Guo XIn
11 months ago
commit
2ab2551735
@ -0,0 +1,38 @@ |
|||||||
|
target/ |
||||||
|
!.mvn/wrapper/maven-wrapper.jar |
||||||
|
!**/src/main/**/target/ |
||||||
|
!**/src/test/**/target/ |
||||||
|
|
||||||
|
### IntelliJ IDEA ### |
||||||
|
.idea/modules.xml |
||||||
|
.idea/jarRepositories.xml |
||||||
|
.idea/compiler.xml |
||||||
|
.idea/libraries/ |
||||||
|
*.iws |
||||||
|
*.iml |
||||||
|
*.ipr |
||||||
|
|
||||||
|
### Eclipse ### |
||||||
|
.apt_generated |
||||||
|
.classpath |
||||||
|
.factorypath |
||||||
|
.project |
||||||
|
.settings |
||||||
|
.springBeans |
||||||
|
.sts4-cache |
||||||
|
|
||||||
|
### NetBeans ### |
||||||
|
/nbproject/private/ |
||||||
|
/nbbuild/ |
||||||
|
/dist/ |
||||||
|
/nbdist/ |
||||||
|
/.nb-gradle/ |
||||||
|
build/ |
||||||
|
!**/src/main/**/build/ |
||||||
|
!**/src/test/**/build/ |
||||||
|
|
||||||
|
### VS Code ### |
||||||
|
.vscode/ |
||||||
|
|
||||||
|
### Mac OS ### |
||||||
|
.DS_Store |
||||||
@ -0,0 +1,6 @@ |
|||||||
|
[submodule "sonar-dependencies/sonar-cxx"] |
||||||
|
path = sonar-dependencies/sonar-cxx |
||||||
|
url = https://github.com/SonarOpenCommunity/sonar-cxx.git |
||||||
|
[submodule "sonar-dependencies/sonar-java"] |
||||||
|
path = sonar-dependencies/sonar-java |
||||||
|
url = https://github.com/SonarSource/sonar-java.git |
||||||
@ -0,0 +1,35 @@ |
|||||||
|
<?xml version="1.0" encoding="UTF-8"?> |
||||||
|
<project xmlns="http://maven.apache.org/POM/4.0.0" |
||||||
|
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" |
||||||
|
xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd"> |
||||||
|
<modelVersion>4.0.0</modelVersion> |
||||||
|
<parent> |
||||||
|
<groupId>org.sonarsource.java</groupId> |
||||||
|
<artifactId>java</artifactId> |
||||||
|
<version>7.30.1.34514</version> |
||||||
|
</parent> |
||||||
|
|
||||||
|
<groupId>com.keyware.sonar</groupId> |
||||||
|
<artifactId>sonar-keyware</artifactId> |
||||||
|
<version>1.0-SNAPSHOT</version> |
||||||
|
<packaging>pom</packaging> |
||||||
|
|
||||||
|
<properties> |
||||||
|
<maven.compiler.source>11</maven.compiler.source> |
||||||
|
<maven.compiler.target>11</maven.compiler.target> |
||||||
|
<project.build.sourceEncoding>UTF-8</project.build.sourceEncoding> |
||||||
|
</properties> |
||||||
|
|
||||||
|
<modules> |
||||||
|
<module>sonar-dependencies</module> |
||||||
|
<module>sonar-keyware-plugins</module> |
||||||
|
</modules> |
||||||
|
<dependencyManagement> |
||||||
|
<dependencies> |
||||||
|
|
||||||
|
</dependencies> |
||||||
|
</dependencyManagement> |
||||||
|
<dependencies> |
||||||
|
|
||||||
|
</dependencies> |
||||||
|
</project> |
||||||
@ -0,0 +1,30 @@ |
|||||||
|
<?xml version="1.0" encoding="UTF-8"?> |
||||||
|
<project xmlns="http://maven.apache.org/POM/4.0.0" |
||||||
|
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" |
||||||
|
xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd"> |
||||||
|
<modelVersion>4.0.0</modelVersion> |
||||||
|
|
||||||
|
<parent> |
||||||
|
<groupId>com.keyware.sonar</groupId> |
||||||
|
<artifactId>sonar-keyware</artifactId> |
||||||
|
<version>1.0-SNAPSHOT</version> |
||||||
|
</parent> |
||||||
|
|
||||||
|
<artifactId>sonar-dependencies</artifactId> |
||||||
|
<version>1.0-SNAPSHOT</version> |
||||||
|
<packaging>pom</packaging> |
||||||
|
|
||||||
|
<modules> |
||||||
|
<!--<module>sonar-cxx</module>--> |
||||||
|
<module>sonar-java</module> |
||||||
|
</modules> |
||||||
|
|
||||||
|
<properties> |
||||||
|
|
||||||
|
</properties> |
||||||
|
|
||||||
|
<dependencyManagement> |
||||||
|
<dependencies> |
||||||
|
</dependencies> |
||||||
|
</dependencyManagement> |
||||||
|
</project> |
||||||
@ -0,0 +1 @@ |
|||||||
|
Subproject commit dd3c88c7343f3a44c5172dc4499b361dda028d85 |
||||||
@ -0,0 +1 @@ |
|||||||
|
Subproject commit 0d3165c6aebe18052b1d97893a2e3da85e6d9b41 |
||||||
@ -0,0 +1,22 @@ |
|||||||
|
<?xml version="1.0" encoding="UTF-8"?> |
||||||
|
<project xmlns="http://maven.apache.org/POM/4.0.0" |
||||||
|
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" |
||||||
|
xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd"> |
||||||
|
<modelVersion>4.0.0</modelVersion> |
||||||
|
|
||||||
|
<parent> |
||||||
|
<groupId>com.keyware.sonar</groupId> |
||||||
|
<artifactId>sonar-keyware</artifactId> |
||||||
|
<version>1.0-SNAPSHOT</version> |
||||||
|
</parent> |
||||||
|
|
||||||
|
<artifactId>sonar-keyware-plugins</artifactId> |
||||||
|
<version>1.0-SNAPSHOT</version> |
||||||
|
<packaging>pom</packaging> |
||||||
|
|
||||||
|
<modules> |
||||||
|
<module>sonar-keyware-plugins-java</module> |
||||||
|
<module>sonar-keyware-plugins-cxx</module> |
||||||
|
</modules> |
||||||
|
|
||||||
|
</project> |
||||||
Binary file not shown.
Binary file not shown.
