sonarqube-plugins
/
sonar-keyware
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Compare commits

base: sonarqube-plugins:63ffdf647b7726c89086f3e7397795c4269e53a0
Branches Tags
sonarqube-plugins:master
sonarqube-plugins:wuhaoyang
...
compare: sonarqube-plugins:88a121b7dc25cb1313ba78cfe9a3d649c7a40268
Branches Tags
sonarqube-plugins:master
sonarqube-plugins:wuhaoyang

3 Commits
63ffdf647b ... 88a121b7dc

Author SHA1 Message Date
Guo XIn 88a121b7dc Merge remote-tracking branch 'origin/master'
10 months ago
Guo XIn 9e79d0f229 修复：内部类的父类由IssuableSubscriptionVisitor改为BaseTreeVisitor
10 months ago
Guo XIn 21ffba058d 修复：junit-jupiter依赖版本冲突
10 months ago
5 changed files with 125 additions and 79 deletions
Show all changes Ignore whitespace when comparing lines Ignore changes in amount of whitespace Ignore changes in whitespace at EOL
Show Stats
  1. 67
      pom.xml
  2. 3
      sonar-keyware-plugins-cxx/pom.xml
  3. 16
      sonar-keyware-plugins-java/pom.xml
  4. 115
      sonar-keyware-plugins-java/src/main/java/com/keyware/sonar/java/rules/checkers/UploadFileVerifyChecker.java
  5. 3
      sonar-keyware-plugins-java/src/test/java/com/keyware/sonar/java/rules/checkers/UploadFileVerifyCheckerTest.java

67
pom.xml
Unescape View File

@ -36,14 +36,33 @@
</scm>
<developers>
<developer><id>guoxin</id><name>GuoXin</name><organization>Keyware</organization></developer>
<developer><id>renfengjiang</id><name>RenFengJiang</name><organization>Keyware</organization></developer>
<developer><id>renfengshan</id><name>RenFengShan</name><organization>Keyware</organization></developer>
<developer><id>wuhaoyang</id><name>WuHaoYang</name><organization>Keyware</organization></developer>
<developer><id>zhangchenbao</id><name>ZhangChenBao</name><organization>Keyware</organization></developer>
<developer>
<id>guoxin</id>
<name>GuoXin</name>
<organization>Keyware</organization>
</developer>
<developer>
<id>renfengjiang</id>
<name>RenFengJiang</name>
<organization>Keyware</organization>
</developer>
<developer>
<id>renfengshan</id>
<name>RenFengShan</name>
<organization>Keyware</organization>
</developer>
<developer>
<id>wuhaoyang</id>
<name>WuHaoYang</name>
<organization>Keyware</organization>
</developer>
<developer>
<id>zhangchenbao</id>
<name>ZhangChenBao</name>
<organization>Keyware</organization>
</developer>
</developers>
<properties>
<java.version>11</java.version>
<jdk.min.version>11</jdk.min.version>
@ -52,6 +71,7 @@
<project.build.sourceEncoding>UTF-8</project.build.sourceEncoding>
<sonar.java.version>7.24.0.32100</sonar.java.version>
<version.jacoco.plugin>0.8.10</version.jacoco.plugin>
<junit.jupiter.version>5.9.1</junit.jupiter.version>
<aggregate.report.dir>integration-tests/target/site/jacoco-aggregate/jacoco.xml</aggregate.report.dir>
</properties>
@ -76,6 +96,41 @@
<type>pom</type>
<scope>import</scope>
</dependency>
<dependency>
<groupId>org.junit.jupiter</groupId>
<artifactId>junit-jupiter</artifactId>
<version>${junit.jupiter.version}</version>
<scope>test</scope>
<exclusions>
<exclusion>
<groupId>org.junit.jupiter</groupId>
<artifactId>junit-jupiter-api</artifactId>
</exclusion>
<exclusion>
<groupId>org.junit.jupiter</groupId>
<artifactId>junit-jupiter-engine</artifactId>
</exclusion>
</exclusions>
</dependency>
<dependency>
<groupId>org.junit.jupiter</groupId>
<artifactId>junit-jupiter-api</artifactId>
<version>${junit.jupiter.version}</version>
<scope>test</scope>
</dependency>
<dependency>
<groupId>org.junit.jupiter</groupId>
<artifactId>junit-jupiter-engine</artifactId>
<version>${junit.jupiter.version}</version>
<scope>test</scope>
</dependency>
<dependency>
<groupId>org.junit.jupiter</groupId>
<artifactId>junit-jupiter-migrationsupport</artifactId>
<version>${junit.jupiter.version}</version>
<scope>test</scope>
</dependency>
</dependencies>
</dependencyManagement>
</project>

