1 line
3.7 KiB
Plaintext
1 line
3.7 KiB
Plaintext
Project Sentinel: Java Language ProfileVersion: 3.0.0-EnterpriseModule: 28-Lang-JavaMaps to: examples/java/Scope: Active enforcement of Maven/Gradle best practices, Spring Boot security, static analysis via SpotBugs, and Checkstyle compliance.1. The JVM Toolchain AdapterSentinel detects a Java project via pom.xml (Maven) or build.gradle (Gradle). It abstracts the verbose invocation of these tools into unified Sentinel commands.1.1 The Wrapper MandateRule: Never use system mvn or gradle. Always use the project wrapper (mvnw, gradlew) to ensure version consistency.Enforcement:Sentinel intercepts build commands.If ./mvnw is missing, Sentinel runs mvn -N io.takari:maven:wrapper to generate it before proceeding.Block: Agent is blocked from running apt-get install maven.1.2 Dependency ConvergenceThreat: Dependency Hell (Jar Hell) and shadowed vulnerabilities.Enforcement:Maven: Sentinel runs mvn dependency:tree and checks for version conflicts.Action: If the same library appears with two different versions, Sentinel blocks the build until <dependencyManagement> is updated to pin the version.Log4Shell Guard: Sentinel scans the resolved dependency tree for log4j-core < 2.17.1. If found, it triggers a CRITICAL BLOCK and injects a remediation prompt.2. Static Analysis & QualitySentinel enforces "Modern Java" standards, moving agents away from legacy patterns.2.1 SpotBugs IntegrationMechanism: Sentinel executes the SpotBugs plugin during the run_lint phase.Critical Checks:EI_EXPOSE_REP: Returning mutable internal state.NP_NULL_ON_SOME_PATH: Potential NullPointerExceptions.Feedback: Sentinel parses the XML report and translates it: "Null Safety Violation in UserService.java: user might be null on line 45. Wrap in Optional."2.2 Checkstyle RigorRule: Google Java Style Guide.Enforcement:Sentinel enforces import ordering, brace placement, and Javadoc requirements.Auto-Fix: Sentinel runs google-java-format on every save, preventing "Lint Churn" commits.3. Spring Boot GuardrailsMost Java agents work on Spring Boot. Sentinel understands the framework's risks.3.1 The "Actuator" LockThreat: Exposing sensitive metrics via /actuator.Enforcement:Sentinel scans application.properties / application.yml.Check: management.endpoints.web.exposure.include=*.Action: BLOCKED.Remediation: "Security Risk: Do not expose all actuators. Explicitly list health,info."3.2 SQL Injection (JPA/Hibernate)Rule: No String concatenation in HQL/JPQL.Enforcement:Sentinel scans @Query annotations.Bad: @Query("select u from User u where u.name = " + name)Good: @Query("select u from User u where u.name = :name")Action: Sentinel detects string concatenation within @Query and rejects the file save.4. Architecture & Testing4.1 Layer EnforcementRule: Controllers should not talk to Repositories directly. Services must be the intermediary.Enforcement:Sentinel analyzes import statements in classes ending in Controller.Check: If import ...Repository is found.Warning: "Architectural Violation: Controllers should inject Services, not Repositories."4.2 Test Hygiene (JUnit 5)Rule: No System.out.println in tests. Use Assertions.Enforcement:Sentinel greps test files for print statements.Action: Rejects commit.Migration: If it detects @Test (JUnit 4) and @Test (JUnit 5) mixed in the same file, it flags a "Mixed Test Framework" warning.5. Troubleshooting Java Agents5.1 Common Failure Modes"Lombok Missing": Agent writes getters/setters manually or forgets annotation processing.Sentinel Fix: Checks pom.xml for Lombok dependency. If present, it suppresses "Method missing" errors in the linter if the @Data annotation is present."Circular Bean Dependency": Spring startup fails.Sentinel Fix: Analyzes the stack trace, identifies the cycle A -> B -> A, and suggests using @Lazy or refactoring. |