Skip to main content

Track data lineage

org.openrewrite.analysis.java.datalineage.TrackDataLineage

Tracks the flow of data from database sources to API sinks to understand data dependencies and support compliance requirements.

Prerequisites for detecting a data flow​

All of the following conditions must be met for the recipe to report a flow:

  1. The source code must contain at least one method call matching a recognized source (see below).
  2. The source code must contain at least one method call matching a recognized sink (see below).
  3. The tainted data must propagate from the source to the sink through variable assignments within the same method or via fields across methods in the same compilation unit.
  4. No flow breaker (see below) may appear on the path between source and sink.
  5. The relevant library types (e.g., java.sql.ResultSet, javax.ws.rs.core.Response) must be on the classpath so that OpenRewrite can resolve types. If types are unresolved, method matchers will not trigger and no flows will be detected.

Recognized sources (database reads)​

CategoryClasses
JDBCjava.sql.ResultSet
JPA (javax)javax.persistence.EntityManager, Query, TypedQuery
JPA (jakarta)jakarta.persistence.EntityManager, Query, TypedQuery
Hibernateorg.hibernate.Session, org.hibernate.query.Query
Spring Dataorg.springframework.data.repository.CrudRepository
Spring JDBCorg.springframework.jdbc.core.JdbcTemplate
MyBatisorg.apache.ibatis.session.SqlSession, org.mybatis.spring.SqlSessionTemplate
MongoDBcom.mongodb.client.MongoCollection, org.springframework.data.mongodb.core.MongoTemplate
Redisredis.clients.jedis.Jedis, org.springframework.data.redis.core.RedisTemplate, ValueOperations, HashOperations
Cassandracom.datastax.driver.core.Session, org.springframework.data.cassandra.core.CassandraTemplate
Elasticsearchorg.elasticsearch.client.RestHighLevelClient, org.springframework.data.elasticsearch.core.ElasticsearchTemplate
HeuristicAny class with Repository, Dao, or Mapper in its name calling methods starting with find, get, query, search, load, fetch, or select

Recognized sinks (API responses)​

CategoryClasses
JAX-RS (javax)javax.ws.rs.core.Response, Response.ResponseBuilder
JAX-RS (jakarta)jakarta.ws.rs.core.Response, Response.ResponseBuilder
Spring MVCorg.springframework.http.ResponseEntity, ResponseEntity.BodyBuilder
Servlet (javax)javax.servlet.http.HttpServletResponse, javax.servlet.ServletOutputStream
Servlet (jakarta)jakarta.servlet.http.HttpServletResponse, jakarta.servlet.ServletOutputStream
Java I/Ojava.io.PrintWriter, java.io.Writer, java.io.OutputStream
Jacksoncom.fasterxml.jackson.databind.ObjectMapper, com.fasterxml.jackson.core.JsonGenerator
Gsoncom.google.gson.Gson, com.google.gson.JsonWriter
GraphQLgraphql.schema.DataFetcher, graphql.schema.PropertyDataFetcher
Spring WebFluxServerResponse, reactor.core.publisher.Mono, reactor.core.publisher.Flux
gRPCio.grpc.stub.StreamObserver
WebSocketjavax.websocket.Session, RemoteEndpoint.Basic, jakarta.websocket.*, org.springframework.web.socket.WebSocketSession

Flow breakers​

Flows are broken by methods matching common sanitization patterns (anonymize, redact, mask, encrypt, hash, sanitize, etc.) or authorization checks (isAuthorized, hasPermission, hasRole, etc.).

Recipe source​

This recipe is only available to users of Moderne.

This recipe is available under the Moderne Proprietary License.

Example​

Before​
import java.sql.ResultSet;
import javax.ws.rs.core.Response;

class UserController {
    public Response getUser(String id, ResultSet rs) throws Exception {
        String name = rs.getString("name");
        String email = rs.getString("email");

        User user = new User(name, email);
        return Response.ok(user).build();
    }

    class User {
        String name, email;
        User(String n, String e) { name = n; email = e; }
    }
}
After​
import java.sql.ResultSet;
import javax.ws.rs.core.Response;

class UserController {
    public Response getUser(String id, ResultSet rs) throws Exception {
        String name = rs.getString("name");
        String email = rs.getString("email");

        User user = new User(name, email);
        return /*~~(DATA_LINEAGE use)~~>*/Response.ok(user).build();
    }

    class User {
        String name, email;
        User(String n, String e) { name = n; email = e; }
    }
}

Usage​

This recipe has no required configuration options. Users of Moderne can run it via the Moderne CLI.

You will need to have configured the Moderne CLI on your machine before you can run the following command.

shell
mod run . --recipe TrackDataLineage

If the recipe is not available locally, then you can install it using:

mod config recipes jar install io.moderne.recipe:rewrite-program-analysis:0.12.2

See how this recipe works across multiple open-source repositories​

Run this recipe on OSS repos at scale with the Moderne SaaS.

The community edition of the Moderne platform enables you to easily run recipes across thousands of open-source repositories.

Please contact Moderne for more information about safely running the recipes on your own codebase in a private SaaS.

Data Tables​

Taint flow​

org.openrewrite.analysis.java.taint.table.TaintFlowTable

Records taint flows from sources to sinks with their taint types.

Column NameDescription
Source fileThe source file that the method call occurred in.
Source lineThe line number where the taint source is located.
SourceThe source code where taint originates.
Sink lineThe line number where the taint sink is located.
SinkThe sink code where taint flows to.
Taint typeThe taint type that matched at the sink.