Case studies

Case study

Background ReadAction Freeze Companion

Most plugins in this catalog start from users complaining about a paid competitor. This one started from JetBrains' own Platform Blog, which describes a background-thread entry point reaching a blocking, non-cancellable read-lock call as a recurring cause of IDE freezes.

Pointed at IntelliJ’s own source, it found the pattern in SearchForTestsTask, which runs one step through the cancellable ReadAction.nonBlocking() and its sibling through the blocking ReadAction.run(). That became IDEA-393501, filed with JetBrains and since triaged and assigned. On the same code it also skipped a read action whose only caller runs on the EDT: a false positive avoided in production code, not in a synthetic test.

View evidence

Case study

Dependency Vulnerability Companion

Every leading alternative (Aikido, Xygeni, JFrog's own Marketplace plugins, Snyk) requires a cloud account or personal access token before it does anything. In December 2024 Semgrep moved its maintained rules to a new restrictive license, and a consortium of competing AppSec vendors (Aikido, Endor Labs, Orca Security and others) answered by forking the engine as Opengrep. This plugin checks the same class of vulnerable dependencies with no account, no token, and no network calls. That is the only way to serve defense contractors regulated by CMMC 2.0, a buyer segment that cannot use any of the cloud-based alternatives above.

View evidence

Case study

SpEL Injection Sink Companion

Spring Expression Language injection is not a theoretical bug class: in CVE-2022-22963, a routing expression supplied by the caller became SpEL source text that Spring Cloud Function parsed and evaluated, leading to remote code execution. CISA added it to its Known Exploited Vulnerabilities catalog in August 2022. This plugin flags the same mechanism in application code, inline in the editor: a Spring ExpressionParser.parseExpression(...) call whose argument is built from an HTTP endpoint parameter. Taint analysis for the broader category exists in IntelliJ IDEA Ultimate and Qodana’s Ultimate Plus tier; this plugin is free, needs no account, and runs in Community Edition.

View evidence

Case study

SSRF Allow-List Bypass Companion

Validating an outbound URL by checking whether an allowed host is a prefix or substring of the raw string is structurally unsound, and Spring Framework showed why: in CVE-2024-22243, a URL parsed by UriComponentsBuilder could pass a host validation check while the request went somewhere else, enabling SSRF or an open redirect. The fix changed how the userinfo part of a URL is parsed. This plugin flags an outbound HTTP call (new URL(...) or Spring’s RestTemplate) that uses an endpoint parameter validated only with .startsWith/.contains against the raw URL string.

View evidence

Case study

Lucene Query Injection Companion

When raw user input becomes Lucene query syntax, it can bypass the filters a search was meant to enforce, and deeply nested syntax can take the cluster down: CVE-2023-31419 is a stack overflow and denial of service triggered by a crafted query string on Elasticsearch’s own _search API. SQL injection is covered by every major SAST tool; this sink is not covered by any query in the public CodeQL repository. This plugin flags a QueryBuilders.queryStringQuery(...) or .simpleQueryStringQuery(...) call whose argument is built from an HTTP endpoint parameter.

View evidence