[openrewrite] add JavaSecurityBestPractices

Vincent Potucek · Vincent Potucek · commit 38d3af40aa85 · 2025-09-25T12:30:59.000+02:00
diff --git a/.github/workflows/claude.yml b/.github/workflows/claude.yml
@@ -22,15 +22,29 @@ jobs:
         with:
           script: |
             try {
+              // Get username - prioritize sender (the person who triggered the event)
+              const username = github.event.sender?.login ||
+                              github.event.comment?.user?.login;
+
+              if (!username) {
+                console.log('Could not determine username from event payload');
+                console.log(`Event type: ${github.event_name}`);
+                console.log(`Event payload keys: ${Object.keys(github.event).join(', ')}`);
+                return false;
+              }
+
+              console.log(`Checking team membership for user: ${username} (triggered by ${github.event_name} event)`);
+
               const { data } = await github.rest.teams.getMembershipForUserInOrg({
                 org: 'diffplug',
                 team_slug: 'spotless',
-                username: github.event.sender.login
+                username: username
               });
-              console.log(`User ${github.event.sender.login} membership status: ${data.state}`);
+              console.log(`User ${username} membership status: ${data.state}`);
               return data.state === 'active';
             } catch (error) {
-              console.log(`User ${github.event.sender.login} is not a member of the Spotless team`);
+              const username = github.event.sender?.login || github.event.comment?.user?.login || 'unknown user';
+              console.log(`User ${username} is not a member of the Spotless team or error occurred: ${error.message}`);
               return false;
             }
 
diff --git a/build.gradle b/build.gradle
@@ -32,4 +32,8 @@ spotless {
 dependencies {
 	rewrite(platform("org.openrewrite.recipe:rewrite-recipe-bom:3.15.0"))
 	rewrite("org.openrewrite.recipe:rewrite-migrate-java:3.18.0")
+	rewrite('org.openrewrite.recipe:rewrite-java-security:3.19.0')
+	rewrite('org.openrewrite.recipe:rewrite-rewrite:0.13.0')
+	rewrite('org.openrewrite.recipe:rewrite-static-analysis:2.17.0')
+	rewrite('org.openrewrite.recipe:rewrite-third-party:0.27.0')
 }
diff --git a/gradle/rewrite.gradle b/gradle/rewrite.gradle
@@ -1,7 +1,37 @@
 apply plugin: 'org.openrewrite.rewrite'
 
 rewrite {
-	activeRecipe("org.openrewrite.java.migrate.UpgradeToJava17")
+	activeRecipe(
+			'org.openrewrite.gradle.GradleBestPractices',
+			'org.openrewrite.java.RemoveUnusedImports',
+			'org.openrewrite.java.migrate.UpgradeToJava17',
+			'org.openrewrite.java.recipes.JavaRecipeBestPractices',
+			'org.openrewrite.java.recipes.RecipeTestingBestPractices',
+			'org.openrewrite.java.security.JavaSecurityBestPractices',
+			'org.openrewrite.staticanalysis.JavaApiBestPractices',
+			'org.openrewrite.staticanalysis.LowercasePackage',
+			'org.openrewrite.staticanalysis.MissingOverrideAnnotation',
+			'org.openrewrite.staticanalysis.ModifierOrder',
+			'org.openrewrite.staticanalysis.NoFinalizer',
+			'org.openrewrite.staticanalysis.RemoveUnusedLocalVariables',
+			'org.openrewrite.staticanalysis.RemoveUnusedPrivateFields',
+			'org.openrewrite.staticanalysis.RemoveUnusedPrivateMethods'
+			// bugs
+			// 'org.openrewrite.staticanalysis.CodeCleanup',
+			// 'org.openrewrite.staticanalysis.CommonStaticAnalysis',
+			)
+	exclusions.addAll( // bugs
+			'**_gradle_node_plugin_example_**',
+			'**gradle/changelog.gradle',
+			'**gradle/java-publish.gradle',
+			'**idea/full.clean.java',
+			'**java-setup.gradle',
+			'**lib-extra/build.gradle',
+			'**lib/build.gradle',
+			'**package-info.java',
+			'**plugin-maven/build.gradle',
+			'**settings.gradle'
+			)
 	exportDatatables = true
 	failOnDryRunResults = true
 }
diff --git a/lib-extra/src/main/java/com/diffplug/spotless/extra/GitAttributesLineEndings.java b/lib-extra/src/main/java/com/diffplug/spotless/extra/GitAttributesLineEndings.java
@@ -146,7 +146,7 @@ static class CachedEndings implements Serializable {
 		private static final long serialVersionUID = -2534772773057900619L;
 
