Code style fixes
This commit is contained in:
1 parent
c5579ea4aa
commit
367e285171
8 files changed
+930
-926
No files matched your search
+73
-71
@@ -23,88 +23,90 @@ import net.sourceforge.pmd.lang.apex.rule.AbstractApexRule;
|
||||
*
|
||||
*/
|
||||
public class ApexBadCryptoRule extends AbstractApexRule {
|
||||
private static final String VALUE_OF = "valueOf";
|
||||
private static final String BLOB = "Blob";
|
||||
private static final String ENCRYPT = "encrypt";
|
||||
private static final String DECRYPT = "decrypt";
|
||||
private static final String CRYPTO = "Crypto";
|
||||
private static final String ENCRYPT_WITH_MANAGED_IV = "encryptWithManagedIV";
|
||||
private static final String DECRYPT_WITH_MANAGED_IV = "decryptWithManagedIV";
|
||||
private static final String VALUE_OF = "valueOf";
|
||||
private static final String BLOB = "Blob";
|
||||
private static final String ENCRYPT = "encrypt";
|
||||
private static final String DECRYPT = "decrypt";
|
||||
private static final String CRYPTO = "Crypto";
|
||||
private static final String ENCRYPT_WITH_MANAGED_IV = "encryptWithManagedIV";
|
||||
private static final String DECRYPT_WITH_MANAGED_IV = "decryptWithManagedIV";
|
||||
|
||||
private final Set<String> potentiallyStaticBlob = new HashSet<>();
|
||||
private final Set<String> potentiallyStaticBlob = new HashSet<>();
|
||||
|
||||
public ApexBadCryptoRule() {
|
||||
setProperty(CODECLIMATE_CATEGORIES, new String[] { "Security" });
|
||||
setProperty(CODECLIMATE_REMEDIATION_MULTIPLIER, 100);
|
||||
setProperty(CODECLIMATE_BLOCK_HIGHLIGHTING, false);
|
||||
}
|
||||
public ApexBadCryptoRule() {
|
||||
setProperty(CODECLIMATE_CATEGORIES, new String[] { "Security" });
|
||||
setProperty(CODECLIMATE_REMEDIATION_MULTIPLIER, 100);
|
||||
setProperty(CODECLIMATE_BLOCK_HIGHLIGHTING, false);
|
||||
}
|
||||
|
||||
@Override
|
||||
public Object visit(ASTUserClass node, Object data) {
|
||||
if (Helper.isTestMethodOrClass(node)) {
|
||||
return data;
|
||||
}
|
||||
@Override
|
||||
public Object visit(ASTUserClass node, Object data) {
|
||||
if (Helper.isTestMethodOrClass(node)) {
|
||||
return data;
|
||||
}
|
||||
|
||||
List<ASTFieldDeclaration> fieldDecl = node.findDescendantsOfType(ASTFieldDeclaration.class);
|
||||
for (ASTFieldDeclaration var : fieldDecl) {
|
||||
findSafeVariables(var);
|
||||
}
|
||||
List<ASTFieldDeclaration> fieldDecl = node.findDescendantsOfType(ASTFieldDeclaration.class);
|
||||
for (ASTFieldDeclaration var : fieldDecl) {
|
||||
findSafeVariables(var);
|
||||
}
|
||||
|
||||
List<ASTVariableDeclaration> variableDecl = node.findDescendantsOfType(ASTVariableDeclaration.class);
|
||||
for (ASTVariableDeclaration var : variableDecl) {
|
||||
findSafeVariables(var);
|
||||
}
|
||||
List<ASTVariableDeclaration> variableDecl = node.findDescendantsOfType(ASTVariableDeclaration.class);
|
||||
for (ASTVariableDeclaration var : variableDecl) {
|
||||
findSafeVariables(var);
|
||||
}
|
||||
|
||||
List<ASTMethodCallExpression> methodCalls = node.findDescendantsOfType(ASTMethodCallExpression.class);
|
||||
for (ASTMethodCallExpression methodCall : methodCalls) {
|
||||
if (Helper.isMethodName(methodCall, CRYPTO, ENCRYPT) || Helper.isMethodName(methodCall, CRYPTO, DECRYPT)
|
||||
|| Helper.isMethodName(methodCall, CRYPTO, ENCRYPT_WITH_MANAGED_IV)
|
||||
|| Helper.isMethodName(methodCall, CRYPTO, DECRYPT_WITH_MANAGED_IV)) {
|
||||
List<ASTMethodCallExpression> methodCalls = node.findDescendantsOfType(ASTMethodCallExpression.class);
|
||||
for (ASTMethodCallExpression methodCall : methodCalls) {
|
||||
