239 Commits

Author SHA1 Message Date
Aaron Hurst
1029d6b24d Fix checkstyle violations.
Change-Id: I0aa6ecfeb343f2e0b48d2ebfd176a877a72f40f6
2022-11-24 20:35:42 +00:00
Aaron Hurst
e62b71f89a Add back DataType.fromBasicType(BasicType) and test.
Isolate references to BasicType inside method implementation.

Change-Id: I4be2ad5b8b42fb7a84da0755106d8f0b08034690
2022-11-24 15:55:43 +00:00
Aaron Hurst
c9e21cd4eb Tweak terminology: the map is case-normalized not case-insensitive.
Change-Id: I3499dc615262612b6c220b7840d3ab8cca87c226
2022-11-22 21:38:03 +00:00
Aaron Hurst
5ad37f6757 Replace uses of Jorje types in pmd-visualforce.
Summary: store and compare primitive type names instead of using BasicType enum.

Udpate unit tests and add a few more cases.

Change-Id: If4e5bb33d11793813839b82cf8beb043aad2ce34
2022-11-22 20:15:39 +00:00
Vyom Yadav
0f01d4686e [core] Updated DataType.java 2022-01-21 11:23:32 +05:30
Andreas Dangel
bd6c72e0f5 Fix code duplications 2021-09-08 20:11:49 +02:00
Andreas Dangel
4fb19e2a5e Bump pmd from 6.34.0 to 6.35.0 2021-05-29 09:06:39 +02:00
Joshua Feingold
d88d8ff913 @W-8680425@: Added LINKTO back into the list of inherently safe functions. 2021-01-29 10:02:09 -06:00
Joshua Feingold
a4916f94fc @W-8680425@: Pulled out some repeated code into convenience method. 2021-01-25 16:33:47 -06:00
Joshua Feingold
c14398d19f @W-8680425@: Refactored escape detection in script context. Multiple false positives resolved. 2021-01-25 14:39:25 -06:00
Andreas Dangel
221c9e785e Merge pull request #3005 from rmohan20:removeOnEventEncoding
[vf] [New Rule] Handle XSS violations that can occur within Html Style
tags #3005
2021-01-21 15:07:05 +01:00
Andreas Dangel
dc4cdf696e Fixups for #3005
- ElEscapeDetector is utility class now
- Improved description and example of new rule
2021-01-21 15:01:58 +01:00
Andreas Dangel
f7909ae78a Merge branch 'master' into pr-2963-update 2021-01-21 11:43:01 +01:00
Jeff Bartolotta
15dd8783c7 Convert Pattern to a static final member 2021-01-19 10:28:08 -08:00
Jeff Bartolotta
98acf1de63 Update pmd-visualforce/src/test/java/net/sourceforge/pmd/lang/vf/rule/security/VfHtmlXssStyleTagUrlPatternMatchingTest.java
Co-authored-by: Clément Fournier <clement.fournier76@gmail.com>
2021-01-19 10:11:52 -08:00
rmohan
6a179980be Applying changes from review feedback 2021-01-15 13:40:07 -08:00
rmohan
407aa690d1 parent 7fc3dee95acbb40692f2c115ebe7b0264f377385
author rmohan <rmohan@salesforce.com> 1608240897 -0800
committer rmohan <rmohan@salesforce.com> 1610153787 -0800
gpgsig -----BEGIN PGP SIGNATURE-----

