Add SSTI, stored XSS, and SSRF vulnerability modules with Kotlin support

Introduce template injection patterns (FreeMarker/Thymeleaf), cross-endpoint
stored XSS flows with column-level sensitivity, SSRF via coroutine-based URL
fetch, and JPA persistence layer with H2. Update README to document all
vulnerability patterns and the expanded tech stack.

Author: misonijnik

README.md

@@ -14,6 +14,22 @@ Intentionally vulnerable patterns, grouped by category:
 4. Constructor chains and field sensitivity
 5. Builder pattern and virtual method calls
 
+### Spring Indirect Data Flow
+
+**DI resolution**: DTO field access through DI-resolved service, configuration-sensitive resolver (unsafe vs hardened)
+
+**Cross-endpoint persistence**: taint flow through JPA save/load cycle, inter-procedural getter through DI-resolved `@Service`, column-level sensitivity, field-level sanitization in entity constructor, `@Service` field state across requests, mid-flow sanitizer
+
+**Async coroutines**: user-controlled URL through Kotlin coroutine scope
+
+## Tech Stack
+
+- Java 21 + Kotlin 1.9
+- Spring Boot 3.3 (Web, Thymeleaf, Data JPA)
+- FreeMarker 2.3
+- H2 (in-memory)
+- Gradle (Kotlin DSL)
+
 ## Scanning with OpenTaint
 
 Detect vulnerabilities using [OpenTaint](https://opentaint.org/):

build.gradle.kts

@@ -1,5 +1,7 @@
 plugins {
     id("java")
+    kotlin("jvm") version "1.9.24"
+    kotlin("plugin.spring") version "1.9.24"
     id("org.springframework.boot") version "3.3.0"
     id("io.spring.dependency-management") version "1.1.6"
 }
@@ -18,6 +20,12 @@ repositories {
 
 dependencies {
     implementation("org.springframework.boot:spring-boot-starter-web")
+    implementation("org.springframework.boot:spring-boot-starter-thymeleaf")
+    implementation("org.springframework.boot:spring-boot-starter-data-jpa")
+    implementation("org.freemarker:freemarker:2.3.33")
+    implementation("commons-io:commons-io:2.17.0")
+    implementation("org.jetbrains.kotlinx:kotlinx-coroutines-core:1.8.1")
+    runtimeOnly("com.h2database:h2")
     testImplementation("org.springframework.boot:spring-boot-starter-test")
     testImplementation(platform("org.junit:junit-bom:5.10.0"))
     testImplementation("org.junit.jupiter:junit-jupiter")

src/main/java/org/seqra/Main.java

@@ -2,8 +2,12 @@
 
 import org.springframework.boot.SpringApplication;
 import org.springframework.boot.autoconfigure.SpringBootApplication;
+import org.springframework.boot.autoconfigure.domain.EntityScan;
+import org.springframework.data.jpa.repository.config.EnableJpaRepositories;
 
-@SpringBootApplication
+@SpringBootApplication(scanBasePackages = {"org.seqra", "org.spring"})
+@EntityScan("org.spring.persistence")
+@EnableJpaRepositories("org.spring.persistence")
 public class Main {
     public static void main(String[] args) {
         SpringApplication.run(Main.class, args);