3
sonar-keyware-plugins-cxx/pom.xml
Unescape View File

@ -44,7 +44,6 @@
<mockito-all.version>1.10.19</mockito-all.version>
<mockito-core.version>5.8.0</mockito-core.version>
<assertj-core.version>3.24.2</assertj-core.version>
<junit-jupiter.version>5.9.1</junit-jupiter.version>
</properties>
<dependencies>
@ -114,13 +113,11 @@
<dependency>
<groupId>org.junit.jupiter</groupId>
<artifactId>junit-jupiter-engine</artifactId>
<version>${junit-jupiter.version}</version>
<scope>test</scope>
</dependency>
<dependency>
<groupId>org.junit.jupiter</groupId>
<artifactId>junit-jupiter-api</artifactId>
<version>${junit-jupiter.version}</version>
<scope>test</scope>
</dependency>
</dependencies>

16
sonar-keyware-plugins-java/pom.xml
Unescape View File

@ -50,6 +50,11 @@
<version>${sonar.java.version}</version>
<scope>test</scope>
</dependency>
<dependency>
<groupId>org.assertj</groupId>
<artifactId>assertj-core</artifactId>
<scope>test</scope>
</dependency>
<dependency>
<groupId>org.junit.jupiter</groupId>
<artifactId>junit-jupiter</artifactId>
@ -57,12 +62,17 @@
</dependency>
<dependency>
<groupId>org.junit.jupiter</groupId>
<artifactId>junit-jupiter-migrationsupport</artifactId>
<artifactId>junit-jupiter-api</artifactId>
<scope>test</scope>
</dependency>
<dependency>
<groupId>org.assertj</groupId>
<artifactId>assertj-core</artifactId>
<groupId>org.junit.jupiter</groupId>
<artifactId>junit-jupiter-engine</artifactId>
<scope>test</scope>
</dependency>
<dependency>
<groupId>org.junit.jupiter</groupId>
<artifactId>junit-jupiter-migrationsupport</artifactId>
<scope>test</scope>
</dependency>
</dependencies>

115
sonar-keyware-plugins-java/src/main/java/com/keyware/sonar/java/rules/checkers/UploadFileVerifyChecker.java
Unescape View File

