Add Java heuristic insecure randomness query

[WritingPanda]

Summary

Adds a heuristic Java CWE-338 query that reports cryptographically weak randomness only when surrounding identifier names suggest a security-sensitive value, such as a token, secret, OTP, nonce, API key, session identifier, or authorization code.

This ports and adapts the query from dsp-testing/codeql-development-template#24 to the Community Packs layout and conventions.

Changes

• add githubsecuritylab/java/heuristic-insecure-randomness under java/src/security/CWE-338
• reuse the standard RandomDataSource and InsecureRandomnessSource abstractions so SecureRandom remains excluded
• add query help with bad/good examples and remediation guidance
• add focused tests covering method, output-variable, generator-variable, and Math.random() matches, plus SecureRandom and non-sensitive negatives
• bump githubsecuritylab/codeql-java-queries from 0.7.5 to 0.8.0

The existing broader WeakPRNG.ql query is unchanged; this query provides a lower-noise, security-context heuristic.

Real-project result

The query was executed against a CodeQL database for hoanghuu1207/Electronic_News at commit 90ffd7abfe84c56b2e39b07572ffb8f46c3af5c4 and reported the weak Random.nextInt(...) used by generateToken:

https://github.com/hoanghuu1207/Electronic_News/blob/90ffd7abfe84c56b2e39b07572ffb8f46c3af5c4/src/helper/GenerateToken.java#L6-L14

Validation

• strict full Java query compilation with warnings treated as errors
• focused CodeQL test: 1/1 passed with four expected findings
• query-help rendering
• Java suite resolution includes the new query
• full Java query-pack build

[felickz]

👍

[Copilot]

Pull request overview

Adds a new heuristic Java query to detect cryptographically weak randomness only in security-sensitive naming contexts, reducing noise compared to broad weak-PRNG checks. This integrates the query into the Community Packs layout with documentation, tests, and a pack version bump.

Changes:

• Added security/CWE-338/HeuristicInsecureRandomness.ql implementing a name-context heuristic on top of RandomDataSource / InsecureRandomnessSource (excluding SecureRandom).
• Added query help (.qhelp) and an example Java snippet for documentation rendering.
• Added focused CodeQL tests (QL ref, Java test file, expected results) and bumped githubsecuritylab/codeql-java-queries version to 0.8.0.

Show a summary per file

File	Description
java/src/security/CWE-338/HeuristicInsecureRandomness.ql	New heuristic query detecting weak PRNG usage when surrounding identifiers imply security-sensitive output.
java/src/security/CWE-338/HeuristicInsecureRandomness.qhelp	Query help text with rationale, recommendations, and references.
java/src/security/CWE-338/HeuristicInsecureRandomness.java	Documentation/example snippet used by qhelp rendering.
java/test/security/CWE-338/HeuristicInsecureRandomness.qlref	Test harness reference pointing at the new query.
java/test/security/CWE-338/HeuristicInsecureRandomness.java	Positive/negative test cases covering method/variable/qualifier/Math.random() and SecureRandom exclusions.
java/test/security/CWE-338/HeuristicInsecureRandomness.expected	Expected findings verifying the intended matches.
java/src/qlpack.yml	Version bump of githubsecuritylab/codeql-java-queries from 0.7.5 to 0.8.0.

Review details

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

• Files reviewed: 7/7 changed files
• Comments generated: 0
• Review effort level: Lite

[Copilot]

One or more custom setup steps configured for this repository failed during this Copilot code review run:

Install CodeQL pack dependencies

Setup steps run before each review. If the review above is missing context, or no review was posted at all, the failing step above may be the cause. See the workflow run for failure details, fix your setup steps configuration, and re-request a review.

Note

You can configure setup steps for Copilot code review separately from Copilot cloud agent with a copilot-code-review.yml file. Read the docs for details.

[WritingPanda]

CI is currently blocked by repository-wide CodeQL CLI/package drift rather than this query.

The failed job installs pinned CLI 2.26.2, then package resolution attempts to read codeql/java-all@9.2.3, whose manifest was produced for CLI 2.26.3; CLI 2.26.2 cannot parse its newer OCI config (Unrecognized field "digest"). The Copilot setup run independently fails the same way on codeql/csharp-all@7.1.2, before reaching Java, which confirms this is not query-specific.

The repository already tracks the required CLI upgrade in #219. The prior upgrade workflow run failed on whitespace in its input, and #220 fixes that workflow validation. Once the repository-wide 2.26.3 dependency-refresh PR lands, this PR's checks should be rerun. I have not added a partial CLI/library bump here because CONTRIBUTING.md requires those pins and lockfiles to be updated together across all packs.

[felickz]

CI is currently blocked by repository-wide CodeQL CLI/package drift rather than this query.

The failed job installs pinned CLI 2.26.2, then package resolution attempts to read codeql/java-all@9.2.3, whose manifest was produced for CLI 2.26.3; CLI 2.26.2 cannot parse its newer OCI config (Unrecognized field "digest"). The Copilot setup run independently fails the same way on codeql/csharp-all@7.1.2, before reaching Java, which confirms this is not query-specific.

The repository already tracks the required CLI upgrade in #219. The prior upgrade workflow run failed on whitespace in its input, and #220 fixes that workflow validation. Once the repository-wide 2.26.3 dependency-refresh PR lands, this PR's checks should be rerun. I have not added a partial CLI/library bump here because CONTRIBUTING.md requires those pins and lockfiles to be updated together across all packs.

Known issue with 2.26.3 packs being used with any other CLI version, synced this repo to use the latest cli and just reran your jobs!