diff --git a/.all-contributorsrc b/.all-contributorsrc
index 6c00093cb9..04b834beb0 100644
--- a/.all-contributorsrc
+++ b/.all-contributorsrc
@@ -7212,6 +7212,25 @@
"contributions": [
"doc"
]
+ },
+ {
+ "login": "rcorfieldffdc",
+ "name": "Richard Corfield",
+ "avatar_url": "https://avatars.githubusercontent.com/u/42997936?v=4",
+ "profile": "https://github.com/rcorfieldffdc",
+ "contributions": [
+ "code"
+ ]
+ },
+ {
+ "login": "m0rjc",
+ "name": "Richard Corfield",
+ "avatar_url": "https://avatars.githubusercontent.com/u/994206?v=4",
+ "profile": "https://github.com/m0rjc",
+ "contributions": [
+ "bug",
+ "code"
+ ]
}
],
"contributorsPerLine": 7,
diff --git a/docs/pages/pmd/projectdocs/credits.md b/docs/pages/pmd/projectdocs/credits.md
index 8893c3c41c..8c79407044 100644
--- a/docs/pages/pmd/projectdocs/credits.md
+++ b/docs/pages/pmd/projectdocs/credits.md
@@ -621,407 +621,409 @@ Thanks goes to these wonderful people ([emoji key](https://allcontributors.org/d
Reda Benhemmouche ๐ |
Renato Oliveira ๐ป ๐ |
Rich DiCroce ๐ |
+ Richard Corfield ๐ป |
+ Richard Corfield ๐ ๐ป |
Riot R1cket ๐ |
- Rishabh Jain ๐ |
- RishabhDeep Singh ๐ |
+ Rishabh Jain ๐ |
+ RishabhDeep Singh ๐ |
Robbie Martinus ๐ป ๐ |
Robert Henry ๐ |
Robert Mihaly ๐ |
Robert Painsi ๐ |
Robert Russell ๐ |
- Robert Sรถsemann ๐ป ๐ ๐ข ๐ |
- Robert Whitebit ๐ |
+ Robert Sรถsemann ๐ป ๐ ๐ข ๐ |
+ Robert Whitebit ๐ |
Robin Richtsfeld ๐ |
Robin Stocker ๐ป ๐ |
Robin Wils ๐ |
RochusOest ๐ |
Rodolfo Noviski ๐ |
- Rodrigo Casara ๐ |
- Rodrigo Fernandes ๐ |
+ Rodrigo Casara ๐ |
+ Rodrigo Fernandes ๐ |
Roman Salvador ๐ป ๐ |
Ronald Blaschke ๐ |
Rรณbert Papp ๐ |
Saikat Sengupta ๐ |
Saksham Handu ๐ |
- Saladoc ๐ |
- Salesforce Bob Lightning ๐ |
+ Saladoc ๐ |
+ Salesforce Bob Lightning ๐ |
Sam Carlberg ๐ |
Satoshi Kubo ๐ |
Scott Kennedy ๐ |
Scott Wells ๐ ๐ป |
Scrsloota ๐ป |
- Sebastian Bรถgl ๐ |
- Sebastian Schuberth ๐ |
+ Sebastian Bรถgl ๐ |
+ Sebastian Schuberth ๐ |
Sebastian Schwarz ๐ |
Seren ๐ ๐ป |
Sergey Gorbaty ๐ |
Sergey Kozlov ๐ |
Sergey Yanzin ๐ป ๐ |
- Seth Wilcox ๐ป |
- Shubham ๐ป ๐ |
+ Seth Wilcox ๐ป |
