|
|
|
@ -18,66 +18,82 @@ import org.sonar.plugins.java.api.IssuableSubscriptionVisitor; |
|
|
|
import org.sonar.plugins.java.api.tree.*; |
|
|
|
import org.sonar.plugins.java.api.tree.*; |
|
|
|
|
|
|
|
|
|
|
|
import java.util.*; |
|
|
|
import java.util.*; |
|
|
|
|
|
|
|
import java.util.stream.Collectors; |
|
|
|
|
|
|
|
|
|
|
|
@Rule(key = "PasswordRegexCheck") |
|
|
|
@Rule(key = "PasswordRegexCheck") |
|
|
|
public class PasswordRegexCheck extends IssuableSubscriptionVisitor { |
|
|
|
public class PasswordRegexCheck extends IssuableSubscriptionVisitor { |
|
|
|
|
|
|
|
|
|
|
|
private static final String MATCHER_METHOD = "matcher"; |
|
|
|
|
|
|
|
private static final String PASSWORD_PARAMETER = "password"; |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
@Override |
|
|
|
@Override |
|
|
|
public List<Tree.Kind> nodesToVisit() { |
|
|
|
public List<Tree.Kind> nodesToVisit() { |
|
|
|
|
|
|
|
// 在这里，我们只考虑方法
|
|
|
|
return Collections.singletonList(Tree.Kind.METHOD); |
|
|
|
return Collections.singletonList(Tree.Kind.METHOD); |
|
|
|
} |
|
|
|
} |
|
|
|
|
|
|
|
|
|
|
|
@Override |
|
|
|
@Override |
|
|
|
public void visitNode(Tree tree) { |
|
|
|
public void visitNode(Tree tree) { |
|
|
|
if (tree.is(Tree.Kind.METHOD)) { |
|
|
|
MethodTree method = (MethodTree) tree; |
|
|
|
MethodTree methodTree = (MethodTree) tree; |
|
|
|
// 检查是否存在名为 “password”的参数
|
|
|
|
checkPasswordValidation(methodTree); |
|
|
|
List<VariableTree> passwordParameters = method.parameters().stream() |
|
|
|
|
|
|
|
.filter(param -> "password".equals(param.simpleName().name())) |
|
|
|
|
|
|
|
.collect(Collectors.toList()); |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
if (!passwordParameters.isEmpty()) { |
|
|
|
|
|
|
|
// 确认参数 "password" 是否在正确的正则表达式之下被检查
|
|
|
|
|
|
|
|
boolean passwordIsCheckedWithRegex = passwordParameters.stream() |
|
|
|
|
|
|
|
.anyMatch(param -> isPasswordValidatedWithRegex(method, param)); |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
if (!passwordIsCheckedWithRegex) { |
|
|
|
|
|
|
|
reportIssue(method.simpleName(), "未对口令进行复杂度验证"); |
|
|
|
|
|
|
|
} |
|
|
|
} |
|
|
|
} |
|
|
|
} |
|
|
|
} |
|
|
|
|
|
|
|
|
|
|
|
private void checkPasswordValidation(MethodTree methodTree) { |
|
|
|
|
|
|
|
boolean hasPasswordValidation = false; |
|
|
|
private boolean isPasswordValidatedWithRegex(Tree tree, VariableTree passwordParameter) { |
|
|
|
|
|
|
|
PasswordValidationVisitor visitor = new PasswordValidationVisitor(passwordParameter); |
|
|
|
for (StatementTree statement : methodTree.block().body()) { |
|
|
|
tree.accept(visitor); |
|
|
|
if (statement.is(Tree.Kind.VARIABLE)) { |
|
|
|
return visitor.isPasswordValidated(); |
|
|
|
VariableTree variableTree = (VariableTree) statement; |
|
|
|
} |
|
|
|
if (variableTree.initializer() != null && variableTree.initializer().is(Tree.Kind.METHOD_INVOCATION)) { |
|
|
|
|
|
|
|
MethodInvocationTree methodInvocationTree = (MethodInvocationTree) variableTree.initializer(); |
|
|
|
private static class PasswordValidationVisitor extends BaseTreeVisitor { |
|
|
|
String methodName = methodInvocationTree.methodSymbol().name(); |
|
|
|
