CrowmanCloud - Vulnerability Analysis Platform

🚀 Tech Stack Overview

Backend Framework

• Java 17 - Core programming language
• Spring Boot 3.x - Main application framework
• Spring Web - REST API development
• Spring Data JPA - Database abstraction layer
• Spring Security - Authentication and authorization

Database & Persistence

• H2 Database - In-memory database for development
• SQLite - Lightweight file-based database for production
• Hibernate ORM - Object-relational mapping
• JPA (Java Persistence API) - Data persistence specification

Code Analysis & Security

• JavaParser 3.25.5 - Abstract Syntax Tree (AST) parsing
• JavaParser Symbol Solver - Enhanced type resolution
• OWASP Dependency Check - Dependency vulnerability scanning
• Custom AST Visitors - Security pattern detection

Build & Dependency Management

• Apache Maven 3.x - Build automation and dependency management
• Maven Wrapper - Ensures consistent Maven version

JSON Processing

• Jackson Databind - JSON serialization/deserialization
• Jackson Core - JSON processing foundation

Code Quality & Analysis

• Checkstyle 10.12.4 - Code style enforcement
• Lombok - Boilerplate code reduction
• SLF4J - Logging facade

Testing Framework

• Spring Boot Test - Integration testing
• JUnit 5 - Unit testing framework
• Mockito - Mocking framework

🏗️ Architecture Components

Core Services

├── ScanService              # Main orchestration service
├── FileProcessingService    # ZIP extraction and file categorization
├── ASTAnalysisService      # Java code vulnerability analysis
├── VulnerabilityAnalysisService # Pattern-based detection
├── DependencyCheckService  # OWASP dependency scanning
└── ReportGenerationService # Vulnerability report creation

Data Models

├── ScanResult              # Scan metadata and results
├── VulnerabilityReport     # Comprehensive vulnerability data
├── ScanRequest/Response    # API request/response DTOs
└── Vulnerability           # Individual vulnerability details

Analysis Capabilities

Static Code Analysis

• AST-Based Analysis - Deep code structure understanding
• Pattern Matching - Regex-based vulnerability detection
• Control Flow Analysis - Method call and data flow tracking
• Annotation Processing - Security annotation validation

Vulnerability Detection

• SQL Injection (CWE-89) - Parameterized query validation
• Cross-Site Scripting (CWE-79) - Output sanitization checks
• Path Traversal (CWE-22) - File path validation
• Hardcoded Secrets (CWE-798) - Credential detection
• Weak Cryptography (CWE-327) - Algorithm strength validation
• Command Injection (CWE-78) - System command safety
• Authentication Issues (CWE-306) - Missing auth checks
• Input Validation (CWE-20) - Parameter validation

Dependency Analysis

• Known Vulnerabilities - CVE database matching
• License Compliance - Open source license checking
• Outdated Dependencies - Version currency analysis

🔧 Configuration & Customization

Application Properties

# Database Configuration
spring.datasource.url=jdbc:h2:file:./crowmancloud.db
spring.jpa.hibernate.ddl-auto=update

# File Upload Configuration
spring.servlet.multipart.max-file-size=50MB
spring.servlet.multipart.max-request-size=50MB

# Security Configuration
spring.security.enabled=true

Supported File Types

• Java Files (.java) - AST-based analysis
• Maven Files (pom.xml) - Dependency scanning
• Configuration (.properties, .yml, .yaml, .json)
• Build Scripts (.gradle)
• Web Assets (.js, .ts)
• Python Files (.py) - Basic pattern matching

API Endpoints

POST /api/v1/scan/upload     # Upload ZIP for analysis
GET  /api/v1/scan/{id}       # Get scan results
GET  /api/v1/scan/{id}/report # Download detailed report
GET  /api/v1/scans           # List all scans

🛡️ Security Features

Input Validation

• File type validation
• ZIP bomb protection
• Path traversal prevention
• Size limit enforcement

Analysis Engine

• Multi-layered Detection - AST + Pattern + Dependency
• CWE Classification - Industry standard vulnerability mapping
• Severity Scoring - CRITICAL/HIGH/MEDIUM/LOW classification
• False Positive Reduction - Context-aware analysis

Reporting

• JSON API Response - Structured vulnerability data
• Line-by-line Analysis - Precise vulnerability location
• Remediation Guidance - Actionable fix recommendations
• Compliance Mapping - OWASP Top 10 alignment

🚀 Getting Started

Prerequisites

• Java 17 or higher
• Maven 3.6+
• 2GB RAM minimum
• 1GB disk space

Quick Start

# Clone repository
git clone <repository-url>
cd crowmancloud

# Build application
./mvnw clean install

# Run application
./mvnw spring-boot:run

# Access API
curl -X POST http://localhost:8080/api/v1/scan/upload \
  -F "file=@your-project.zip" \
  -F "projectName=MyProject"

Development Setup

# Run with development profile
./mvnw spring-boot:run -Dspring-boot.run.profiles=dev

# Run tests
./mvnw test

# Generate reports
./mvnw site

📊 Performance & Scalability

Analysis Performance

• AST Parsing - ~1000 lines/second
• Pattern Matching - ~5000 lines/second
• Dependency Scanning - ~100 dependencies/second
• Memory Usage - ~50MB per 1000 Java files

Scalability Features

• Asynchronous processing
• Temporary file cleanup
• Database connection pooling
• Configurable thread pools

🔍 Monitoring & Logging

Application Metrics

• Scan completion rates
• Vulnerability detection statistics
• Processing time metrics
• Error rate monitoring

Logging Configuration

logging.level.com.crowmancloud=DEBUG
logging.file.name=crowmancloud.log
logging.pattern.console=%d{HH:mm:ss.SSS} [%thread] %-5level %logger{36} - %msg%n

🤝 Contributing

Code Standards

• Java 17 features encouraged
• Spring Boot best practices
• Comprehensive unit tests
• Checkstyle compliance

Adding Custom Rules

1. Extend ASTAnalysisService
2. Implement AST visitor patterns
3. Add vulnerability detection logic
4. Include test cases
5. Update documentation

This tech stack provides a robust, scalable foundation for enterprise-grade security analysis with modern Java technologies and industry-standard security practices.