feat(java): detect UnprotectedRootAction JSON body parse without HMAC header (CWE-306)

[ai-anant]

Summary

Adds a Jenkins Java rule that flags an UnprotectedRootAction handler which deserializes the HTTP request body with ObjectMapper.readValue(request.getInputStream(), ...) without first reading an HMAC/signature header (X-Hub-Signature / X-Hub-Signature-256).

UnprotectedRootAction skips Jenkins authentication. Parsing inbound JSON events with no shared-secret check lets any caller who can POST to the endpoint inject those events (CWE-306).

Pattern (generic)

• Positive: class implements UnprotectedRootAction and calls ObjectMapper.readValue on StaplerRequest.getInputStream() with no prior getHeader("X-Hub-Signature") / X-Hub-Signature-256.
• Negative: the same shape after reading X-Hub-Signature.

Test

Validated with semgrep --validate. Positive repro fires; sanitized negative (signature header read before readValue) is silent.

Notes

No plugin/project names, file paths, versions, or exploit details.