Static analysis findings: SQLi, Jackson deserialization, and IDOR detected by Chanakya in JavaSecLab #19

We ran Chanakya static analyzer on JavaSecLab.
All findings are intentional vulnerabilities.

SQL Injection: 34 findings in 2.6 seconds
Multiple controllers using string concatenation
into JDBC queries

Jackson Deserialization: 2 findings
JacksonController.java:39 — VULNERABLE
@RequestBody String → readValue(body, Class)
JacksonController.java:59 — VULNERABLE
Same shape, /safe endpoint

IDOR: 2 findings
@PathParam IDs flowing to repository.findById()
without ownership checks

Sharing in case useful for lesson documentation
or static analysis integration examples.

Tool: Chanakya (github.com/sujanaacharya/CHANAKYA)
SQLi: 88.60% recall on OWASP BenchmarkJava at 0 FP
1.0 precision on deserialization detection

Contributed by: Suman Lamichhane and Sujana Acharya
Contact: sumanlamichhane45@gmail.com | sujanaacharya17@gmail.com