+ Shubham ๐ป ๐ |
Simon Abykov ๐ป ๐ |
Simon Xiao ๐ |
Srinivasan Venkatachalam ๐ |
Stanislav Gromov ๐ |
Stanislav Myachenkov ๐ป |
- Stefan Birkner ๐ |
- Stefan Bohn ๐ |
+ Stefan Birkner ๐ |
+ Stefan Bohn ๐ |
Stefan Endrullis ๐ |
Stefan Klรถss-Schuster ๐ |
Stefan Wolf ๐ |
Stephan H. Wissel ๐ |
Stephen ๐ |
- Stephen Friedrich ๐ |
- Steve Babula ๐ป |
+ Stephen Friedrich ๐ |
+ Steve Babula ๐ป |
Steven Stearns ๐ ๐ป |
Stexxe ๐ |
Stian Lรฅgstad ๐ |
StuartClayton5 ๐ |
Supun Arunoda ๐ |
- Suren Abrahamyan ๐ |
- Suvashri ๐ |
+ Suren Abrahamyan ๐ |
+ Suvashri ๐ |
SwatiBGupta1110 ๐ |
SyedThoufich ๐ |
Szymon Sasin ๐ |
T-chuangxin ๐ |
TERAI Atsuhiro ๐ |
- TIOBE Software ๐ป ๐ |
- Tarush Singh ๐ป |
+ TIOBE Software ๐ป ๐ |
+ Tarush Singh ๐ป |
Taylor Smock ๐ |
Techeira Damiรกn ๐ป ๐ |
Ted Husted ๐ |
TehBakker ๐ |
The Gitter Badger ๐ |
- Theodoor ๐ |
- Thiago Henrique Hรผpner ๐ |
+ Theodoor ๐ |
+ Thiago Henrique Hรผpner ๐ |
Thibault Meyer ๐ |
Thomas Gรผttler ๐ |
Thomas Jones-Low ๐ |
Thomas Smith ๐ป ๐ |
ThrawnCA ๐ |
- Thunderforge ๐ป ๐ |
- Tim van der Lippe ๐ |
+ Thunderforge ๐ป ๐ |
+ Tim van der Lippe ๐ |
Tobias Weimer ๐ป ๐ |
Tom Copeland ๐ ๐ป ๐ |
Tom Daly ๐ |
Tomer Figenblat ๐ |
Tomi De Lucca ๐ป ๐ |
- Torsten Kleiber ๐ |
- TrackerSB ๐ |
+ Torsten Kleiber ๐ |
+ TrackerSB ๐ |
Tyson Stewart ๐ |
Ullrich Hafner ๐ |
Utku Cuhadaroglu ๐ป ๐ |
Valentin Brandl ๐ |
Valeria ๐ |
- Valery Yatsynovich ๐ |
- Vasily Anisimov ๐ |
+ Valery Yatsynovich ๐ |
+ Vasily Anisimov ๐ |
Vibhor Goyal ๐ |
Vickenty Fesunov ๐ |
Victor Noรซl ๐ |
Vincent Galloy ๐ป |
Vincent HUYNH ๐ |
- Vincent Maurin ๐ |
- Vincent Privat ๐ |
+ Vincent Maurin ๐ |
+ Vincent Privat ๐ |
Vishhwas ๐ |
Vitaly ๐ |
Vitaly Polonetsky ๐ |
Vojtech Polivka ๐ |
Vsevolod Zholobov ๐ |
- Vyom Yadav ๐ป |
- Wang Shidong ๐ |
+ Vyom Yadav ๐ป |
+ Wang Shidong ๐ |
Waqas Ahmed ๐ |
Wayne J. Earl ๐ |
Wchenghui ๐ |
Wener ๐ป |
Will Winder ๐ |
- William Brockhus ๐ป ๐ |
- Wilson Kurniawan ๐ |
+ William Brockhus ๐ป ๐ |
+ Wilson Kurniawan ๐ |
Wim Deblauwe ๐ |
Woongsik Choi ๐ |
XenoAmess ๐ป ๐ |
Yang ๐ป |
YaroslavTER ๐ |
- Yasar Shaikh ๐ป |
- Young Chan ๐ป ๐ |
