diff --git a/.all-contributorsrc b/.all-contributorsrc index 6c00093cb9..04b834beb0 100644 --- a/.all-contributorsrc +++ b/.all-contributorsrc @@ -7212,6 +7212,25 @@ "contributions": [ "doc" ] + }, + { + "login": "rcorfieldffdc", + "name": "Richard Corfield", + "avatar_url": "https://avatars.githubusercontent.com/u/42997936?v=4", + "profile": "https://github.com/rcorfieldffdc", + "contributions": [ + "code" + ] + }, + { + "login": "m0rjc", + "name": "Richard Corfield", + "avatar_url": "https://avatars.githubusercontent.com/u/994206?v=4", + "profile": "https://github.com/m0rjc", + "contributions": [ + "bug", + "code" + ] } ], "contributorsPerLine": 7, diff --git a/docs/pages/pmd/projectdocs/credits.md b/docs/pages/pmd/projectdocs/credits.md index 8893c3c41c..8c79407044 100644 --- a/docs/pages/pmd/projectdocs/credits.md +++ b/docs/pages/pmd/projectdocs/credits.md @@ -621,407 +621,409 @@ Thanks goes to these wonderful people ([emoji key](https://allcontributors.org/d
Reda Benhemmouche

๐Ÿ›
Renato Oliveira

๐Ÿ’ป ๐Ÿ›
Rich DiCroce

๐Ÿ› +
Richard Corfield

๐Ÿ’ป +
Richard Corfield

๐Ÿ› ๐Ÿ’ป
Riot R1cket

๐Ÿ› -
Rishabh Jain

๐Ÿ› -
RishabhDeep Singh

๐Ÿ› +
Rishabh Jain

๐Ÿ› +
RishabhDeep Singh

๐Ÿ›
Robbie Martinus

๐Ÿ’ป ๐Ÿ›
Robert Henry

๐Ÿ›
Robert Mihaly

๐Ÿ›
Robert Painsi

๐Ÿ›
Robert Russell

๐Ÿ› -
Robert Sรถsemann

๐Ÿ’ป ๐Ÿ“– ๐Ÿ“ข ๐Ÿ› -
Robert Whitebit

๐Ÿ› +
Robert Sรถsemann

๐Ÿ’ป ๐Ÿ“– ๐Ÿ“ข ๐Ÿ› +
Robert Whitebit

๐Ÿ›
Robin Richtsfeld

๐Ÿ›
Robin Stocker

๐Ÿ’ป ๐Ÿ›
Robin Wils

๐Ÿ›
RochusOest

๐Ÿ›
Rodolfo Noviski

๐Ÿ› -
Rodrigo Casara

๐Ÿ› -
Rodrigo Fernandes

๐Ÿ› +
Rodrigo Casara

๐Ÿ› +
Rodrigo Fernandes

๐Ÿ›
Roman Salvador

๐Ÿ’ป ๐Ÿ›
Ronald Blaschke

๐Ÿ›
Rรณbert Papp

๐Ÿ›
Saikat Sengupta

๐Ÿ›
Saksham Handu

๐Ÿ› -
Saladoc

๐Ÿ› -
Salesforce Bob Lightning

๐Ÿ› +
Saladoc

๐Ÿ› +
Salesforce Bob Lightning

๐Ÿ›
