From 686f8175ee6a8002dba39c29e57909307d7f6085 Mon Sep 17 00:00:00 2001 From: Guo XIn <371864209@qq.com> Date: Thu, 11 Jan 2024 11:03:31 +0800 Subject: [PATCH 1/6] =?UTF-8?q?=E6=96=B0=E5=A2=9E=E5=87=86=E5=88=99?= =?UTF-8?q?=EF=BC=9A=E5=9C=A8=E5=8A=A8=E6=80=81=E5=8A=A0=E8=BD=BD=E5=BA=93?= =?UTF-8?q?=E5=89=8D=E5=BA=94=E5=AF=B9=E8=BE=93=E5=85=A5=E6=95=B0=E6=8D=AE?= =?UTF-8?q?=E8=BF=9B=E8=A1=8C=E9=AA=8C=E8=AF=81=EF=BC=8C=E7=A1=AE=E4=BF=9D?= =?UTF-8?q?=E8=BE=93=E5=85=A5=E6=95=B0=E6=8D=AE=E4=BB=85=E8=83=BD=E7=94=A8?= =?UTF-8?q?=E4=BA=8E=E5=8A=A0=E8=BD=BD=E5=85=81=E8=AE=B8=E5=8A=A0=E8=BD=BD?= =?UTF-8?q?=E7=9A=84=E4=BB=A3=E7=A0=81=E5=BA=93?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- .../checkers/DynamicLibraryLoadChecker.java | 87 +++++++++++++++++++ .../rules/java/DynamicLibraryLoadChecker.html | 9 ++ .../rules/java/DynamicLibraryLoadChecker.json | 13 +++ .../test/files/DynamicLibraryLoadChecker.java | 10 +++ .../DynamicLibraryLoadCheckerTest.java | 23 +++++ 5 files changed, 142 insertions(+) create mode 100644 sonar-keyware-plugins-java/src/main/java/com/keyware/sonar/java/rules/checkers/DynamicLibraryLoadChecker.java create mode 100644 sonar-keyware-plugins-java/src/main/resources/org/sonar/l10n/java/rules/java/DynamicLibraryLoadChecker.html create mode 100644 sonar-keyware-plugins-java/src/main/resources/org/sonar/l10n/java/rules/java/DynamicLibraryLoadChecker.json create mode 100644 sonar-keyware-plugins-java/src/test/files/DynamicLibraryLoadChecker.java create mode 100644 sonar-keyware-plugins-java/src/test/java/com/keyware/sonar/java/rules/checkers/DynamicLibraryLoadCheckerTest.java diff --git a/sonar-keyware-plugins-java/src/main/java/com/keyware/sonar/java/rules/checkers/DynamicLibraryLoadChecker.java b/sonar-keyware-plugins-java/src/main/java/com/keyware/sonar/java/rules/checkers/DynamicLibraryLoadChecker.java new file mode 100644 index 0000000..b1abe56 --- /dev/null +++ b/sonar-keyware-plugins-java/src/main/java/com/keyware/sonar/java/rules/checkers/DynamicLibraryLoadChecker.java @@ -0,0 +1,87 @@ +package com.keyware.sonar.java.rules.checkers; + +import org.sonar.check.Rule; +import org.sonar.java.ast.visitors.SubscriptionVisitor; +import org.sonar.plugins.java.api.tree.*; +import org.springframework.lang.NonNull; + +import java.util.Arrays; +import java.util.List; +import java.util.Set; +import java.util.stream.Collectors; + +/** + * 在动态加载库前应对输入数据进行验证，确保输入数据仅能用于加载允许加载的代码库。 + * 判断逻辑: 当检测到函数中包含调用System.loadLibrary()方法时，则认为是在加载动态库，然后判断其参数是否由方法入参传递的 + * + * @author GuoXin + * @date 2024/1/10 + */ +@Rule(key = "DynamicLibraryLoadChecker") +public class DynamicLibraryLoadChecker extends SubscriptionVisitor { + + @Override + public List nodesToVisit() { + var nodeType = new Tree.Kind[]{Tree.Kind.METHOD}; + return Arrays.asList(nodeType); + } + + @Override + public void visitNode(@NonNull Tree tree) { + if (tree.is(Tree.Kind.METHOD)) { + MethodTree method = (MethodTree) tree; + var block = method.block(); + if (block != null) { + // 拿到方法入参列表 + var methodNames = method.parameters().stream().map((item) -> item.simpleName().name()).collect(Collectors.toSet()); + // 使用方法体查看器对代码块进行遍历 + block.accept(new MethodBodyVisitor(this, methodNames)); + } + } + } + + /** + * 该内部类用于遍历方法体中的代码块，并检查是否调用了System.loadLibrary()方法，并且方法参数为方法入参 + */ + static class MethodBodyVisitor extends BaseTreeVisitor { + private final DynamicLibraryLoadChecker checker; + private final Set methodParameters; + + /** + * 构造方法 + * + * @param checker 动态库加载检查器 + * @param methodParameters 方法入参集合 + */ + public MethodBodyVisitor(DynamicLibraryLoadChecker checker, Set methodParameters) { + this.checker = checker; + this.methodParameters = methodParameters; + } + + /** + * 遍历方法调用语法树节点 + * + * @param tree 语法树节点 + */ + @Override + public void visitMethodInvocation(MethodInvocationTree tree) { + var methodSelect = tree.methodSelect(); + if (methodSelect instanceof MemberSelectExpressionTree) { + var mset = (MemberSelectExpressionTree) methodSelect; + // 判断是否调用了System.loadLibrary() + if (mset.firstToken() != null && "System".equals(mset.firstToken().text()) && "loadLibrary".equals(mset.identifier().name())) { + // 判断方法调用的参数是否是方法入参，在System.loadLibrary()函数仅接受一个参数 + var exp = tree.arguments().get(0); + if (exp.is(Tree.Kind.IDENTIFIER)) { + var id = (IdentifierTree) exp; + if (methodParameters.contains(id.name())) { + // 报告问题 + checker.context.reportIssue(checker, tree, "在动态加载库前对输入数据进行验证，确保输入数据仅能用于加载允许加载的代码库"); + } + } + } + } + } + } + +} diff --git a/sonar-keyware-plugins-java/src/main/resources/org/sonar/l10n/java/rules/java/DynamicLibraryLoadChecker.html b/sonar-keyware-plugins-java/src/main/resources/org/sonar/l10n/java/rules/java/DynamicLibraryLoadChecker.html new file mode 100644 index 0000000..5e9d5ae --- /dev/null +++ b/sonar-keyware-plugins-java/src/main/resources/org/sonar/l10n/java/rules/java/DynamicLibraryLoadChecker.html @@ -0,0 +1,9 @@ +

在动态加载库前对输入数据进行验证，确保输入数据仅能用于加载允许加载的代码库

+

在动态加载库前对输入数据进行验证，确保输入数据仅能用于加载允许加载的代码库。

+
+
+
+

合规解决方案

+
+
+
diff --git a/sonar-keyware-plugins-java/src/main/resources/org/sonar/l10n/java/rules/java/DynamicLibraryLoadChecker.json b/sonar-keyware-plugins-java/src/main/resources/org/sonar/l10n/java/rules/java/DynamicLibraryLoadChecker.json new file mode 100644 index 0000000..eefc274 --- /dev/null +++ b/sonar-keyware-plugins-java/src/main/resources/org/sonar/l10n/java/rules/java/DynamicLibraryLoadChecker.json @@ -0,0 +1,13 @@ +{ + "title": "在动态加载库前对输入数据进行验证，确保输入数据仅能用于加载允许加载的代码库", + "type": "CODE_SMELL", + "status": "ready", + "remediation": { + "func": "Constant\/Issue", + "constantCost": "5min" + }, + "tags": [ + "28suo" + ], + "defaultSeverity": "Minor" +} \ No newline at end of file diff --git a/sonar-keyware-plugins-java/src/test/files/DynamicLibraryLoadChecker.java b/sonar-keyware-plugins-java/src/test/files/DynamicLibraryLoadChecker.java new file mode 100644 index 0000000..8b30244 --- /dev/null +++ b/sonar-keyware-plugins-java/src/test/files/DynamicLibraryLoadChecker.java @@ -0,0 +1,10 @@ +// 在动态加载库前对输入数据进行验证，确保输入数据仅能用于加载允许加载的代码库 +class DynamicLibraryLoadCheckerExample { + + public void loadLibrary(String libraryName, int number) { + String abc = "bac"; + System.loadLibrary("/path/to/your/library"); + System.loadLibrary(libraryName); // Noncompliant {{在动态加载库前对输入数据进行验证，确保输入数据仅能用于加载允许加载的代码库}} + + } +} \ No newline at end of file diff --git a/sonar-keyware-plugins-java/src/test/java/com/keyware/sonar/java/rules/checkers/DynamicLibraryLoadCheckerTest.java b/sonar-keyware-plugins-java/src/test/java/com/keyware/sonar/java/rules/checkers/DynamicLibraryLoadCheckerTest.java new file mode 100644 index 0000000..5e2eb0e --- /dev/null +++ b/sonar-keyware-plugins-java/src/test/java/com/keyware/sonar/java/rules/checkers/DynamicLibraryLoadCheckerTest.java @@ -0,0 +1,23 @@ +package com.keyware.sonar.java.rules.checkers; + +import com.keyware.sonar.java.utils.FilesUtils; +import org.junit.jupiter.api.Test; +import org.sonar.java.checks.verifier.CheckVerifier; + +/** + * 在动态加载库前对输入数据进行验证 单元测试类 + * + * @author GuoXin + * @date 2024/1/10 + */ +public class DynamicLibraryLoadCheckerTest { + + @Test + public void test() { + CheckVerifier.newVerifier() + .onFile("src/test/files/DynamicLibraryLoadChecker.java") + .withCheck(new DynamicLibraryLoadChecker()) + .withClassPath(FilesUtils.getClassPath("target/test-jars")) + .verifyIssues(); + } +} From 80eb8c5d9b77dc0a5331eb374a399ba506547e48 Mon Sep 17 00:00:00 2001 From: Guo XIn <371864209@qq.com> Date: Thu, 11 Jan 2024 11:14:51 +0800 Subject: [PATCH 2/6] =?UTF-8?q?=E4=BF=AE=E5=A4=8D=EF=BC=9A=E6=9C=AC?= =?UTF-8?q?=E5=9C=B0=E6=8F=90=E4=BA=A4=E4=BB=A3=E7=A0=81=E6=97=B6=E5=8F=AF?= =?UTF-8?q?=E8=83=BD=E4=BC=9A=E6=8F=90=E4=BA=A4.idea=E9=A1=B9=E7=9B=AE?= =?UTF-8?q?=E9=85=8D=E7=BD=AE=E6=96=87=E4=BB=B6=E7=9A=84=E9=97=AE=E9=A2=98?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- .gitignore | 5 +---- 1 file changed, 1 insertion(+), 4 deletions(-) diff --git a/.gitignore b/.gitignore index 685c11a..eb2b9fe 100644 --- a/.gitignore +++ b/.gitignore @@ -4,10 +4,7 @@ target/ !**/src/test/**/target/ ### IntelliJ IDEA ### -.idea/modules.xml -.idea/jarRepositories.xml -.idea/compiler.xml -.idea/libraries/ +.idea/ *.iws *.iml *.ipr From 088ab51787b56b942c30fe135d1ad8d4c2274f2c Mon Sep 17 00:00:00 2001 From: Guo XIn <371864209@qq.com> Date: Thu, 11 Jan 2024 11:17:11 +0800 Subject: [PATCH 3/6] =?UTF-8?q?=E4=BF=AE=E5=A4=8D=EF=BC=9A=E5=9C=A8?= =?UTF-8?q?=E5=8A=A8=E6=80=81=E5=8A=A0=E8=BD=BD=E5=BA=93=E5=89=8D=E5=BA=94?