A Spring Boot application containing intentionally vulnerable code patterns for testing application security tools. Each pattern exercises a distinct data-flow complexity, making this a practical benchmark for taint analysis engines.
Intentionally vulnerable patterns, grouped by category:
- Direct user input return
- Local variable assignment
- Inter-procedural flow
- Constructor chains and field sensitivity
- Builder pattern and virtual method calls
DI resolution: DTO field access through DI-resolved service, configuration-sensitive resolver (unsafe vs hardened)
Cross-endpoint persistence: taint flow through JPA save/load cycle, inter-procedural getter through DI-resolved @Service, column-level sensitivity, field-level sanitization in entity constructor, @Service field state across requests, mid-flow sanitizer
Async coroutines: user-controlled URL through Kotlin coroutine scope
- Java 21 + Kotlin 1.9
- Spring Boot 3.3 (Web, Thymeleaf, Data JPA)
- FreeMarker 2.3
- H2 (in-memory)
- Gradle (Kotlin DSL)
Detect vulnerabilities using OpenTaint:
opentaint scan .
A CI workflow is included at .github/workflows/opentaint.yml — see github.com/seqra/opentaint for setup details.