive vulnerability proof". Expect false positives; the process stage with a ReviewAgentSpi weeds them out.

Patterns favour the most common idioms in mainstream languages (Java, Python, JavaScript / TypeScript, plus a couple more for language-portable matchers like hardcoded-secrets). Adding more languages is a pure additive change inside the relevant pattern list.

Since:
0.10.0 (TNS-291)

  • Method Details

    • sqlInjection

      public static MatcherSpi sqlInjection()
      CWE-89 — SQL injection via raw string concatenation in queries.

    • pathTraversal

      public static MatcherSpi pathTraversal()
      CWE-22 — Path traversal in file / FS operations.

    • commandInjection

      public static MatcherSpi commandInjection()
      CWE-78 — OS command injection.

    • hardcodedSecrets

      public static MatcherSpi hardcodedSecrets()
      CWE-798 — Hardcoded credentials (API keys, tokens, passwords).

    • weakCrypto

      public static MatcherSpi weakCrypto()
      CWE-327 — Use of weak / broken cryptographic algorithms.

    • crossSiteScripting

      public static MatcherSpi crossSiteScripting()
      CWE-79 — Cross-site scripting via unsafe innerHTML / unescaped output.

    • unsafeDeserialization

      public static MatcherSpi unsafeDeserialization()
      CWE-502 — Unsafe deserialisation (Java ObjectInputStream, pickle, yaml).

    • serverSideRequestForgery

      public static MatcherSpi serverSideRequestForgery()
      CWE-918 — Server-side request forgery via user-controlled URL.

    • xmlExternalEntity

      public static MatcherSpi xmlExternalEntity()
      CWE-611 — XML External Entity expansion (XXE).

    • evalOnInput

      public static MatcherSpi evalOnInput()
      CWE-95 — eval() / exec() of user-controlled input.

    • all

      public static List<MatcherSpi> all()
      Convenience — every shipped matcher in a stable order.