+ Yasar Shaikh ๐ป |
+ Young Chan ๐ป ๐ |
YuJin Kim ๐ |
Yuri Dolzhenko ๐ |
Yurii Dubinka ๐ |
Zoltan Farkas ๐ |
Zustin ๐ |
- aaronhurst-google ๐ ๐ป |
- alexmodis ๐ |
+ aaronhurst-google ๐ ๐ป |
+ alexmodis ๐ |
andreoss ๐ |
andrey81inmd ๐ป ๐ |
anicoara ๐ |
arunprasathav ๐ |
asiercamara ๐ |
- astillich-igniti ๐ป |
- avesolovksyy ๐ |
+ astillich-igniti ๐ป |
+ avesolovksyy ๐ |
avishvat ๐ |
avivmu ๐ |
axelbarfod1 ๐ |
b-3-n ๐ |
balbhadra9 ๐ |
- base23de ๐ |
- bergander ๐ |
+ base23de ๐ |
+ bergander ๐ |
berkam ๐ป ๐ |
breizh31 ๐ |
caesarkim ๐ |
carolyujing ๐ |
cbfiddle ๐ |
- cesares-basilico ๐ |
- chrite ๐ |
+ cesares-basilico ๐ |
+ chrite ๐ |
cobratbq ๐ |
coladict ๐ |
cosmoJFH ๐ |
cristalp ๐ |
crunsk ๐ |
- cwholmes ๐ |
- cyberjj999 ๐ |
+ cwholmes ๐ |
+ cyberjj999 ๐ |
cyw3 ๐ ๐ |
d1ss0nanz ๐ |
dague1 ๐ |
dalizi007 ๐ป |
danbrycefairsailcom ๐ |
- dariansanity ๐ |
- darrenmiliband ๐ |
+ dariansanity ๐ |
+ darrenmiliband ๐ |
davidburstrom ๐ |
dbirkman-paloalto ๐ |
deepak-patra ๐ |
dependabot[bot] ๐ป ๐ |
dinesh150 ๐ |
- diziaq ๐ |
- dreaminpast123 ๐ |
+ diziaq ๐ |
+ dreaminpast123 ๐ |
duanyanan ๐ |
dutt-sanjay ๐ |
dylanleung ๐ |
dzeigler ๐ |
ekkirala ๐ |
- emersonmoura ๐ |
- fairy ๐ |
+ emersonmoura ๐ |
+ fairy ๐ |
filiprafalowicz ๐ป |
foxmason ๐ |
frankegabor ๐ |
frankl ๐ |
freafrea ๐ |
- fsapatin ๐ |
- gracia19 ๐ |
+ fsapatin ๐ |
+ gracia19 ๐ |
guo fei ๐ |
gurmsc5 ๐ |
gwilymatgearset ๐ป ๐ |
haigsn ๐ |
hemanshu070 ๐ |
- henrik242 ๐ |
- hongpuwu ๐ |
+ henrik242 ๐ |
+ hongpuwu ๐ |
hvbtup ๐ป ๐ |
igniti GmbH ๐ |
ilovezfs ๐ |
itaigilo ๐ |
jakivey32 ๐ |
- jbennett2091 ๐ |
- jcamerin ๐ |
+ jbennett2091 ๐ |
+ jcamerin ๐ |
jkeener1 ๐ |
jmetertea ๐ |
johnra2 ๐ป |
josemanuelrolon ๐ป ๐ |
kabroxiko ๐ป ๐ |
- karwer ๐ |
- kaulonline ๐ |
+ karwer ๐ |
+ kaulonline ๐ |
kdaemonv ๐ |
kdebski85 ๐ ๐ป |
kenji21 ๐ป ๐ |
kfranic ๐ |
khalidkh ๐ |
- koalalam ๐ |
- krzyk ๐ |
+ koalalam ๐ |
+ krzyk ๐ |
lasselindqvist ๐ |
lgemeinhardt ๐ |
lihuaib ๐ |
lonelyma1021 ๐ |
lpeddy ๐ |
- lujiefsi ๐ป |
- lukelukes ๐ป |
+ lujiefsi ๐ป |
+ lukelukes ๐ป |
lyriccoder ๐ |
marcelmore ๐ |
matchbox ๐ |
matthiaskraaz ๐ |
