Implement SCA Reachability: detect and report vulnerable library classes loaded at runtime#11352

Draft

jandro996 wants to merge 24 commits into

masterfrom

alejandro.gonzalez/sca-reachability

Commits on May 12, 2026

Implement SCA Reachability: detect vulnerable library classes at runtime
jandro996
committed

Commits on May 13, 2026

Commit sca_cves.json as versioned resource; update generateScaCvesJson task
jandro996
committed
Fix Path B classpath scan for Java 9+: fall back to java.class.path
jandro996
committed
Add Java 9+ test for Path B classpath fallback; make method package-private
jandro996
committed
Implement method-level symbol detection with ASM bytecode injection
jandro996
committed
Retransform classes for method-level detection: already-loaded and version-unresolved
jandro996
committed
Fix: remove incorrect dedup from injectCallbacks; update invariants
jandro996
committed
pr-review: fix null guard, encapsulate periodicWorkCallback, update Javadoc, add retransform tests
jandro996
committed
Fix two Codex review issues: java.nio in premain and transitive JAR resolution
jandro996
committed
Refactor: extract CLASS_LEVEL_SYMBOL constant and reportClassLevelHitIfPresent helper
jandro996
committed
Move CLASS_LEVEL_SYMBOL to ScaReachabilityHit; fix misleading comment
jandro996
committed
Move java.nio comment to usage site; add tests for transitive JAR fallback
jandro996
committed
Remove dead visitCode() override and redundant CLASS_LEVEL_SYMBOL alias
jandro996
committed
Capture callsite for method-level hits (mirrors Python tracer)
jandro996
committed
Move callsite detection from bootstrap to ScaReachabilitySystem handler
jandro996
committed
Use AbstractStackWalker.isNotDatadogTraceStackElement for callsite filtering
jandro996
committed
Add tests for ScaReachabilitySystem.findCallsite(); document fallback path
jandro996
committed
Update ScaReachabilityHit Javadoc to reflect dual callsite/symbol semantics
jandro996
committed
Move findCallsite() after start() — helpers after main public method
jandro996
committed
Use ConcurrentHashMap.newKeySet() instead of verbose newSetFromMap idiom
jandro996
committed
Lazy entryHasMethodLevelSymbol check — avoid stream alloc on normal path
jandro996
committed
Remove Path B from startup scan — JDK symbols are false positive indicators
jandro996
committed
Remove dead processPathB() — never called after Path B removal
jandro996
committed
Fix dedup key to include class name for method-level hits
jandro996
committed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Implement SCA Reachability: detect and report vulnerable library classes loaded at runtime#11352

Implement SCA Reachability: detect and report vulnerable library classes loaded at runtime#11352
jandro996 wants to merge 24 commits into
masterfrom
alejandro.gonzalez/sca-reachability

Commits on May 12, 2026

Implement SCA Reachability: detect vulnerable library classes at runtime

Commits on May 13, 2026

Commit sca_cves.json as versioned resource; update generateScaCvesJson task

Fix Path B classpath scan for Java 9+: fall back to java.class.path

Add Java 9+ test for Path B classpath fallback; make method package-private

Implement method-level symbol detection with ASM bytecode injection

Retransform classes for method-level detection: already-loaded and version-unresolved

Fix: remove incorrect dedup from injectCallbacks; update invariants

pr-review: fix null guard, encapsulate periodicWorkCallback, update Javadoc, add retransform tests

Fix two Codex review issues: java.nio in premain and transitive JAR resolution

Refactor: extract CLASS_LEVEL_SYMBOL constant and reportClassLevelHitIfPresent helper

Move CLASS_LEVEL_SYMBOL to ScaReachabilityHit; fix misleading comment

Move java.nio comment to usage site; add tests for transitive JAR fallback

Remove dead visitCode() override and redundant CLASS_LEVEL_SYMBOL alias

Capture callsite for method-level hits (mirrors Python tracer)

Move callsite detection from bootstrap to ScaReachabilitySystem handler

Use AbstractStackWalker.isNotDatadogTraceStackElement for callsite filtering

Add tests for ScaReachabilitySystem.findCallsite(); document fallback path

Update ScaReachabilityHit Javadoc to reflect dual callsite/symbol semantics

Move findCallsite() after start() — helpers after main public method

Use ConcurrentHashMap.newKeySet() instead of verbose newSetFromMap idiom

Lazy entryHasMethodLevelSymbol check — avoid stream alloc on normal path

Remove Path B from startup scan — JDK symbols are false positive indicators

Remove dead processPathB() — never called after Path B removal

Fix dedup key to include class name for method-level hits