@ -0,0 +1,155 @@ |
|||||||
|
<?xml version="1.0" encoding="UTF-8"?> |
||||||
|
<project xmlns="http://maven.apache.org/POM/4.0.0" |
||||||
|
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" |
||||||
|
xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd"> |
||||||
|
<modelVersion>4.0.0</modelVersion> |
||||||
|
|
||||||
|
<parent> |
||||||
|
<groupId>com.keyware.sonar</groupId> |
||||||
|
<artifactId>sonar-keyware-plugins</artifactId> |
||||||
|
<version>1.0-SNAPSHOT</version> |
||||||
|
</parent> |
||||||
|
|
||||||
|
<name>C++ 信息安全性设计准则</name> |
||||||
|
<artifactId>sonar-keyware-plugins-cxx</artifactId> |
||||||
|
<version>1.0-SNAPSHOT</version> |
||||||
|
<description>用于检查C++源代码的安全性设计准则的Sonarqube插件</description> |
||||||
|
|
||||||
|
<properties> |
||||||
|
<java.version>11</java.version> |
||||||
|
<commons-io.version>2.15.1</commons-io.version> |
||||||
|
<commons-lang.version>2.6</commons-lang.version> |
||||||
|
<!-- we depend on API ${sonar.version} but we keep backward compatibility with LTS --> |
||||||
|
<sonar.version>9.9.0.65466</sonar.version> |
||||||
|
<sonar.plugin.api.version>9.14.0.375</sonar.plugin.api.version> |
||||||
|
<sonarQubeMinVersion>8.9</sonarQubeMinVersion> |
||||||
|
<gson.version>2.10.1</gson.version> |
||||||
|
<guava.version>33.0.0-jre</guava.version> |
||||||
|
<jsr305.version>3.0.2</jsr305.version> |
||||||
|
<mockito-all.version>1.10.19</mockito-all.version> |
||||||
|
<mockito-core.version>5.8.0</mockito-core.version> |
||||||
|
<assertj-core.version>3.24.2</assertj-core.version> |
||||||
|
<junit-jupiter.version>5.10.1</junit-jupiter.version> |
||||||
|
</properties> |
||||||
|
|
||||||
|
<dependencies> |
||||||
|
<dependency> |
||||||
|
<groupId>org.sonarsource.sonarqube-plugins.cxx</groupId> |
||||||
|
<artifactId>cxx-sslr-toolkit</artifactId> |
||||||
|
<systemPath>${project.basedir}/libs/cxx-sslr-toolkit-2.1.1.488.jar</systemPath> |
||||||
|
<version>2.1.1.488</version> |
||||||
|
<scope>system</scope> |
||||||
|
</dependency> |
||||||
|
<dependency> |
||||||
|
<groupId>org.sonarsource.sonarqube-plugins.cxx</groupId> |
||||||
|
<artifactId>sonar-cxx-plugin</artifactId> |
||||||
|
<systemPath>${project.basedir}/libs/sonar-cxx-plugin-2.1.1.488.jar</systemPath> |
||||||
|
<version>2.1.1.488</version> |
||||||
|
<scope>system</scope> |
||||||
|
</dependency> |
||||||
|
|
||||||
|
<dependency> |
||||||
|
<groupId>org.sonarsource.api.plugin</groupId> |
||||||
|
<artifactId>sonar-plugin-api</artifactId> |
||||||
|
<version>${sonar.plugin.api.version}</version> |
||||||
|
</dependency> |
||||||
|
|
||||||
|
<dependency> |
||||||
|
<groupId>org.sonarsource.sonarqube</groupId> |
||||||
|
<artifactId>sonar-plugin-api-impl</artifactId> |
||||||
|
<version>${sonar.version}</version> |
||||||
|
<scope>compile</scope> |
||||||
|
</dependency> |
||||||
|
|
||||||
|
<dependency> |
||||||
|
<groupId>commons-io</groupId> |
||||||
|
<artifactId>commons-io</artifactId> |
||||||
|
<version>${commons-io.version}</version> |
||||||
|
<scope>test</scope> |
||||||
|
</dependency> |
||||||
|
<dependency> |
||||||
|
<groupId>commons-lang</groupId> |
||||||
|
<artifactId>commons-lang</artifactId> |
||||||
|
<version>${commons-lang.version}</version> |
||||||
|
</dependency> |
||||||
|
<dependency> |
||||||
|
<groupId>com.google.code.findbugs</groupId> |
||||||
|
<artifactId>jsr305</artifactId> |
||||||
|
<version>${jsr305.version}</version> |
||||||
|
</dependency> |
||||||
|
<dependency> |
||||||
|
<groupId>com.google.guava</groupId> |
||||||
|
<artifactId>guava</artifactId> |
||||||
|
<version>${guava.version}</version> |
||||||
|
</dependency> |
||||||
|
<dependency> |
||||||
|
<groupId>com.google.code.gson</groupId> |
||||||
|
<artifactId>gson</artifactId> |
||||||
|
<version>${gson.version}</version> |
||||||
|
</dependency> |
||||||
|
<dependency> |
||||||
|
<groupId>org.mockito</groupId> |
||||||
|
<artifactId>mockito-core</artifactId> |
||||||
|
<version>${mockito-core.version}</version> |
||||||
|
<scope>test</scope> |
||||||
|
</dependency> |
||||||
|
<dependency> |
||||||
|
<groupId>org.assertj</groupId> |
||||||
|
<artifactId>assertj-core</artifactId> |
||||||
|
<version>${assertj-core.version}</version> |
||||||
|
<scope>test</scope> |
||||||
|
</dependency> |
||||||
|
<dependency> |
||||||
|
<groupId>org.junit.jupiter</groupId> |
||||||
|
<artifactId>junit-jupiter-api</artifactId> |
||||||
|
<version>${junit-jupiter.version}</version> |
||||||
|
<scope>test</scope> |
||||||
|
</dependency> |
||||||
|
<dependency> |
||||||
|
<groupId>org.junit.jupiter</groupId> |
||||||
|
<artifactId>junit-jupiter-engine</artifactId> |
||||||
|
<version>${junit-jupiter.version}</version> |
||||||
|
<scope>test</scope> |
||||||
|
</dependency> |
||||||
|
</dependencies> |
||||||
|
|
||||||
|
|
||||||
|
<build> |
||||||
|
<plugins> |
||||||
|
<plugin> |
||||||
|
<groupId>org.sonarsource.sonar-packaging-maven-plugin</groupId> |
||||||
|
<artifactId>sonar-packaging-maven-plugin</artifactId> |
||||||
|
<configuration> |
||||||
|
<sonarQubeMinVersion>${sonarQubeMinVersion}</sonarQubeMinVersion> |
||||||
|
</configuration> |
||||||
|
</plugin> |
||||||
|
|
||||||
|
<plugin> |
||||||
|
<groupId>com.mycila</groupId> |
||||||
|
<artifactId>license-maven-plugin</artifactId> |
||||||
|
<configuration> |
||||||
|
<header>${project.basedir}/src/main/resources/license-header.txt</header> |
||||||
|
<!--排除文件--> |
||||||
|
<excludes> |
||||||
|
<exclude>**/*.properties</exclude> |
||||||
|
<exclude>*.sh</exclude> |
||||||
|
<exclude>*.yml</exclude> |
||||||
|
<exclude>.editorconfig</exclude> |
||||||
|
<exclude>.gitignore</exclude> |
||||||
|
<exclude>**/*.md</exclude> |
||||||
|
<exclude>**/*.xml</exclude> |
||||||
|
</excludes> |
||||||
|
</configuration> |
||||||
|
</plugin> |
||||||
|
</plugins> |
||||||
|
<resources> |
||||||
|
<resource> |
||||||
|
<directory>src/main/resources</directory> |
||||||
|
<excludes> |
||||||
|
<exclude>com/sonar/sqale/cxx-model-project*</exclude> |
||||||
|
<exclude>external/*</exclude> |
||||||
|
</excludes> |
||||||
|
</resource> |
||||||
|
</resources> |
||||||
|
</build> |
||||||
|
</project> |
||||||
@ -0,0 +1,25 @@ |
|||||||
|
/* |
||||||
|
* Copyright (c) 2023 - 2024. KeyWare.Co.Ltd All rights reserved. |
||||||
|
* 项目名称：C++ 信息安全性设计准则 |
||||||
|