Sam Carlberg

๐Ÿ›
Satoshi Kubo

๐Ÿ›
Scott Kennedy

๐Ÿ›
Scott Wells

๐Ÿ› ๐Ÿ’ป
Scrsloota

๐Ÿ’ป -
Sebastian Bรถgl

๐Ÿ› -
Sebastian Schuberth

๐Ÿ› +
Sebastian Bรถgl

๐Ÿ› +
Sebastian Schuberth

๐Ÿ›
Sebastian Schwarz

๐Ÿ›
Seren

๐Ÿ› ๐Ÿ’ป
Sergey Gorbaty

๐Ÿ›
Sergey Kozlov

๐Ÿ›
Sergey Yanzin

๐Ÿ’ป ๐Ÿ› -
Seth Wilcox

๐Ÿ’ป -
Shubham

๐Ÿ’ป ๐Ÿ› +
Seth Wilcox

๐Ÿ’ป +
Shubham

๐Ÿ’ป ๐Ÿ›
Simon Abykov

๐Ÿ’ป ๐Ÿ›
Simon Xiao

๐Ÿ›
Srinivasan Venkatachalam

๐Ÿ›
Stanislav Gromov

๐Ÿ›
Stanislav Myachenkov

๐Ÿ’ป -
Stefan Birkner

๐Ÿ› -
Stefan Bohn

๐Ÿ› +
Stefan Birkner

๐Ÿ› +
Stefan Bohn

๐Ÿ›
Stefan Endrullis

๐Ÿ›
Stefan Klรถss-Schuster

๐Ÿ›
Stefan Wolf

๐Ÿ›
Stephan H. Wissel

๐Ÿ›
Stephen

๐Ÿ› -
Stephen Friedrich

๐Ÿ› -
Steve Babula

๐Ÿ’ป +
Stephen Friedrich

๐Ÿ› +
Steve Babula

๐Ÿ’ป
Steven Stearns

๐Ÿ› ๐Ÿ’ป
Stexxe

๐Ÿ›
Stian Lรฅgstad

๐Ÿ›
StuartClayton5

๐Ÿ›
Supun Arunoda

๐Ÿ› -
Suren Abrahamyan

๐Ÿ› -
Suvashri

๐Ÿ“– +
Suren Abrahamyan

๐Ÿ› +
Suvashri

๐Ÿ“–
SwatiBGupta1110

๐Ÿ›
SyedThoufich

๐Ÿ›
Szymon Sasin

๐Ÿ›
T-chuangxin

๐Ÿ›
TERAI Atsuhiro

๐Ÿ› -
TIOBE Software

๐Ÿ’ป ๐Ÿ› -
Tarush Singh

๐Ÿ’ป +
TIOBE Software

๐Ÿ’ป ๐Ÿ› +
Tarush Singh

๐Ÿ’ป
Taylor Smock

๐Ÿ›
Techeira Damiรกn

๐Ÿ’ป ๐Ÿ›
Ted Husted

๐Ÿ›
TehBakker

๐Ÿ›
The Gitter Badger

๐Ÿ› -
Theodoor

๐Ÿ› -
Thiago Henrique Hรผpner

๐Ÿ› +
Theodoor

๐Ÿ› +
Thiago Henrique Hรผpner

๐Ÿ›
Thibault Meyer

๐Ÿ›
Thomas Gรผttler

๐Ÿ›
Thomas Jones-Low

๐Ÿ›
Thomas Smith

๐Ÿ’ป ๐Ÿ›
ThrawnCA

๐Ÿ› -
Thunderforge

๐Ÿ’ป ๐Ÿ› -
Tim van der Lippe

๐Ÿ› +
Thunderforge

๐Ÿ’ป ๐Ÿ› +
Tim van der Lippe

๐Ÿ›
Tobias Weimer

๐Ÿ’ป ๐Ÿ›
Tom Copeland

๐Ÿ› ๐Ÿ’ป ๐Ÿ“–
Tom Daly

๐Ÿ›
Tomer Figenblat

๐Ÿ›
Tomi De Lucca

๐Ÿ’ป ๐Ÿ› -
Torsten Kleiber

๐Ÿ› -
TrackerSB

๐Ÿ› +
Torsten Kleiber

๐Ÿ› +
TrackerSB

๐Ÿ›
Tyson Stewart

๐Ÿ›
Ullrich Hafner

๐Ÿ›
Utku Cuhadaroglu

๐Ÿ’ป ๐Ÿ›
Valentin Brandl

๐Ÿ›
Valeria

๐Ÿ› -
Valery Yatsynovich