if (Helper.isMethodName(methodCall, CRYPTO, ENCRYPT) || Helper.isMethodName(methodCall, CRYPTO, DECRYPT)
|
||||
|| Helper.isMethodName(methodCall, CRYPTO, ENCRYPT_WITH_MANAGED_IV)
|
||||
|| Helper.isMethodName(methodCall, CRYPTO, DECRYPT_WITH_MANAGED_IV)) {
|
||||
|
||||
validateStaticIVorKey(methodCall, data);
|
||||
}
|
||||
}
|
||||
return data;
|
||||
}
|
||||
validateStaticIVorKey(methodCall, data);
|
||||
}
|
||||
}
|
||||
return data;
|
||||
}
|
||||
|
||||
private void findSafeVariables(AbstractApexNode<?> var) {
|
||||
ASTMethodCallExpression methodCall = var.getFirstChildOfType(ASTMethodCallExpression.class);
|
||||
if (methodCall != null && Helper.isMethodName(methodCall, BLOB, VALUE_OF)) {
|
||||
ASTVariableExpression variable = var.getFirstChildOfType(ASTVariableExpression.class);
|
||||
if (variable != null) {
|
||||
potentiallyStaticBlob.add(Helper.getFQVariableName(variable));
|
||||
}
|
||||
}
|
||||
}
|
||||
private void findSafeVariables(AbstractApexNode<?> var) {
|
||||
ASTMethodCallExpression methodCall = var.getFirstChildOfType(ASTMethodCallExpression.class);
|
||||
if (methodCall != null && Helper.isMethodName(methodCall, BLOB, VALUE_OF)) {
|
||||
ASTVariableExpression variable = var.getFirstChildOfType(ASTVariableExpression.class);
|
||||
if (variable != null) {
|
||||
potentiallyStaticBlob.add(Helper.getFQVariableName(variable));
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
private void validateStaticIVorKey(ASTMethodCallExpression methodCall, Object data) {
|
||||
// .encrypt('AES128', key, exampleIv, data);
|
||||
int numberOfChildren = methodCall.jjtGetNumChildren();
|
||||
switch (numberOfChildren) {
|
||||
// matching signature to encrypt(
|
||||
case 5:
|
||||
Object potentialIV = methodCall.jjtGetChild(3);
|
||||
reportIfHardCoded(data, potentialIV);
|
||||
// no break on purpose
|
||||
private void validateStaticIVorKey(ASTMethodCallExpression methodCall, Object data) {
|
||||
// .encrypt('AES128', key, exampleIv, data);
|
||||
int numberOfChildren = methodCall.jjtGetNumChildren();
|
||||
switch (numberOfChildren) {
|
||||
// matching signature to encrypt(
|
||||
case 5:
|
||||
Object potentialIV = methodCall.jjtGetChild(3);
|
||||
reportIfHardCoded(data, potentialIV);
|
||||
Object potentialKey = methodCall.jjtGetChild(2);
|
||||
reportIfHardCoded(data, potentialKey);
|
||||
break;
|
||||
|
||||
// matching signature to encryptWithManagedIV(
|
||||
case 4:
|
||||
Object potentialKey = methodCall.jjtGetChild(2);
|
||||
reportIfHardCoded(data, potentialKey);
|
||||
break;
|
||||
// matching signature to encryptWithManagedIV(
|
||||
case 4:
|
||||
Object key = methodCall.jjtGetChild(2);
|
||||
reportIfHardCoded(data, key);
|
||||
break;
|
||||
|
||||
default:
|
||||
break;
|
||||
}
|
||||
default:
|
||||
break;
|
||||
}
|
||||
|
||||
}
|
||||
}
|
||||
|
||||
private void reportIfHardCoded(Object data, Object potentialIV) {
|
||||
if (potentialIV instanceof ASTVariableExpression) {
|
||||
ASTVariableExpression variable = (ASTVariableExpression) potentialIV;
|
||||
if (potentiallyStaticBlob.contains(Helper.getFQVariableName(variable))) {
|
||||
addViolation(data, variable);
|
||||
}
|
||||
}
|
||||
}
|
||||
private void reportIfHardCoded(Object data, Object potentialIV) {
|
||||
if (potentialIV instanceof ASTVariableExpression) {
|
||||
ASTVariableExpression variable = (ASTVariableExpression) potentialIV;
|
||||
if (potentiallyStaticBlob.contains(Helper.getFQVariableName(variable))) {
|
||||
addViolation(data, variable);
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
+256
-256
File diff suppressed because it is too large.