* 项目描述：用于检查C++源代码的安全性设计准则的Sonarqube插件 |
||||||
|
* 版权说明：本软件属北京关键科技股份有限公司所有，在未获得北京关键科技股份有限公司正式授权情况下，任何企业和个人，不能获取、阅读、安装、传播本软件涉及的任何受知识产权保护的内容。 |
||||||
|
*/ |
||||||
|
package com.keyware.sonar.cxx; |
||||||
|
|
||||||
|
import com.keyware.sonar.cxx.rules.CxxSecurityDesignRulesRepository; |
||||||
|
import org.sonar.api.Plugin; |
||||||
|
import org.sonar.plugins.cxx.CxxLanguage; |
||||||
|
|
||||||
|
/** |
||||||
|
* TODO CxxSecurityDesignRulesPlugin |
||||||
|
* |
||||||
|
* @author GuoXin |
||||||
|
* @date 2024/1/6 |
||||||
|
*/ |
||||||
|
public class CxxSecurityDesignRulesPlugin implements Plugin { |
||||||
|
@Override |
||||||
|
public void define(Context context) { |
||||||
|
context.addExtension(CxxLanguage.class); |
||||||
|
context.addExtension(CxxSecurityDesignRulesRepository.class); |
||||||
|
} |
||||||
|
} |
||||||
@ -0,0 +1,108 @@ |
|||||||
|
/* |
||||||
|
* Copyright (c) 2023 - 2024. KeyWare.Co.Ltd All rights reserved. |
||||||
|
* 项目名称：C++ 信息安全性设计准则 |
||||||
|
* 项目描述：用于检查C++源代码的安全性设计准则的Sonarqube插件 |
||||||
|
* 版权说明：本软件属北京关键科技股份有限公司所有，在未获得北京关键科技股份有限公司正式授权情况下，任何企业和个人，不能获取、阅读、安装、传播本软件涉及的任何受知识产权保护的内容。 |
||||||
|
*/ |
||||||
|
package com.keyware.sonar.cxx.rules; |
||||||
|
|
||||||
|
import org.sonar.api.SonarEdition; |
||||||
|
import org.sonar.api.SonarProduct; |
||||||
|
import org.sonar.api.SonarQubeSide; |
||||||
|
import org.sonar.api.SonarRuntime; |
||||||
|
import org.sonar.api.config.internal.MapSettings; |
||||||
|
import org.sonar.api.resources.Language; |
||||||
|
import org.sonar.api.server.rule.RulesDefinition; |
||||||
|
import org.sonar.api.utils.Version; |
||||||
|
import org.sonar.plugins.cxx.CustomCxxRulesDefinition; |
||||||
|
import org.sonar.plugins.cxx.CxxLanguage; |
||||||
|
|
||||||
|
import java.util.Collections; |
||||||
|
import java.util.Objects; |
||||||
|
import java.util.Set; |
||||||
|
|
||||||
|
/** |
||||||
|
* TODO CxxSecurityDesignRulesRepository |
||||||
|
* |
||||||
|
* @author GuoXin |
||||||
|
* @date 2024/1/6 |
||||||
|
*/ |
||||||
|
public class CxxSecurityDesignRulesRepository extends CustomCxxRulesDefinition { |
||||||
|
// 不要修改这个值，因为路径在 CheckVerifier 中是硬编码的
|
||||||
|
private static final String RESOURCE_BASE_PATH = "org/sonar/l10n/java/rules/java"; |
||||||
|
|
||||||
|
public static final String REPOSITORY_KEY = "keyware-cxx-security-design"; |
||||||
|
public static final String REPOSITORY_NAME = "C++ 安全性设计准则"; |
||||||
|
|
||||||
|
|
||||||
|
// 添加需要视为模板规则的规则的规则键
|
||||||
|
private static final Set<String> RULE_TEMPLATES_KEY = Collections.emptySet(); |
||||||
|
|
||||||
|
private final SonarRuntime runtime; |
||||||
|
|
||||||
|
public CxxSecurityDesignRulesRepository(SonarRuntime runtime) { |
||||||
|
this.runtime = runtime; |
||||||
|
} |
||||||
|
|
||||||
|
@Override |
||||||
|
public void define(RulesDefinition.Context context) { |
||||||
|
RulesDefinition.NewRepository repository = context.createRepository(REPOSITORY_KEY, "cxx").setName(REPOSITORY_NAME); |
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
setTemplates(repository); |
||||||
|
|
||||||
|
repository.done(); |
||||||
|
} |
||||||
|
|
||||||
|
@Override |
||||||
|
public Language getLanguage() { |
||||||
|
return new CxxLanguage(new MapSettings().asConfig()); |
||||||
|
} |
||||||
|
|
||||||
|
@Override |
||||||
|
public String repositoryName() { |
||||||
|
return REPOSITORY_NAME; |
||||||
|
} |
||||||
|
|
||||||
|
@Override |
||||||
|
public String repositoryKey() { |
||||||
|
return REPOSITORY_KEY; |
||||||
|
} |
||||||
|
|
||||||
|
@Override |
||||||
|
public Class[] checkClasses() { |
||||||
|
return new Class[0]; |
||||||
|
} |
||||||
|
|
||||||
|
private static void setTemplates(RulesDefinition.NewRepository repository) { |
||||||
|
RULE_TEMPLATES_KEY.stream() |
||||||
|
.map(repository::rule) |
||||||
|
.filter(Objects::nonNull) |
||||||
|
.forEach(rule -> rule.setTemplate(true)); |
||||||
|
} |
||||||
|
|
||||||
|
|
||||||
|
public static class MockedSonarRuntime implements SonarRuntime { |
||||||
|
|
||||||
|
@Override |
||||||
|
public Version getApiVersion() { |
||||||
|
return Version.create(9, 9); |
||||||
|
} |
||||||
|
|
||||||
|
@Override |
||||||
|
public SonarProduct getProduct() { |
||||||
|
return SonarProduct.SONARQUBE; |
||||||
|
} |
||||||
|
|
||||||
|
@Override |
||||||
|
public SonarQubeSide getSonarQubeSide() { |
||||||
|
return SonarQubeSide.SCANNER; |
||||||
|
} |
||||||
|
|
||||||
|
@Override |
||||||
|
public SonarEdition getEdition() { |
||||||
|
return SonarEdition.COMMUNITY; |
||||||
|
} |
||||||
|
} |
||||||
|
} |
||||||
@ -0,0 +1,39 @@ |
|||||||
|
/* |
||||||
|
* Copyright (c) 2023 - 2024. KeyWare.Co.Ltd All rights reserved. |
||||||
|
* 项目名称：C++ 信息安全性设计准则 |
||||||
|
* 项目描述：用于检查C++源代码的安全性设计准则的Sonarqube插件 |
||||||
|
* 版权说明：本软件属北京关键科技股份有限公司所有，在未获得北京关键科技股份有限公司正式授权情况下，任何企业和个人，不能获取、阅读、安装、传播本软件涉及的任何受知识产权保护的内容。 |
||||||
|
*/ |
||||||
|
package com.keyware.sonar.cxx.rules.checkers; |
||||||
|
|
||||||
|
import com.sonar.cxx.sslr.api.AstNode; |
||||||
|
import com.sonar.cxx.sslr.api.Grammar; |
||||||
|
import org.sonar.check.Priority; |
||||||
|
import org.sonar.check.Rule; |
||||||
|
import org.sonar.cxx.parser.CxxGrammarImpl; |
||||||
|
import org.sonar.cxx.squidbridge.SquidAstVisitor; |
||||||
|
import org.sonar.cxx.squidbridge.annotations.ActivatedByDefault; |
||||||
|
import org.sonar.cxx.squidbridge.annotations.SqaleConstantRemediation; |
||||||
|
|
||||||
|
/** |
||||||
|
* TODO DemoChecker |
||||||
|
* |
||||||
|
* @author GuoXin |
||||||
|
* @date 2024/1/6 |
||||||
|
*/ |
||||||
|
@Rule(key = "DemoChecker", name = "DemoChecker", description = "DemoChecker", priority = Priority.INFO, tags = {"28Suo"}) |
||||||
|
@ActivatedByDefault |
||||||
|
@SqaleConstantRemediation("5min") |
||||||
|
public class DemoChecker extends SquidAstVisitor<Grammar> { |
||||||
|
@Override |
||||||
|
public void init() { |
||||||
|
this.subscribeTo( |
||||||
|
CxxGrammarImpl.functionDefinition |
||||||
|
); |
||||||
|
} |
||||||
|
|
||||||
|
@Override |
||||||
|
public void visitNode(AstNode astNode) { |
||||||
|
super.visitNode(astNode); |
||||||
|
} |
||||||
|
} |
||||||
@ -0,0 +1,4 @@ |
|||||||
|
Copyright (c) 2023 - 2024. KeyWare.Co.Ltd All rights reserved. |
||||||
|
项目名称：${project.name} |
||||||
|
项目描述：${project.description} |
||||||
|