= =?UTF-8?q?=E5=AF=B9=E8=BE=93=E5=85=A5=E6=95=B0=E6=8D=AE=E8=BF=9B=E8=A1=8C?= =?UTF-8?q?=E9=AA=8C=E8=AF=81=E5=87=86=E5=88=99=E5=A2=9E=E5=8A=A0=E5=88=B0?= =?UTF-8?q?RulesList=E4=B8=AD?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- .../java/com/keyware/sonar/java/rules/RulesList.java | 11 ++--------- 1 file changed, 2 insertions(+), 9 deletions(-) diff --git a/sonar-keyware-plugins-java/src/main/java/com/keyware/sonar/java/rules/RulesList.java b/sonar-keyware-plugins-java/src/main/java/com/keyware/sonar/java/rules/RulesList.java index ea2e248..ec6b211 100644 --- a/sonar-keyware-plugins-java/src/main/java/com/keyware/sonar/java/rules/RulesList.java +++ b/sonar-keyware-plugins-java/src/main/java/com/keyware/sonar/java/rules/RulesList.java @@ -35,15 +35,8 @@ public final class RulesList { AbsolutePathDetectorChecker.class, PathAndKeywordCheck.class, DynamicCodeChecker.class, - SystemFunctionChecker.class - /*SpringControllerRequestMappingEntityRule.class, - AvoidAnnotationRule.class, - AvoidBrandInMethodNamesRule.class, - AvoidMethodDeclarationRule.class, - AvoidSuperClassRule.class, - AvoidTreeListRule.class, - MyCustomSubscriptionRule.class, - SecurityAnnotationMandatoryRule.class*/ + SystemFunctionChecker.class, + DynamicLibraryLoadChecker.class )); } From e9897ca9cfb282c76a24a5ad4c679ee1243155b6 Mon Sep 17 00:00:00 2001 From: Guo XIn <371864209@qq.com> Date: Thu, 11 Jan 2024 11:18:10 +0800 Subject: [PATCH 4/6] =?UTF-8?q?=E4=BF=AE=E5=A4=8D=EF=BC=9A=E5=9C=A8?= =?UTF-8?q?=E5=8A=A8=E6=80=81=E5=8A=A0=E8=BD=BD=E5=BA=93=E5=89=8D=E5=BA=94?= =?UTF-8?q?=E5=AF=B9=E8=BE=93=E5=85=A5=E6=95=B0=E6=8D=AE=E8=BF=9B=E8=A1=8C?= =?UTF-8?q?=E9=AA=8C=E8=AF=81=E5=87=86=E5=88=99=E5=A2=9E=E5=8A=A0=E5=88=B0?= =?UTF-8?q?RulesList=E4=B8=AD?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- .../src/main/java/com/keyware/sonar/java/rules/RulesList.java | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-) diff --git a/sonar-keyware-plugins-java/src/main/java/com/keyware/sonar/java/rules/RulesList.java b/sonar-keyware-plugins-java/src/main/java/com/keyware/sonar/java/rules/RulesList.java index ec6b211..a0730bd 100644 --- a/sonar-keyware-plugins-java/src/main/java/com/keyware/sonar/java/rules/RulesList.java +++ b/sonar-keyware-plugins-java/src/main/java/com/keyware/sonar/java/rules/RulesList.java @@ -44,8 +44,6 @@ public final class RulesList { * These rules are going to target TEST code only */ public static List> getJavaTestChecks() { - return Collections.unmodifiableList(Arrays.asList( - /*NoIfStatementInTestsRule.class*/ - )); + return Collections.emptyList(); } } From dfc1d819d1f0ec795dc3e65165e165e22a05ab95 Mon Sep 17 00:00:00 2001 From: Guo XIn <371864209@qq.com> Date: Thu, 11 Jan 2024 11:21:13 +0800 Subject: [PATCH 5/6] =?UTF-8?q?=E4=BC=98=E5=8C=96=EF=BC=9ARulesList.getJav?