meandonlyme ๐ |
- mikesive ๐ |
- milossesic ๐ |
+ mikesive ๐ |
+ milossesic ๐ |
mluckam ๐ป |
mohan-chinnappan-n ๐ป |
mriddell95 ๐ |
mrlzh ๐ |
msloan ๐ |
- mucharlaravalika ๐ |
- mvenneman ๐ |
+ mucharlaravalika ๐ |
+ mvenneman ๐ |
nareshl119 ๐ |
nicolas-harraudeau-sonarsource ๐ |
noerremark ๐ |
novsirion ๐ |
nwcm ๐ |
- oggboy ๐ |
- oinume ๐ |
+ oggboy ๐ |
+ oinume ๐ |
orimarko ๐ป ๐ |
pacvz ๐ป |
pallavi agarwal ๐ |
parksungrin ๐ |
patpatpat123 ๐ |
- patriksevallius ๐ |
- pbrajesh1 ๐ |
+ patriksevallius ๐ |
+ pbrajesh1 ๐ |
phoenix384 ๐ |
piotrszymanski-sc ๐ป |
plan3d ๐ |
poojasix ๐ |
prabhushrikant ๐ |
- pujitha8783 ๐ |
- r-r-a-j ๐ |
+ pujitha8783 ๐ |
+ r-r-a-j ๐ |
raghujayjunk ๐ |
rajeshveera ๐ |
rajeswarreddy88 ๐ |
recdevs ๐ |
reudismam ๐ป ๐ |
- rijkt ๐ |
- rillig-tk ๐ |
+ rijkt ๐ |
+ rillig-tk ๐ |
rmohan20 ๐ป ๐ |
rnveach ๐ |
rxmicro ๐ |
ryan-gustafson ๐ป ๐ |
sabi0 ๐ |
- scais ๐ |
- sebbASF ๐ |
+ scais ๐ |
+ sebbASF ๐ |
sergeygorbaty ๐ป |
shilko2013 ๐ |
shiomiyan ๐ |
simeonKondr ๐ |
snajberk ๐ |
- sniperrifle2004 ๐ |
- snuyanzin ๐ ๐ป |
+ sniperrifle2004 ๐ |
+ snuyanzin ๐ ๐ป |
sratz ๐ |
stonio ๐ |
sturton ๐ป ๐ |
sudharmohan ๐ |
suruchidawar ๐ |
- svenfinitiv ๐ |
- tashiscool ๐ |
+ svenfinitiv ๐ |
+ tashiscool ๐ |
test-git-hook ๐ |
testation21 ๐ป ๐ |
thanosa ๐ |
tiandiyixian ๐ |
tobwoerk ๐ |
- tprouvot ๐ ๐ป |
- trentchilders ๐ |
+ tprouvot ๐ ๐ป |
+ trentchilders ๐ |
triandicAnt ๐ |
trishul14 ๐ |
tsui ๐ |
winhkey ๐ |
witherspore ๐ |
- wjljack ๐ |
- wuchiuwong ๐ |
+ wjljack ๐ |
+ wuchiuwong ๐ |
xingsong ๐ |
xioayuge ๐ |
xnYi9wRezm ๐ป ๐ |
xuanuy ๐ |
xyf0921 ๐ |
- yalechen-cyw3 ๐ |
- yasuharu-sato ๐ |
+ yalechen-cyw3 ๐ |
+ yasuharu-sato ๐ |
zenglian ๐ |
zgrzyt93 ๐ป ๐ |
zh3ng ๐ |
zt_soft ๐ |
ztt79 ๐ |
- zzzzfeng ๐ |
- รrpรกd Magosรกnyi ๐ |
+ zzzzfeng ๐ |
+ รrpรกd Magosรกnyi ๐ |
ไปป่ดตๆฐ ๐ |
่
ๅปถๅฎ ๐ป |
diff --git a/docs/pages/release_notes.md b/docs/pages/release_notes.md
index 343bfe23ea..f4270a1420 100644
--- a/docs/pages/release_notes.md
+++ b/docs/pages/release_notes.md
@@ -60,6 +60,8 @@ The remaining section describes the complete release notes for 7.0.0.