版权说明：本软件属北京关键科技股份有限公司所有，在未获得北京关键科技股份有限公司正式授权情况下，任何企业和个人，不能获取、阅读、安装、传播本软件涉及的任何受知识产权保护的内容。 |
||||||
@ -0,0 +1,244 @@ |
|||||||
|
<?xml version="1.0" encoding="UTF-8"?> |
||||||
|
<project xmlns="http://maven.apache.org/POM/4.0.0" |
||||||
|
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" |
||||||
|
xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd"> |
||||||
|
<modelVersion>4.0.0</modelVersion> |
||||||
|
|
||||||
|
<parent> |
||||||
|
<groupId>com.keyware.sonar</groupId> |
||||||
|
<artifactId>sonar-keyware-plugins</artifactId> |
||||||
|
<version>1.0-SNAPSHOT</version> |
||||||
|
</parent> |
||||||
|
|
||||||
|
<name>Java 信息安全性设计准则</name> |
||||||
|
<artifactId>sonar-keyware-plugins-java</artifactId> |
||||||
|
<packaging>sonar-plugin</packaging> |
||||||
|
<version>1.0-SNAPSHOT</version> |
||||||
|
<description>用于检查Java源代码的安全性设计准则的Sonarqube插件</description> |
||||||
|
|
||||||
|
<properties> |
||||||
|
<jacoco.version>0.8.10</jacoco.version> |
||||||
|
<project.build.sourceEncoding>UTF-8</project.build.sourceEncoding> |
||||||
|
</properties> |
||||||
|
|
||||||
|
<dependencies> |
||||||
|
<dependency> |
||||||
|
<groupId>org.sonarsource.java</groupId> |
||||||
|
<artifactId>sonar-java-plugin</artifactId> |
||||||
|
<version>7.30.1.34514</version> |
||||||
|
<type>sonar-plugin</type> |
||||||
|
<scope>compile</scope> |
||||||
|
</dependency> |
||||||
|
|
||||||
|
<dependency> |
||||||
|
<groupId>org.sonarsource.api.plugin</groupId> |
||||||
|
<artifactId>sonar-plugin-api</artifactId> |
||||||
|
<scope>provided</scope> |
||||||
|
</dependency> |
||||||
|
|
||||||
|
<dependency> |
||||||
|
<groupId>org.sonarsource.analyzer-commons</groupId> |
||||||
|
<artifactId>sonar-analyzer-commons</artifactId> |
||||||
|
</dependency> |
||||||
|
|
||||||
|
<dependency> |
||||||
|
<groupId>org.slf4j</groupId> |
||||||
|
<artifactId>slf4j-api</artifactId> |
||||||
|
<scope>provided</scope> |
||||||
|
</dependency> |
||||||
|
|
||||||
|
<!-- unit tests --> |
||||||
|
<dependency> |
||||||
|
<groupId>org.sonarsource.api.plugin</groupId> |
||||||
|
<artifactId>sonar-plugin-api-test-fixtures</artifactId> |
||||||
|
<scope>test</scope> |
||||||
|
</dependency> |
||||||
|
<dependency> |
||||||
|
<groupId>org.sonarsource.sonarqube</groupId> |
||||||
|
<artifactId>sonar-plugin-api-impl</artifactId> |
||||||
|
<scope>test</scope> |
||||||
|
</dependency> |
||||||
|
<dependency> |
||||||
|
<groupId>org.sonarsource.java</groupId> |
||||||
|
<artifactId>test-classpath-reader</artifactId> |
||||||
|
<version>7.30.1.34514</version> |
||||||
|
<scope>test</scope> |
||||||
|
</dependency> |
||||||
|
<dependency> |
||||||
|
<groupId>org.sonarsource.java</groupId> |
||||||
|
<artifactId>java-checks-testkit</artifactId> |
||||||
|
<version>7.30.1.34514</version> |
||||||
|
<scope>test</scope> |
||||||
|
</dependency> |
||||||
|
<dependency> |
||||||
|
<groupId>org.junit.jupiter</groupId> |
||||||
|
<artifactId>junit-jupiter</artifactId> |
||||||
|
<scope>test</scope> |
||||||
|
</dependency> |
||||||
|
<dependency> |
||||||
|
<groupId>org.junit.jupiter</groupId> |
||||||
|
<artifactId>junit-jupiter-migrationsupport</artifactId> |
||||||
|
<scope>test</scope> |
||||||
|
</dependency> |
||||||
|
<dependency> |
||||||
|
<groupId>org.mockito</groupId> |
||||||
|
<artifactId>mockito-core</artifactId> |
||||||
|
<scope>test</scope> |
||||||
|
</dependency> |
||||||
|
<dependency> |
||||||
|
<groupId>org.assertj</groupId> |
||||||
|
<artifactId>assertj-core</artifactId> |
||||||
|
<scope>test</scope> |
||||||
|
</dependency> |
||||||
|
<dependency> |
||||||
|
<groupId>com.google.guava</groupId> |
||||||
|
<artifactId>guava</artifactId> |
||||||
|
<scope>test</scope> |
||||||
|
</dependency> |
||||||
|
</dependencies> |
||||||
|
|
||||||
|
<build> |
||||||
|
<plugins> |
||||||
|
<plugin> |
||||||
|
<groupId>org.sonarsource.sonar-packaging-maven-plugin</groupId> |
||||||
|
<artifactId>sonar-packaging-maven-plugin</artifactId> |
||||||
|
<extensions>true</extensions> |
||||||
|
<configuration> |
||||||
|
<pluginKey>keyware-java-plugin</pluginKey> |
||||||
|
<pluginName>Java 安全性设计准则</pluginName> |
||||||
|
<pluginClass>com.keyware.sonar.java.JavaSecurityDesignRulesPlugin</pluginClass> |
||||||
|
<sonarLintSupported>true</sonarLintSupported> |
||||||
|
<skipDependenciesPackaging>true</skipDependenciesPackaging> |
||||||
|
<pluginApiMinVersion>9.14.0.375</pluginApiMinVersion> |
||||||
|
<requirePlugins>java:${project.version}</requirePlugins> |
||||||
|
</configuration> |
||||||
|
</plugin> |
||||||
|
<plugin> |
||||||
|
<groupId>org.apache.maven.plugins</groupId> |
||||||
|
<artifactId>maven-jar-plugin</artifactId> |
||||||
|
</plugin> |
||||||
|
<plugin> |
||||||
|
<groupId>org.apache.maven.plugins</groupId> |
||||||
|
<artifactId>maven-shade-plugin</artifactId> |
||||||
|
<configuration> |
||||||
|
</configuration> |
||||||
|
<executions> |
||||||
|
<execution> |
||||||
|
<phase>package</phase> |
||||||
|
<goals> |
||||||
|
<goal>shade</goal> |
||||||
|
</goals> |
||||||
|
</execution> |
||||||
|
</executions> |
||||||
|
</plugin> |
||||||
|
|
||||||
|
<plugin> |
||||||
|
<groupId>org.apache.maven.plugins</groupId> |
||||||
|
<artifactId>maven-compiler-plugin</artifactId> |
||||||
|
<configuration> |
||||||
|
<source>11</source> |
||||||
|
<target>11</target> |
||||||
|
</configuration> |
||||||
|
</plugin> |
||||||
|
|
||||||
|
<plugin> |
||||||
|
<groupId>org.jacoco</groupId> |
||||||
|
<artifactId>jacoco-maven-plugin</artifactId> |
||||||
|
<version>${jacoco.version}</version> |
||||||
|
<executions> |
||||||
|
<execution> |
||||||
|
<id>prepare-agent</id> |
||||||
|
<goals> |
||||||
|
<goal>prepare-agent</goal> |
||||||
|
</goals> |
||||||
|
</execution> |
||||||
|
<execution> |
||||||
|
<id>report</id> |
||||||
|
<goals> |
||||||
|
<goal>report</goal> |
||||||
|
</goals> |
||||||
|
</execution> |
||||||
|
</executions> |
||||||
|
</plugin> |
||||||
|
|
||||||
|
<!-- only required to run UT - these are UT dependencies --> |
||||||
|
<plugin> |
||||||
|
<groupId>org.apache.maven.plugins</groupId> |
||||||
|
<artifactId>maven-dependency-plugin</artifactId> |
||||||
|
<executions> |
||||||
|
<execution> |
||||||
|
<id>copy</id> |
||||||
|
<phase>test-compile</phase> |
||||||
|
<goals> |
||||||
|
<goal>copy</goal> |
||||||
|
</goals> |
||||||
|
<configuration> |