Load diff
+76
-76
@@ -26,98 +26,98 @@ import net.sourceforge.pmd.lang.apex.rule.AbstractApexRule;
|
||||
*
|
||||
*/
|
||||
public class ApexInsecureEndpointRule extends AbstractApexRule {
|
||||
private static final String SET_ENDPOINT = "setEndpoint";
|
||||
private static final Pattern PATTERN = Pattern.compile("^http://.+?$", Pattern.CASE_INSENSITIVE);
|
||||
private static final String SET_ENDPOINT = "setEndpoint";
|
||||
private static final Pattern PATTERN = Pattern.compile("^http://.+?$", Pattern.CASE_INSENSITIVE);
|
||||
|
||||
private static final Set<String> httpEndpointStrings = new HashSet<>();
|
||||
private static final Set<String> httpEndpointStrings = new HashSet<>();
|
||||
|
||||
public ApexInsecureEndpointRule() {
|
||||
setProperty(CODECLIMATE_CATEGORIES, new String[] { "Security" });
|
||||
setProperty(CODECLIMATE_REMEDIATION_MULTIPLIER, 100);
|
||||
setProperty(CODECLIMATE_BLOCK_HIGHLIGHTING, false);
|
||||
}
|
||||
public ApexInsecureEndpointRule() {
|
||||
setProperty(CODECLIMATE_CATEGORIES, new String[] { "Security" });
|
||||
setProperty(CODECLIMATE_REMEDIATION_MULTIPLIER, 100);
|
||||
setProperty(CODECLIMATE_BLOCK_HIGHLIGHTING, false);
|
||||
}
|
||||
|
||||
@Override
|
||||
public Object visit(ASTAssignmentExpression node, Object data) {
|
||||
findInsecureEndpoints(node, data);
|
||||
return data;
|
||||
}
|
||||
@Override
|
||||
public Object visit(ASTAssignmentExpression node, Object data) {
|
||||
findInsecureEndpoints(node, data);
|
||||
return data;
|
||||
}
|
||||
|
||||
@Override
|
||||
public Object visit(ASTVariableDeclaration node, Object data) {
|
||||
findInsecureEndpoints(node, data);
|
||||
return data;
|
||||
}
|
||||
@Override
|
||||
public Object visit(ASTVariableDeclaration node, Object data) {
|
||||
findInsecureEndpoints(node, data);
|
||||
return data;
|
||||
}
|
||||
|
||||
@Override
|
||||
public Object visit(ASTFieldDeclaration node, Object data) {
|
||||
findInsecureEndpoints(node, data);
|
||||
return data;
|
||||
}
|
||||
@Override
|
||||
public Object visit(ASTFieldDeclaration node, Object data) {
|
||||
findInsecureEndpoints(node, data);
|
||||
return data;
|
||||
}
|
||||
|
||||
private void findInsecureEndpoints(AbstractApexNode<?> node, Object data) {
|
||||
ASTVariableExpression variableNode = node.getFirstChildOfType(ASTVariableExpression.class);
|
||||
findInnerInsecureEndpoints(node, variableNode);
|
||||
private void findInsecureEndpoints(AbstractApexNode<?> node, Object data) {
|
||||
ASTVariableExpression variableNode = node.getFirstChildOfType(ASTVariableExpression.class);
|
||||
findInnerInsecureEndpoints(node, variableNode);
|
||||
|
||||
ASTBinaryExpression binaryNode = node.getFirstChildOfType(ASTBinaryExpression.class);
|
||||
if (binaryNode != null) {
|
||||
findInnerInsecureEndpoints(binaryNode, variableNode);
|
||||
}
|
||||
ASTBinaryExpression binaryNode = node.getFirstChildOfType(ASTBinaryExpression.class);
|
||||
if (binaryNode != null) {
|
||||
findInnerInsecureEndpoints(binaryNode, variableNode);
|
||||
}
|
||||
|
||||
}
|
||||
}
|
||||
|
||||
private void findInnerInsecureEndpoints(AbstractApexNode<?> node, ASTVariableExpression variableNode) {
|
||||
ASTLiteralExpression literalNode = node.getFirstChildOfType(ASTLiteralExpression.class);
|
||||
private void findInnerInsecureEndpoints(AbstractApexNode<?> node, ASTVariableExpression variableNode) {
|
||||
ASTLiteralExpression literalNode = node.getFirstChildOfType(ASTLiteralExpression.class);
|
||||
|
||||
if (literalNode != null && variableNode != null) {
|
||||
Object o = literalNode.getNode().getLiteral();
|
||||
if (o instanceof String) {
|
||||
String literal = (String) o;
|
||||
if (PATTERN.matcher(literal).matches()) {
|
||||
httpEndpointStrings.add(Helper.getFQVariableName(variableNode));
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
if (literalNode != null && variableNode != null) {
|
||||
Object o = literalNode.getNode().getLiteral();
|
||||
if (o instanceof String) {
|
||||
String literal = (String) o;
|
||||
if (PATTERN.matcher(literal).matches()) {
|
||||
httpEndpointStrings.add(Helper.getFQVariableName(variableNode));
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
@Override
|
||||
public Object visit(ASTMethodCallExpression node, Object data) {
|
||||
processInsecureEndpoint(node, data);
|
||||
return data;
|
||||
}
|
||||
@Override
|
||||
public Object visit(ASTMethodCallExpression node, Object data) {
|
||||
processInsecureEndpoint(node, data);
|
||||
return data;
|
||||
}
|