 		/** this is transient, to simulate PathSensitive.RELATIVE */
-		transient final String rootDir;
+		final transient String rootDir;
 		/** the line ending used for most files */
 		final String defaultEnding;
 		/** any exceptions to that default, in terms of relative path from rootDir */
diff --git a/lib-extra/src/main/java/com/diffplug/spotless/extra/GitRatchet.java b/lib-extra/src/main/java/com/diffplug/spotless/extra/GitRatchet.java
@@ -1,5 +1,5 @@
 /*
- * Copyright 2020-2023 DiffPlug
+ * Copyright 2020-2025 DiffPlug
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -132,9 +132,9 @@ private static boolean worktreeIsCleanCheckout(TreeWalk treeWalk) {
 		return treeWalk.idEqual(TREE, WORKDIR);
 	}
 
-	private final static int TREE = 0;
-	private final static int INDEX = 1;
-	private final static int WORKDIR = 2;
+	private static final int TREE = 0;
+	private static final int INDEX = 1;
+	private static final int WORKDIR = 2;
 
 	Map<File, Repository> gitRoots = new HashMap<>();
 	Table<Repository, String, ObjectId> rootTreeShaCache = HashBasedTable.create();
diff --git a/lib-extra/src/test/java/com/diffplug/spotless/extra/groovy/GrEclipseFormatterStepTest.java b/lib-extra/src/test/java/com/diffplug/spotless/extra/groovy/GrEclipseFormatterStepTest.java
@@ -1,5 +1,5 @@
 /*
- * Copyright 2016-2024 DiffPlug
+ * Copyright 2016-2025 DiffPlug
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -24,8 +24,8 @@
 import com.diffplug.spotless.extra.eclipse.EquoResourceHarness;
 
 public class GrEclipseFormatterStepTest extends EquoResourceHarness {
-	private final static String INPUT = "class F{ def m(){} }";
-	private final static String EXPECTED = "class F{\n\tdef m(){}\n}";
+	private static final String INPUT = "class F{ def m(){} }";
+	private static final String EXPECTED = "class F{\n\tdef m(){}\n}";
 
 	public GrEclipseFormatterStepTest() {
 		super(GrEclipseFormatterStep.createBuilder(TestProvisioner.mavenCentral()));
diff --git a/lib-extra/src/test/java/com/diffplug/spotless/extra/wtp/EclipseWtpFormatterStepTest.java b/lib-extra/src/test/java/com/diffplug/spotless/extra/wtp/EclipseWtpFormatterStepTest.java
@@ -1,5 +1,5 @@
 /*
- * Copyright 2016-2024 DiffPlug
+ * Copyright 2016-2025 DiffPlug
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -19,6 +19,7 @@
 import java.io.FileOutputStream;
 import java.io.IOException;
 import java.io.OutputStream;
+import java.nio.file.Files;
 import java.util.Properties;
 import java.util.function.Consumer;
 import java.util.stream.Stream;
@@ -33,7 +34,7 @@
 import com.diffplug.spotless.extra.eclipse.EclipseResourceHarness;
 
 public class EclipseWtpFormatterStepTest {
-	private final static Jvm.Support<String> JVM_SUPPORT = Jvm.<String> support("Oldest Version").add(8, "4.8.0");
+	private static final Jvm.Support<String> JVM_SUPPORT = Jvm.<String> support("Oldest Version").add(8, "4.8.0");
 