||||||
|
<artifactItems> |
||||||
|
<artifactItem> |
||||||
|
<groupId>org.slf4j</groupId> |
||||||
|
<artifactId>slf4j-api</artifactId> |
||||||
|
<version>1.7.30</version> |
||||||
|
<type>jar</type> |
||||||
|
</artifactItem> |
||||||
|
<artifactItem> |
||||||
|
<groupId>org.apache.commons</groupId> |
||||||
|
<artifactId>commons-collections4</artifactId> |
||||||
|
<version>4.0</version> |
||||||
|
<type>jar</type> |
||||||
|
</artifactItem> |
||||||
|
<artifactItem> |
||||||
|
<groupId>javax</groupId> |
||||||
|
<artifactId>javaee-api</artifactId> |
||||||
|
<version>6.0</version> |
||||||
|
<type>jar</type> |
||||||
|
</artifactItem> |
||||||
|
<artifactItem> |
||||||
|
<groupId>org.springframework</groupId> |
||||||
|
<artifactId>spring-webmvc</artifactId> |
||||||
|
<version>4.3.3.RELEASE</version> |
||||||
|
<type>jar</type> |
||||||
|
</artifactItem> |
||||||
|
<artifactItem> |
||||||
|
<groupId>org.springframework</groupId> |
||||||
|
<artifactId>spring-web</artifactId> |
||||||
|
<version>4.3.3.RELEASE</version> |
||||||
|
<type>jar</type> |
||||||
|
</artifactItem> |
||||||
|
<artifactItem> |
||||||
|
<groupId>org.springframework</groupId> |
||||||
|
<artifactId>spring-context</artifactId> |
||||||
|
<version>4.3.3.RELEASE</version> |
||||||
|
<type>jar</type> |
||||||
|
</artifactItem> |
||||||
|
<artifactItem> |
||||||
|
<groupId>junit</groupId> |
||||||
|
<artifactId>junit</artifactId> |
||||||
|
<version>4.13.2</version> |
||||||
|
<type>jar</type> |
||||||
|
</artifactItem> |
||||||
|
</artifactItems> |
||||||
|
<outputDirectory>${project.build.directory}/test-jars</outputDirectory> |
||||||
|
</configuration> |
||||||
|
</execution> |
||||||
|
</executions> |
||||||
|
</plugin> |
||||||
|
<plugin> |
||||||
|
<groupId>com.mycila</groupId> |
||||||
|
<artifactId>license-maven-plugin</artifactId> |
||||||
|
<configuration> |
||||||
|
<header>${project.basedir}/src/main/resources/license-header.txt</header> |
||||||
|
<!--排除文件--> |
||||||
|
<excludes> |
||||||
|
<exclude>**/*.properties</exclude> |
||||||
|
<exclude>*.sh</exclude> |
||||||
|
<exclude>*.yml</exclude> |
||||||
|
<exclude>.editorconfig</exclude> |
||||||
|
<exclude>.gitignore</exclude> |
||||||
|
<exclude>**/*.md</exclude> |
||||||
|
<exclude>**/*.xml</exclude> |
||||||
|
</excludes> |
||||||
|
</configuration> |
||||||
|
</plugin> |
||||||
|
</plugins> |
||||||
|
</build> |
||||||
|
</project> |
||||||
@ -0,0 +1,29 @@ |
|||||||
|
/* |
||||||
|
* Copyright (c) 2023 - 2024. KeyWare.Co.Ltd All rights reserved. |
||||||
|
* 项目名称：Java 信息安全性设计准则 |
||||||
|
* 项目描述：用于检查Java源代码的安全性设计准则的Sonarqube插件 |
||||||
|
* 版权说明：本软件属北京关键科技股份有限公司所有，在未获得北京关键科技股份有限公司正式授权情况下，任何企业和个人，不能获取、阅读、安装、传播本软件涉及的任何受知识产权保护的内容。 |
||||||
|
*/ |
||||||
|
package com.keyware.sonar.java; |
||||||
|
|
||||||
|
import com.keyware.sonar.java.rules.JavaFileCheckRegistrar; |
||||||
|
import com.keyware.sonar.java.rules.JavaSecurityDesignRulesRepository; |
||||||
|
import org.sonar.api.Plugin; |
||||||
|
|
||||||
|
/** |
||||||
|
* Java 安全性设计准则插件 |
||||||
|
* |
||||||
|
* @author GuoXin |
||||||
|
* @date 2024/1/6 |
||||||
|
*/ |
||||||
|
public class JavaSecurityDesignRulesPlugin implements Plugin { |
||||||
|
@Override |
||||||
|
public void define(Context context) { |
||||||
|
// 服务器扩展 - >对象在服务器启动期间实例化
|
||||||
|
context.addExtension(JavaSecurityDesignRulesRepository.class); |
||||||
|
|
||||||
|
// 批处理扩展 - >对象在代码分析期间实例化
|
||||||
|
context.addExtension(JavaFileCheckRegistrar.class); |
||||||
|
|
||||||
|
} |
||||||
|
} |
||||||
@ -0,0 +1,45 @@ |
|||||||
|
/* |
||||||
|
* Copyright (c) 2023 - 2024. KeyWare.Co.Ltd All rights reserved. |
||||||
|
* 项目名称：Java 信息安全性设计准则 |
||||||
|
* 项目描述：用于检查Java源代码的安全性设计准则的Sonarqube插件 |
||||||
|
* 版权说明：本软件属北京关键科技股份有限公司所有，在未获得北京关键科技股份有限公司正式授权情况下，任何企业和个人，不能获取、阅读、安装、传播本软件涉及的任何受知识产权保护的内容。 |
||||||
|
*/ |
||||||
|
package com.keyware.sonar.java.rules; |
||||||
|
|
||||||
|
import org.sonar.plugins.java.api.CheckRegistrar; |
||||||
|
import org.sonar.plugins.java.api.JavaCheck; |
||||||
|
import org.sonarsource.api.sonarlint.SonarLintSide; |
||||||
|
|
||||||
|
import java.util.List; |
||||||
|
|
||||||
|
/** |
||||||
|
* 负责将java规则检查器注册到SonarQube中 |
||||||
|
* |
||||||
|
* @author GuoXin |
||||||
|
* @date 2024/1/6 |
||||||
|
*/ |
||||||
|
@SonarLintSide |
||||||
|
public class JavaFileCheckRegistrar implements CheckRegistrar { |
||||||
|
/** |
||||||
|
* 注册将用于在分析期间实例化检查的类。 |
||||||
|
*/ |
||||||
|
@Override |
||||||
|
public void register(RegistrarContext registrarContext) { |
||||||
|
// 调用 registerClassesForRepository 以将类与正确的存储库密钥相关联
|
||||||
|
registrarContext.registerClassesForRepository(JavaSecurityDesignRulesRepository.REPOSITORY_KEY, checkClasses(), testCheckClasses()); |
||||||
|
} |
||||||
|
|
||||||
|
/** |
||||||
|
* 列出插件提供的所有主检查器 |
||||||
|
*/ |
||||||
|
public static List<Class<? extends JavaCheck>> checkClasses() { |
||||||
|
return RulesList.getJavaChecks(); |
||||||
|
} |
||||||
|
|
||||||
|
/** |
||||||
|
* 列出插件提供的所有测试检查器 |
||||||
|
*/ |
||||||
|
public static List<Class<? extends JavaCheck>> testCheckClasses() { |
||||||
|
return RulesList.getJavaTestChecks(); |
||||||
|
} |
||||||
|
} |
||||||
@ -0,0 +1,87 @@ |
|||||||
|
/* |
||||||
|
* Copyright (c) 2023 - 2024. KeyWare.Co.Ltd All rights reserved. |
||||||
|
* 项目名称：Java 信息安全性设计准则 |
||||||
|
* 项目描述：用于检查Java源代码的安全性设计准则的Sonarqube插件 |
||||||
|
* 版权说明：本软件属北京关键科技股份有限公司所有，在未获得北京关键科技股份有限公司正式授权情况下，任何企业和个人，不能获取、阅读、安装、传播本软件涉及的任何受知识产权保护的内容。 |
||||||
|
*/ |
||||||
|
package com.keyware.sonar.java.rules; |
||||||
|
|
||||||
|
import org.sonar.api.SonarEdition; |
||||||
|
import org.sonar.api.SonarProduct; |
||||||
|
import org.sonar.api.SonarQubeSide; |
||||||
|
import org.sonar.api.SonarRuntime; |
||||||
|
import org.sonar.api.server.rule.RulesDefinition; |
||||||
|
import org.sonar.api.utils.Version; |
||||||
|
import org.sonarsource.analyzer.commons.RuleMetadataLoader; |
||||||
|
|
||||||
|
import java.util.ArrayList; |
||||||
|
import java.util.Collections; |
||||||
|
import java.util.Objects; |
||||||
|
import java.util.Set; |
||||||
|
|
||||||
|
/** |
||||||
|
* 用于定义出现在规则页面中规则的元数据 |
||||||
|
* |
||||||
|
* @author GuoXin |
||||||
|
* @date 2024/1/6 |
||||||
|
*/ |
||||||
|
public class JavaSecurityDesignRulesRepository implements RulesDefinition { |
||||||
|