|
|
|
|
if (MATCHER_METHOD.equals(methodName)) { |
|
|
|
private final VariableTree passwordParameter; |
|
|
|
hasPasswordValidation = hasPasswordValidation || hasPasswordParameter(methodInvocationTree.arguments()); |
|
|
|
private boolean passwordValidated = false; |
|
|
|
} |
|
|
|
|
|
|
|
} |
|
|
|
PasswordValidationVisitor(VariableTree passwordParameter) { |
|
|
|
|
|
|
|
this.passwordParameter = passwordParameter; |
|
|
|
|
|
|
|
} |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
@Override |
|
|
|
|
|
|
|
public void visitMethodInvocation(MethodInvocationTree tree) { |
|
|
|
|
|
|
|
// 改变行为，查找是否存在匹配指定方法调用模式的表达式
|
|
|
|
|
|
|
|
if (isCorrectPasswordValidationMethod(tree)) { |
|
|
|
|
|
|
|
passwordValidated = true; |
|
|
|
} |
|
|
|
} |
|
|
|
|
|
|
|
super.visitMethodInvocation(tree); |
|
|
|
} |
|
|
|
} |
|
|
|
|
|
|
|
|
|
|
|
if (!hasPasswordValidation) { |
|
|
|
public boolean isPasswordValidated() { |
|
|
|
//如果没有发现密码验证，报告问题
|
|
|
|
return passwordValidated; |
|
|
|
System.out.println("未对口令进行复杂度验证"+methodTree.simpleName()); |
|
|
|
|
|
|
|
reportIssue(methodTree.simpleName(), "未对口令进行复杂度验证"); |
|
|
|
|
|
|
|
} |
|
|
|
} |
|
|
|
} |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
private boolean hasPasswordParameter(List<ExpressionTree> arguments) { |
|
|
|
private boolean isCorrectPasswordValidationMethod(MethodInvocationTree mit) { |
|
|
|
for (ExpressionTree argument : arguments) { |
|
|
|
if ("matches".equals(mit.methodSymbol().name()) |
|
|
|
if (argument.is(Tree.Kind.IDENTIFIER)) { |
|
|
|
&& mit.methodSelect().is(Tree.Kind.MEMBER_SELECT) |
|
|
|
IdentifierTree identifier = (IdentifierTree) argument; |
|
|
|
&& ((MemberSelectExpressionTree) mit.methodSelect()).identifier().name().equals("matcher") |
|
|
|
if (PASSWORD_PARAMETER.equalsIgnoreCase(identifier.name())) { |
|
|
|
&& ((MemberSelectExpressionTree) mit.methodSelect()).expression().is(Tree.Kind.METHOD_INVOCATION)) { |
|
|
|
//检查标识符是否有密码验证
|
|
|
|
|
|
|
|
return hasPasswordValidationInMethod(identifier.name()); |
|
|
|
MethodInvocationTree innerMit = (MethodInvocationTree) ((MemberSelectExpressionTree) mit.methodSelect()).expression(); |
|
|
|
|
|
|
|
if ("compile".equals(innerMit.methodSymbol().name()) |
|
|
|
|
|
|
|
&& innerMit.methodSelect().is(Tree.Kind.MEMBER_SELECT) |
|
|
|
|
|
|
|
&& "Pattern".equals( ((MemberSelectExpressionTree)innerMit.methodSelect()).expression().toString())) { |
|
|
|
|
|
|
|
// 需要确定参数中包含名为 'password' 的参数
|
|
|
|
|
|
|
|
List<VariableTree> arguments = mit.methodSymbol().declaration().parameters().stream().filter(param -> param.symbol().name().equals("password")).collect(Collectors.toList()); |
|
|
|
|
|
|
|
return (!arguments.isEmpty()); |
|
|
|
} |
|
|
|
} |
|
|
|
} |
|
|
|
} |
|
|
|
|
|
|
|
return false; |
|
|
|
} |
|
|
|
} |
|
|
|
|
|
|
|
|
|
|
|
return false; |
|
|
|
|
|
|
|
} |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
private boolean hasPasswordValidationInMethod(String paramName) { |
|
|
|
|
|
|
|
//参数名是'password'，已经存在
|
|
|
|
|
|
|
|
return PASSWORD_PARAMETER.equalsIgnoreCase(paramName); |
|
|
|
|
|
|
|
} |
|
|
|
} |
|
|
|
|
|
|
|
|
|
|
|
} |
|
|
|
} |
|
|
|
|
