phoedos/pmd
1
1
Fork 1
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Merge branch 'pr-229' into pmd/5.5.x

Browse Source
This commit is contained in:
Juan Martín Sotuyo Dodero
2017-02-02 12:32:44 -03:00
parent 8d420d0387 27b2f9f547
commit cb1556bb41
3 changed files with 20 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
pmd-apex/src/main/java/net/sourceforge/pmd/lang/apex/rule/security/ApexSOQLInjectionRule.java
View File

@ -96,6 +96,10 @@ public class ApexSOQLInjectionRule extends AbstractApexRule {
if (literal != null) {
if (left != null) {
Object o = literal.getNode().getLiteral();
if (o instanceof Integer || o instanceof Boolean || o instanceof Double) {
safeVariables.add(Helper.getFQVariableName(left));
}
if (o instanceof String) {
if (SELECT_PATTERN.matcher((String) o).matches()) {
selectContainingVariables.put(Helper.getFQVariableName(left), Boolean.TRUE);

15
pmd-apex/src/test/resources/net/sourceforge/pmd/lang/apex/rule/security/xml/ApexSOQLInjection.xml
View File

@ -206,4 +206,19 @@ public class Foo {
}
]]></code>
</test-code>
<test-code>
<description>Dynamic SOQL with Integer
</description>
<expected-problems>0</expected-problems>
<code><![CDATA[
public class Foo {
public void test1() {
Integer field1 = 4;
Database.query('SELECT Id FROM Account LIMIT ' + field1);
}
}
]]></code>
</test-code>
</test-data>

1
src/site/markdown/overview/changelog.md
View File

@ -26,4 +26,5 @@ The PMD team is pleased to announce PMD 5.5.4
* [#227](https://github.com/pmd/pmd/pull/227): \[apex] Improving detection of getters
* [#228](https://github.com/pmd/pmd/pull/228): \[apex] Excluding count from CRUD/FLS checks
* [#229](https://github.com/pmd/pmd/pull/229): \[apex] Dynamic SOQL is safe against Integer, Boolean, Double