Sample: Java — see SquidGate detect findings

[DotNetRussell]

SquidGate language sample — Java

This PR intentionally introduces insecure patterns so you can see SquidGate work on Java:

• Hardcoded secret / credential
• Injection and/or dangerous API usage

File

examples/java/UserDao.java

What to look for

1. Check run named SquidGate
2. Line annotations on the sample file
3. PR comment summarizing findings
4. Check failure when severity ≥ block_on (default high)

Demo only. Do not merge these patterns into production apps.

All language samples · Setup SquidGate on your repo

[github-actions]

🛡️ Security Scan Results

Three high-severity vulnerabilities introduced: hardcoded credential, SQL injection via string concatenation, and OS command injection via Runtime.exec.

⛔ 3 finding(s) block merge.

HIGH — Hardcoded API Key

File: examples/java/UserDao.java:5 | Confidence: high

A secret API key is hardcoded directly in the source code. This exposes the credential to anyone with access to the source or compiled artifacts.

CWE: CWE-798 | OWASP: A07:2021

Recommendation: Remove the hardcoded value and load the secret from environment variables or a secure secrets manager, e.g. System.getenv("API_KEY").

---

HIGH — SQL Injection

File: examples/java/UserDao.java:9 | Confidence: high

User-controlled input 'id' is directly concatenated into a SQL query using Statement.executeQuery without parameterization or escaping, allowing arbitrary SQL execution.

CWE: CWE-89 | OWASP: A03:2021

Recommendation: Use PreparedStatement with parameterized queries: PreparedStatement ps = c.prepareStatement("SELECT * FROM users WHERE id = ?"); ps.setString(1, id);

---

HIGH — OS Command Injection

File: examples/java/UserDao.java:14 | Confidence: high

User-controlled input 'cmd' is concatenated into a shell command and executed via Runtime.exec without sanitization or validation, enabling arbitrary command execution.

CWE: CWE-78 | OWASP: A03:2021

Recommendation: Avoid executing shell commands with user input. If necessary, use ProcessBuilder with argument arrays and strict validation/whitelisting of allowed commands.

---