diff --git a/sonar-keyware-plugins-cxx/src/main/java/com/keyware/sonar/cxx/rules/checkers/FVNRPassWordChecker.java b/sonar-keyware-plugins-cxx/src/main/java/com/keyware/sonar/cxx/rules/checkers/FVNRPassWordChecker.java index c14686c..4400cc1 100644 --- a/sonar-keyware-plugins-cxx/src/main/java/com/keyware/sonar/cxx/rules/checkers/FVNRPassWordChecker.java +++ b/sonar-keyware-plugins-cxx/src/main/java/com/keyware/sonar/cxx/rules/checkers/FVNRPassWordChecker.java @@ -43,10 +43,9 @@ public class FVNRPassWordChecker extends SquidCheck { List inputFileLines = getContext().getInputFileLines(); for (String str:inputFileLines) { if(str.startsWith("#include")){ - if(str.contains("")){ - getContext().createFileViolation(this, "应使用单向不可逆算法对密码进行加密"); - }else if(str.contains("")){ + if(str.contains("") || str.contains("")){ getContext().createFileViolation(this, "应使用单向不可逆算法对密码进行加密"); + break; } } } diff --git a/sonar-keyware-plugins-cxx/src/main/java/com/keyware/sonar/cxx/rules/checkers/FVNRShaChecker.java b/sonar-keyware-plugins-cxx/src/main/java/com/keyware/sonar/cxx/rules/checkers/FVNRShaChecker.java index 0b5fb1f..c3b14f2 100644 --- a/sonar-keyware-plugins-cxx/src/main/java/com/keyware/sonar/cxx/rules/checkers/FVNRShaChecker.java +++ b/sonar-keyware-plugins-cxx/src/main/java/com/keyware/sonar/cxx/rules/checkers/FVNRShaChecker.java @@ -46,6 +46,7 @@ public class FVNRShaChecker extends SquidCheck { if(str.contains("") && !str.contains("blake2.h>") && !str.contains("md5.h>")){ getContext().createFileViolation(this, "应使用不可逆标准散列算法"); + break; } } } diff --git a/sonar-keyware-plugins-cxx/src/main/java/com/keyware/sonar/cxx/rules/checkers/HighEncryptDesChecker.java b/sonar-keyware-plugins-cxx/src/main/java/com/keyware/sonar/cxx/rules/checkers/HighEncryptDesChecker.java index 103e552..9de89e2 100644 --- a/sonar-keyware-plugins-cxx/src/main/java/com/keyware/sonar/cxx/rules/checkers/HighEncryptDesChecker.java +++ b/sonar-keyware-plugins-cxx/src/main/java/com/keyware/sonar/cxx/rules/checkers/HighEncryptDesChecker.java @@ -46,6 +46,7 @@ public class HighEncryptDesChecker extends SquidCheck { if(str.contains("") && !str.contains("des.h>") ){ getContext().createFileViolation(this, "应采用加密强度较高的标准加密算法"); + break; } } } diff --git a/sonar-keyware-plugins-cxx/src/main/java/com/keyware/sonar/cxx/rules/checkers/LogChecker.java b/sonar-keyware-plugins-cxx/src/main/java/com/keyware/sonar/cxx/rules/checkers/LogChecker.java index 2563731..2183bc9 100644 --- a/sonar-keyware-plugins-cxx/src/main/java/com/keyware/sonar/cxx/rules/checkers/LogChecker.java +++ b/sonar-keyware-plugins-cxx/src/main/java/com/keyware/sonar/cxx/rules/checkers/LogChecker.java @@ -27,7 +27,6 @@ public class LogChecker extends SquidCheck { @Override public void visitFile(@Nullable AstNode astNode) { - super.visitFile(astNode); if(getContext().getInputFile().filename().endsWith(".log")){ getContext().createFileViolation(this, "日志文件检查"); } diff --git a/sonar-keyware-plugins-cxx/src/main/java/com/keyware/sonar/cxx/rules/checkers/PassWordCountChecker.java b/sonar-keyware-plugins-cxx/src/main/java/com/keyware/sonar/cxx/rules/checkers/PassWordCountChecker.java index 3fc7227..48ce6ac 100644 --- a/sonar-keyware-plugins-cxx/src/main/java/com/keyware/sonar/cxx/rules/checkers/PassWordCountChecker.java +++ b/sonar-keyware-plugins-cxx/src/main/java/com/keyware/sonar/cxx/rules/checkers/PassWordCountChecker.java @@ -6,7 +6,9 @@ */ package com.keyware.sonar.cxx.rules.checkers; +import com.keyware.sonar.cxx.SubscriptionAstVisitor; import com.sonar.cxx.sslr.api.AstNode; +import com.sonar.cxx.sslr.api.AstNodeType; import com.sonar.cxx.sslr.api.Grammar; import org.sonar.check.Priority; import org.sonar.check.Rule; @@ -15,6 +17,7 @@ import org.sonar.cxx.squidbridge.annotations.ActivatedByDefault; import org.sonar.cxx.squidbridge.annotations.SqaleConstantRemediation; import org.sonar.cxx.squidbridge.checks.SquidCheck; +import java.util.ArrayList; import java.util.List; /** @@ -32,7 +35,7 @@ public class PassWordCountChecker extends SquidCheck { public void init() { // 