Skip to content

JavaMiningPlan.md

Latest commit

 

History

History
130 lines (95 loc) · 5.25 KB

JavaMiningPlan.md

File metadata and controls

130 lines (95 loc) · 5.25 KB
Raw

Java Spring Boot Mining Plan

Date: 2026-07-29
Miner: security-pattern-miner (Rust)
Target: Spring Boot / Spring Security patterns on Maven
Data Root: ./build/volumes/data_java/

Background

Why spring-security-core failed

The initial mine of org.springframework.security:spring-security-core returned 21,800 raw entries but only 3 unique repos (spring-boot, quarkus, apereo/cas). This is expected: spring-security-core is an internal Spring module. Java applications depend on spring-boot-starter-security instead, which transitively pulls in spring-security-core.

Python analogy

In Python mining, the strategy was:

  • Web framework: fastapi (6,452 dependents)
  • Pattern-specific libs: bcrypt, pyjwt, redis, itsdangerous
  • Mining: mutual dependents = fastapi ∩ pattern-lib

For Java/Spring Boot:

  • Web framework equivalent: org.springframework.boot:spring-boot-starter-security
  • Pattern-specific libs: io.jsonwebtoken:jjwt-api, org.springframework.session:spring-session-data-redis, etc.
  • BCrypt is built-in to spring-security-crypto (included in starter-security), so password-based auth doesn't need a second package

Step 1: Mine Individual Package Dependents

Package (Maven coordinate) Pattern relevance Expected yield
org.springframework.boot:spring-boot-starter-security All patterns (primary pool) High (thousands)
io.jsonwebtoken:jjwt-api verifiable_token_authentication Medium (popular JWT lib)
org.springframework.session:spring-session-data-redis opaque_token + session_based_ac Medium
com.nimbusds:nimbus-jose-jwt verifiable_token_authentication (alt JWT) Medium

If spring-boot-starter-security yields too few repos, fallback candidates:

  • org.springframework.boot:spring-boot-starter-oauth2-resource-server (JWT/OAuth2)
  • org.springframework.boot:spring-boot-starter-oauth2-client (OAuth2 login)
  • org.springframework.security:spring-security-web (lower-level, but more direct dependents than core)

Step 2: Compute Mutual Dependents

Pattern Dependencies (intersection) Notes
password_based_authentication spring-boot-starter-security alone BCrypt is built-in; filter by grep for BCryptPasswordEncoder
verifiable_token_authentication spring-boot-starter-security ∩ jjwt-api Also grep for nimbus-jose-jwt in the main pool
opaque_token_authentication spring-boot-starter-security ∩ spring-session-data-redis
session_based_access_control Same as opaque_token Different recovery template (like Python approach)
obscure_token_access_control spring-boot-starter-security alone No standard Java API-key lib; filter by grep for API key patterns

Step 3: Clone Repositories

  • Clone into ./build/volumes/data_java/cloned_repos/
  • Use the Rust miner's crawl subcommand
  • Max concurrent clones: 4

Step 4: Grep-Based Filtering

Unlike Python's from fastapi.security import filter, for Java we apply pattern-specific grep filters on .java files.

Primary filter (equivalent to from fastapi.security import)

import org.springframework.security

This confirms the repo actually uses Spring Security (not just declaring it as a transitive dependency).

Pattern-specific grep keywords

password_based_authentication

  • BCryptPasswordEncoder — Spring's built-in password encoder
  • PasswordEncoder — password encoder interface
  • UserDetailsService — user lookup for authentication
  • DaoAuthenticationProvider — database-backed auth
  • @PostMapping.*register\|signup — registration endpoints

verifiable_token_authentication

  • JwtDecoder / JwtEncoder — Spring Security JWT support
  • Jwts.builder\|Jwts.parser — jjwt library usage
  • JWTVerifier\|JWTCreator — auth0 java-jwt usage
  • OncePerRequestFilter.*jwt\|token — JWT filter chains
  • BearerTokenAuthenticationFilter — Spring OAuth2 resource server

opaque_token_authentication

  • @EnableRedisHttpSession — Spring Session with Redis
  • SessionRepository — session storage abstraction
  • OpaqueTokenIntrospector — Spring's opaque token support
  • HttpSession + setAttribute — servlet session management

obscure_token_access_control

  • ApiKey\|API_KEY\|api-key — API key patterns
  • @RequestHeader.*[Aa]uthorization\|[Aa]pi.?[Kk]ey — header-based key extraction
  • X-API-Key\|X-Api-Key — custom API key headers

session_based_access_control

  • @PreAuthorize\|@Secured\|@RolesAllowed — method-level authz
  • hasRole\|hasAuthority\|hasPermission — Spring Security expressions
  • AccessDecisionManager\|AuthorizationManager — authz decision classes
  • GrantedAuthority — role/permission model

Step 5: Log Results

Document in MiningLog.md:

  1. Dependents mined per package (unique count, pages fetched)
  2. Mutual dependents computed per pattern
  3. Clone success/failure counts
  4. Grep filter results: repos matching each pattern's keywords
  5. Final candidate counts per pattern

Volume Configuration

# docker-compose.yml change
volumes:
  - ./build/volumes/data_java:/data   # Separate from Python data

This keeps Java repos completely isolated from the existing 459 Python repos in ./build/volumes/data/.