๐Ÿ“– -
Vasily Anisimov

๐Ÿ› +
Valery Yatsynovich

๐Ÿ“– +
Vasily Anisimov

๐Ÿ›
Vibhor Goyal

๐Ÿ›
Vickenty Fesunov

๐Ÿ›
Victor Noรซl

๐Ÿ›
Vincent Galloy

๐Ÿ’ป
Vincent HUYNH

๐Ÿ› -
Vincent Maurin

๐Ÿ› -
Vincent Privat

๐Ÿ› +
Vincent Maurin

๐Ÿ› +
Vincent Privat

๐Ÿ›
Vishhwas

๐Ÿ›
Vitaly

๐Ÿ›
Vitaly Polonetsky

๐Ÿ›
Vojtech Polivka

๐Ÿ›
Vsevolod Zholobov

๐Ÿ› -
Vyom Yadav

๐Ÿ’ป -
Wang Shidong

๐Ÿ› +
Vyom Yadav

๐Ÿ’ป +
Wang Shidong

๐Ÿ›
Waqas Ahmed

๐Ÿ›
Wayne J. Earl

๐Ÿ›
Wchenghui

๐Ÿ›
Wener

๐Ÿ’ป
Will Winder

๐Ÿ› -
William Brockhus

๐Ÿ’ป ๐Ÿ› -
Wilson Kurniawan

๐Ÿ› +
William Brockhus

๐Ÿ’ป ๐Ÿ› +
Wilson Kurniawan

๐Ÿ›
Wim Deblauwe

๐Ÿ›
Woongsik Choi

๐Ÿ›
XenoAmess

๐Ÿ’ป ๐Ÿ›
Yang

๐Ÿ’ป
YaroslavTER

๐Ÿ› -
Yasar Shaikh

๐Ÿ’ป -
Young Chan

๐Ÿ’ป ๐Ÿ› +
Yasar Shaikh

๐Ÿ’ป +
Young Chan

๐Ÿ’ป ๐Ÿ›
YuJin Kim

๐Ÿ›
Yuri Dolzhenko

๐Ÿ›
Yurii Dubinka

๐Ÿ›
Zoltan Farkas

๐Ÿ›
Zustin

๐Ÿ› -
aaronhurst-google

๐Ÿ› ๐Ÿ’ป -
alexmodis

๐Ÿ› +
aaronhurst-google

๐Ÿ› ๐Ÿ’ป +
alexmodis

๐Ÿ›
andreoss

๐Ÿ›
andrey81inmd

๐Ÿ’ป ๐Ÿ›
anicoara

๐Ÿ›
arunprasathav

๐Ÿ›
asiercamara

๐Ÿ› -
astillich-igniti

๐Ÿ’ป -
avesolovksyy

๐Ÿ› +
astillich-igniti

๐Ÿ’ป +
avesolovksyy

๐Ÿ›
avishvat

๐Ÿ›
avivmu

๐Ÿ›
axelbarfod1

๐Ÿ›
b-3-n

๐Ÿ›
balbhadra9

๐Ÿ› -
base23de

๐Ÿ› -
bergander

๐Ÿ› +
base23de

๐Ÿ› +
bergander

๐Ÿ›
berkam

๐Ÿ’ป ๐Ÿ›
breizh31

๐Ÿ›
caesarkim

๐Ÿ›
carolyujing

๐Ÿ›
cbfiddle

๐Ÿ› -
cesares-basilico

๐Ÿ› -
chrite

๐Ÿ› +
cesares-basilico

๐Ÿ› +
chrite

๐Ÿ›
cobratbq

๐Ÿ›
coladict

๐Ÿ›
cosmoJFH

๐Ÿ›
cristalp

๐Ÿ›
crunsk

๐Ÿ› -
cwholmes

๐Ÿ› -
cyberjj999

๐Ÿ› +
cwholmes

๐Ÿ› +
cyberjj999

๐Ÿ›
cyw3

๐Ÿ› ๐Ÿ“–
d1ss0nanz

๐Ÿ›
dague1

๐Ÿ“–
dalizi007

๐Ÿ’ป
danbrycefairsailcom

๐Ÿ› -
dariansanity

๐Ÿ› -
darrenmiliband

๐Ÿ› +
dariansanity

๐Ÿ› +
darrenmiliband

๐Ÿ›
davidburstrom

๐Ÿ›
dbirkman-paloalto

๐Ÿ›
deepak-patra

๐Ÿ›
dependabot[bot]