* [#4521](https://github.com/pmd/pmd/issues/4521): \[doc] Website is not mobile friendly
* apex-design
* [#4596](https://github.com/pmd/pmd/issues/4596): \[apex] ExcessivePublicCount ignores properties
+* apex-security
+ * [#4646](https://github.com/pmd/pmd/issues/4646): \[apex] ApexSOQLInjection does not recognise SObjectType or SObjectField as safe variable types
* java
* [#4401](https://github.com/pmd/pmd/issues/4401): \[java] PMD 7 fails to build under Java 19
* java-bestpractices
@@ -228,6 +230,7 @@ The following classes have been removed:
#### External Contributions
* [#4528](https://github.com/pmd/pmd/pull/4528): \[apex] Update to apexlink - [Kevin Jones](https://github.com/nawforce) (@nawforce)
* [#4637](https://github.com/pmd/pmd/pull/4637): \[java] fix #4634 - JUnit4TestShouldUseTestAnnotation false positive with TestNG - [Krystian Dabrowski](https://github.com/krdabrowski) (@krdabrowski)
+* [#4649](https://github.com/pmd/pmd/pull/4649): \[apex] Add SObjectType and SObjectField to list of injectable SOQL variable types - [Richard Corfield](https://github.com/rcorfieldffdc) (@rcorfieldffdc)
* [#4651](https://github.com/pmd/pmd/pull/4651): \[doc] Add "Tencent Cloud Code Analysis" in Tools / Integrations - [yale](https://github.com/cyw3) (@cyw3)
* [#4664](https://github.com/pmd/pmd/pull/4664): \[cli] CPD: Fix NPE when only `--file-list` is specified - [Wener](https://github.com/wener-tiobe) (@wener-tiobe)
* [#4665](https://github.com/pmd/pmd/pull/4665): \[java] Doc: Fix references AutoClosable -> AutoCloseable - [Andrey Bozhko](https://github.com/AndreyBozhko) (@AndreyBozhko)
@@ -609,6 +612,8 @@ Language specific fixes:
* [#2667](https://github.com/pmd/pmd/issues/2667): \[apex] Integrate nawforce/ApexLink to build robust Unused rule
* [#4509](https://github.com/pmd/pmd/issues/4509): \[apex] ExcessivePublicCount doesn't consider inner classes correctly
* [#4596](https://github.com/pmd/pmd/issues/4596): \[apex] ExcessivePublicCount ignores properties
+* apex-security
+ * [#4646](https://github.com/pmd/pmd/issues/4646): \[apex] ApexSOQLInjection does not recognise SObjectType or SObjectField as safe variable types
* java
* [#520](https://github.com/pmd/pmd/issues/520): \[java] Allow `@SuppressWarnings` with constants instead of literals
* [#864](https://github.com/pmd/pmd/issues/864): \[java] Similar/duplicated implementations for determining FQCN
@@ -815,6 +820,7 @@ Language specific fixes:
* [#4542](https://github.com/pmd/pmd/pull/4542): \[java] Fix #4510: A false positive about ConstructorCallsOverridableMethod and @Value - [AnnaDev](https://github.com/LynnBroe) (@LynnBroe)
* [#4553](https://github.com/pmd/pmd/pull/4553): \[java] Fix #4492: GuardLogStatement gives false positive when argument is a Java method reference - [Anastasiia Koba](https://github.com/anastasiia-koba) (@anastasiia-koba)
* [#4637](https://github.com/pmd/pmd/pull/4637): \[java] fix #4634 - JUnit4TestShouldUseTestAnnotation false positive with TestNG - [Krystian Dabrowski](https://github.com/krdabrowski) (@krdabrowski)
+* [#4649](https://github.com/pmd/pmd/pull/4649): \[apex] Add SObjectType and SObjectField to list of injectable SOQL variable types - [Richard Corfield](https://github.com/rcorfieldffdc) (@rcorfieldffdc)
* [#4651](https://github.com/pmd/pmd/pull/4651): \[doc] Add "Tencent Cloud Code Analysis" in Tools / Integrations - [yale](https://github.com/cyw3) (@cyw3)
* [#4664](https://github.com/pmd/pmd/pull/4664): \[cli] CPD: Fix NPE when only `--file-list` is specified - [Wener](https://github.com/wener-tiobe) (@wener-tiobe)
* [#4665](https://github.com/pmd/pmd/pull/4665): \[java] Doc: Fix references AutoClosable -> AutoCloseable - [Andrey Bozhko](https://github.com/AndreyBozhko) (@AndreyBozhko)
diff --git a/pmd-apex/src/main/java/net/sourceforge/pmd/lang/apex/rule/security/ApexSOQLInjectionRule.java b/pmd-apex/src/main/java/net/sourceforge/pmd/lang/apex/rule/security/ApexSOQLInjectionRule.java
