Merge branch 'pr/3243'

Refs #3243

docs/pages/release_notes.md

@@ -25,6 +25,8 @@ This is a {{ site.pmd.release_type }} release.
 
 ### Fixed Issues
 
+*   apex
+    *   [#3243](https://github.com/pmd/pmd/pull/3243): \[apex] Correct findBoundary when traversing AST
 *   doc
     *   [#3230](https://github.com/pmd/pmd/issues/3230): \[doc] Remove "Edit me" button for language index pages
 *   dist

pmd-apex/src/main/java/net/sourceforge/pmd/lang/apex/ast/ApexRootNode.java

@@ -50,4 +50,9 @@ public abstract class ApexRootNode<T extends AstNode> extends AbstractApexNode<T
     public double getApexVersion() {
         return node.getDefiningType().getCodeUnitDetails().getVersion().getExternal();
     }
+
+    @Override
+    public boolean isFindBoundary() {
+        return true;
+    }
 }

pmd-apex/src/main/java/net/sourceforge/pmd/lang/apex/rule/security/ApexBadCryptoRule.java

@@ -35,6 +35,7 @@ public class ApexBadCryptoRule extends AbstractApexRule {
     private final Set<String> potentiallyStaticBlob = new HashSet<>();
 
     public ApexBadCryptoRule() {
+        addRuleChainVisit(ASTUserClass.class);
         setProperty(CODECLIMATE_CATEGORIES, "Security");
         setProperty(CODECLIMATE_REMEDIATION_MULTIPLIER, 100);
         setProperty(CODECLIMATE_BLOCK_HIGHLIGHTING, false);

pmd-apex/src/main/java/net/sourceforge/pmd/lang/apex/rule/security/ApexDangerousMethodsRule.java

@@ -40,7 +40,7 @@ public class ApexDangerousMethodsRule extends AbstractApexRule {
     private final Set<String> whiteListedVariables = new HashSet<>();
 
     public ApexDangerousMethodsRule() {
-        super.addRuleChainVisit(ASTUserClass.class);
+        addRuleChainVisit(ASTUserClass.class);
         setProperty(CODECLIMATE_CATEGORIES, "Security");
         setProperty(CODECLIMATE_REMEDIATION_MULTIPLIER, 100);
         setProperty(CODECLIMATE_BLOCK_HIGHLIGHTING, false);

pmd-apex/src/main/java/net/sourceforge/pmd/lang/apex/rule/security/ApexOpenRedirectRule.java

@@ -31,7 +31,7 @@ public class ApexOpenRedirectRule extends AbstractApexRule {
     private final Set<String> listOfStringLiteralVariables = new HashSet<>();
 
     public ApexOpenRedirectRule() {
-        super.addRuleChainVisit(ASTUserClass.class);
+        addRuleChainVisit(ASTUserClass.class);
         setProperty(CODECLIMATE_CATEGORIES, "Security");
         setProperty(CODECLIMATE_REMEDIATION_MULTIPLIER, 100);
         setProperty(CODECLIMATE_BLOCK_HIGHLIGHTING, false);

pmd-apex/src/main/java/net/sourceforge/pmd/lang/apex/rule/security/ApexSOQLInjectionRule.java

@@ -51,6 +51,7 @@ public class ApexSOQLInjectionRule extends AbstractApexRule {
     private final Map<String, Boolean> selectContainingVariables = new HashMap<>();
 
     public ApexSOQLInjectionRule() {
+        addRuleChainVisit(ASTUserClass.class);
         setProperty(CODECLIMATE_CATEGORIES, "Security");
         setProperty(CODECLIMATE_REMEDIATION_MULTIPLIER, 100);
         setProperty(CODECLIMATE_BLOCK_HIGHLIGHTING, false);

pmd-apex/src/main/java/net/sourceforge/pmd/lang/apex/rule/security/ApexSuggestUsingNamedCredRule.java

@@ -34,7 +34,7 @@ public class ApexSuggestUsingNamedCredRule extends AbstractApexRule {
     private final Set<String> listOfAuthorizationVariables = new HashSet<>();
 
     public ApexSuggestUsingNamedCredRule() {
-        super.addRuleChainVisit(ASTUserClass.class);
+        addRuleChainVisit(ASTUserClass.class);
         setProperty(CODECLIMATE_CATEGORIES, "Security");
         setProperty(CODECLIMATE_REMEDIATION_MULTIPLIER, 100);
         setProperty(CODECLIMATE_BLOCK_HIGHLIGHTING, false);

pmd-apex/src/main/java/net/sourceforge/pmd/lang/apex/rule/security/ApexXSSFromEscapeFalseRule.java