๐Ÿ’ป ๐Ÿ›
dinesh150

๐Ÿ› -
diziaq

๐Ÿ› -
dreaminpast123

๐Ÿ› +
diziaq

๐Ÿ› +
dreaminpast123

๐Ÿ›
duanyanan

๐Ÿ›
dutt-sanjay

๐Ÿ›
dylanleung

๐Ÿ›
dzeigler

๐Ÿ›
ekkirala

๐Ÿ› -
emersonmoura

๐Ÿ› -
fairy

๐Ÿ› +
emersonmoura

๐Ÿ› +
fairy

๐Ÿ›
filiprafalowicz

๐Ÿ’ป
foxmason

๐Ÿ›
frankegabor

๐Ÿ›
frankl

๐Ÿ›
freafrea

๐Ÿ› -
fsapatin

๐Ÿ› -
gracia19

๐Ÿ› +
fsapatin

๐Ÿ› +
gracia19

๐Ÿ›
guo fei

๐Ÿ›
gurmsc5

๐Ÿ›
gwilymatgearset

๐Ÿ’ป ๐Ÿ›
haigsn

๐Ÿ›
hemanshu070

๐Ÿ› -
henrik242

๐Ÿ› -
hongpuwu

๐Ÿ› +
henrik242

๐Ÿ› +
hongpuwu

๐Ÿ›
hvbtup

๐Ÿ’ป ๐Ÿ›
igniti GmbH

๐Ÿ›
ilovezfs

๐Ÿ›
itaigilo

๐Ÿ›
jakivey32

๐Ÿ› -
jbennett2091

๐Ÿ› -
jcamerin

๐Ÿ› +
jbennett2091

๐Ÿ› +
jcamerin

๐Ÿ›
jkeener1

๐Ÿ›
jmetertea

๐Ÿ›
johnra2

๐Ÿ’ป
josemanuelrolon

๐Ÿ’ป ๐Ÿ›
kabroxiko

๐Ÿ’ป ๐Ÿ› -
karwer

๐Ÿ› -
kaulonline

๐Ÿ› +
karwer

๐Ÿ› +
kaulonline

๐Ÿ›
kdaemonv

๐Ÿ›
kdebski85

๐Ÿ› ๐Ÿ’ป
kenji21

๐Ÿ’ป ๐Ÿ›
kfranic

๐Ÿ›
khalidkh

๐Ÿ› -
koalalam

๐Ÿ› -
krzyk

๐Ÿ› +
koalalam

๐Ÿ› +
krzyk

๐Ÿ›
lasselindqvist

๐Ÿ›
lgemeinhardt

๐Ÿ›
lihuaib

๐Ÿ›
lonelyma1021

๐Ÿ›
lpeddy

๐Ÿ› -
lujiefsi

๐Ÿ’ป -
lukelukes

๐Ÿ’ป +
lujiefsi

๐Ÿ’ป +
lukelukes

๐Ÿ’ป
lyriccoder

๐Ÿ›
marcelmore

๐Ÿ›
matchbox

๐Ÿ›
matthiaskraaz

๐Ÿ›
meandonlyme

๐Ÿ› -
mikesive

๐Ÿ› -
milossesic

๐Ÿ› +
mikesive

๐Ÿ› +
milossesic

๐Ÿ›
mluckam

๐Ÿ’ป
mohan-chinnappan-n

๐Ÿ’ป
mriddell95

๐Ÿ›
mrlzh

๐Ÿ›
msloan

๐Ÿ› -
mucharlaravalika

๐Ÿ› -
mvenneman

๐Ÿ› +
mucharlaravalika

๐Ÿ› +
mvenneman

๐Ÿ›
nareshl119

๐Ÿ›
nicolas-harraudeau-sonarsource

๐Ÿ›
noerremark

๐Ÿ›
novsirion

๐Ÿ›
nwcm

๐Ÿ“– -
oggboy

๐Ÿ› -
oinume

๐Ÿ› +
oggboy

๐Ÿ› +
oinume

๐Ÿ›
orimarko

๐Ÿ’ป ๐Ÿ›
pacvz

๐Ÿ’ป
pallavi agarwal

๐Ÿ›
parksungrin

๐Ÿ›
patpatpat123

๐Ÿ› -
patriksevallius

๐Ÿ› -
pbrajesh1

๐Ÿ› +
patriksevallius

๐Ÿ› +
pbrajesh1

๐Ÿ›
phoenix384

๐Ÿ›
piotrszymanski-sc

๐Ÿ’ป
plan3d

๐Ÿ›
poojasix

๐Ÿ›
prabhushrikant

๐Ÿ› -
pujitha8783

๐Ÿ› -
r-r-a-j

๐Ÿ› +
pujitha8783

๐Ÿ› +
r-r-a-j

๐Ÿ›
raghujayjunk

๐Ÿ›
rajeshveera

๐Ÿ›
rajeswarreddy88

๐Ÿ›
recdevs

๐Ÿ›
reudismam

๐Ÿ’ป ๐Ÿ› -
rijkt

๐Ÿ› -
rillig-tk

๐Ÿ› +
rijkt

๐Ÿ› +
rillig-tk

๐Ÿ›
rmohan20

๐Ÿ’ป ๐Ÿ›
rnveach

๐Ÿ›
rxmicro

๐Ÿ›
ryan-gustafson

๐Ÿ’ป ๐Ÿ›
sabi0

๐Ÿ› -
scais

๐Ÿ› -
sebbASF

๐Ÿ› +
scais

๐Ÿ› +
sebbASF

๐Ÿ›
sergeygorbaty

๐Ÿ’ป
shilko2013

๐Ÿ›
shiomiyan

๐Ÿ“–
simeonKondr

๐Ÿ›
snajberk

๐Ÿ› -
sniperrifle2004

๐Ÿ› -
snuyanzin

๐Ÿ› ๐Ÿ’ป +
sniperrifle2004

๐Ÿ› +
snuyanzin

๐Ÿ› ๐Ÿ’ป
sratz

๐Ÿ›
stonio

๐Ÿ›
sturton

๐Ÿ’ป ๐Ÿ›
sudharmohan

๐Ÿ›
suruchidawar

๐Ÿ› -
svenfinitiv

๐Ÿ› -
tashiscool

๐Ÿ› +
svenfinitiv

๐Ÿ› +
tashiscool

๐Ÿ›
test-git-hook

๐Ÿ›
testation21

๐Ÿ’ป ๐Ÿ›
thanosa

๐Ÿ›
tiandiyixian

๐Ÿ›
tobwoerk

๐Ÿ› -
tprouvot

๐Ÿ› ๐Ÿ’ป -
trentchilders

๐Ÿ› +
tprouvot

๐Ÿ› ๐Ÿ’ป +
trentchilders

๐Ÿ›
triandicAnt

๐Ÿ›
trishul14

๐Ÿ›
tsui

๐Ÿ›
winhkey

๐Ÿ›
witherspore

๐Ÿ› -
wjljack

๐Ÿ› -
wuchiuwong

๐Ÿ› +
