Java: remove version debugging from alert message

github · jcogs33 · Aug 26, 2025 · Jul 9, 2025 · Jul 9, 2025 · Jul 10, 2025
commit 0dd33b273437cfa85904760e6f4b9366fca12a81
@@ -11,9 +11,8 @@ private class SpringBootParent extends Parent {
   SpringBootParent() { this.getGroup().getValue() = "org.springframework.boot" }
 }
 
-// TODO: private once done with version string debugging in alert msg.
 /** A `Pom` with a Spring Boot parent node. */
-class SpringBootPom extends Pom {
+private class SpringBootPom extends Pom {
   SpringBootPom() { this.getParentElement() instanceof SpringBootParent }
 
   /** Holds if the Spring Boot Security module is used in the project. */

@@ -15,11 +15,6 @@ import java
 import semmle.code.xml.MavenPom
 import semmle.code.java.security.SpringBootActuatorsConfigQuery
 
-from SpringBootStarterActuatorDependency d, JavaPropertyOption jpOption, SpringBootPom pom
-where
-  exposesSensitiveEndpoint(d, jpOption) and
-  // TODO: remove pom; for debugging versions
-  d = pom.getADependency()
-select d,
-  "Insecure Spring Boot actuator $@ exposes sensitive endpoints (" +
-    pom.getParentElement().getVersionString() + ").", jpOption, "configuration"
+from SpringBootStarterActuatorDependency d, JavaPropertyOption jpOption
+where exposesSensitiveEndpoint(d, jpOption)
+select d, "Insecure Spring Boot actuator $@ exposes sensitive endpoints.", jpOption, "configuration"