订阅要检查AST节点类型,用于在visitNode方法中检查该类型节点 this.subscribeTo( - CxxGrammarImpl.simpleDeclaration + CxxGrammarImpl.functionBody ); } @@ -44,11 +47,69 @@ public class PassWordCountChecker extends SquidCheck { */ @Override public void visitNode(AstNode astNode) { - List descendants = astNode.getDescendants(CxxGrammarImpl.templateName); - for (AstNode desc:descendants) { - String value = desc.getToken().getValue(); - if("hash".equals(value)){ - getContext().createLineViolation(this, "使用盐值计算散列值", desc); + BodyWay bodyWay = new BodyWay(this); + bodyWay.accept(astNode); + } + + class BodyWay extends SubscriptionAstVisitor{ + + /** + * 构造函数需要传入初代访问器 + * + * @param checker 初代规则检查器 + */ + public BodyWay(SquidCheck checker) { + super(checker); + } + + @Override + public List visitNodeTypes() { + return List.of(CxxGrammarImpl.functionBody); + } + + @Override + public void visitNode(AstNode astNode) { + //获取方法参数列表 + List nodeDescendants = astNode.getDescendants(CxxGrammarImpl.expressionList); + List seqLists = new ArrayList<>(); + for(AstNode desc :nodeDescendants){ + seqLists.add(desc.getTokenValue()); + } + //判读入参有没有进行赋值操作 + List astNodes = astNode.getDescendants(CxxGrammarImpl.assignmentExpression); + List aslists = new ArrayList<>(); + for(AstNode ast : astNodes){ + if(seqLists.contains(ast.getTokenValue())){ + aslists.add(ast.getTokenValue()); + } + } + //获取到声明hash变量名 + List lists = new ArrayList<>(); + List astNodeDescendants = astNode.getDescendants(CxxGrammarImpl.simpleDeclaration); + for(AstNode des :astNodeDescendants){ + if("std".equals(des.getTokenValue())){ + List descendants = des.getDescendants(CxxGrammarImpl.typeName); + for (AstNode dan : descendants){ + if("hash".equals(dan.getTokenValue())){ + List nodeList = des.getDescendants(CxxGrammarImpl.initDeclarator); + for (AstNode lis:nodeList) { + lists.add(lis.getTokenValue()); + } + } + } + } + } + //判断生成的散列值参数是否是进行赋后的入参 + List descendants = astNode.getDescendants(CxxGrammarImpl.postfixExpression); + for (AstNode desc:descendants) { + if(lists.contains(desc.getTokenValue())){ + List descDescendants = desc.getDescendants(CxxGrammarImpl.expressionList); + for(AstNode dd : descDescendants){ + if(!aslists.contains(dd.getTokenValue())){ + reportIssue(dd, "使用盐值计算散列值"); + } + } + } } } } diff --git a/sonar-keyware-plugins-cxx/src/test/java/com/keyware/sonar/cxx/rules/checkers/PassWordCountCheckerTest.java b/sonar-keyware-plugins-cxx/src/test/java/com/keyware/sonar/cxx/rules/checkers/PassWordCountCheckerTest.java index 37b8712..88e3f8f 100644 --- a/sonar-keyware-plugins-cxx/src/test/java/com/keyware/sonar/cxx/rules/checkers/PassWordCountCheckerTest.java +++ b/sonar-keyware-plugins-cxx/src/test/java/com/keyware/sonar/cxx/rules/checkers/PassWordCountCheckerTest.java @@ -28,7 +28,7 @@ public class PassWordCountCheckerTest { var tester = CxxFileTesterHelper.create("PassWordCountChecker.cc"); SourceFile file = CxxAstScanner.scanSingleInputFile(tester.asInputFile(), checker); CheckMessagesVerifier.verify(file.getCheckMessages()) - .next().atLine(5).withMessage("使用盐值计算散列值") + .next().atLine(10).withMessage("使用盐值计算散列值") .noMore(); } } diff --git a/sonar-keyware-plugins-cxx/src/test/resources/com/keyware/sonar/cxx/rules/checkers/PassWordCountChecker.cc b/sonar-keyware-plugins-cxx/src/test/resources/com/keyware/sonar/cxx/rules/checkers/PassWordCountChecker.cc index 4dcd2b4..2d17bd4 100644 --- a/sonar-keyware-plugins-cxx/src/test/resources/com/keyware/sonar/cxx/rules/checkers/PassWordCountChecker.cc +++ b/sonar-keyware-plugins-cxx/src/test/resources/com/keyware/sonar/cxx/rules/checkers/PassWordCountChecker.cc @@ -1,10 +1,20 @@ -int main() { +#include +#include +#include // 引入std::hash + +int test(std::string& input) { +// input = "example" + "1234"; - std::string input = "example"; - // 使用std::hash - std::hash hasher ; // error + // 正确实例化并使用std::hash + std::hash hasher; size_t hash_value = hasher(input); std::cout << "Hash value using std::hash: " << hash_value << std::endl; + return 0; +} + +int main() { + std::string input; + test(input); return 0; } \ No newline at end of file