增加准则:在重定向前对输入数据进行验证

wuhaoyang
Guo XIn 1 year ago
parent 89eb2d44af
commit 9e75d0032e
  1. 6
      sonar-keyware-plugins-java/src/main/java/com/keyware/sonar/java/rules/checkers/RedirectUrlChecker.java

@ -2,8 +2,8 @@ package com.keyware.sonar.java.rules.checkers;
import org.sonar.check.Rule; import org.sonar.check.Rule;
import org.sonar.java.ast.visitors.SubscriptionVisitor; import org.sonar.java.ast.visitors.SubscriptionVisitor;
import org.sonar.plugins.java.api.JavaFileScannerContext;
import org.sonar.plugins.java.api.tree.*; import org.sonar.plugins.java.api.tree.*;
import org.springframework.lang.NonNull;
import java.util.Arrays; import java.util.Arrays;
import java.util.List; import java.util.List;
@ -23,12 +23,12 @@ public class RedirectUrlChecker extends SubscriptionVisitor {
} }
@Override @Override
public void visitNode(Tree tree) { public void visitNode(@NonNull Tree tree) {
MethodTree methodTree = (MethodTree) tree; MethodTree methodTree = (MethodTree) tree;
BlockTree block = methodTree.block(); BlockTree block = methodTree.block();
// 方法的参数列表 // 方法的参数列表
List<? extends VariableTree> parameters = methodTree.parameters(); List<? extends VariableTree> parameters = methodTree.parameters();
if (block != null && !parameters.isEmpty() && isHttpRequestHandlerMethod(methodTree)) { if (block != null && !parameters.isEmpty() && isHttpRequestHandlerMethod(methodTree) && methodTree.returnType() != null) {
// 判断方法的返回节点的类型为RedirectView 或 String 类型 // 判断方法的返回节点的类型为RedirectView 或 String 类型
if ("RedirectView".equals(methodTree.returnType().toString())) { if ("RedirectView".equals(methodTree.returnType().toString())) {
// 传递上下文,和方法的参数列表 // 传递上下文,和方法的参数列表

Loading…
Cancel
Save