 iQIzBAABCAAdFiEEPykD30Ug+JG+ZQ7x5XWwXqT2VuwFAl/4/zsACgkQ5XWwXqT2
 VuwJoBAAsdl/TU3nculnOPwrCHtaxgtM/4zB+wLdw7f+KtIaGMv5A8v8gMbqh0V+
 OTPV0Q/CTEk4PxA2qD5aCPLOaO9+LHOKjPdkWalttVjINtTVPR2pKo0PKR+f2q77
 79eFkhiB1uNx741ThGIZoWPv8eMKHYP+1BEwndFdByxSA70+gdYkbmZqKLLOOrTE
 2uxuGwnNM02ZYskupvgPW2pZvWFviR2sZt/GbFPkqAwgjf40MxM5+3cujOOV850E
 hLHCcch5G5sh8sHTb9nCyNmc6i1kSw9+OOpOHmJGV4u3DRBBtTE9FdwyEUJ2VliZ
 77VrfRPxwzkAE3jTH7EGCY7kpf84jQMqrGn/gav1LfH4DscPZmF617r9iYZ5fOr6
 Z2Fun4vaCXk0h1CojCOpnh4WAthhiVtvBJmdiyO489/hmbtwWuz7KBkCsEVBS+8E
 ViEaQylIOWjcFXkAq5PQ8fCxIqqMgbI7p5kQL6zatpykteMT5zoJj41t8oyjr5Rz
 RUGXNPxpW3zKq3jw4VsjZ8qNYuoSerTzx0qGuUQIALO97HZ8ZBsxmcDTFJrzAkj7
 yfslzLRIoPlL4ZKdpOgCGzVLBX1D/YCBn9KXQiYEYRh57umIt0wpM/Y/Xkl+/Jr4
 97DYj7GQr1gYavSqe7z5n3aUixyibpWy/wx2K3VN6PmtZ3FEB5I=
 =dqIs
 -----END PGP SIGNATURE-----

Creating new VfHtmlStyleTagXss rule to handle XSS in style tags.
Also, refactoring common code out of VfUnescapeElRule to avoid duplication.
2021-01-08 17:08:46 -08:00
Andreas Dangel
c37f208d3e Call jjtree/javacc with UTF-8 as default encoding
Fixes #2970
2020-12-17 18:31:13 +01:00
rmohan
7fc3dee95a Merging Style tag and HTML XSS checks with typecheck changes for real 2020-12-16 16:22:40 -08:00
rmohan
94a3eb636a Changes to fix apex namespace bug 2020-12-16 14:28:35 -08:00
rmohan
35ee2a534e Redoing HTML Style tag changes on updated Typecheck logic 2020-12-16 13:37:14 -08:00
Jeff Bartolotta
4e00c20499 Small comment and doc edits 2020-12-10 22:20:10 -08:00
Clément Fournier
f7829531c9 Add some doc 2020-12-10 20:17:51 +01:00
Maikel Steneker
af31b3a773 Add GenericToken.getKind() to interface 2020-12-10 12:10:47 +01:00
Jeff Bartolotta
f805b85850 Fix Html DataType
This DataType does not need to be escaped, it is always escaped by the
server.
2020-12-09 20:11:25 -08:00
Clément Fournier
2d5781482e Fix tests 2020-11-24 12:22:32 +01:00
Clément Fournier
b94ac4f018 Don't create a vf language module per parser options 2020-11-24 12:09:25 +01:00
Clément Fournier
0ad1f47b29 Use interface instead of deprecated abstract class 2020-11-24 12:02:32 +01:00
Clément Fournier
fabf2cf6db Make the parser options properties private 2020-11-24 11:53:45 +01:00
Clément Fournier
21506cea85 Cleanup languages to skip 2020-11-24 11:39:59 +01:00
Jeff Bartolotta
86b5948f07 Update the way nodes with data are identified
Changed method for how the Visualforce strings are reconstructed from the AST. The previous implementation had incorrect assumptions about the structure of the AST. Added tests to more thoroughly test these situations.

Changed name of IdentifierType to DataType. This information can be stored on either ASTIdentifier or ASTLiteral nodes.

Changes based on PR feedgack:
- Restored ParserOptionsTest in order to avoid binary compatibilty issues.
- Changed ParserOptions to contain a PropertySource instead of extending AbtractPropertySource.
2020-11-20 11:59:23 -08:00
Jeff Bartolotta
e1c42a10ec Move visitor to VfParser#parse
LanguageVersionHandler#getTypeResolutionFacade is deprecated. Moved the VfExpressionTypeVisitor creation and execution to VfParser#parse instead.

ParsingOptionsTest located in pmd-test wasn't running previously because it was in the src/main hierarchy. Moved this test into the src/test hierarchy and consolidated the methods from the
similarly named class from pmd-core.
2020-11-12 20:13:19 -08:00
Jeff Bartolotta
db7bf0a786 Store type information in AST instead of map
Store the IdentifierType on ASTIdentifier node instead of in a separate map.

