parent
9e75d0032e
commit
34d97c1d39
@ -0,0 +1,78 @@ |
||||
/* |
||||
* Copyright (c) 2023 - 2024. KeyWare.Co.Ltd All rights reserved. |
||||
* 项目名称:Java 信息安全性设计准则 |
||||
* 项目描述:用于检查Java源代码的安全性设计准则的Sonarqube插件 |
||||
* 版权说明:本软件属北京关键科技股份有限公司所有,在未获得北京关键科技股份有限公司正式授权情况下,任何企业和个人,不能获取、阅读、安装、传播本软件涉及的任何受知识产权保护的内容。 |
||||
*/ |
||||
package com.keyware.sonar.java.rules.checkers;/* |
||||
*@title DetectionPath |
||||
*@description |
||||
*@author Admin |
||||
*@version 1.0 |
||||
*@create 2024/1/9 9:35 |
||||
*/ |
||||
|
||||
import org.sonar.check.Rule; |
||||
import org.sonar.plugins.java.api.IssuableSubscriptionVisitor; |
||||
import org.sonar.plugins.java.api.tree.ExpressionTree; |
||||
import org.sonar.plugins.java.api.tree.LiteralTree; |
||||
import org.sonar.plugins.java.api.tree.Tree; |
||||
import org.sonar.plugins.java.api.tree.VariableTree; |
||||
|
||||
import java.util.Collections; |
||||
import java.util.List; |
||||
|
||||
/** |
||||
* 检测代码中读取配置文件或者服务器中文件时是否使用绝对路径 |
||||
* |
||||
* @author WuHaoyang |
||||
* @date 2024/1/9 |
||||
*/ |
||||
@Rule(key = "AbsolutePathDetector") |
||||
public class AbsolutePathDetectorChecker extends IssuableSubscriptionVisitor { |
||||
|
||||
@Override |
||||
public List<Tree.Kind> nodesToVisit() { |
||||
return Collections.singletonList( |
||||
Tree.Kind.VARIABLE |
||||
); |
||||
} |
||||
|
||||
@Override |
||||
public void visitNode(Tree tree) { |
||||
VariableTree node = (VariableTree) tree; |
||||
checkVariableDeclaration(node); |
||||
} |
||||
|
||||
private void checkVariableDeclaration(VariableTree variableTree) { |
||||
// 获取变量的信息
|
||||
String variableName = variableTree.simpleName().name(); |
||||
String variableType = variableTree.type().symbolType().name(); |
||||
|
||||
// 获取变量的初始化表达式
|
||||
ExpressionTree initializer = variableTree.initializer(); |
||||
|
||||
// 检查初始化表达式是否为字符串字面量
|
||||
if (initializer != null && initializer.is(Tree.Kind.STRING_LITERAL)) { |
||||
LiteralTree literalTree = (LiteralTree) initializer; |
||||
String literalValue = literalTree.value().replace("\"", ""); |
||||
|
||||
// 检查字符串字面量是否为绝对路径
|
||||
if (isAbsolutePath(literalValue)) { |
||||
//打印变量信息
|
||||
System.out.println("变量名称: " + variableName); |
||||
System.out.println("变量类型: " + variableType); |
||||
System.out.println("检测到绝对路径: " + literalValue); |
||||
|
||||
//报告问题(如果检测到问题)
|
||||
reportIssue(variableTree, "读取配置文件或者服务器中文件时不可使用绝对路径"); |
||||
} |
||||
} |
||||
} |
||||
|
||||
//检查字符串是否为绝对路径
|
||||
private boolean isAbsolutePath(String path) { |
||||
return path.startsWith("/") || path.matches("^[A-Za-z]:\\\\.*"); |
||||
} |
||||
|
||||
} |
@ -0,0 +1,9 @@ |
||||
<p>读取配置文件或者服务器中文件时不可使用绝对路径</p> |
||||
<h2>读取配置文件或者服务器中文件时不可使用绝对路径</h2> |
||||
<pre> |
||||
|
||||
</pre> |
||||
<h2>合规解决方案</h2> |
||||
<pre> |
||||
|
||||
</pre> |
@ -0,0 +1,13 @@ |
||||
{ |
||||
"title": "读取配置文件或者服务器中文件时不可使用绝对路径", |
||||
"type": "CODE_SMELL", |
||||
"status": "ready", |
||||
"remediation": { |
||||
"func": "Constant\/Issue", |
||||
"constantCost": "5min" |
||||
}, |
||||
"tags": [ |
||||
"28suo" |
||||
], |
||||
"defaultSeverity": "Minor" |
||||
} |
@ -0,0 +1,18 @@ |
||||
|
||||
class PathDetectorRule{ |
||||
// 使用绝对路径读取配置文件,触发规则
|
||||
String configFilePath = "/path/to/config.properties"; // Noncompliant {{读取配置文件或者服务器中文件时不可使用绝对路径}}
|
||||
|
||||
// 使用相对路径读取配置文件,不触发规则
|
||||
String relativePath = "config.properties"; |
||||
|
||||
public String getABC(){ |
||||
return configFilePath; |
||||
} |
||||
|
||||
public void test(){ |
||||
System.out.println(configFilePath); |
||||
} |
||||
|
||||
|
||||
} |
@ -0,0 +1,33 @@ |
||||
/* |
||||
* Copyright (c) 2023 - 2024. KeyWare.Co.Ltd All rights reserved. |
||||
* 项目名称:Java 信息安全性设计准则 |
||||
* 项目描述:用于检查Java源代码的安全性设计准则的Sonarqube插件 |
||||
* 版权说明:本软件属北京关键科技股份有限公司所有,在未获得北京关键科技股份有限公司正式授权情况下,任何企业和个人,不能获取、阅读、安装、传播本软件涉及的任何受知识产权保护的内容。 |
||||
*/ |
||||
package com.keyware.sonar.java.rules.checkers;/* |
||||
*@title AbsolutePathDetectorTest |
||||
*@description |
||||
*@author Admin |
||||
*@version 1.0 |
||||
*@create 2024/1/9 10:33 |
||||
*/ |
||||
|
||||
import com.keyware.sonar.java.utils.FilesUtils; |
||||
import org.junit.jupiter.api.Test; |
||||
import org.sonar.java.checks.verifier.CheckVerifier; |
||||
|
||||
public class AbsolutePathDetectorTest { |
||||
|
||||
|
||||
@Test |
||||
void detected() { |
||||
AbsolutePathDetectorChecker rule = new AbsolutePathDetectorChecker(); |
||||
|
||||
|
||||
CheckVerifier.newVerifier() |
||||
.onFile("src/test/files/AbsolutePathDetectorRule.java") |
||||
.withCheck(rule) |
||||
.withClassPath(FilesUtils.getClassPath("target/test-jars")) |
||||
.verifyIssues(); |
||||
} |
||||
} |
Loading…
Reference in new issue