wjljack

๐Ÿ› +
wuchiuwong

๐Ÿ›
xingsong

๐Ÿ›
xioayuge

๐Ÿ›
xnYi9wRezm

๐Ÿ’ป ๐Ÿ›
xuanuy

๐Ÿ›
xyf0921

๐Ÿ› -
yalechen-cyw3

๐Ÿ› -
yasuharu-sato

๐Ÿ› +
yalechen-cyw3

๐Ÿ› +
yasuharu-sato

๐Ÿ›
zenglian

๐Ÿ›
zgrzyt93

๐Ÿ’ป ๐Ÿ›
zh3ng

๐Ÿ›
zt_soft

๐Ÿ›
ztt79

๐Ÿ› -
zzzzfeng

๐Ÿ› -
รrpรกd Magosรกnyi

๐Ÿ› +
zzzzfeng

๐Ÿ› +
รrpรกd Magosรกnyi

๐Ÿ›
ไปป่ดตๆฐ

๐Ÿ›
่Œ…ๅปถๅฎ‰

๐Ÿ’ป diff --git a/docs/pages/release_notes.md b/docs/pages/release_notes.md index 343bfe23ea..f4270a1420 100644 --- a/docs/pages/release_notes.md +++ b/docs/pages/release_notes.md @@ -60,6 +60,8 @@ The remaining section describes the complete release notes for 7.0.0. * [#4521](https://github.com/pmd/pmd/issues/4521): \[doc] Website is not mobile friendly * apex-design * [#4596](https://github.com/pmd/pmd/issues/4596): \[apex] ExcessivePublicCount ignores properties +* apex-security + * [#4646](https://github.com/pmd/pmd/issues/4646): \[apex] ApexSOQLInjection does not recognise SObjectType or SObjectField as safe variable types * java * [#4401](https://github.com/pmd/pmd/issues/4401): \[java] PMD 7 fails to build under Java 19 * java-bestpractices @@ -228,6 +230,7 @@ The following classes have been removed: #### External Contributions * [#4528](https://github.com/pmd/pmd/pull/4528): \[apex] Update to apexlink - [Kevin Jones](https://github.com/nawforce) (@nawforce) * [#4637](https://github.com/pmd/pmd/pull/4637): \[java] fix #4634 - JUnit4TestShouldUseTestAnnotation false positive with TestNG - [Krystian Dabrowski](https://github.com/krdabrowski) (@krdabrowski) +* [#4649](https://github.com/pmd/pmd/pull/4649): \[apex] Add SObjectType and SObjectField to list of injectable SOQL variable types - [Richard Corfield](https://github.com/rcorfieldffdc) (@rcorfieldffdc) * [#4651](https://github.com/pmd/pmd/pull/4651): \[doc] Add "Tencent Cloud Code Analysis" in Tools / Integrations - [yale](https://github.com/cyw3) (@cyw3) * [#4664](https://github.com/pmd/pmd/pull/4664): \[cli] CPD: Fix NPE when only `--file-list` is specified - [Wener](https://github.com/wener-tiobe) (@wener-tiobe) * [#4665](https://github.com/pmd/pmd/pull/4665): \[java] Doc: Fix references AutoClosable -> AutoCloseable - [Andrey Bozhko](https://github.com/AndreyBozhko) (@AndreyBozhko) @@ -609,6 +612,8 @@ Language specific fixes: * [#2667](https://github.com/pmd/pmd/issues/2667): \[apex] Integrate nawforce/ApexLink to build robust Unused rule * [#4509](https://github.com/pmd/pmd/issues/4509): \[apex] ExcessivePublicCount doesn't consider inner classes correctly * [#4596](https://github.com/pmd/pmd/issues/4596): \[apex] ExcessivePublicCount ignores properties +* apex-security + * [#4646](https://github.com/pmd/pmd/issues/4646): \[apex] ApexSOQLInjection does not recognise SObjectType or SObjectField as safe variable