phoedos/pmd
1
1 Fork 1
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Merge branch 'GCImprovements' of https://github.com/sgorbaty/pmd

Browse Source
This commit is contained in:
Juan Martín Sotuyo Dodero committed 2016-12-16 16:40:31 -03:00
2 parents ad22f8b4ef 10e3bc172b
commit 7bc8b4ec00
2 files changed
+9 -9
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

pmd-apex/src/main/java/net/sourceforge/pmd/lang/apex/rule/security/ApexInsecureEndpointRule.java
+3 -3
View File
@@ -29,7 +29,7 @@ public class ApexInsecureEndpointRule extends AbstractApexRule {
private static final String SET_ENDPOINT = "setEndpoint";
private static final Pattern PATTERN = Pattern.compile("^http://.+?$", Pattern.CASE_INSENSITIVE);
private static final Set<String> HTTP_ENDPOINT_STRINGS = new HashSet<>();
private final Set<String> httpEndpointStrings = new HashSet<>();
public ApexInsecureEndpointRule() {
setProperty(CODECLIMATE_CATEGORIES, new String[] { "Security" });
@@ -74,7 +74,7 @@ public class ApexInsecureEndpointRule extends AbstractApexRule {
if (o instanceof String) {
String literal = (String) o;
if (PATTERN.matcher(literal).matches()) {
HTTP_ENDPOINT_STRINGS.add(Helper.getFQVariableName(variableNode));
httpEndpointStrings.add(Helper.getFQVariableName(variableNode));
}
}
}
@@ -114,7 +114,7 @@ public class ApexInsecureEndpointRule extends AbstractApexRule {
ASTVariableExpression variableNode = node.getFirstChildOfType(ASTVariableExpression.class);
if (variableNode != null) {
if (HTTP_ENDPOINT_STRINGS.contains(Helper.getFQVariableName(variableNode))) {
if (httpEndpointStrings.contains(Helper.getFQVariableName(variableNode))) {
addViolation(data, variableNode);
}
pmd-apex/src/main/java/net/sourceforge/pmd/lang/apex/rule/security/ApexXSSFromURLParamRule.java
+6 -6
View File
@@ -37,7 +37,7 @@ public class ApexXSSFromURLParamRule extends AbstractApexRule {
private static final String[] DOUBLE_VALUEOF = new String[] { "Double", "valueOf" };
private static final String[] STRING_ISEMPTY = new String[] { "String", "isEmpty" };
private static final Set<String> URL_PARAMETER_STRINGS = new HashSet<>();
private final Set<String> urlParameterStrings = new HashSet<>();
public ApexXSSFromURLParamRule() {
setProperty(CODECLIMATE_CATEGORIES, new String[] { "Security" });
@@ -88,7 +88,7 @@ public class ApexXSSFromURLParamRule extends AbstractApexRule {
List<ASTVariableExpression> nodes = node.findChildrenOfType(ASTVariableExpression.class);
for (ASTVariableExpression varExpression : nodes) {
if (URL_PARAMETER_STRINGS.contains(Helper.getFQVariableName(varExpression))) {
if (urlParameterStrings.contains(Helper.getFQVariableName(varExpression))) {
addViolation(data, nodes.get(0));
}
}
@@ -133,7 +133,7 @@ public class ApexXSSFromURLParamRule extends AbstractApexRule {
ASTVariableExpression left = node.getFirstChildOfType(ASTVariableExpression.class);
if (left != null) {
URL_PARAMETER_STRINGS.add(Helper.getFQVariableName(left));
urlParameterStrings.add(Helper.getFQVariableName(left));
}
}
@@ -159,7 +159,7 @@ public class ApexXSSFromURLParamRule extends AbstractApexRule {
return;
}
if (URL_PARAMETER_STRINGS.contains(Helper.getFQVariableName(variable))) {
if (urlParameterStrings.contains(Helper.getFQVariableName(variable))) {
if (!isEscapingMethod(methodNode)) {
addViolation(data, variable);
}
@@ -192,7 +192,7 @@ public class ApexXSSFromURLParamRule extends AbstractApexRule {
// Look for: foo = bar;
final ASTVariableExpression right = reverseOrder ? nodes.get(0) : nodes.get(1);
if (URL_PARAMETER_STRINGS.contains(Helper.getFQVariableName(right))) {
if (urlParameterStrings.contains(Helper.getFQVariableName(right))) {
addViolation(data, right);
}
}
@@ -217,7 +217,7 @@ public class ApexXSSFromURLParamRule extends AbstractApexRule {
final List<ASTVariableExpression> nodes = node.findChildrenOfType(ASTVariableExpression.class);
for (ASTVariableExpression n : nodes) {
if (URL_PARAMETER_STRINGS.contains(Helper.getFQVariableName(n))) {
if (urlParameterStrings.contains(Helper.getFQVariableName(n))) {
addViolation(data, n);
}
}