diff --git a/sonar-keyware-plugins-cxx/src/main/java/com/keyware/sonar/cxx/rules/checkers/ValidatePasswordCheck.java b/sonar-keyware-plugins-cxx/src/main/java/com/keyware/sonar/cxx/rules/checkers/ValidatePasswordCheck.java new file mode 100644 index 0000000..350f547 --- /dev/null +++ b/sonar-keyware-plugins-cxx/src/main/java/com/keyware/sonar/cxx/rules/checkers/ValidatePasswordCheck.java @@ -0,0 +1,93 @@ +/* + * Copyright (c) 2023 - 2024. KeyWare.Co.Ltd All rights reserved. + * 项目名称:C++ 信息安全性设计准则 + * 项目描述:用于检查C++源代码的安全性设计准则的Sonarqube插件 + * 版权说明:本软件属北京关键科技股份有限公司所有,在未获得北京关键科技股份有限公司正式授权情况下,任何企业和个人,不能获取、阅读、安装、传播本软件涉及的任何受知识产权保护的内容。 + */ +package com.keyware.sonar.cxx.rules.checkers; + +import com.sonar.cxx.sslr.api.AstNode; +import com.sonar.cxx.sslr.api.Grammar; +import org.sonar.check.Priority; +import org.sonar.check.Rule; +import org.sonar.cxx.parser.CxxGrammarImpl; +import org.sonar.cxx.squidbridge.annotations.ActivatedByDefault; +import org.sonar.cxx.squidbridge.annotations.SqaleConstantRemediation; +import org.sonar.cxx.squidbridge.checks.SquidCheck; + +import java.util.List; + +/** + * 检查口令长度不少于10位,且至少包含特殊字符、大写、小写、数字中的3种, + * + * @author WuHaoYang + * @date 2024/1/13 + */ +@Rule(key = "ValidatePasswordCheck", name = "口令不匹配足够复杂度", description = "口令不匹配足够复杂度", priority = Priority.INFO, tags = {"28suo"}) +@ActivatedByDefault +@SqaleConstantRemediation("5min") +public class ValidatePasswordCheck extends SquidCheck { + + + private static final String passwordRegex = "^(?=.*[a-z])(?=.*[A-Z])(?=.*\\d)(?=.*[@#$%^&+=!]).{10,}$"; + + @Override + public void init() { + subscribeTo(CxxGrammarImpl.functionDefinition); + } + + @Override + public void visitNode(AstNode astNode) { + + AstNode functionNameNode = astNode.getFirstDescendant(CxxGrammarImpl.declaratorId); + String functionName = functionNameNode.getTokenOriginalValue(); + + //检查函数是否为main + if ("main".equals(functionName)) { + checkPasswordValidationInMain(astNode); + } + } + + private void checkPasswordValidationInMain(AstNode mainFunctionNode) { + AstNode compoundStatement = mainFunctionNode.getFirstDescendant(CxxGrammarImpl.compoundStatement); + + if (compoundStatement != null) { + List declarations = compoundStatement.getDescendants(CxxGrammarImpl.initDeclarator); + + for (AstNode initDeclarator : declarations) { + AstNode declaratorId = initDeclarator.getFirstDescendant(CxxGrammarImpl.declaratorId); + + if (declaratorId != null) { + String variableName = declaratorId.getTokenOriginalValue(); + + // 检查变量是否命名为password + if ("password".equalsIgnoreCase(variableName)) { + checkPasswordInitialization(initDeclarator); + } + } + } + } + } + + private void checkPasswordInitialization(AstNode declaration) { + AstNode initializer = declaration.getFirstDescendant(CxxGrammarImpl.initializer); + + if (initializer != null) { + + // 获取初始化值的子节点 + AstNode initializationValue = initializer.getLastChild(); + + if (initializationValue != null) { + + String passwordValue = initializationValue.getTokenOriginalValue(); + + if (!passwordValue.matches(passwordRegex)) { + System.out.println("未通过正则校验的口令:"+passwordValue); + getContext().createLineViolation(this, "口令不匹配足够复杂度", initializationValue); + } + } + } + } + + +} diff --git a/sonar-keyware-plugins-cxx/src/test/java/com/keyware/sonar/cxx/rules/checkers/ValidatePasswordCheckTest.java b/sonar-keyware-plugins-cxx/src/test/java/com/keyware/sonar/cxx/rules/checkers/ValidatePasswordCheckTest.java new file mode 100644 index 0000000..c02dee8 --- /dev/null +++ b/sonar-keyware-plugins-cxx/src/test/java/com/keyware/sonar/cxx/rules/checkers/ValidatePasswordCheckTest.java @@ -0,0 +1,28 @@ +/* + * Copyright (c) 2023 - 2024. KeyWare.Co.Ltd All rights reserved. + * 项目名称:C++ 信息安全性设计准则 + * 项目描述:用于检查C++源代码的安全性设计准则的Sonarqube插件 + * 版权说明:本软件属北京关键科技股份有限公司所有,在未获得北京关键科技股份有限公司正式授权情况下,任何企业和个人,不能获取、阅读、安装、传播本软件涉及的任何受知识产权保护的内容。 + */ +package com.keyware.sonar.cxx.rules.checkers; + +import com.keyware.sonar.cxx.CxxFileTesterHelper; +import org.junit.jupiter.api.Test; +import org.sonar.cxx.CxxAstScanner; +import org.sonar.cxx.squidbridge.api.SourceFile; +import org.sonar.cxx.squidbridge.checks.CheckMessagesVerifier; + +import java.io.IOException; + +public class ValidatePasswordCheckTest { + + @Test + public void checkTest() throws IOException { + var checker = new ValidatePasswordCheck(); + var tester = CxxFileTesterHelper.create("ValidatePasswordCheck.cc"); + SourceFile file = CxxAstScanner.scanSingleInputFile(tester.asInputFile(), checker); + CheckMessagesVerifier.verify(file.getCheckMessages()) + .next().atLine(5).withMessage("口令不匹配足够复杂度") + .noMore(); + } +} diff --git a/sonar-keyware-plugins-cxx/src/test/resources/com/keyware/sonar/cxx/rules/checkers/ValidatePasswordCheck.cc b/sonar-keyware-plugins-cxx/src/test/resources/com/keyware/sonar/cxx/rules/checkers/ValidatePasswordCheck.cc new file mode 100644 index 0000000..da35b33 --- /dev/null +++ b/sonar-keyware-plugins-cxx/src/test/resources/com/keyware/sonar/cxx/rules/checkers/ValidatePasswordCheck.cc @@ -0,0 +1,7 @@ +#include +using namespace std; + +int main() { + string password = "1111111111"; // error + return 0; +}