types * java * [#520](https://github.com/pmd/pmd/issues/520): \[java] Allow `@SuppressWarnings` with constants instead of literals * [#864](https://github.com/pmd/pmd/issues/864): \[java] Similar/duplicated implementations for determining FQCN @@ -815,6 +820,7 @@ Language specific fixes: * [#4542](https://github.com/pmd/pmd/pull/4542): \[java] Fix #4510: A false positive about ConstructorCallsOverridableMethod and @Value - [AnnaDev](https://github.com/LynnBroe) (@LynnBroe) * [#4553](https://github.com/pmd/pmd/pull/4553): \[java] Fix #4492: GuardLogStatement gives false positive when argument is a Java method reference - [Anastasiia Koba](https://github.com/anastasiia-koba) (@anastasiia-koba) * [#4637](https://github.com/pmd/pmd/pull/4637): \[java] fix #4634 - JUnit4TestShouldUseTestAnnotation false positive with TestNG - [Krystian Dabrowski](https://github.com/krdabrowski) (@krdabrowski) +* [#4649](https://github.com/pmd/pmd/pull/4649): \[apex] Add SObjectType and SObjectField to list of injectable SOQL variable types - [Richard Corfield](https://github.com/rcorfieldffdc) (@rcorfieldffdc) * [#4651](https://github.com/pmd/pmd/pull/4651): \[doc] Add "Tencent Cloud Code Analysis" in Tools / Integrations - [yale](https://github.com/cyw3) (@cyw3) * [#4664](https://github.com/pmd/pmd/pull/4664): \[cli] CPD: Fix NPE when only `--file-list` is specified - [Wener](https://github.com/wener-tiobe) (@wener-tiobe) * [#4665](https://github.com/pmd/pmd/pull/4665): \[java] Doc: Fix references AutoClosable -> AutoCloseable - [Andrey Bozhko](https://github.com/AndreyBozhko) (@AndreyBozhko) diff --git a/pmd-apex/src/main/java/net/sourceforge/pmd/lang/apex/rule/security/ApexSOQLInjectionRule.java b/pmd-apex/src/main/java/net/sourceforge/pmd/lang/apex/rule/security/ApexSOQLInjectionRule.java index df4d0fa59a..2309ed0423 100644 --- a/pmd-apex/src/main/java/net/sourceforge/pmd/lang/apex/rule/security/ApexSOQLInjectionRule.java +++ b/pmd-apex/src/main/java/net/sourceforge/pmd/lang/apex/rule/security/ApexSOQLInjectionRule.java @@ -4,6 +4,7 @@ package net.sourceforge.pmd.lang.apex.rule.security; +import java.util.Collections; import java.util.HashMap; import java.util.HashSet; import java.util.List; @@ -11,6 +12,8 @@ import java.util.Locale; import java.util.Map; import java.util.Set; import java.util.regex.Pattern; +import java.util.stream.Collectors; +import java.util.stream.Stream; import net.sourceforge.pmd.lang.apex.ast.ASTAssignmentExpression; import net.sourceforge.pmd.lang.apex.ast.ASTBinaryExpression; @@ -35,12 +38,12 @@ import net.sourceforge.pmd.lang.apex.rule.internal.Helper; * */ public class ApexSOQLInjectionRule extends AbstractApexRule { - private static final String DOUBLE = "double"; - private static final String LONG = "long"; - private