fix(rules): improve precision and recall of java opengrep rules

.github/workflows/python-tests.yml

@@ -6,6 +6,8 @@ on:
     paths:
       - "socket_basics/**/*.py"
       - "tests/**/*.py"
+      - "tests/fixtures/**"
+      - "socket_basics/rules/**"
       - "pyproject.toml"
       - "uv.lock"
       - "action.yml"
@@ -19,6 +21,8 @@ on:
     paths:
       - "socket_basics/**/*.py"
       - "tests/**/*.py"
+      - "tests/fixtures/**"
+      - "socket_basics/rules/**"
       - "pyproject.toml"
       - "uv.lock"
       - "action.yml"
@@ -57,6 +61,20 @@ jobs:
         run: |
           python -m pip install --upgrade pip uv
           uv sync --locked --extra dev
+      - name: 🔎 Install opengrep
+        # The Java rule regression tests skip when opengrep is not on PATH.
+        # Install the exact release the images ship (the Dockerfile ARG) so the
+        # tests exercise the engine users get, and require it below so a broken
+        # install fails the job instead of quietly skipping the module.
+        run: |
+          version="$(sed -n 's/^ARG OPENGREP_VERSION=//p' Dockerfile)"
+          test -n "$version"
+          install -d "$RUNNER_TEMP/opengrep"
+          curl -fsSL --retry 3 -o "$RUNNER_TEMP/opengrep/opengrep" \
+            "https://github.com/opengrep/opengrep/releases/download/${version}/opengrep_manylinux_x86"
+          chmod +x "$RUNNER_TEMP/opengrep/opengrep"
+          echo "$RUNNER_TEMP/opengrep" >> "$GITHUB_PATH"
+          "$RUNNER_TEMP/opengrep/opengrep" --version
       - name: 🔐 Assert uv.lock is in sync with pyproject.toml
         # Catches dependency PRs (Dependabot or maintainer) that change
         # pyproject.toml without regenerating the lock, or vice versa.
@@ -66,4 +84,6 @@ jobs:
       - name: 📚 Assert current-release docs are in sync
         run: python3 scripts/check_release_docs.py --check
       - name: 🧪 Run tests
+        env:
+          SOCKET_BASICS_REQUIRE_OPENGREP: "1"
         run: uv run --no-sync pytest -q tests/

CHANGELOG.md

@@ -31,6 +31,14 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/).
   match the Dockerfile pins; `--write` updates both. (CE-445)
 - Documentation for the `-heavy` image variant and for when the standard image
   is the right choice. (CE-445)
+- Java SAST: `java-xss` (CWE-79) and `java-xpath-injection` (CWE-643) taint
+  rules; an OWASP Benchmark scorer (`scripts/score_owasp_benchmark.py`) with the
+  method and results in `docs/java-sast-benchmark.md`; and annotated Java rule
+  regression fixtures under `tests/fixtures/opengrep/java`, which CI now runs
+  against the opengrep release pinned in the Dockerfile. (#112)
+
+### Changed
+- Socket Python CLI 2.7.0 → 2.8.0 in the heavy and app-tests images. (#112)
 
 ### Removed
 - The `workspace` and `GITHUB_API_URL` GitHub Action inputs. Neither had an
@@ -57,6 +65,24 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/).
   pre-commit hook examples use the published image name, and the installation
   guide states the Python 3.10 requirement and the npm install path for the
   Socket CLI. New guidance covers large repositories and facts-file size.
+- **Java SAST precision and recall.** Twelve Java rules were rewritten after a
+  customer evaluation reported roughly 90% false positives. On six mature open
+  source projects (~17,400 files) the rule set now emits about 95% fewer
+  findings, and the lint-style rules (`java-empty-catch-block`,
+  `java-system-out-usage`, `java-reflection-injection`,
+  `java-hardcoded-credentials`) report nothing there. On OWASP Benchmark v1.2,
+  recall rises from 13% to 71% while precision improves from 64.5% to 76.7%.
+  Two systematic defects drove the recall gap: patterns written with simple
+  type names never matched fully qualified call sites, and crypto rules matched
+  exact algorithm literals instead of transformation strings. (#112)
+- Java SAST false positives removed along the way: `RSA/ECB/...` is no longer a
+  weak cipher; a hardened cookie no longer hides an unhardened neighbour;
+  parameterized `JdbcTemplate`/`PreparedStatement` calls, the four-argument
+  LDAP `search(base, filter, args, controls)` form, `MessageDigest.update()`,
+  and the `Path.startsWith`/canonical-path containment idioms are no longer
+  reported; SnakeYAML `SafeConstructor` loads are excluded (including the 2.0
+  `LoaderOptions` form) while `loadAs`/`loadAll` are now sinks; `"10.0.0.1"` is
+  reported as a hardcoded IP and `"10.2.3"` is not. (#112)
 
 ## [3.1.0] - 2026-09-02
 

Dockerfile.heavy

@@ -4,7 +4,7 @@ ARG TRUFFLEHOG_VERSION=3.96.0
 ARG UV_VERSION=0.12.1
 ARG OPENGREP_VERSION=v1.26.0
 ARG SOCKET_NPM_CLI_VERSION=1.1.165
-ARG SOCKET_PYTHON_CLI_VERSION=2.7.0
+ARG SOCKET_PYTHON_CLI_VERSION=2.8.0
 # Socket-built Trivy, pinned by digest — see the note in ./Dockerfile.
 ARG TRIVY_IMAGE=ghcr.io/socketdev/trivy:0.73.0@sha256:e3d9d5f10250cb73b0ea9446ae1191c0f2da2f5e6173eac08a840b1812f02e0b
 

app_tests/Dockerfile

@@ -13,7 +13,7 @@ ARG UV_VERSION=0.12.1
 ARG GOSEC_VERSION=v2.28.0
 ARG OPENGREP_VERSION=v1.26.0
 ARG SOCKET_NPM_CLI_VERSION=1.1.165
-ARG SOCKET_PYTHON_CLI_VERSION=2.7.0
+ARG SOCKET_PYTHON_CLI_VERSION=2.8.0
 #
 # NOT Dependabot-trackable — Socket-built Trivy, pinned by digest; updated by
 # Socket's trivy-dist release process. See the note in the root ./Dockerfile.