Scaling the Security Researcher to Eliminate OSS Vulnerabilities Once and For All

The talk starts with an HTTP dependency-resolution flaw found in a Gradle build at the speaker's employer. Checking the wider Java ecosystem, he found the same weakness across many well-known organizations and repositories, and a coordinated push to move major artifact servers to HTTPS only still left many projects exposed. Filing issues by hand could not keep pace, so he set out to fix problems at scale instead.

The middle of the talk covers the tooling. CodeQL queries locate vulnerable projects, while OpenRewrite offers a format-preserving syntax tree for Java that lets recipes insert or rewrite code in each project's own style. The speakers walk through three Java flaws: temporary directory hijacking, partial path traversal and zip slip. For each, they explain why a naive fix can fall short, and how data flow and control flow analysis help confirm real issues and avoid false positives. They also describe GitHub API rate limits that slow bulk pull request creation.

The closing section gives practical lessons for anyone sending bulk fixes. Messages to maintainers should be careful, because maintainers are people. Commits should be signed off and GPG-signed, the effects of public disclosure should be weighed, and GitHub should be contacted in advance. The argument is that automated fixes can reach far more projects than individual reports, and listeners are pointed to OpenRewrite, CodeQL and open source security communities.