||||
|
||||
private void processInsecureEndpoint(ASTMethodCallExpression node, Object data) {
|
||||
if (!Helper.isMethodName(node, SET_ENDPOINT)) {
|
||||
return;
|
||||
}
|
||||
private void processInsecureEndpoint(ASTMethodCallExpression node, Object data) {
|
||||
if (!Helper.isMethodName(node, SET_ENDPOINT)) {
|
||||
return;
|
||||
}
|
||||
|
||||
ASTBinaryExpression binaryNode = node.getFirstChildOfType(ASTBinaryExpression.class);
|
||||
if (binaryNode != null) {
|
||||
runChecks(binaryNode, data);
|
||||
}
|
||||
ASTBinaryExpression binaryNode = node.getFirstChildOfType(ASTBinaryExpression.class);
|
||||
if (binaryNode != null) {
|
||||
runChecks(binaryNode, data);
|
||||
}
|
||||
|
||||
runChecks(node, data);
|
||||
runChecks(node, data);
|
||||
|
||||
}
|
||||
}
|
||||
|
||||
private void runChecks(AbstractApexNode<?> node, Object data) {
|
||||
ASTLiteralExpression literalNode = node.getFirstChildOfType(ASTLiteralExpression.class);
|
||||
if (literalNode != null) {
|
||||
Object o = literalNode.getNode().getLiteral();
|
||||
if (o instanceof String) {
|
||||
String literal = (String) o;
|
||||
if (PATTERN.matcher(literal).matches()) {
|
||||
addViolation(data, literalNode);
|
||||
}
|
||||
}
|
||||
}
|
||||
private void runChecks(AbstractApexNode<?> node, Object data) {
|
||||
ASTLiteralExpression literalNode = node.getFirstChildOfType(ASTLiteralExpression.class);
|
||||
if (literalNode != null) {
|
||||
Object o = literalNode.getNode().getLiteral();
|
||||
if (o instanceof String) {
|
||||
String literal = (String) o;
|
||||
if (PATTERN.matcher(literal).matches()) {
|
||||
addViolation(data, literalNode);
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
ASTVariableExpression variableNode = node.getFirstChildOfType(ASTVariableExpression.class);
|
||||
if (variableNode != null) {
|
||||
if (httpEndpointStrings.contains(Helper.getFQVariableName(variableNode))) {
|
||||
addViolation(data, variableNode);
|
||||
}
|
||||
ASTVariableExpression variableNode = node.getFirstChildOfType(ASTVariableExpression.class);
|
||||
if (variableNode != null) {
|
||||
if (httpEndpointStrings.contains(Helper.getFQVariableName(variableNode))) {
|
||||
addViolation(data, variableNode);
|
||||
}
|
||||
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
+68
-68
@@ -27,83 +27,83 @@ import apex.jorje.data.ast.TypeRef.ClassTypeRef;
|
||||
* @author sergey.gorbaty
|
||||
*/
|
||||
public class ApexOpenRedirectRule extends AbstractApexRule {
|
||||
private final static String PAGEREFERENCE = "PageReference";
|
||||
private final Set<String> listOfStringLiteralVariables = new HashSet<>();
|
||||
private static final String PAGEREFERENCE = "PageReference";
|
||||
private final Set<String> listOfStringLiteralVariables = new HashSet<>();
|
||||
|
||||
public ApexOpenRedirectRule() {
|
||||
setProperty(CODECLIMATE_CATEGORIES, new String[] { "Security" });
|
||||
setProperty(CODECLIMATE_REMEDIATION_MULTIPLIER, 100);
|
||||
setProperty(CODECLIMATE_BLOCK_HIGHLIGHTING, false);
|
||||
}
|
||||
public ApexOpenRedirectRule() {
|
||||
setProperty(CODECLIMATE_CATEGORIES, new String[] { "Security" });
|
||||
setProperty(CODECLIMATE_REMEDIATION_MULTIPLIER, 100);
|
||||
setProperty(CODECLIMATE_BLOCK_HIGHLIGHTING, false);
|
||||
}
|
||||
|
||||
@Override
|
||||
public Object visit(ASTNewObjectExpression node, Object data) {
|
||||
checkNewObjects(node, data);
|
||||
return data;
|
||||
}
|
||||
@Override
|
||||
public Object visit(ASTNewObjectExpression node, Object data) {
|
||||
checkNewObjects(node, data);
|
||||
return data;
|
||||
}
|
||||
|
||||
@Override
|
||||
public Object visit(ASTVariableDeclaration node, Object data) {
|
||||
findSafeLiterals(node);
|
||||
@Override
|
||||
public Object visit(ASTVariableDeclaration node, Object data) {
|
||||
findSafeLiterals(node);
|
||||
|
||||
return data;
|
||||
}
|
||||
return data;
|
||||
}
|
||||
|
||||
private void findSafeLiterals(AbstractApexNode<?> node) {
|
||||
ASTLiteralExpression literal = node.getFirstChildOfType(ASTLiteralExpression.class);
|
||||
if (literal != null) {
|
||||
ASTVariableExpression variable = node.getFirstChildOfType(ASTVariableExpression.class);
|
||||
if (variable != null) {
|
||||
listOfStringLiteralVariables.add(Helper.getFQVariableName(variable));
|
||||
}
|
||||
}
|
||||
}
|
||||
private void findSafeLiterals(AbstractApexNode<?> node) {
|
||||
ASTLiteralExpression literal = node.getFirstChildOfType(ASTLiteralExpression.class);
|
||||
if (literal != null) {
|
||||