static final String DECIMAL = "decimal"; - private static final String BOOLEAN = "boolean"; - private static final String ID = "id"; - private static final String INTEGER = "integer"; + private static final Set SAFE_VARIABLE_TYPES = + Collections.unmodifiableSet(Stream.of( + "double", "long", "decimal", "boolean", "id", "integer", + "sobjecttype", "schema.sobjecttype", "sobjectfield", "schema.sobjectfield" + ).collect(Collectors.toSet())); + private static final String JOIN = "join"; private static final String ESCAPE_SINGLE_QUOTES = "escapeSingleQuotes"; private static final String STRING = "String"; @@ -108,23 +111,16 @@ public class ApexSOQLInjectionRule extends AbstractApexRule { return Helper.isMethodName(m, DATABASE, QUERY) || Helper.isMethodName(m, DATABASE, COUNT_QUERY); } + private boolean isSafeVariableType(String typeName) { + return SAFE_VARIABLE_TYPES.contains(typeName.toLowerCase(Locale.ROOT)); + } + private void findSafeVariablesInSignature(ASTMethod m) { for (ASTParameter p : m.findChildrenOfType(ASTParameter.class)) { - switch (p.getType().toLowerCase(Locale.ROOT)) { - case ID: - case INTEGER: - case BOOLEAN: - case DECIMAL: - case LONG: - case DOUBLE: + if (isSafeVariableType(p.getType())) { safeVariables.add(Helper.getFQVariableName(p)); - break; - default: - break; } - } - } private void findSanitizedVariables(ApexNode node) { @@ -159,17 +155,8 @@ public class ApexSOQLInjectionRule extends AbstractApexRule { } if (node instanceof ASTVariableDeclaration) { - switch (((ASTVariableDeclaration) node).getType().toLowerCase(Locale.ROOT)) { - case INTEGER: - case ID: - case BOOLEAN: - case DECIMAL: - case LONG: - case DOUBLE: + if (isSafeVariableType(((ASTVariableDeclaration) node).getType())) { safeVariables.add(Helper.getFQVariableName(left)); - break; - default: - break; } } } diff --git a/pmd-apex/src/test/resources/net/sourceforge/pmd/lang/apex/rule/security/xml/ApexSOQLInjection.xml b/pmd-apex/src/test/resources/net/sourceforge/pmd/lang/apex/rule/security/xml/ApexSOQLInjection.xml index 966f46c48f..1b1055f776 100644 --- a/pmd-apex/src/test/resources/net/sourceforge/pmd/lang/apex/rule/security/xml/ApexSOQLInjection.xml +++ b/pmd-apex/src/test/resources/net/sourceforge/pmd/lang/apex/rule/security/xml/ApexSOQLInjection.xml @@ -62,6 +62,62 @@ public class Foo { ]]> + + SObjectType and Field as parameters are safe to use in SOQL query string building #4646 + 0 + + + + + SObjectType and Field as variables are safe to use in SOQL query string building #4646 + 0 + + + + + Schema.SObjectType and Field as parameters are safe to use in SOQL query string building #4646 + 0 + + + + + Schema.SObjectType and Field as variables are safe to use in SOQL query string building #4646 + 0 + + + Safe SOQL + merged variable from a literal 0