From b45d9065026559baebb88b3cafdbcb3451956f13 Mon Sep 17 00:00:00 2001
From: ai-anant <ant2010in@gmail.com>
Date: Fri, 4 Sep 2026 09:44:31 +0530
Subject: [PATCH] feat(java): detect System.exit() termination in Jenkins
 build/plugin code (CWE-248)

---
 .../dos/system-exit-in-build-code.yaml        | 34 +++++++++++++++++++
 1 file changed, 34 insertions(+)
 create mode 100644 java/jenkins/dos/system-exit-in-build-code.yaml

diff --git a/java/jenkins/dos/system-exit-in-build-code.yaml b/java/jenkins/dos/system-exit-in-build-code.yaml
new file mode 100644
index 0000000..8e0923c
--- /dev/null
+++ b/java/jenkins/dos/system-exit-in-build-code.yaml
@@ -0,0 +1,34 @@
+rules:
+  - id: codevigilant.java.jenkins.dos.system-exit-in-build-code
+    message: >-
+      Detected a call to System.exit() inside a build/plugin execution path.
+      In a long-running server process (Jenkins controller or agent JVM) this
+      terminates the ENTIRE JVM instead of failing the current operation,
+      taking down the node and every concurrent build/job running in it
+      (CWE-248/674, DoS). Build steps must fail via thrown exceptions
+      (e.g. AbortException), never by terminating the process.
+    languages: [java]
+    severity: HIGH
+    metadata:
+      category: security
+      cwe: "CWE-248: Uncaught Exception"
+      owasp: "A04:2021 - Insecure Design"
+      technology: jenkins
+      confidence: HIGH
+      references:
+        - https://www.jenkins.io/doc/developer/security/
+        - https://rules.sonarsource.com/java/type/Bug/RSPEC-1147/
+        - https://spotbugs.readthedocs.io/en/stable/bugDescriptions.html#dm-exit-dm-exit-dm-exit-dm-exit
+      source: independent security review
+      license: MIT
+    patterns:
+      - pattern-either:
+          - pattern: System.exit($ARG);
+          - pattern: System.exit($ARG)
+      - pattern-not-inside: |
+          public static void main(String[] $ARGS) {
+              ...
+          }
+      - metavariable-regex:
+          metavariable: $ARG
+          regex: '[0-9]+'
\ No newline at end of file