ASTVariableExpression variable = node.getFirstChildOfType(ASTVariableExpression.class);
|
||||
if (variable != null) {
|
||||
listOfStringLiteralVariables.add(Helper.getFQVariableName(variable));
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
@Override
|
||||
public Object visit(ASTFieldDeclaration node, Object data) {
|
||||
findSafeLiterals(node);
|
||||
return data;
|
||||
}
|
||||
@Override
|
||||
public Object visit(ASTFieldDeclaration node, Object data) {
|
||||
findSafeLiterals(node);
|
||||
return data;
|
||||
}
|
||||
|
||||
/**
|
||||
* Traverses all new declarations to find PageReferences
|
||||
*
|
||||
* @param node
|
||||
* @param data
|
||||
*/
|
||||
private void checkNewObjects(ASTNewObjectExpression node, Object data) {
|
||||
ClassTypeRef classRef = (ClassTypeRef) node.getNode().getTypeRef();
|
||||
Identifier identifier = classRef.className.get(0);
|
||||
/**
|
||||
* Traverses all new declarations to find PageReferences
|
||||
*
|
||||
* @param node
|
||||
* @param data
|
||||
*/
|
||||
private void checkNewObjects(ASTNewObjectExpression node, Object data) {
|
||||
ClassTypeRef classRef = (ClassTypeRef) node.getNode().getTypeRef();
|
||||
Identifier identifier = classRef.className.get(0);
|
||||
|
||||
if (identifier.value.equalsIgnoreCase(PAGEREFERENCE)) {
|
||||
getObjectValue(node, data);
|
||||
}
|
||||
}
|
||||
if (identifier.value.equalsIgnoreCase(PAGEREFERENCE)) {
|
||||
getObjectValue(node, data);
|
||||
}
|
||||
}
|
||||
|
||||
/**
|
||||
* Finds any variables being present in PageReference constructor
|
||||
*
|
||||
* @param node
|
||||
* - PageReference
|
||||
* @param data
|
||||
*
|
||||
*/
|
||||
private void getObjectValue(ApexNode<?> node, Object data) {
|
||||
// PageReference(foo);
|
||||
final List<ASTVariableExpression> variableExpressions = node.findChildrenOfType(ASTVariableExpression.class);
|
||||
for (ASTVariableExpression variable : variableExpressions) {
|
||||
StringBuilder sb = new StringBuilder().append(variable.getNode().getDefiningType()).append(":")
|
||||
.append(variable.getNode().getIdentifier().value);
|
||||
if (variable.jjtGetChildIndex() == 0 && !listOfStringLiteralVariables.contains(sb.toString())) {
|
||||
addViolation(data, variable);
|
||||
}
|
||||
}
|
||||
/**
|
||||
* Finds any variables being present in PageReference constructor
|
||||
*
|
||||
* @param node
|
||||
* - PageReference
|
||||
* @param data
|
||||
*
|
||||
*/
|
||||
private void getObjectValue(ApexNode<?> node, Object data) {
|
||||
// PageReference(foo);
|
||||
final List<ASTVariableExpression> variableExpressions = node.findChildrenOfType(ASTVariableExpression.class);
|
||||
for (ASTVariableExpression variable : variableExpressions) {
|
||||
StringBuilder sb = new StringBuilder().append(variable.getNode().getDefiningType()).append(":")
|
||||
.append(variable.getNode().getIdentifier().value);
|
||||
if (variable.jjtGetChildIndex() == 0 && !listOfStringLiteralVariables.contains(sb.toString())) {
|
||||
addViolation(data, variable);
|
||||
}
|
||||
}
|
||||
|
||||
// PageReference(foo + bar)
|
||||
final List<ASTBinaryExpression> binaryExpressions = node.findChildrenOfType(ASTBinaryExpression.class);
|
||||
for (ASTBinaryExpression z : binaryExpressions) {
|
||||
getObjectValue(z, data);
|
||||
}
|
||||
}
|
||||
// PageReference(foo + bar)
|
||||
final List<ASTBinaryExpression> binaryExpressions = node.findChildrenOfType(ASTBinaryExpression.class);
|
||||
for (ASTBinaryExpression z : binaryExpressions) {
|
||||
getObjectValue(z, data);
|
||||
}
|
||||
}
|
||||
|
||||
}
|
||||
+140
-140
File diff suppressed because it is too large.
Load diff
+41
-41
@@ -19,51 +19,51 @@ import net.sourceforge.pmd.lang.apex.rule.AbstractApexRule;
|
||||
*
|
||||
*/
|
||||
public class ApexXSSFromEscapeFalseRule extends AbstractApexRule {
|
||||
private static final String ADD_ERROR = "addError";
|
||||
private static final String ADD_ERROR = "addError";
|
||||
|
||||
public ApexXSSFromEscapeFalseRule() {
|
||||
setProperty(CODECLIMATE_CATEGORIES, new String[] { "Security" });
|
||||
setProperty(CODECLIMATE_REMEDIATION_MULTIPLIER, 100);
|
||||
setProperty(CODECLIMATE_BLOCK_HIGHLIGHTING, false);
|
||||
}
|
||||
public ApexXSSFromEscapeFalseRule() {
|
||||
setProperty(CODECLIMATE_CATEGORIES, new String[] { "Security" });
|
||||
setProperty(CODECLIMATE_REMEDIATION_MULTIPLIER, 100);
|
||||
setProperty(CODECLIMATE_BLOCK_HIGHLIGHTING, false);
|
||||
}
|
||||
|
||||
@Override
|
||||
public Object visit(ASTUserClass node, Object data) {
|
||||
