|
|
|
@ -41,11 +41,11 @@ public class UploadFileVerifyChecker extends IssuableSubscriptionVisitor { |
|
|
|
|
if (boo) { |
|
|
|
|
//获取文件名称类型判断是否配置文件权限
|
|
|
|
|
var interiorInvoIf = new InteriorInvoIf(); |
|
|
|
|
interiorInvoIf.check(((MethodTree) tree).block()); |
|
|
|
|
((MethodTree) tree).block().accept(interiorInvoIf); |
|
|
|
|
if (interiorInvoIf.fileType != "") { |
|
|
|
|
//判断是否对文件后缀进行限制
|
|
|
|
|
NodeIf nodeIf = new NodeIf(interiorInvoIf.fileType); |
|
|
|
|
nodeIf.check(((MethodTree) tree).block()); |
|
|
|
|
((MethodTree) tree).block().accept(nodeIf); |
|
|
|
|
if (nodeIf.boo) { |
|
|
|
|
context.reportIssue(this, node.simpleName(), "程序设计时,应以“白名单”方式限制允许用户上传的文件的类型"); |
|
|
|
|
} |
|
|
|
@ -53,7 +53,7 @@ public class UploadFileVerifyChecker extends IssuableSubscriptionVisitor { |
|
|
|
|
if (interiorInvoIf.fileName != "") { |
|
|
|
|
// 判断是否对文件后缀进行限制
|
|
|
|
|
NodeIf nodeIf = new NodeIf(interiorInvoIf.fileName); |
|
|
|
|
nodeIf.check(((MethodTree) tree).block()); |
|
|
|
|
((MethodTree) tree).block().accept(nodeIf); |
|
|
|
|
if (nodeIf.boo) { |
|
|
|
|
context.reportIssue(this, node.simpleName(), "程序设计时,应以“白名单”方式限制允许用户上传的文件的类型"); |
|
|
|
|
} |
|
|
|
@ -65,7 +65,8 @@ public class UploadFileVerifyChecker extends IssuableSubscriptionVisitor { |
|
|
|
|
if (interiorInvoIf.sizeName != "") { |
|
|
|
|
//判断是否对文件大小进行限制
|
|
|
|
|
NodeIf nodeIf = new NodeIf(interiorInvoIf.sizeName); |
|
|
|
|
nodeIf.check(((MethodTree) tree).block()); |
|
|
|
|
//nodeIf.check(((MethodTree) tree).block());
|
|
|
|
|
((MethodTree) tree).block().accept(nodeIf); |
|
|
|
|
if (nodeIf.boo) { |
|
|
|
|
context.reportIssue(this, node.simpleName(), "程序设计时,应以“白名单”方式限制允许用户上传的文件的类型"); |
|
|
|
|
} |
|
|
|
@ -79,7 +80,7 @@ public class UploadFileVerifyChecker extends IssuableSubscriptionVisitor { |
|
|
|
|
} |
|
|
|
|
|
|
|
|
|
//內部文件名称类型获取类
|
|
|
|
|
private class InteriorInvoIf extends IssuableSubscriptionVisitor{ |
|
|
|
|
private class InteriorInvoIf extends BaseTreeVisitor { |
|
|
|
|
//文件全名字
|
|
|
|
|
public String fileName = ""; |
|
|
|
|
// 文件后缀名
|
|
|
|
@ -90,15 +91,9 @@ public class UploadFileVerifyChecker extends IssuableSubscriptionVisitor { |
|
|
|
|
public boolean privType = true; |
|
|
|
|
|
|
|
|
|
@Override |
|
|
|
|
public List<Tree.Kind> nodesToVisit() { |
|
|
|
|
return Collections.singletonList(Tree.Kind.METHOD_INVOCATION); |
|
|
|
|
} |
|
|
|
|
|
|
|
|
|
@Override |
|
|
|
|
public void visitNode(Tree tree){ |
|
|
|
|
MethodInvocationTree methodInvocationTree = (MethodInvocationTree) tree; |
|
|
|
|
public void visitMethodInvocation(MethodInvocationTree tree) { |
|
|
|
|
//获取到方法调用的参数
|
|
|
|
|
ExpressionTree expressionTree = methodInvocationTree.methodSelect(); |
|
|
|
|
ExpressionTree expressionTree = tree.methodSelect(); |
|
|
|
|
if (expressionTree instanceof MemberSelectExpressionTree) { |
|
|
|
|
MemberSelectExpressionTree expressionTree1 = (MemberSelectExpressionTree) expressionTree; |
|
|
|
|
//对调用方法进行判断
|
|
|
|
@ -137,32 +132,22 @@ public class UploadFileVerifyChecker extends IssuableSubscriptionVisitor { |
|
|
|
|
} |
|
|
|
|
} |
|
|
|
|
} |
|
|
|
|
public void check(Tree tree){ |
|
|
|
|
this.scanTree(tree); |
|
|
|
|
} |
|
|
|
|
} |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
public class NodeIf extends IssuableSubscriptionVisitor{ |
|
|
|
|
public class NodeIf extends BaseTreeVisitor { |
|
|
|
|
|
|
|
|
|
private String name; |
|
|
|
|
public boolean boo = true; |
|
|
|
|
@Override |
|
|
|
|
public List<Tree.Kind> nodesToVisit() { |
|
|
|
|
return Collections.singletonList(Tree.Kind.IF_STATEMENT); |
|
|
|
|
} |
|
|
|
|
|
|
|
|
|
public NodeIf(String name) { |
|
|
|
|
this.name = name; |
|
|
|
|
} |
|
|
|
|
public void check(Tree tree){ |
|
|
|
|
this.scanTree(tree); |
|
|
|
|
} |
|
|
|
|
|
|
|
|
|
@Override |
|
|
|
|
public void visitNode(Tree tree){ |
|
|
|
|
IfStatementTree tree1 = (IfStatementTree) tree; |
|
|
|
|
public void visitIfStatement(IfStatementTree tree) { |
|
|
|
|
//获取到if表达式
|
|
|
|
|
ExpressionTree condition = tree1.condition(); |
|
|
|
|
ExpressionTree condition = tree.condition(); |
|
|
|
|
if (condition instanceof BinaryExpressionTree) { |
|
|
|
|
BinaryExpressionTree binaryExpressionTree = (BinaryExpressionTree) condition; |
|
|
|
|
//判断是否进行if判断
|
|
|
|
|