= =?UTF-8?q?aChecks()=E6=96=B9=E6=B3=95=EF=BC=8C=E7=94=B1Collections?= =?UTF-8?q?=E6=9B=BF=E6=8D=A2=E4=B8=BAList.of()?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- .../main/java/com/keyware/sonar/java/rules/RulesList.java | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-) diff --git a/sonar-keyware-plugins-java/src/main/java/com/keyware/sonar/java/rules/RulesList.java b/sonar-keyware-plugins-java/src/main/java/com/keyware/sonar/java/rules/RulesList.java index a0730bd..86029a5 100644 --- a/sonar-keyware-plugins-java/src/main/java/com/keyware/sonar/java/rules/RulesList.java +++ b/sonar-keyware-plugins-java/src/main/java/com/keyware/sonar/java/rules/RulesList.java @@ -10,7 +10,6 @@ import com.keyware.sonar.java.rules.checkers.*; import org.sonar.plugins.java.api.JavaCheck; import java.util.ArrayList; -import java.util.Arrays; import java.util.Collections; import java.util.List; @@ -30,14 +29,14 @@ public final class RulesList { * These rules are going to target MAIN code only */ public static List> getJavaChecks() { - return Collections.unmodifiableList(Arrays.asList( + return List.of( ABCVarNameChecker.class, AbsolutePathDetectorChecker.class, PathAndKeywordCheck.class, DynamicCodeChecker.class, SystemFunctionChecker.class, DynamicLibraryLoadChecker.class - )); + ); } /** From ea351ac386a7b0f778452b08a5983ff6f812e8da Mon Sep 17 00:00:00 2001 From: renfengshan <1535889807@qqcom> Date: Thu, 11 Jan 2024 11:30:05 +0800 Subject: [PATCH 6/6] =?UTF-8?q?=E6=96=B0=E5=A2=9E=E2=80=9C=E7=A8=8B?= =?UTF-8?q?=E5=BA=8F=E8=AE=BE=E8=AE=A1=E6=97=B6=E7=A6=81=E6=AD=A2=E5=8A=A8?= =?UTF-8?q?=E6=80=81=E6=9E=84=E5=BB=BA=E4=BB=A3=E7=A0=81=E8=BF=9B=E8=A1=8C?= =?UTF-8?q?=E5=8A=9F=E8=83=BD=E5=AE=9E=E7=8E=B0=E2=80=9D=E5=87=86=E5=88=99?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- .../sonar/java/rules/checkers/DynamicCodeChecker.java | 7 +------ 1 file changed, 1 insertion(+), 6 deletions(-) diff --git a/sonar-keyware-plugins-java/src/main/java/com/keyware/sonar/java/rules/checkers/DynamicCodeChecker.java b/sonar-keyware-plugins-java/src/main/java/com/keyware/sonar/java/rules/checkers/DynamicCodeChecker.java index 11b14c4..009a51f 100644 --- a/sonar-keyware-plugins-java/src/main/java/com/keyware/sonar/java/rules/checkers/DynamicCodeChecker.java +++ b/sonar-keyware-plugins-java/src/main/java/com/keyware/sonar/java/rules/checkers/DynamicCodeChecker.java @@ -12,18 +12,13 @@ import java.util.Collections; import java.util.List; -@Rule(key = "SessionExpirationDateChecker") +@Rule(key = "DynamicCodeChecker") //检测代码中包含动态代码执行操作时，工具进行提示 public class DynamicCodeChecker extends SubscriptionVisitor { @Override public List nodesToVisit() { - /** - * Tree.Kind.METHOD：方法节点 - * Tree.Kind.BLOCK：方法的代码块节点 - * Tree.Kind.METHOD_INVOCATION： 方法的调用节点 - */ return Collections.singletonList( Tree.Kind.METHOD_INVOCATION );