if (Helper.isTestMethodOrClass(node)) {
|
||||
return data;
|
||||
}
|
||||
@Override
|
||||
public Object visit(ASTUserClass node, Object data) {
|
||||
if (Helper.isTestMethodOrClass(node)) {
|
||||
return data;
|
||||
}
|
||||
|
||||
List<ASTMethodCallExpression> methodCalls = node.findDescendantsOfType(ASTMethodCallExpression.class);
|
||||
for (ASTMethodCallExpression methodCall : methodCalls) {
|
||||
if (Helper.isMethodName(methodCall, ADD_ERROR)) {
|
||||
validateBooleanParameter(methodCall, data);
|
||||
}
|
||||
}
|
||||
return data;
|
||||
}
|
||||
List<ASTMethodCallExpression> methodCalls = node.findDescendantsOfType(ASTMethodCallExpression.class);
|
||||
for (ASTMethodCallExpression methodCall : methodCalls) {
|
||||
if (Helper.isMethodName(methodCall, ADD_ERROR)) {
|
||||
validateBooleanParameter(methodCall, data);
|
||||
}
|
||||
}
|
||||
return data;
|
||||
}
|
||||
|
||||
private void validateBooleanParameter(ASTMethodCallExpression methodCall, Object data) {
|
||||
int numberOfChildren = methodCall.jjtGetNumChildren();
|
||||
if (numberOfChildren == 3) { // addError('',false)
|
||||
Object potentialLiteral = methodCall.jjtGetChild(2);
|
||||
if (potentialLiteral instanceof ASTLiteralExpression) {
|
||||
ASTLiteralExpression parameter = (ASTLiteralExpression) potentialLiteral;
|
||||
Object o = parameter.getNode().getLiteral();
|
||||
if (o instanceof Boolean) {
|
||||
Boolean paramValue = (Boolean) o;
|
||||
if (paramValue.equals(Boolean.FALSE)) {
|
||||
validateLiteralPresence(methodCall, data);
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
private void validateBooleanParameter(ASTMethodCallExpression methodCall, Object data) {
|
||||
int numberOfChildren = methodCall.jjtGetNumChildren();
|
||||
if (numberOfChildren == 3) { // addError('',false)
|
||||
Object potentialLiteral = methodCall.jjtGetChild(2);
|
||||
if (potentialLiteral instanceof ASTLiteralExpression) {
|
||||
ASTLiteralExpression parameter = (ASTLiteralExpression) potentialLiteral;
|
||||
Object o = parameter.getNode().getLiteral();
|
||||
if (o instanceof Boolean) {
|
||||
Boolean paramValue = (Boolean) o;
|
||||
if (paramValue.equals(Boolean.FALSE)) {
|
||||
validateLiteralPresence(methodCall, data);
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
private void validateLiteralPresence(ASTMethodCallExpression methodCall, Object data) {
|
||||
List<ASTVariableExpression> variables = methodCall.findDescendantsOfType(ASTVariableExpression.class);
|
||||
for (ASTVariableExpression v : variables) {
|
||||
addViolation(data, v);
|
||||
}
|
||||
}
|
||||
private void validateLiteralPresence(ASTMethodCallExpression methodCall, Object data) {
|
||||
List<ASTVariableExpression> variables = methodCall.findDescendantsOfType(ASTVariableExpression.class);
|
||||
for (ASTVariableExpression v : variables) {
|
||||
addViolation(data, v);
|
||||
}
|
||||
}
|
||||
|
||||
}
|
||||
+178
-178
File diff suppressed because it is too large.
Load diff
@@ -6,8 +6,7 @@ package net.sourceforge.pmd.lang.apex.rule.security;
|
||||
|
||||
import java.util.Arrays;
|
||||
import java.util.List;
|
||||
import apex.jorje.semantic.ast.expression.MethodCallExpression;
|
||||
import apex.jorje.semantic.ast.expression.VariableExpression;
|
||||
|
||||
import net.sourceforge.pmd.lang.apex.ast.ASTDmlDeleteStatement;
|
||||
import net.sourceforge.pmd.lang.apex.ast.ASTDmlInsertStatement;
|
||||
import net.sourceforge.pmd.lang.apex.ast.ASTDmlMergeStatement;
|
||||
@@ -23,6 +22,9 @@ import net.sourceforge.pmd.lang.apex.ast.ASTSoslExpression;
|
||||
import net.sourceforge.pmd.lang.apex.ast.ASTVariableExpression;
|
||||
import net.sourceforge.pmd.lang.apex.ast.ApexNode;
|
||||
|
||||
import apex.jorje.semantic.ast.expression.MethodCallExpression;
|
||||
import apex.jorje.semantic.ast.expression.VariableExpression;
|
||||
|
||||
/**
|
||||
* Helper methods
|
||||
*
|
||||
@@ -30,116 +32,116 @@ import net.sourceforge.pmd.lang.apex.ast.ApexNode;
|
||||
*
|
||||
*/
|
||||
public final class Helper {
|
||||
private Helper() {
|
||||
throw new AssertionError("Can't instantiate helper classes");
|
||||
}
|
||||
private Helper() {
|
||||
throw new AssertionError("Can't instantiate helper classes");
|
||||
}
|
||||
|
||||
static boolean isTestMethodOrClass(final ApexNode<?> node) {
|
||||
final List<ASTModifierNode> modifierNode = node.findChildrenOfType(ASTModifierNode.class);
|
||||
for (final ASTModifierNode m : modifierNode) {
|
||||
if (m.getNode().getModifiers().isTest()) {
|
||||
return true;
|