index df4d0fa59a..2309ed0423 100644
--- a/pmd-apex/src/main/java/net/sourceforge/pmd/lang/apex/rule/security/ApexSOQLInjectionRule.java
+++ b/pmd-apex/src/main/java/net/sourceforge/pmd/lang/apex/rule/security/ApexSOQLInjectionRule.java
@@ -4,6 +4,7 @@
package net.sourceforge.pmd.lang.apex.rule.security;
+import java.util.Collections;
import java.util.HashMap;
import java.util.HashSet;
import java.util.List;
@@ -11,6 +12,8 @@ import java.util.Locale;
import java.util.Map;
import java.util.Set;
import java.util.regex.Pattern;
+import java.util.stream.Collectors;
+import java.util.stream.Stream;
import net.sourceforge.pmd.lang.apex.ast.ASTAssignmentExpression;
import net.sourceforge.pmd.lang.apex.ast.ASTBinaryExpression;
@@ -35,12 +38,12 @@ import net.sourceforge.pmd.lang.apex.rule.internal.Helper;
*
*/
public class ApexSOQLInjectionRule extends AbstractApexRule {
- private static final String DOUBLE = "double";
- private static final String LONG = "long";
- private static final String DECIMAL = "decimal";
- private static final String BOOLEAN = "boolean";
- private static final String ID = "id";
- private static final String INTEGER = "integer";
+ private static final Set SAFE_VARIABLE_TYPES =
+ Collections.unmodifiableSet(Stream.of(
+ "double", "long", "decimal", "boolean", "id", "integer",
+ "sobjecttype", "schema.sobjecttype", "sobjectfield", "schema.sobjectfield"
+ ).collect(Collectors.toSet()));
+
private static final String JOIN = "join";
private static final String ESCAPE_SINGLE_QUOTES = "escapeSingleQuotes";
private static final String STRING = "String";
@@ -108,23 +111,16 @@ public class ApexSOQLInjectionRule extends AbstractApexRule {
return Helper.isMethodName(m, DATABASE, QUERY) || Helper.isMethodName(m, DATABASE, COUNT_QUERY);
}
+ private boolean isSafeVariableType(String typeName) {
+ return SAFE_VARIABLE_TYPES.contains(typeName.toLowerCase(Locale.ROOT));
+ }
+
private void findSafeVariablesInSignature(ASTMethod m) {
for (ASTParameter p : m.findChildrenOfType(ASTParameter.class)) {
- switch (p.getType().toLowerCase(Locale.ROOT)) {
- case ID:
- case INTEGER:
- case BOOLEAN:
- case DECIMAL:
- case LONG:
- case DOUBLE:
+ if (isSafeVariableType(p.getType())) {
safeVariables.add(Helper.getFQVariableName(p));
- break;
- default:
- break;
}
-
}
-
}
private void findSanitizedVariables(ApexNode> node) {
@@ -159,17 +155,8 @@ public class ApexSOQLInjectionRule extends AbstractApexRule {
}
if (node instanceof ASTVariableDeclaration) {
- switch (((ASTVariableDeclaration) node).getType().toLowerCase(Locale.ROOT)) {
- case INTEGER:
- case ID:
- case BOOLEAN:
- case DECIMAL:
- case LONG:
- case DOUBLE:
+ if (isSafeVariableType(((ASTVariableDeclaration) node).getType())) {
safeVariables.add(Helper.getFQVariableName(left));
- break;
- default:
- break;
}
}
}
diff --git a/pmd-apex/src/test/resources/net/sourceforge/pmd/lang/apex/rule/security/xml/ApexSOQLInjection.xml b/pmd-apex/src/test/resources/net/sourceforge/pmd/lang/apex/rule/security/xml/ApexSOQLInjection.xml
index 966f46c48f..1b1055f776 100644
--- a/pmd-apex/src/test/resources/net/sourceforge/pmd/lang/apex/rule/security/xml/ApexSOQLInjection.xml
+++ b/pmd-apex/src/test/resources/net/sourceforge/pmd/lang/apex/rule/security/xml/ApexSOQLInjection.xml
@@ -62,6 +62,62 @@ public class Foo {
]]>
+
+ SObjectType and Field as parameters are safe to use in SOQL query string building #4646
+ 0
+
+
+
+
+ SObjectType and Field as variables are safe to use in SOQL query string building #4646
+ 0
+
+
+
+
+ Schema.SObjectType and Field as parameters are safe to use in SOQL query string building #4646
+ 0
+
+
+
+
+ Schema.SObjectType and Field as variables are safe to use in SOQL query string building #4646
+ 0
+
+
+
Safe SOQL + merged variable from a literal
0