src/main/java/org/spring/content/CampaignController.java

@@ -0,0 +1,84 @@
+package org.spring.content;
+
+import freemarker.template.TemplateException;
+import org.springframework.http.ResponseEntity;
+import org.springframework.web.bind.annotation.PostMapping;
+import org.springframework.web.bind.annotation.RequestBody;
+import org.springframework.web.bind.annotation.RequestMapping;
+import org.springframework.web.bind.annotation.RestController;
+
+import java.io.IOException;
+
+/**
+ * Controller for campaign and notification template rendering.
+ */
+@RestController
+@RequestMapping("/api/campaigns")
+public class CampaignController {
+
+    private final MarketingTemplateService marketingService;
+    private final NotificationTemplateService notificationService;
+    private final TemplateRenderingService templateService;
+
+    public CampaignController(MarketingTemplateService marketingService,
+                              NotificationTemplateService notificationService,
+                              TemplateRenderingService templateService) {
+        this.marketingService = marketingService;
+        this.notificationService = notificationService;
+        this.templateService = templateService;
+    }
+
+    /**
+     * Preview a marketing email template before sending to customers.
+     */
+    @PostMapping("/marketing/preview")
+    public ResponseEntity<String> previewMarketing(@RequestBody RenderRequest request) {
+        try {
+            String result = marketingService.render(request.getTemplateName(), request.getTemplateContent());
+            return ResponseEntity.ok(result);
+        } catch (IOException | TemplateException e) {
+            return ResponseEntity.badRequest().body("Preview failed: " + e.getMessage());
+        }
+    }
+
+    /**
+     * Render a notification template with hardened configuration.
+     */
+    @PostMapping("/notifications/render")
+    public ResponseEntity<String> renderNotification(@RequestBody RenderRequest request) {
+        try {
+            String result = notificationService.render(request.getTemplateName(), request.getTemplateContent());
+            return ResponseEntity.ok(result);
+        } catch (IOException | TemplateException e) {
+            return ResponseEntity.badRequest().body("Render failed: " + e.getMessage());
+        }
+    }
+
+    /**
+     * Renders a custom template from user input.
+     * Data flows from request body → DTO fields → service → template engine.
+     */
+    @PostMapping("/render")
+    public ResponseEntity<String> renderTemplate(@RequestBody RenderRequest request) {
+        try {
+            String result = templateService.renderFromRequest(request);
+            return ResponseEntity.ok(result);
+        } catch (Exception e) {
+            return ResponseEntity.badRequest().body("Template processing failed: " + e.getMessage());
+        }
+    }
+
+    /**
+     * Alternative endpoint demonstrating data flow through object field assignment.
+     */
+    @PostMapping("/render/inline")
+    public ResponseEntity<String> renderInline(@RequestBody RenderRequest request) {
+        try {
+            String templateContent = request.getTemplateContent();
+            String result = templateService.renderFromContent(templateContent);
+            return ResponseEntity.ok(result);
+        } catch (Exception e) {
+            return ResponseEntity.badRequest().body("Processing failed: " + e.getMessage());
+        }
+    }
+}

src/main/java/org/spring/content/MarketingTemplateService.java

@@ -0,0 +1,39 @@
+package org.spring.content;
+
+import java.io.IOException;
+import java.io.StringReader;
+import java.io.StringWriter;
+import java.util.HashMap;
+import java.util.Map;
+
+import org.springframework.stereotype.Service;
+
+import freemarker.core.TemplateClassResolver;
+import freemarker.template.Configuration;
+import freemarker.template.Template;
+import freemarker.template.TemplateException;
+
+@Service
+public class MarketingTemplateService {
+
+    private final Configuration templateConfig;
+
+    public MarketingTemplateService() {
+        Configuration templateConfig = new Configuration(Configuration.VERSION_2_3_33);
+        templateConfig.setNewBuiltinClassResolver(TemplateClassResolver.UNRESTRICTED_RESOLVER);
+        templateConfig.setAPIBuiltinEnabled(true);
+        this.templateConfig = templateConfig;
+    }
+
+    public String render(String name, String content) throws IOException, TemplateException {
+        Template template = new Template(name, new StringReader(content), templateConfig);
+
+        Map<String, Object> model = new HashMap<>();
+        model.put("brandName", "Acme Corp");
+        model.put("campaignId", name);
+
+        StringWriter output = new StringWriter();
+        template.process(model, output);
+        return output.toString();
+    }
+}

