#1299 MethodReturnsInternalArray false positive

pmd-java/src/main/java/net/sourceforge/pmd/lang/java/rule/sunsecure/MethodReturnsInternalArrayRule.java

@@ -8,6 +8,8 @@ import java.util.List;
 import net.sourceforge.pmd.lang.java.ast.ASTAllocationExpression;
 import net.sourceforge.pmd.lang.java.ast.ASTClassOrInterfaceDeclaration;
 import net.sourceforge.pmd.lang.java.ast.ASTMethodDeclaration;
+import net.sourceforge.pmd.lang.java.ast.ASTName;
+import net.sourceforge.pmd.lang.java.ast.ASTPrimaryExpression;
 import net.sourceforge.pmd.lang.java.ast.ASTPrimaryPrefix;
 import net.sourceforge.pmd.lang.java.ast.ASTPrimarySuffix;
 import net.sourceforge.pmd.lang.java.ast.ASTReturnStatement;
@@ -48,6 +50,9 @@ public class MethodReturnsInternalArrayRule extends AbstractSunSecureRule {
             if (ret.hasDescendantOfType(ASTAllocationExpression.class)) {
                 continue;
             }
+            if (hasArraysCopyOf(ret)) {
+                continue;
+            }
             if (!isLocalVariable(vn, method)) {
                 addViolation(data, ret, vn);
             } else {
@@ -64,5 +69,15 @@ public class MethodReturnsInternalArrayRule extends AbstractSunSecureRule {
         return data;
     }
 
-
+    private boolean hasArraysCopyOf(ASTReturnStatement ret) {
+        List<ASTPrimaryExpression> expressions = ret.findDescendantsOfType(ASTPrimaryExpression.class);
+        for (ASTPrimaryExpression e : expressions) {
+            if (e.jjtGetNumChildren() == 2 && e.jjtGetChild(0) instanceof ASTPrimaryPrefix
+                    && e.jjtGetChild(0).jjtGetNumChildren() == 1 && e.jjtGetChild(0).jjtGetChild(0) instanceof ASTName
+                    && ((ASTName)e.jjtGetChild(0).jjtGetChild(0)).getImage().endsWith("Arrays.copyOf")) {
+                return true;
+            }
+        }
+        return false;
+    }
 }

pmd-java/src/test/resources/net/sourceforge/pmd/lang/java/rule/sunsecure/xml/MethodReturnsInternalArray.xml

@@ -149,4 +149,16 @@ public class Test {
 }
      ]]></code>
     </test-code>
+    <test-code>
+        <description>#1299 MethodReturnsInternalArray false positive</description>
+        <expected-problems>0</expected-problems>
+        <code><![CDATA[
+public class WebServiceResponseMessage {
+    private Object[] responseObjects;
+    public Object[] getResponseObjects() {
+        return responseObjects == null ? null : Arrays.copyOf(responseObjects, responseObjects.length);
+    }
+}
+        ]]></code>
+    </test-code>
 </test-data>

src/site/markdown/overview/changelog.md

@@ -11,3 +11,4 @@
 **Bugfixes:**
 
 * [#1298](https://sourceforge.net/p/pmd/bugs/1298/): Member variable int type with value 0xff000000 causes processing error
+* [#1299](https://sourceforge.net/p/pmd/bugs/1299/): MethodReturnsInternalArray false positive