phoedos/pmd
1
1
Fork 1
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Accessibility checks improved with CF

Browse Source
This commit is contained in:
Sergey Gorbaty
2017-01-10 09:46:10 -08:00
committed by Juan Martín Sotuyo Dodero
parent 9baf99f19d
commit 7a3ab3d7a1
2 changed files with 71 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files

17
pmd-apex/src/main/java/net/sourceforge/pmd/lang/apex/rule/security/ApexCRUDViolationRule.java
View File

@@ -95,7 +95,7 @@ public class ApexCRUDViolationRule extends AbstractApexRule {
@Override
public Object visit(ASTMethodCallExpression node, Object data) {
performMethodLevelChecks(node);
collectCRUDMethodLevelChecks(node);
return data;
}
@@ -192,7 +192,7 @@ public class ApexCRUDViolationRule extends AbstractApexRule {
}
private void performMethodLevelChecks(final ASTMethodCallExpression node) {
private void collectCRUDMethodLevelChecks(final ASTMethodCallExpression node) {
final String method = node.getNode().getMethodName();
final ASTReferenceExpression ref = node.getFirstChildOfType(ASTReferenceExpression.class);
if (ref == null) {
@@ -270,9 +270,9 @@ public class ApexCRUDViolationRule extends AbstractApexRule {
}
private void checkForCRUD(final AbstractApexNode<?> node, final Object data, final String crudMethod) {
final HashSet<ASTMethodCallExpression> prevCalls = getPreviousCalls(node);
final HashSet<ASTMethodCallExpression> prevCalls = getPreviousMethodCalls(node);
for (ASTMethodCallExpression prevCall : prevCalls) {
performMethodLevelChecks(prevCall);
collectCRUDMethodLevelChecks(prevCall);
}
final ASTMethod wrappingMethod = node.getFirstParentOfType(ASTMethod.class);
@@ -301,7 +301,7 @@ public class ApexCRUDViolationRule extends AbstractApexRule {
}
}
private HashSet<ASTMethodCallExpression> getPreviousCalls(final AbstractApexNode<?> self) {
private HashSet<ASTMethodCallExpression> getPreviousMethodCalls(final AbstractApexNode<?> self) {
final HashSet<ASTMethodCallExpression> innerMethodCalls = new HashSet<>();
final ASTBlockStatement blockStatement = self.getFirstParentOfType(ASTBlockStatement.class);
@@ -414,7 +414,12 @@ public class ApexCRUDViolationRule extends AbstractApexRule {
}
}
private void checkForAccessibility(final AbstractApexNode<?> node, Object data) {
private void checkForAccessibility(final ASTSoqlExpression node, Object data) {
final HashSet<ASTMethodCallExpression> prevCalls = getPreviousMethodCalls(node);
for (ASTMethodCallExpression prevCall : prevCalls) {
collectCRUDMethodLevelChecks(prevCall);
}
boolean isGetter = false;
String returnType = null;

60
pmd-apex/src/test/resources/net/sourceforge/pmd/lang/apex/rule/security/xml/ApexCRUDViolation.xml
View File

@@ -542,4 +542,64 @@ public class Foo {
} ]]></code>
</test-code>
<test-code>
<description>Control flow accessibility CRUD check</description>
<expected-problems>0</expected-problems>
<code><![CDATA[
public class Foo {
public Contact justGiveMeFoo() {
checkPerms();
String tempID = 'someID';
return [SELECT Name FROM Contact WHERE Id=:tempID];
}
private void checkPerms() {
if (!Contact.sObjectType.getDescribe().isAccessible()) {
throw new NoAccessException();
}
}
}
]]></code>
</test-code>
<test-code>
<description>Control flow substitute CRUD check</description>
<expected-problems>0</expected-problems>
<code><![CDATA[
public class Foo {
public Contact justGiveMeFoo() {
checkPerms();
String tempID = 'someID';
return [SELECT Name FROM Contact WHERE Id=:tempID];
}
private void checkPerms() {
if (!Contact.sObjectType.getDescribe().isCreateable()) {
throw new NoAccessException();
}
}
}
]]></code>
</test-code>
<test-code>
<description>Forgot to call the CRUD check</description>
<expected-problems>1</expected-problems>
<code><![CDATA[
public class Foo {
public Contact justGiveMeFoo() {
String tempID = 'someID';
return [SELECT Name FROM Contact WHERE Id=:tempID];
}
private void checkPerms() {
if (!Contact.sObjectType.getDescribe().isCreateable()) {
throw new NoAccessException();
}
}
}
]]></code>
</test-code>
</test-data>