Deeps-2005/java-ssl-scanner

1---2title: SSL/HTTPS Vulnerability Scanner3emoji: 🔐4colorFrom: blue5colorTo: green6sdk: docker7pinned: false8short_description: 🔐 SSL/HTTPS Vulnerability Scanner & Auto-Patcher9---10 11# 🔐 SSL/HTTPS Vulnerability Scanner & Auto-Patcher12 13## 📘 Project Overview14 15This application is a comprehensive tool designed to enhance the security of Java applications by identifying and automatically patching common SSL/HTTPS vulnerabilities. It provides a user-friendly web interface for developers to analyze their code and apply security fixes effortlessly.16 17### Key Features18 19*   **Multiple Input Methods**: Analyze code by uploading single `.java` files, pasting code directly into a text area, or uploading a `.zip` archive containing multiple Java files.20*   **Vulnerability Detection**: Scans for a wide range of insecure practices, including:21    *   Improperly configured `X509TrustManager` and `HostnameVerifier`.22    *   Use of weak or outdated TLS/SSL protocols (e.g., SSLv3, TLSv1.0).23    *   Inclusion of weak cipher suites.24    *   Hardcoded passwords and sensitive credentials.25    *   Insecure `SecureRandom` instantiation.26*   **Automated Patching**: Offers an "Auto-Patch" feature that modifies the source code to apply security best practices, replacing insecure implementations with robust alternatives.27*   **Detailed Reporting**: Provides clear, actionable reports for each detected vulnerability, including severity levels, detailed suggestions, and secure code examples.28 29## 🛠️ Tech Stack30 31*   **Frontend**: A responsive web interface built with **Streamlit**.32*   **Backend**: A robust API powered by **FastAPI**.33*   **Core Analyzer**: A static analysis engine written in **Java**, utilizing the **JavaParser** library to inspect the Abstract Syntax Tree (AST) of the source code.34*   **Deployment**: Containerized with **Docker** and designed for easy deployment on platforms like Hugging Face Spaces.35 36---37 38This project is intended for educational and illustrative purposes to demonstrate best practices in secure coding and automated code analysis.