 	private static class NestedTests extends EclipseResourceHarness {
 		private final String unformatted, formatted;
@@ -76,7 +77,7 @@ void multipleConfigurations() throws Exception {
 		private File createPropertyFile(Consumer<Properties> config) throws IOException {
 			Properties configProps = new Properties();
 			config.accept(configProps);
-			File tempFile = File.createTempFile("EclipseWtpFormatterStepTest-", ".properties");
+			File tempFile = Files.createTempFile("EclipseWtpFormatterStepTest-", ".properties").toFile();
 			OutputStream tempOut = new FileOutputStream(tempFile);
 			configProps.store(tempOut, "test properties");
 			tempOut.flush();
diff --git a/lib/src/jackson/java/com/diffplug/spotless/glue/json/JacksonJsonFormatterFunc.java b/lib/src/jackson/java/com/diffplug/spotless/glue/json/JacksonJsonFormatterFunc.java
@@ -52,6 +52,7 @@ protected Class<?> inferType(String input) {
 	 * @return a {@link JsonFactory}. May be overridden to handle alternative formats.
 	 * @see <a href="https://github.com/FasterXML/jackson-dataformats-text">jackson-dataformats-text</a>
 	 */
+	@Override
 	protected JsonFactory makeJsonFactory() {
 		JsonFactory jsonFactory = new JsonFactoryBuilder().build();
 
diff --git a/lib/src/main/java/com/diffplug/spotless/FormatterProperties.java b/lib/src/main/java/com/diffplug/spotless/FormatterProperties.java
@@ -33,6 +33,7 @@
 import java.util.stream.Collectors;
 import java.util.stream.IntStream;
 
+import javax.xml.XMLConstants;
 import javax.xml.parsers.DocumentBuilder;
 import javax.xml.parsers.DocumentBuilderFactory;
 import javax.xml.parsers.ParserConfigurationException;
@@ -201,6 +202,21 @@ private Properties executeWithSupplier(Supplier<InputStream> isSupplier) throws
 			private Node getRootNode(final InputStream is) throws IOException, IllegalArgumentException {
 				try {
 					DocumentBuilderFactory dbf = DocumentBuilderFactory.newInstance();
+					try {
+						dbf.setFeature("http://xml.org/sax/features/external-parameter-entities", false);
+
+						dbf.setFeature("http://apache.org/xml/features/nonvalidating/load-external-dtd", false);
+
+						dbf.setFeature("http://xml.org/sax/features/external-general-entities", false);
+
+						dbf.setXIncludeAware(false);
+						dbf.setExpandEntityReferences(false);
+
+						dbf.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true);
+
+					} catch (ParserConfigurationException e) {
+						throw new IllegalStateException("Some features are not supported by your XML processor.", e);
+					}
 					/*
 					 * It is not required to validate or normalize attribute values for
 					 * the XMLs currently supported. Disabling validation is supported by
diff --git a/lib/src/main/java/com/diffplug/spotless/NoLambda.java b/lib/src/main/java/com/diffplug/spotless/NoLambda.java
@@ -44,7 +44,7 @@ public interface NoLambda extends Serializable {
 	public byte[] toBytes();
 
 	/** An implementation of NoLambda in which equality is based on the serialized representation of itself. */
-	public static abstract class EqualityBasedOnSerialization implements NoLambda {
+	public abstract static class EqualityBasedOnSerialization implements NoLambda {
 		@Serial
 		private static final long serialVersionUID = 1733798699224768949L;
 
diff --git a/lib/src/main/java/com/diffplug/spotless/biome/BiomeSettings.java b/lib/src/main/java/com/diffplug/spotless/biome/BiomeSettings.java
@@ -24,12 +24,12 @@
 public final class BiomeSettings {
 	private static final Logger logger = LoggerFactory.getLogger(BiomeSettings.class);
 