Use the existing TypeResolution pattern to configure the visitor instead deriving from an abstract rule.

Changed ParserOptions to extend AbstractPropertySource with the ability to override the defaults via environment variables.
2020-11-12 10:15:04 -08:00
Jeff Bartolotta
ba2e91b3a0 Exclude languages in AbstractRuleSetFactoryTest
Allow subclasses of AbstractRuleSetFactoryTest to filter out languages
that show up in the classpath but should not be tested.

Change VFTestContstants to final instead of abstract.
2020-10-29 17:22:35 -07:00
Jeff Bartolotta
f70b2e44fc Rename ExpressionType, remove google collections
Renamed ExpressionType to IdentifierType since this is more accurate.

Removed usage of google.collect classes that were causing UnsupportedClassVersionError exception in the Travis CI run.
2020-10-27 16:23:14 -07:00
Jeff Bartolotta
ef9e350fd5 Mark AbstractVfTypedElExpressionRule as abstract 2020-10-22 12:11:44 -07:00
Jeff Bartolotta
ddf55c7f81 Provide type information to Visualforce rules
Addresses the general issue raised in https://github.com/pmd/pmd/issues/1092 This commit removes false positives from expressions in apex tags. The specific use case raised in 1092 isn't reproducible and represents a false negative that will be fixed separately.

The existing Visualforce rules don't have any information about the data types referenced in the Visualforce page. This results in false positives when attempting to identify expressions that are vulnerable to XSS attacks. The rules should not warn about XSS attacks when the expression refers to a type such as Integer or Boolean.

The VfExpressionTypeVisitor visits the Visualforce page and extracts the datatypes from Salesforce metadata. Data type information can come from either Apex classes or Object Fields. The Salesforce metadata is generally located in a sibling directory of the Visualforce directory. By default the code looks in directories relative to the Visualforce file to find the metadata. The conventional locations for the metadata are "../classes" and "../objects", the user can override this default with other directories if required.
2020-10-22 11:30:45 -07:00
rmohan
7e7182b26d Modifying VF tokenizer test content to keep up with the minor grammar change
Streamlined IDENTIFIED_DOTTED logic. Added a couple more negative tests
2020-10-16 09:31:43 -07:00
rmohan
5ea116fa52 First draft of change to allow dotted attributes in Visualforce 2020-09-18 13:45:43 -07:00
XenoAmess
244a39db0f fix typos. 2020-08-27 11:47:11 +08:00
Andreas Dangel
06d2225b27 [vf] Deprecate VfSimpleCharStream 2020-08-20 10:38:41 +02:00
Andreas Dangel
23bc58f23c [vf] Use tabSize=1 as well 2020-08-20 10:38:19 +02:00
Andreas Dangel
eb683569af Merge branch 'pr-2617'
[core] Deprecate missing language attribute on rule definition #2617
2020-07-30 10:19:03 +02:00
Andreas Dangel
044d7aea2d Merge branch 'pr-2638'
[visualforce] add new safe resource for VfUnescapeEl #2638
2020-07-17 15:29:25 +02:00
Andreas Dangel
7ae424a35b Add deprecation javadocs 2020-07-17 14:43:43 +02:00
Andreas Dangel
d89a6d080d [visualforce] Add test for VfUnescapeEl with $MessageChannel 2020-07-09 12:20:09 +02:00
Peter Chittum
2fb196b16a [visualforce] added new global variable name to safe resources
Cherry-picked from 7f0f91f71aac132e3c5ddd9ce397c73f19ebb04e
2020-07-09 12:19:54 +02:00
Peter Chittum
5e50b16e05 [visualforce] added new global variable name to safe resources
Cherry-picked from 25cb8de645e0c016a99a933950bffdc996d74b39
2020-07-09 12:19:38 +02:00
Clément Fournier
8add323403 Fix other offenders 2020-07-06 14:02:21 +02:00
Clément Fournier
49635c2a66 Deprecate Rulechain visitors 2020-07-01 11:27:38 +02:00