// 不要修改这个值，因为路径在 CheckVerifier 中是硬编码的
|
||||||
|
private static final String RESOURCE_BASE_PATH = "org/sonar/l10n/java/rules/java"; |
||||||
|
|
||||||
|
public static final String REPOSITORY_KEY = "keyware-java-security-design"; |
||||||
|
public static final String REPOSITORY_NAME = "Java安全性设计准则"; |
||||||
|
|
||||||
|
// 添加需要视为模板规则的规则的规则键
|
||||||
|
private static final Set<String> RULE_TEMPLATES_KEY = Collections.emptySet(); |
||||||
|
|
||||||
|
private final SonarRuntime runtime; |
||||||
|
|
||||||
|
public JavaSecurityDesignRulesRepository(SonarRuntime runtime) { |
||||||
|
this.runtime = runtime; |
||||||
|
} |
||||||
|
|
||||||
|
@Override |
||||||
|
public void define(RulesDefinition.Context context) { |
||||||
|
RulesDefinition.NewRepository repository = context.createRepository(REPOSITORY_KEY, "java").setName(REPOSITORY_NAME); |
||||||
|
|
||||||
|
RuleMetadataLoader ruleMetadataLoader = new RuleMetadataLoader(RESOURCE_BASE_PATH, runtime); |
||||||
|
|
||||||
|
ruleMetadataLoader.addRulesByAnnotatedClass(repository, new ArrayList<>(RulesList.getChecks())); |
||||||
|
|
||||||
|
setTemplates(repository); |
||||||
|
|
||||||
|
repository.done(); |
||||||
|
} |
||||||
|
|
||||||
|
private static void setTemplates(RulesDefinition.NewRepository repository) { |
||||||
|
RULE_TEMPLATES_KEY.stream() |
||||||
|
.map(repository::rule) |
||||||
|
.filter(Objects::nonNull) |
||||||
|
.forEach(rule -> rule.setTemplate(true)); |
||||||
|
} |
||||||
|
|
||||||
|
|
||||||
|
public static class MockedSonarRuntime implements SonarRuntime { |
||||||
|
|
||||||
|
@Override |
||||||
|
public Version getApiVersion() { |
||||||
|
return Version.create(9, 9); |
||||||
|
} |
||||||
|
|
||||||
|
@Override |
||||||
|
public SonarProduct getProduct() { |
||||||
|
return SonarProduct.SONARQUBE; |
||||||
|
} |
||||||
|
|
||||||
|
@Override |
||||||
|
public SonarQubeSide getSonarQubeSide() { |
||||||
|
return SonarQubeSide.SCANNER; |
||||||
|
} |
||||||
|
|
||||||
|
@Override |
||||||
|
public SonarEdition getEdition() { |
||||||
|
return SonarEdition.COMMUNITY; |
||||||
|
} |
||||||
|
} |
||||||
|
} |
||||||
@ -0,0 +1,54 @@ |
|||||||
|
/* |
||||||
|
* Copyright (c) 2023 - 2024. KeyWare.Co.Ltd All rights reserved. |
||||||
|
* 项目名称：Java 信息安全性设计准则 |
||||||
|
* 项目描述：用于检查Java源代码的安全性设计准则的Sonarqube插件 |
||||||
|
* 版权说明：本软件属北京关键科技股份有限公司所有，在未获得北京关键科技股份有限公司正式授权情况下，任何企业和个人，不能获取、阅读、安装、传播本软件涉及的任何受知识产权保护的内容。 |
||||||
|
*/ |
||||||
|
package com.keyware.sonar.java.rules; |
||||||
|
|
||||||
|
import com.keyware.sonar.java.rules.checkers.ABCVarNameChecker; |
||||||
|
import org.sonar.plugins.java.api.JavaCheck; |
||||||
|
|
||||||
|
import java.util.ArrayList; |
||||||
|
import java.util.Arrays; |
||||||
|
import java.util.Collections; |
||||||
|
import java.util.List; |
||||||
|
|
||||||
|
public final class RulesList { |
||||||
|
|
||||||
|
private RulesList() { |
||||||
|
} |
||||||
|
|
||||||
|
public static List<Class<? extends JavaCheck>> getChecks() { |
||||||
|
List<Class<? extends JavaCheck>> checks = new ArrayList<>(); |
||||||
|
checks.addAll(getJavaChecks()); |
||||||
|
checks.addAll(getJavaTestChecks()); |
||||||
|
return Collections.unmodifiableList(checks); |
||||||
|
} |
||||||
|
|
||||||
|
/** |
||||||
|
* These rules are going to target MAIN code only |
||||||
|
*/ |
||||||
|
public static List<Class<? extends JavaCheck>> getJavaChecks() { |
||||||
|
return Collections.unmodifiableList(Arrays.asList( |
||||||
|
ABCVarNameChecker.class |
||||||
|
/*SpringControllerRequestMappingEntityRule.class, |
||||||
|
AvoidAnnotationRule.class, |
||||||
|
AvoidBrandInMethodNamesRule.class, |
||||||
|
AvoidMethodDeclarationRule.class, |
||||||
|
AvoidSuperClassRule.class, |
||||||
|
AvoidTreeListRule.class, |
||||||
|
MyCustomSubscriptionRule.class, |
||||||
|
SecurityAnnotationMandatoryRule.class*/ |
||||||
|
)); |
||||||
|
} |
||||||
|
|
||||||
|
/** |
||||||
|
* These rules are going to target TEST code only |
||||||
|
*/ |
||||||
|
public static List<Class<? extends JavaCheck>> getJavaTestChecks() { |
||||||
|
return Collections.unmodifiableList(Arrays.asList( |
||||||
|
/*NoIfStatementInTestsRule.class*/ |
||||||
|
)); |
||||||
|
} |
||||||
|
} |
||||||
@ -0,0 +1,40 @@ |
|||||||
|
/* |
||||||
|
* Copyright (c) 2023 - 2024. KeyWare.Co.Ltd All rights reserved. |
||||||
|
* 项目名称：Java 信息安全性设计准则 |
||||||
|
* 项目描述：用于检查Java源代码的安全性设计准则的Sonarqube插件 |
||||||
|
* 版权说明：本软件属北京关键科技股份有限公司所有，在未获得北京关键科技股份有限公司正式授权情况下，任何企业和个人，不能获取、阅读、安装、传播本软件涉及的任何受知识产权保护的内容。 |
||||||
|
*/ |
||||||
|
package com.keyware.sonar.java.rules.checkers; |
||||||
|
|
||||||
|
import org.sonar.check.Rule; |
||||||
|
import org.sonar.java.ast.visitors.SubscriptionVisitor; |
||||||
|
import org.sonar.plugins.java.api.tree.Tree; |
||||||
|
import org.sonar.plugins.java.api.tree.VariableTree; |
||||||
|
|
||||||
|
import java.util.Collections; |
||||||
|
import java.util.List; |
||||||
|
|
||||||
|
/** |
||||||
|
* TODO ABCVarNameChecker |
||||||
|
* |
||||||
|
* @author GuoXin |
||||||
|
* @date 2024/1/6 |
||||||
|
*/ |
||||||
|
@Rule(key = "ABCVarNameChecker") |
||||||
|
public class ABCVarNameChecker extends SubscriptionVisitor { |
||||||
|
|
||||||
|
@Override |
||||||
|
public List<Tree.Kind> nodesToVisit() { |
||||||
|
return Collections.singletonList( |
||||||
|
Tree.Kind.VARIABLE |
||||||
|
); |
||||||
|
} |
||||||
|
|
||||||
|
@Override |
||||||
|
public void visitNode(Tree tree) { |
||||||
|
VariableTree node = (VariableTree) tree; |
||||||
|
if (node.simpleName().name().matches("ABC")) { |
||||||
|
context.reportIssue(this, node.simpleName(), "不能使用ABC作为变量名"); |
||||||
|
} |
||||||
|
} |
||||||
|
} |
||||||
@ -0,0 +1,4 @@ |
|||||||
|
Copyright (c) 2023 - 2024. KeyWare.Co.Ltd All rights reserved. |
||||||
|
项目名称：${project.name} |
||||||
|
项目描述：${project.description} |
||||||
|
版权说明：本软件属北京关键科技股份有限公司所有，在未获得北京关键科技股份有限公司正式授权情况下，任何企业和个人，不能获取、阅读、安装、传播本软件涉及的任何受知识产权保护的内容。 |
||||||
@ -0,0 +1,9 @@ |
|||||||
|
<p>不能使用ABC作为变量名</p> |
||||||
|
<h2>不能使用ABC作为变量名</h2> |
||||||
|
<pre> |
||||||
|
|
||||||
|
</pre> |
||||||
|
<h2>合规解决方案</h2> |
||||||
|
<pre> |
||||||
|
|
||||||
|
</pre> |
||||||
@ -0,0 +1,13 @@ |
|||||||
|
{ |
||||||
|
"title": "不能使用ABC作为变量名", |
||||||
|
"type": "CODE_SMELL", |
||||||
|
"status": "ready", |
||||||
|
"remediation": { |
||||||
|
"func": "Constant\/Issue", |
||||||