||||
}
|
||||
}
|
||||
return false;
|
||||
}
|
||||
static boolean isTestMethodOrClass(final ApexNode<?> node) {
|
||||
final List<ASTModifierNode> modifierNode = node.findChildrenOfType(ASTModifierNode.class);
|
||||
for (final ASTModifierNode m : modifierNode) {
|
||||
if (m.getNode().getModifiers().isTest()) {
|
||||
return true;
|
||||
}
|
||||
}
|
||||
return false;
|
||||
}
|
||||
|
||||
static boolean foundAnySOQLorSOSL(final ApexNode<?> node) {
|
||||
final List<ASTSoqlExpression> dmlSoqlExpression = node.findDescendantsOfType(ASTSoqlExpression.class);
|
||||
final List<ASTSoslExpression> dmlSoslExpression = node.findDescendantsOfType(ASTSoslExpression.class);
|
||||
static boolean foundAnySOQLorSOSL(final ApexNode<?> node) {
|
||||
final List<ASTSoqlExpression> dmlSoqlExpression = node.findDescendantsOfType(ASTSoqlExpression.class);
|
||||
final List<ASTSoslExpression> dmlSoslExpression = node.findDescendantsOfType(ASTSoslExpression.class);
|
||||
|
||||
if (dmlSoqlExpression.isEmpty() && dmlSoslExpression.isEmpty()) {
|
||||
return false;
|
||||
}
|
||||
if (dmlSoqlExpression.isEmpty() && dmlSoslExpression.isEmpty()) {
|
||||
return false;
|
||||
}
|
||||
|
||||
return true;
|
||||
}
|
||||
return true;
|
||||
}
|
||||
|
||||
/**
|
||||
* Finds DML operations in a given node descendants' path
|
||||
*
|
||||
* @param node
|
||||
*
|
||||
* @return true if found DML operations in node descendants
|
||||
*/
|
||||
static boolean foundAnyDML(final ApexNode<?> node) {
|
||||
/**
|
||||
* Finds DML operations in a given node descendants' path
|
||||
*
|
||||
* @param node
|
||||
*
|
||||
* @return true if found DML operations in node descendants
|
||||
*/
|
||||
static boolean foundAnyDML(final ApexNode<?> node) {
|
||||
|
||||
final List<ASTDmlUpsertStatement> dmlUpsertStatement = node.findDescendantsOfType(ASTDmlUpsertStatement.class);
|
||||
final List<ASTDmlUpdateStatement> dmlUpdateStatement = node.findDescendantsOfType(ASTDmlUpdateStatement.class);
|
||||
final List<ASTDmlUndeleteStatement> dmlUndeleteStatement = node
|
||||
.findDescendantsOfType(ASTDmlUndeleteStatement.class);
|
||||
final List<ASTDmlMergeStatement> dmlMergeStatement = node.findDescendantsOfType(ASTDmlMergeStatement.class);
|
||||
final List<ASTDmlInsertStatement> dmlInsertStatement = node.findDescendantsOfType(ASTDmlInsertStatement.class);
|
||||
final List<ASTDmlDeleteStatement> dmlDeleteStatement = node.findDescendantsOfType(ASTDmlDeleteStatement.class);
|
||||
final List<ASTDmlUpsertStatement> dmlUpsertStatement = node.findDescendantsOfType(ASTDmlUpsertStatement.class);
|
||||
final List<ASTDmlUpdateStatement> dmlUpdateStatement = node.findDescendantsOfType(ASTDmlUpdateStatement.class);
|
||||
final List<ASTDmlUndeleteStatement> dmlUndeleteStatement = node
|
||||
.findDescendantsOfType(ASTDmlUndeleteStatement.class);
|
||||
final List<ASTDmlMergeStatement> dmlMergeStatement = node.findDescendantsOfType(ASTDmlMergeStatement.class);
|
||||
final List<ASTDmlInsertStatement> dmlInsertStatement = node.findDescendantsOfType(ASTDmlInsertStatement.class);
|
||||
final List<ASTDmlDeleteStatement> dmlDeleteStatement = node.findDescendantsOfType(ASTDmlDeleteStatement.class);
|
||||
|
||||
if (dmlUpsertStatement.isEmpty() && dmlUpdateStatement.isEmpty() && dmlUndeleteStatement.isEmpty()
|
||||
&& dmlMergeStatement.isEmpty() && dmlInsertStatement.isEmpty() && dmlDeleteStatement.isEmpty()) {
|
||||
return false;
|
||||
}
|
||||
if (dmlUpsertStatement.isEmpty() && dmlUpdateStatement.isEmpty() && dmlUndeleteStatement.isEmpty()
|
||||
&& dmlMergeStatement.isEmpty() && dmlInsertStatement.isEmpty() && dmlDeleteStatement.isEmpty()) {
|
||||
return false;
|
||||
}
|
||||
|
||||
return true;
|
||||
}
|
||||
return true;
|
||||
}
|
||||
|
||||
static boolean isMethodName(final ASTMethodCallExpression methodNode, final String className,
|
||||
final String methodName) {
|
||||
final ASTReferenceExpression reference = methodNode.getFirstChildOfType(ASTReferenceExpression.class);
|
||||
if (reference.getNode().getJadtIdentifiers().size() == 1) {
|
||||
if (reference.getNode().getJadtIdentifiers().get(0).value.equalsIgnoreCase(className)
|
||||
&& isMethodName(methodNode, methodName)) {
|
||||
return true;
|
||||
}
|
||||
}
|
||||
static boolean isMethodName(final ASTMethodCallExpression methodNode, final String className,
|
||||
final String methodName) {
|
||||
final ASTReferenceExpression reference = methodNode.getFirstChildOfType(ASTReferenceExpression.class);
|
||||