-	private final static String CONFIG_NAME = "biome.json";
-	private final static String DEFAULT_VERSION = "1.2.0";
-	private final static String DOWNLOAD_FILE_PATTERN = "biome-%s-%s-%s";
-	private final static String SHORT_NAME = "biome";
-	private final static String URL_PATTERN_1X = "https://github.com/biomejs/biome/releases/download/cli%%2Fv%s/biome-%s";
-	private final static String URL_PATTERN_2X = "https://github.com/biomejs/biome/releases/download/%%40biomejs%%2Fbiome%%40%s/biome-%s";
+	private static final String CONFIG_NAME = "biome.json";
+	private static final String DEFAULT_VERSION = "1.2.0";
+	private static final String DOWNLOAD_FILE_PATTERN = "biome-%s-%s-%s";
+	private static final String SHORT_NAME = "biome";
+	private static final String URL_PATTERN_1X = "https://github.com/biomejs/biome/releases/download/cli%%2Fv%s/biome-%s";
+	private static final String URL_PATTERN_2X = "https://github.com/biomejs/biome/releases/download/%%40biomejs%%2Fbiome%%40%s/biome-%s";
 
 	private BiomeSettings() {}
 
diff --git a/lib/src/main/java/com/diffplug/spotless/generic/IdeaStep.java b/lib/src/main/java/com/diffplug/spotless/generic/IdeaStep.java
@@ -213,7 +213,7 @@ private static boolean isMacOs() {
 
 		private String format(IdeaStepFormatterCleanupResources ideaStepFormatterCleanupResources, String unix, File file) throws Exception {
 			// since we cannot directly work with the file, we need to write the unix string to a temporary file
-			File tempFile = File.createTempFile("spotless", file.getName());
+			File tempFile = Files.createTempFile("spotless", file.getName()).toFile();
 			try {
 				Files.write(tempFile.toPath(), unix.getBytes(StandardCharsets.UTF_8));
 				List<String> params = getParams(tempFile);
diff --git a/lib/src/main/java/com/diffplug/spotless/java/FormatAnnotationsStep.java b/lib/src/main/java/com/diffplug/spotless/java/FormatAnnotationsStep.java
@@ -435,7 +435,6 @@ private static final class State implements Serializable {
 
 		// group 1 is the basename of the annotation.
 		private static final String annoNoArgRegex = "@(?:[A-Za-z_][A-Za-z0-9_.]*\\.)?([A-Za-z_][A-Za-z0-9_]*)";
-		private static final Pattern annoNoArgPattern = Pattern.compile(annoNoArgRegex);
 		// 3 non-empty cases:  ()  (".*")  (.*)
 		private static final String annoArgRegex = "(?:\\(\\)|\\(\"[^\"]*\"\\)|\\([^\")][^)]*\\))?";
 		// group 1 is the basename of the annotation.
diff --git a/lib/src/main/java/com/diffplug/spotless/kotlin/KtfmtStep.java b/lib/src/main/java/com/diffplug/spotless/kotlin/KtfmtStep.java
@@ -82,9 +82,9 @@ public enum Style {
 		;
 		// @formatter:on
 
-		final private String format;
-		final private String since;
-		final private @Nullable String until;
+		private final String format;
+		private final String since;
+		private final @Nullable String until;
 
 		Style(String format, String since) {
 			this.format = format;
diff --git a/lib/src/main/java/com/diffplug/spotless/npm/SimpleRestClient.java b/lib/src/main/java/com/diffplug/spotless/npm/SimpleRestClient.java
@@ -93,7 +93,7 @@ private String readInputStream(InputStream inputStream) throws IOException {
 		}
 	}
 
-	static abstract class SimpleRestException extends RuntimeException {
+	abstract static class SimpleRestException extends RuntimeException {
 		private static final long serialVersionUID = -8260821395756603787L;
 
 		public SimpleRestException() {}
diff --git a/lib/src/main/java/com/diffplug/spotless/npm/StandardNpmProcessFactory.java b/lib/src/main/java/com/diffplug/spotless/npm/StandardNpmProcessFactory.java
@@ -42,7 +42,7 @@ public NpmLongRunningProcess createNpmServeProcess(NodeServerLayout nodeServerLa
 		return new NpmServe(nodeServerLayout.nodeModulesDir(), formatterStepLocations, nodeServerInstanceId);
 	}
 