|
"constantCost": "5min" |
||||||
|
}, |
||||||
|
"tags": [ |
||||||
|
"28suo" |
||||||
|
], |
||||||
|
"defaultSeverity": "Minor" |
||||||
|
} |
||||||
@ -0,0 +1,11 @@ |
|||||||
|
class VarNameRule{ |
||||||
|
private static String ABC = "abc"; // Noncompliant {{不能使用ABC作为变量名}}
|
||||||
|
private static String edf = "edf"; |
||||||
|
|
||||||
|
public String getABC(){ |
||||||
|
return ABC; |
||||||
|
} |
||||||
|
public void test(){ |
||||||
|
System.out.println(ABC); |
||||||
|
} |
||||||
|
} |
||||||
@ -0,0 +1,55 @@ |
|||||||
|
/* |
||||||
|
* Copyright (c) 2023 - 2024. KeyWare.Co.Ltd All rights reserved. |
||||||
|
* 项目名称：Java 信息安全性设计准则 |
||||||
|
* 项目描述：用于检查Java源代码的安全性设计准则的Sonarqube插件 |
||||||
|
* 版权说明：本软件属北京关键科技股份有限公司所有，在未获得北京关键科技股份有限公司正式授权情况下，任何企业和个人，不能获取、阅读、安装、传播本软件涉及的任何受知识产权保护的内容。 |
||||||
|
*/ |
||||||
|
package com.keyware.sonar.java; |
||||||
|
|
||||||
|
import org.junit.jupiter.api.Test; |
||||||
|
import org.sonar.api.*; |
||||||
|
import org.sonar.api.utils.Version; |
||||||
|
|
||||||
|
import static org.assertj.core.api.Assertions.assertThat; |
||||||
|
|
||||||
|
/** |
||||||
|
* TODO JavaSecurityDesignRulesPluginTest |
||||||
|
* |
||||||
|
* @author GuoXin |
||||||
|
* @date 2024/1/6 |
||||||
|
*/ |
||||||
|
public class JavaSecurityDesignRulesPluginTest { |
||||||
|
@Test |
||||||
|
void testName() { |
||||||
|
Plugin.Context context = new Plugin.Context(new MockedSonarRuntime()); |
||||||
|
|
||||||
|
new JavaSecurityDesignRulesPlugin().define(context); |
||||||
|
|
||||||
|
assertThat(context.getExtensions()) |
||||||
|
.extracting(ext -> ((Class) ext).getSimpleName()) |
||||||
|
.containsExactlyInAnyOrder("JavaSecurityDesignRulesRepository", "JavaFileCheckRegistrar"); |
||||||
|
} |
||||||
|
|
||||||
|
public static class MockedSonarRuntime implements SonarRuntime { |
||||||
|
|
||||||
|
@Override |
||||||
|
public Version getApiVersion() { |
||||||
|
return Version.create(9, 9); |
||||||
|
} |
||||||
|
|
||||||
|
@Override |
||||||
|
public SonarProduct getProduct() { |
||||||
|
return SonarProduct.SONARQUBE; |
||||||
|
} |
||||||
|
|
||||||
|
@Override |
||||||
|
public SonarQubeSide getSonarQubeSide() { |
||||||
|
return SonarQubeSide.SCANNER; |
||||||
|
} |
||||||
|
|
||||||
|
@Override |
||||||
|
public SonarEdition getEdition() { |
||||||
|
return SonarEdition.COMMUNITY; |
||||||
|
} |
||||||
|
} |
||||||
|
} |
||||||
@ -0,0 +1,63 @@ |
|||||||
|
/* |
||||||
|
* Copyright (c) 2023 - 2024. KeyWare.Co.Ltd All rights reserved. |
||||||
|
* 项目名称：Java 信息安全性设计准则 |
||||||
|
* 项目描述：用于检查Java源代码的安全性设计准则的Sonarqube插件 |
||||||
|
* 版权说明：本软件属北京关键科技股份有限公司所有，在未获得北京关键科技股份有限公司正式授权情况下，任何企业和个人，不能获取、阅读、安装、传播本软件涉及的任何受知识产权保护的内容。 |
||||||
|
*/ |
||||||
|
package com.keyware.sonar.java.rules; |
||||||
|
|
||||||
|
import org.junit.jupiter.api.Test; |
||||||
|
import org.sonar.api.rule.RuleKey; |
||||||
|
import org.sonar.java.checks.verifier.TestCheckRegistrarContext; |
||||||
|
|
||||||
|
import static org.assertj.core.api.Assertions.assertThat; |
||||||
|
|
||||||
|
/** |
||||||
|
* TODO JavaFileCheckRegistrarTest |
||||||
|
* |
||||||
|
* @author GuoXin |
||||||
|
* @date 2024/1/6 |
||||||
|
*/ |
||||||
|
public class JavaFileCheckRegistrarTest { |
||||||
|
|
||||||
|
@Test |
||||||
|
void checkRegisteredRulesKeysAndClasses() { |
||||||
|
TestCheckRegistrarContext context = new TestCheckRegistrarContext(); |
||||||
|
|
||||||
|
JavaFileCheckRegistrar registrar = new JavaFileCheckRegistrar(); |
||||||
|
registrar.register(context); |
||||||
|
|
||||||
|
assertThat(context.mainRuleKeys).extracting(RuleKey::toString).containsExactly( |
||||||
|
/*"mycompany-java:SpringControllerRequestMappingEntity", |
||||||
|
"mycompany-java:AvoidAnnotation", |
||||||
|
"mycompany-java:AvoidBrandInMethodNames", |
||||||
|
"mycompany-java:AvoidMethodDeclaration", |
||||||
|
"mycompany-java:AvoidSuperClass", |
||||||
|
"mycompany-java:AvoidTreeList", |
||||||
|
"mycompany-java:AvoidMethodWithSameTypeInArgument", |
||||||
|
"mycompany-java:SecurityAnnotationMandatory"*/ |
||||||
|
"keyware-java-security-design:ABCVarNameChecker" |
||||||
|
); |
||||||
|
|
||||||
|
assertThat(context.mainCheckClasses).extracting(Class::getSimpleName).containsExactly( |
||||||
|
/*"SpringControllerRequestMappingEntityRule", |
||||||
|
"AvoidAnnotationRule", |
||||||
|
"AvoidBrandInMethodNamesRule", |
||||||
|
"AvoidMethodDeclarationRule", |
||||||
|
"AvoidSuperClassRule", |
||||||
|
"AvoidTreeListRule", |
||||||
|
"MyCustomSubscriptionRule", |
||||||
|
"SecurityAnnotationMandatoryRule"*/ |
||||||
|
"ABCVarNameChecker" |
||||||
|
); |
||||||
|
|
||||||
|
assertThat(context.testRuleKeys).extracting(RuleKey::toString).containsExactly( |
||||||
|
/*"mycompany-java:NoIfStatementInTests"*/ |
||||||
|
); |
||||||
|
|
||||||
|
assertThat(context.testCheckClasses).extracting(Class::getSimpleName).containsExactly( |
||||||
|
/*"NoIfStatementInTestsRule"*/ |
||||||
|
); |
||||||
|
} |
||||||
|
|
||||||
|
} |
||||||
@ -0,0 +1,65 @@ |
|||||||
|
/* |
||||||
|
* Copyright (c) 2023 - 2024. KeyWare.Co.Ltd All rights reserved. |
||||||
|
* 项目名称：Java 信息安全性设计准则 |
||||||
|
* 项目描述：用于检查Java源代码的安全性设计准则的Sonarqube插件 |
||||||
|
* 版权说明：本软件属北京关键科技股份有限公司所有，在未获得北京关键科技股份有限公司正式授权情况下，任何企业和个人，不能获取、阅读、安装、传播本软件涉及的任何受知识产权保护的内容。 |
||||||
|
*/ |
||||||
|
package com.keyware.sonar.java.rules; |
||||||
|
|
||||||
|
import org.junit.jupiter.api.Test; |
||||||
|
import org.sonar.api.rules.RuleType; |
||||||
|
import org.sonar.api.server.debt.DebtRemediationFunction; |
||||||
|
import org.sonar.api.server.rule.RuleParamType; |
||||||
|
import org.sonar.api.server.rule.RulesDefinition; |
||||||
|
|
||||||
|
import static org.assertj.core.api.Assertions.assertThat; |
||||||
|
|
||||||
|
/** |
||||||
|
* TODO JavaSecurityDesignRulesRepositoryTest |
||||||
|
* |
||||||
|
* @author GuoXin |
||||||
|
* @date 2024/1/6 |
||||||
|
*/ |
||||||
|
public class JavaSecurityDesignRulesRepositoryTest { |
||||||
|
|
||||||
|
@Test |
||||||
|
void test() { |
||||||
|
JavaSecurityDesignRulesRepository rulesDefinition = new JavaSecurityDesignRulesRepository(new JavaSecurityDesignRulesRepository.MockedSonarRuntime()); |
||||||
|
RulesDefinition.Context context = new RulesDefinition.Context(); |
||||||
|
rulesDefinition.define(context); |
||||||
|
