Java / Spring source review

When it applies

Reviewing Java source, most often a Spring/Spring Boot service. Java's biggest hitters are deserialization, XXE-by-default, and expression-language injection — all high impact and all grep-able.

Why it works

Several Java APIs are unsafe by default (XML parsers resolve external entities; ObjectInputStream instantiates arbitrary classes) and frameworks expose powerful expression languages (SpEL/OGNL) that turn a string into code. Tracing the source to a request parameter or message body confirms reach.