find_second_order_injection
Identifies second-order injection by tracing taint from JPA writes to reads that reach dangerous sinks. Prioritizes manual review using structural analysis.
Instructions
Detect second-order injection patterns: taint written to DB then read back unsanitized.
A second-order (stored) injection occurs when:
1. User-controlled data reaches a persistence write (JPA save/persist/merge).
2. That same data is later read back from the DB and passed to a dangerous sink.
Orihime approximates this by finding:
- Methods that write to a JPA entity (call to save/persist/merge on a Repository
class or on an EntityManager).
- Methods that read from the same entity type (findById/findAll/executeQuery) AND
whose return value flows into a sink (detected via call chain analysis).
This is a structural approximation — it is not full data-flow. False positives are
expected; use it to prioritise manual review, not as a definitive scanner.
Args:
repo_name: Repository to analyse.
Returns:
List of dicts with keys:
``entity_fqn``, ``write_method_fqn``, ``read_method_fqn``,
``read_file_path``, ``risk_level``.Input Schema
TableJSON Schema
| Name | Required | Description | Default |
|---|---|---|---|
| repo_name | Yes |
Output Schema
TableJSON Schema
| Name | Required | Description | Default |
|---|---|---|---|
| result | Yes |