RulesDefinition.Repository repository = context.repository(JavaSecurityDesignRulesRepository.REPOSITORY_KEY); |
||||||
|
|
||||||
|
assertThat(repository.name()).isEqualTo(JavaSecurityDesignRulesRepository.REPOSITORY_NAME); |
||||||
|
assertThat(repository.language()).isEqualTo("java"); |
||||||
|
assertThat(repository.rules()).hasSize(RulesList.getChecks().size()); |
||||||
|
assertThat(repository.rules().stream().filter(RulesDefinition.Rule::template)).isEmpty(); |
||||||
|
|
||||||
|
//assertRuleProperties(repository);
|
||||||
|
// assertParameterProperties(repository);
|
||||||
|
// assertAllRuleParametersHaveDescription(repository);
|
||||||
|
} |
||||||
|
|
||||||
|
private static void assertParameterProperties(RulesDefinition.Repository repository) { |
||||||
|
RulesDefinition.Param max = repository.rule("AvoidAnnotation").param("name"); |
||||||
|
assertThat(max).isNotNull(); |
||||||
|
assertThat(max.defaultValue()).isEqualTo("Inject"); |
||||||
|
assertThat(max.description()).isEqualTo("Name of the annotation to avoid, without the prefix @, for instance 'Override'"); |
||||||
|
assertThat(max.type()).isEqualTo(RuleParamType.STRING); |
||||||
|
} |
||||||
|
|
||||||
|
private static void assertRuleProperties(RulesDefinition.Repository repository) { |
||||||
|
RulesDefinition.Rule rule = repository.rule("AvoidAnnotation"); |
||||||
|
assertThat(rule).isNotNull(); |
||||||
|
assertThat(rule.name()).isEqualTo("Title of AvoidAnnotation"); |
||||||
|
assertThat(rule.debtRemediationFunction().type()).isEqualTo(DebtRemediationFunction.Type.CONSTANT_ISSUE); |
||||||
|
assertThat(rule.type()).isEqualTo(RuleType.CODE_SMELL); |
||||||
|
} |
||||||
|
|
||||||
|
private static void assertAllRuleParametersHaveDescription(RulesDefinition.Repository repository) { |
||||||
|
for (RulesDefinition.Rule rule : repository.rules()) { |
||||||
|
for (RulesDefinition.Param param : rule.params()) { |
||||||
|
assertThat(param.description()).as("description for " + param.key()).isNotEmpty(); |
||||||
|
} |
||||||
|
} |
||||||
|
} |
||||||
|
} |
||||||
@ -0,0 +1,36 @@ |
|||||||
|
/* |
||||||
|
* Copyright (c) 2023 - 2024. KeyWare.Co.Ltd All rights reserved. |
||||||
|
* 项目名称：Java 信息安全性设计准则 |
||||||
|
* 项目描述：用于检查Java源代码的安全性设计准则的Sonarqube插件 |
||||||
|
* 版权说明：本软件属北京关键科技股份有限公司所有，在未获得北京关键科技股份有限公司正式授权情况下，任何企业和个人，不能获取、阅读、安装、传播本软件涉及的任何受知识产权保护的内容。 |
||||||
|
*/ |
||||||
|
package com.keyware.sonar.java.rules.checkers; |
||||||
|
|
||||||
|
import com.keyware.sonar.java.utils.FilesUtils; |
||||||
|
import org.junit.jupiter.api.Test; |
||||||
|
import org.sonar.java.checks.verifier.CheckVerifier; |
||||||
|
|
||||||
|
/** |
||||||
|
* TODO ABCVarNameCheckerTest |
||||||
|
* |
||||||
|
* @author GuoXin |
||||||
|
* @date 2024/1/6 |
||||||
|
*/ |
||||||
|
public class ABCVarNameCheckerTest { |
||||||
|
@Test |
||||||
|
void detected() { |
||||||
|
|
||||||
|
|
||||||
|
ABCVarNameChecker rule = new ABCVarNameChecker(); |
||||||
|
|
||||||
|
|
||||||
|
// Verifies that the check will raise the adequate issues with the expected message.
|
||||||
|
// In the test file, lines which should raise an issue have been commented out
|
||||||
|
// by using the following syntax: "// Noncompliant {{EXPECTED_MESSAGE}}"
|
||||||
|
CheckVerifier.newVerifier() |
||||||
|
.onFile("src/test/files/ABCVarNameRule.java") |
||||||
|
.withCheck(rule) |
||||||
|
.withClassPath(FilesUtils.getClassPath("target/test-jars")) |
||||||
|
.verifyIssues(); |
||||||
|
} |
||||||
|
} |
||||||
@ -0,0 +1,75 @@ |
|||||||
|
/* |
||||||
|
* Copyright (c) 2023 - 2024. KeyWare.Co.Ltd All rights reserved. |
||||||
|
* 项目名称：Java 信息安全性设计准则 |
||||||
|
* 项目描述：用于检查Java源代码的安全性设计准则的Sonarqube插件 |
||||||
|
* 版权说明：本软件属北京关键科技股份有限公司所有，在未获得北京关键科技股份有限公司正式授权情况下，任何企业和个人，不能获取、阅读、安装、传播本软件涉及的任何受知识产权保护的内容。 |
||||||
|
*/ |
||||||
|
package com.keyware.sonar.java.utils; |
||||||
|
|
||||||
|
import java.io.File; |
||||||
|
import java.io.IOException; |
||||||
|
import java.nio.file.*; |
||||||
|
import java.nio.file.attribute.BasicFileAttributes; |
||||||
|
import java.util.ArrayList; |
||||||
|
import java.util.LinkedList; |
||||||
|
import java.util.List; |
||||||
|
|
||||||
|
/** |
||||||
|
* Duplicates org.sonar.java.checks.verifier.FilesUtils to locate test jars within the custom-rules plugin |
||||||
|
*/ |
||||||
|
public class FilesUtils { |
||||||
|
|
||||||
|
private FilesUtils() { |
||||||
|
} |
||||||
|
|
||||||
|
/** |
||||||
|
* Default location of the jars/zips to be taken into account when performing the analysis. |
||||||
|
*/ |
||||||
|
private static final String DEFAULT_TEST_JARS_DIRECTORY = "target/test-jars"; |
||||||
|
|
||||||
|
public static List<File> getClassPath(String jarsDirectory) { |
||||||
|
List<File> classpath = new LinkedList<>(); |
||||||
|
Path testJars = Paths.get(jarsDirectory); |
||||||
|
if (testJars.toFile().exists()) { |
||||||
|
classpath = getFilesRecursively(testJars, "jar", "zip"); |
||||||
|
} else if (!DEFAULT_TEST_JARS_DIRECTORY.equals(jarsDirectory)) { |
||||||
|
throw new AssertionError("The directory to be used to extend class path does not exists (" |
||||||
|
+ testJars.toAbsolutePath() |
||||||
|
+ ")."); |
||||||
|
} |
||||||
|
classpath.add(new File("target/test-classes")); |
||||||
|
return classpath; |
||||||
|
} |
||||||
|
|
||||||
|
private static List<File> getFilesRecursively(Path root, String... extensions) { |
||||||
|
final List<File> files = new ArrayList<>(); |
||||||
|
|
||||||
|
FileVisitor<Path> visitor = new SimpleFileVisitor<Path>() { |
||||||
|
@Override |
||||||
|
public FileVisitResult visitFile(Path filePath, BasicFileAttributes attrs) { |
||||||
|
for (String extension : extensions) { |
||||||
|
if (filePath.toString().endsWith("." |
||||||
|
+ extension)) { |
||||||
|
files.add(filePath.toFile()); |
||||||
|
break; |
||||||
|
} |
||||||
|
} |
||||||
|
return FileVisitResult.CONTINUE; |
||||||
|
} |
||||||
|
|
||||||
|
@Override |
||||||
|
public FileVisitResult visitFileFailed(Path file, IOException exc) { |
||||||
|
return FileVisitResult.CONTINUE; |
||||||
|
} |
||||||
|
}; |
||||||
|
|
||||||
|
try { |
||||||
|
Files.walkFileTree(root, visitor); |
||||||
|
} catch (IOException e) { |
||||||
|
// we already ignore errors in the visitor
|
||||||
|
} |
||||||
|
|
||||||
|
return files; |
||||||
|
} |
||||||
|
|
||||||
|
} |
||||||
Loading…
Reference in new issue