@@ -23,6 +23,7 @@ public class ApexXSSFromEscapeFalseRule extends AbstractApexRule {
     private static final String ADD_ERROR = "addError";
 
     public ApexXSSFromEscapeFalseRule() {
+        addRuleChainVisit(ASTUserClass.class);
         setProperty(CODECLIMATE_CATEGORIES, "Security");
         setProperty(CODECLIMATE_REMEDIATION_MULTIPLIER, 100);
         setProperty(CODECLIMATE_BLOCK_HIGHLIGHTING, false);

pmd-apex/src/test/resources/net/sourceforge/pmd/lang/apex/rule/security/xml/ApexBadCrypto.xml

@@ -7,6 +7,7 @@
     <test-code>
         <description>Apex Crypto hardcoded IV</description>
         <expected-problems>1</expected-problems>
+        <expected-linenumbers>6</expected-linenumbers>
         <code><![CDATA[
 public class Foo {
     public Foo() {
@@ -76,6 +77,24 @@ public class Foo {
         Blob data = Blob.valueOf('Data to be encrypted');
         Blob encrypted = Crypto.encryptWithManagedIV('AES128', key, data);
     }
+}
+        ]]></code>
+    </test-code>
+
+    <test-code>
+        <description>Apex Crypto hardcoded IV in inner class</description>
+        <expected-problems>1</expected-problems>
+        <expected-linenumbers>7</expected-linenumbers>
+        <code><![CDATA[
+public class Foo {
+    class MyInnerClass {
+        public MyInnerClass() {
+            Blob exampleIv = Blob.valueOf('0000000000000000');
+            Blob key = Crypto.generateAesKey(128);
+            Blob data = Blob.valueOf('Data to be encrypted');
+            Blob encrypted = Crypto.encrypt('AES128', key, exampleIv, data);
+        }
+    }
 }
         ]]></code>
     </test-code>

pmd-apex/src/test/resources/net/sourceforge/pmd/lang/apex/rule/security/xml/ApexSOQLInjection.xml

@@ -7,6 +7,7 @@
     <test-code>
         <description>Potentially unsafe SOQL on concatenation of variables 1</description>
         <expected-problems>1</expected-problems>
+        <expected-linenumbers>5</expected-linenumbers>
         <code><![CDATA[
 public class Foo {
     public void test1() {
@@ -304,6 +305,23 @@ public class Foo {
     public void test1(String name) {
         List<SObject> res = Database.query('Select Id,Name From ' + (name == 'Account' ? name : 'Cases'));
     }
+}
+        ]]></code>
+    </test-code>
+
+    <test-code>
+        <description>Potentially unsafe SOQL on concatenation of variables in nested class</description>
+        <expected-problems>1</expected-problems>
+        <expected-linenumbers>6</expected-linenumbers>
+        <code><![CDATA[
+public class Foo {
+    class MyNestedClass {
+        public void test1() {
+            String field1 = getSomeID();
+            String field2 = 'SELECT Id FROM Account WHERE Id =';
+            Database.query(field2 + field1);
+        }
+    }
 }
         ]]></code>
     </test-code>

pmd-apex/src/test/resources/net/sourceforge/pmd/lang/apex/rule/security/xml/ApexXSSFromEscapeFalse.xml

@@ -7,6 +7,7 @@
     <test-code>
         <description>Add error variable with escape false</description>
         <expected-problems>1</expected-problems>
+        <expected-linenumbers>3</expected-linenumbers>
         <code><![CDATA[
 public class Foo {
     public void test1(String bad) {
@@ -36,6 +37,21 @@ public class Foo {
     public void test1() {
         Trigger.new[0].addError('something else' + bad, false);
     }
+}
+        ]]></code>
+    </test-code>
+
+    <test-code>
+        <description>Add error variable with escape false in nested class</description>
+        <expected-problems>1</expected-problems>
+        <expected-linenumbers>4</expected-linenumbers>
+        <code><![CDATA[
+public class Foo {
+    class MyNestedClass {
+        public void test1(String bad) {
+            Trigger.new[0].addError(bad, false);
+        }
+    }
 }
         ]]></code>
     </test-code>