-	private static abstract class AbstractStandardNpmProcess {
+	private abstract static class AbstractStandardNpmProcess {
 		protected final ProcessRunner processRunner = ProcessRunner.usingRingBuffersOfCapacity(100 * 1024); // 100kB
 
 		protected final File workingDir;
diff --git a/lib/src/main/java/com/diffplug/spotless/sql/dbeaver/FormatterToken.java b/lib/src/main/java/com/diffplug/spotless/sql/dbeaver/FormatterToken.java
@@ -1,5 +1,5 @@
 /*
- * Copyright 2016 DiffPlug
+ * Copyright 2016-2025 DiffPlug
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -63,6 +63,7 @@ public int getPos() {
 		return fPos;
 	}
 
+	@Override
 	public String toString() {
 		final StringBuilder buf = new StringBuilder();
 		buf.append(getClass().getName());
diff --git a/lib/src/main/java/com/diffplug/spotless/sql/dbeaver/KeywordCase.java b/lib/src/main/java/com/diffplug/spotless/sql/dbeaver/KeywordCase.java
@@ -1,5 +1,5 @@
 /*
- * Copyright 2016 DiffPlug
+ * Copyright 2016-2025 DiffPlug
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -22,16 +22,19 @@
  */
 enum KeywordCase {
 	UPPER {
+		@Override
 		public String transform(String value) {
 			return value.toUpperCase(Locale.ENGLISH);
 		}
 	},
 	LOWER {
+		@Override
 		public String transform(String value) {
 			return value.toLowerCase(Locale.ENGLISH);
 		}
 	},
 	ORIGINAL {
+		@Override
 		public String transform(String value) {
 			return value;
 		}
diff --git a/lib/src/sortPom/java/com/diffplug/spotless/glue/pom/SortPomFormatterFunc.java b/lib/src/sortPom/java/com/diffplug/spotless/glue/pom/SortPomFormatterFunc.java
@@ -1,5 +1,5 @@
 /*
- * Copyright 2021-2024 DiffPlug
+ * Copyright 2021-2025 DiffPlug
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -15,7 +15,9 @@
  */
 package com.diffplug.spotless.glue.pom;
 
-import java.io.*;
+import java.io.BufferedWriter;
+import java.io.File;
+import java.io.FileWriter;
 import java.lang.reflect.Method;
 import java.nio.charset.Charset;
 import java.nio.file.Files;
@@ -41,7 +43,7 @@ public SortPomFormatterFunc(SortPomCfg cfg) {
 	@Override
 	public String apply(String input) throws Exception {
 		// SortPom expects a file to sort, so we write the input into a temporary file
-		File pom = File.createTempFile("pom", ".xml");
+		File pom = Files.createTempFile("pom", ".xml").toFile();
 		pom.deleteOnExit();
 		try (BufferedWriter writer = new BufferedWriter(new FileWriter(pom, Charset.forName(cfg.encoding)))) {
 			writer.write(input);
diff --git a/plugin-gradle/src/main/java/com/diffplug/gradle/spotless/CssExtension.java b/plugin-gradle/src/main/java/com/diffplug/gradle/spotless/CssExtension.java
@@ -43,6 +43,7 @@ protected void setupTask(SpotlessTask task) {
 	 * offline, you can specify the path to the Biome executable via
 	 * {@code biome().pathToExe(...)}.
 	 */
+	@Override
 	public BiomeCss biome() {
 		return biome(null);
 	}
@@ -54,6 +55,7 @@ public BiomeCss biome() {
 	 * {@code biome().pathToExe(...)}.
 	 * @param version Biome version to use.
 	 */
+	@Override
 	public BiomeCss biome(String version) {
 		var biomeConfig = new BiomeCss(version);
 		addStep(biomeConfig.createStep());
diff --git a/plugin-gradle/src/main/java/com/diffplug/gradle/spotless/FormatExtension.java b/plugin-gradle/src/main/java/com/diffplug/gradle/spotless/FormatExtension.java
@@ -748,7 +748,7 @@ protected void replaceStep() {
 			replaceStep.accept(createStep());
 		}
 
-		abstract protected FormatterStep createStep();
+		protected abstract FormatterStep createStep();
 