if (reference.getNode().getJadtIdentifiers().size() == 1) {
|
||||
if (reference.getNode().getJadtIdentifiers().get(0).value.equalsIgnoreCase(className)
|
||||
&& isMethodName(methodNode, methodName)) {
|
||||
return true;
|
||||
}
|
||||
}
|
||||
|
||||
return false;
|
||||
}
|
||||
return false;
|
||||
}
|
||||
|
||||
static boolean isMethodName(final ASTMethodCallExpression m, final String methodName) {
|
||||
return isMethodName(m.getNode(), methodName);
|
||||
}
|
||||
static boolean isMethodName(final ASTMethodCallExpression m, final String methodName) {
|
||||
return isMethodName(m.getNode(), methodName);
|
||||
}
|
||||
|
||||
static boolean isMethodName(final MethodCallExpression m, final String methodName) {
|
||||
return m.getMethodName().equalsIgnoreCase(methodName);
|
||||
}
|
||||
static boolean isMethodName(final MethodCallExpression m, final String methodName) {
|
||||
return m.getMethodName().equalsIgnoreCase(methodName);
|
||||
}
|
||||
|
||||
static boolean isMethodCallChain(final ASTMethodCallExpression methodNode, final String... methodNames) {
|
||||
String methodName = methodNames[methodNames.length - 1];
|
||||
if (Helper.isMethodName(methodNode, methodName)) {
|
||||
final ASTReferenceExpression reference = methodNode.getFirstChildOfType(ASTReferenceExpression.class);
|
||||
if (reference != null) {
|
||||
final ASTDottedExpression dottedExpression = reference.getFirstChildOfType(ASTDottedExpression.class);
|
||||
if (dottedExpression != null) {
|
||||
final ASTMethodCallExpression nestedMethod = dottedExpression
|
||||
.getFirstChildOfType(ASTMethodCallExpression.class);
|
||||
if (nestedMethod != null) {
|
||||
String[] newMethodNames = Arrays.copyOf(methodNames, methodNames.length - 1);
|
||||
return isMethodCallChain(nestedMethod, newMethodNames);
|
||||
} else {
|
||||
String[] newClassName = Arrays.copyOf(methodNames, methodNames.length - 1);
|
||||
if (newClassName.length == 1) {
|
||||
return Helper.isMethodName(methodNode, newClassName[0], methodName);
|
||||
}
|
||||
}
|
||||
}
|
||||
static boolean isMethodCallChain(final ASTMethodCallExpression methodNode, final String... methodNames) {
|
||||
String methodName = methodNames[methodNames.length - 1];
|
||||
if (Helper.isMethodName(methodNode, methodName)) {
|
||||
final ASTReferenceExpression reference = methodNode.getFirstChildOfType(ASTReferenceExpression.class);
|
||||
if (reference != null) {
|
||||
final ASTDottedExpression dottedExpression = reference.getFirstChildOfType(ASTDottedExpression.class);
|
||||
if (dottedExpression != null) {
|
||||
final ASTMethodCallExpression nestedMethod = dottedExpression
|
||||
.getFirstChildOfType(ASTMethodCallExpression.class);
|
||||
if (nestedMethod != null) {
|
||||
String[] newMethodNames = Arrays.copyOf(methodNames, methodNames.length - 1);
|
||||
return isMethodCallChain(nestedMethod, newMethodNames);
|
||||
} else {
|
||||
String[] newClassName = Arrays.copyOf(methodNames, methodNames.length - 1);
|
||||
if (newClassName.length == 1) {
|
||||
return Helper.isMethodName(methodNode, newClassName[0], methodName);
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
return false;
|
||||
}
|
||||
return false;
|
||||
}
|
||||
|
||||
static String getFQVariableName(final ASTVariableExpression variable) {
|
||||
final ASTReferenceExpression ref = variable.getFirstChildOfType(ASTReferenceExpression.class);
|
||||
String objectName = "";
|
||||
if (ref != null) {
|
||||
if (ref.getNode().getJadtIdentifiers().size() == 1) {
|
||||
objectName = ref.getNode().getJadtIdentifiers().get(0).value + ".";
|
||||
}
|
||||
}
|
||||
static String getFQVariableName(final ASTVariableExpression variable) {
|
||||
final ASTReferenceExpression ref = variable.getFirstChildOfType(ASTReferenceExpression.class);
|
||||
String objectName = "";
|
||||
if (ref != null) {
|
||||
if (ref.getNode().getJadtIdentifiers().size() == 1) {
|
||||
objectName = ref.getNode().getJadtIdentifiers().get(0).value + ".";
|
||||
}
|
||||
}
|
||||
|
||||
VariableExpression n = variable.getNode();
|
||||
StringBuilder sb = new StringBuilder().append(n.getDefiningType()).append(":").append(objectName)
|
||||
.append(n.getIdentifier().value);
|
||||
return sb.toString();
|
||||
}
|
||||
VariableExpression n = variable.getNode();
|
||||
StringBuilder sb = new StringBuilder().append(n.getDefiningType()).append(":").append(objectName)
|
||||
.append(n.getIdentifier().value);
|
||||
return sb.toString();
|
||||
}
|
||||
|
||||
}
|
||||
Reference in new issue
Block a user