src/main/java/org/spring/content/NotificationTemplateService.java

@@ -0,0 +1,38 @@
+package org.spring.content;
+
+import freemarker.core.TemplateClassResolver;
+import freemarker.template.Configuration;
+import freemarker.template.Template;
+import freemarker.template.TemplateException;
+import org.springframework.stereotype.Service;
+
+import java.io.IOException;
+import java.io.StringReader;
+import java.io.StringWriter;
+import java.util.HashMap;
+import java.util.Map;
+
+@Service
+public class NotificationTemplateService {
+
+    private final Configuration templateConfig;
+
+    public NotificationTemplateService() {
+        Configuration templateConfig = new Configuration(Configuration.VERSION_2_3_33);
+        templateConfig.setNewBuiltinClassResolver(TemplateClassResolver.ALLOWS_NOTHING_RESOLVER);
+        templateConfig.setAPIBuiltinEnabled(false);
+        this.templateConfig = templateConfig;
+    }
+
+    public String render(String name, String content) throws IOException, TemplateException {
+        Template template = new Template(name, new StringReader(content), templateConfig);
+
+        Map<String, Object> model = new HashMap<>();
+        model.put("appName", "Notification Service");
+        model.put("templateId", name);
+
+        StringWriter output = new StringWriter();
+        template.process(model, output);
+        return output.toString();
+    }
+}

src/main/java/org/spring/content/RenderRequest.java

@@ -0,0 +1,29 @@
+package org.spring.content;
+
+/**
+ * DTO for template rendering requests.
+ * Data flows from request body through this object's fields.
+ */
+public class RenderRequest {
+    private String templateContent;
+    private String templateName;
+
+    public RenderRequest() {
+    }
+
+    public String getTemplateContent() {
+        return templateContent;
+    }
+
+    public void setTemplateContent(String templateContent) {
+        this.templateContent = templateContent;
+    }
+
+    public String getTemplateName() {
+        return templateName;
+    }
+
+    public void setTemplateName(String templateName) {
+        this.templateName = templateName;
+    }
+}

src/main/java/org/spring/content/TemplateRenderingService.java

@@ -0,0 +1,41 @@
+package org.spring.content;
+
+import org.springframework.stereotype.Service;
+import org.thymeleaf.TemplateEngine;
+import org.thymeleaf.context.Context;
+import org.thymeleaf.templatemode.TemplateMode;
+import org.thymeleaf.templateresolver.StringTemplateResolver;
+
+@Service
+public class TemplateRenderingService {
+
+    private final TemplateEngine templateEngine;
+
+    public TemplateRenderingService() {
+        this.templateEngine = new TemplateEngine();
+        StringTemplateResolver resolver = new StringTemplateResolver();
+        resolver.setTemplateMode(TemplateMode.HTML);
+        resolver.setCacheable(false);
+        this.templateEngine.setTemplateResolver(resolver);
+    }
+
+    /**
+     * Renders a template from user-provided content.
+     * Data flows from the request through templateContent parameter to the TemplateEngine.
+     */
+    public String renderFromContent(String templateContent) {
+        Context context = new Context();
+        context.setVariable("appName", "Demo Application");
+
+        return templateEngine.process(templateContent, context);
+    }
+
+    /**
+     * Renders a template using the request object.
+     * Demonstrates data flow through object field access.
+     */
+    public String renderFromRequest(RenderRequest request) {
+        String content = request.getTemplateContent();
+        return renderFromContent(content);
+    }
+}

src/main/java/org/spring/messaging/CreateMessageRequest.java

@@ -0,0 +1,41 @@
+package org.spring.messaging;
+
+public class CreateMessageRequest {
+
+    private String title;
+    private String content;
+    private String author;
+
+    public CreateMessageRequest() {
+    }
+
+    public CreateMessageRequest(String title, String content, String author) {
+        this.title = title;
+        this.content = content;
+        this.author = author;
+    }
+
+    public String getTitle() {
+        return title;
+    }
+
+    public void setTitle(String title) {
+        this.title = title;
+    }
+
+    public String getContent() {
+        return content;
+    }
+
+    public void setContent(String content) {
+        this.content = content;
+    }
+
+    public String getAuthor() {
+        return author;
+    }
+
+    public void setAuthor(String author) {
+        this.author = author;
+    }
+}