 	}
 
diff --git a/plugin-gradle/src/main/java/com/diffplug/gradle/spotless/IdeHook.java b/plugin-gradle/src/main/java/com/diffplug/gradle/spotless/IdeHook.java
@@ -1,5 +1,5 @@
 /*
- * Copyright 2016-2024 DiffPlug
+ * Copyright 2016-2025 DiffPlug
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -47,9 +47,9 @@ static class State extends NoLambda.EqualityBasedOnSerialization {
 		}
 	}
 
-	final static String PROPERTY = "spotlessIdeHook";
-	final static String USE_STD_IN = "spotlessIdeHookUseStdIn";
-	final static String USE_STD_OUT = "spotlessIdeHookUseStdOut";
+	static final String PROPERTY = "spotlessIdeHook";
+	static final String USE_STD_IN = "spotlessIdeHookUseStdIn";
+	static final String USE_STD_OUT = "spotlessIdeHookUseStdOut";
 
 	private static void dumpIsClean() {
 		System.err.println("IS CLEAN");
diff --git a/plugin-gradle/src/main/java/com/diffplug/gradle/spotless/JavascriptExtension.java b/plugin-gradle/src/main/java/com/diffplug/gradle/spotless/JavascriptExtension.java
diff --git a/plugin-gradle/src/main/java/com/diffplug/gradle/spotless/JsonExtension.java b/plugin-gradle/src/main/java/com/diffplug/gradle/spotless/JsonExtension.java
diff --git a/plugin-gradle/src/main/java/com/diffplug/gradle/spotless/SpotlessTaskImpl.java b/plugin-gradle/src/main/java/com/diffplug/gradle/spotless/SpotlessTaskImpl.java
diff --git a/plugin-gradle/src/main/java/com/diffplug/gradle/spotless/SpotlessTaskService.java b/plugin-gradle/src/main/java/com/diffplug/gradle/spotless/SpotlessTaskService.java
diff --git a/plugin-gradle/src/main/java/com/diffplug/gradle/spotless/TypescriptExtension.java b/plugin-gradle/src/main/java/com/diffplug/gradle/spotless/TypescriptExtension.java
diff --git a/plugin-maven/src/main/java/com/diffplug/spotless/maven/ArtifactResolver.java b/plugin-maven/src/main/java/com/diffplug/spotless/maven/ArtifactResolver.java
diff --git a/plugin-maven/src/main/java/com/diffplug/spotless/maven/incremental/UpToDateChecker.java b/plugin-maven/src/main/java/com/diffplug/spotless/maven/incremental/UpToDateChecker.java
diff --git a/plugin-maven/src/main/java/com/diffplug/spotless/maven/java/Eclipse.java b/plugin-maven/src/main/java/com/diffplug/spotless/maven/java/Eclipse.java
diff --git a/plugin-maven/src/main/java/com/diffplug/spotless/maven/javascript/EslintJs.java b/plugin-maven/src/main/java/com/diffplug/spotless/maven/javascript/EslintJs.java
diff --git a/testlib/src/test/java/com/diffplug/spotless/FileSignatureTest.java b/testlib/src/test/java/com/diffplug/spotless/FileSignatureTest.java
diff --git a/testlib/src/test/java/com/diffplug/spotless/GitPrePushHookInstallerTest.java b/testlib/src/test/java/com/diffplug/spotless/GitPrePushHookInstallerTest.java

Original file line number	Diff line number	Diff line change
`@@ -32,4 +32,8 @@ spotless {`
`32`	`32`	`dependencies {`
`33`	`33`	`rewrite(platform("org.openrewrite.recipe:rewrite-recipe-bom:3.15.0"))`
`34`	`34`	`rewrite("org.openrewrite.recipe:rewrite-migrate-java:3.18.0")`
	`35`	`+ rewrite('org.openrewrite.recipe:rewrite-java-security:3.19.0')`
	`36`	`+ rewrite('org.openrewrite.recipe:rewrite-rewrite:0.13.0')`
	`37`	`+ rewrite('org.openrewrite.recipe:rewrite-static-analysis:2.17.0')`
	`38`	`+ rewrite('org.openrewrite.recipe:rewrite-third-party:0.27.0')`
`35`	`39`	`}`