@ -36,139 +36,124 @@ public class UploadFileVerifyChecker extends IssuableSubscriptionVisitor {
public void visitNode(Tree tree) {
MethodTree node = (MethodTree) tree;
List<VariableTree> parameters = node.parameters();
// 盘带是否是文件上传类
//盘带是否是文件上传类
boolean boo = parameters.stream().anyMatch(type -> "MultipartFile".equals(type.type().toString()));
if(boo){
// 获取文件名称类型判断是否配置文件权限
if (boo) {
//获取文件名称类型判断是否配置文件权限
var interiorInvoIf = new InteriorInvoIf();
interiorInvoIf.check(((MethodTree) tree).block());
if(interiorInvoIf.fileType != ""){
// 判断是否对文件后缀进行限制
((MethodTree) tree).block().accept(interiorInvoIf);
if (interiorInvoIf.fileType != "") {
//判断是否对文件后缀进行限制
NodeIf nodeIf = new NodeIf(interiorInvoIf.fileType);
nodeIf.check(((MethodTree) tree).block());
if (nodeIf.boo){
((MethodTree) tree).block().accept(nodeIf);
if (nodeIf.boo) {
context.reportIssue(this, node.simpleName(), "程序设计时，应以“白名单”方式限制允许用户上传的文件的类型");
}
}else {
if(interiorInvoIf.fileName != ""){
} else {
if (interiorInvoIf.fileName != "") {
// 判断是否对文件后缀进行限制
NodeIf nodeIf = new NodeIf(interiorInvoIf.fileName);
nodeIf.check(((MethodTree) tree).block());
if (nodeIf.boo){
((MethodTree) tree).block().accept(nodeIf);
if (nodeIf.boo) {
context.reportIssue(this, node.simpleName(), "程序设计时，应以“白名单”方式限制允许用户上传的文件的类型");
}
}else {
} else {
context.reportIssue(this, node.simpleName(), "程序设计时，应以“白名单”方式限制允许用户上传的文件的类型");
}
}
if(interiorInvoIf.sizeName != ""){
// 判断是否对文件大小进行限制
if (interiorInvoIf.sizeName != "") {
//判断是否对文件大小进行限制
NodeIf nodeIf = new NodeIf(interiorInvoIf.sizeName);
nodeIf.check(((MethodTree) tree).block());
if (nodeIf.boo){
//nodeIf.check(((MethodTree) tree).block());
((MethodTree) tree).block().accept(nodeIf);
if (nodeIf.boo) {
context.reportIssue(this, node.simpleName(), "程序设计时，应以“白名单”方式限制允许用户上传的文件的类型");
}
}
// 判断是否进行权限设置
if(interiorInvoIf.privType){
//判断是否进行权限设置
if (interiorInvoIf.privType) {
context.reportIssue(this, node.simpleName(), "程序设计时，应以“白名单”方式限制允许用户上传的文件的类型");
}
}
}
// 內部文件名称类型获取类
private class InteriorInvoIf extends IssuableSubscriptionVisitor{
// 文件全名字
//內部文件名称类型获取类
private class InteriorInvoIf extends BaseTreeVisitor {
//文件全名字
public String fileName = "";
// 文件后缀名
public String fileType = "";
// 文件大小
//文件大小
public String sizeName = "";
// 判断权限
//判断权限
public boolean privType = true;
@Override
public List<Tree.Kind> nodesToVisit() {
return Collections.singletonList(Tree.Kind.METHOD_INVOCATION);
}
@Override
public void visitNode(Tree tree){
MethodInvocationTree methodInvocationTree = (MethodInvocationTree) tree;
// 获取到方法调用的参数
ExpressionTree expressionTree = methodInvocationTree.methodSelect();
if(expressionTree instanceof MemberSelectExpressionTree){
public void visitMethodInvocation(MethodInvocationTree tree) {
//获取到方法调用的参数
ExpressionTree expressionTree = tree.methodSelect();
if (expressionTree instanceof MemberSelectExpressionTree) {
MemberSelectExpressionTree expressionTree1 = (MemberSelectExpressionTree) expressionTree;
// 对调用方法进行判断
if("getOriginalFilename".equals(expressionTree1.identifier().toString())){
//对调用方法进行判断
if ("getOriginalFilename".equals(expressionTree1.identifier().toString())) {
Tree parent = expressionTree1.parent();
if(parent instanceof MethodInvocationTree){
if (parent instanceof MethodInvocationTree) {
MethodInvocationTree memberSelectExpressionTree = (MethodInvocationTree) parent;
Tree parent1 = memberSelectExpressionTree.parent();
if(parent1 instanceof VariableTree){
if (parent1 instanceof VariableTree) {
VariableTree variableTree = (VariableTree) parent1;
fileName = variableTree.simpleName().toString();
}
}
}else if("extName".equals(expressionTree1.identifier().toString())){
} else if ("extName".equals(expressionTree1.identifier().toString())) {
Tree parent = expressionTree1.parent();
if(parent instanceof MethodInvocationTree){
if (parent instanceof MethodInvocationTree) {
MethodInvocationTree memberSelectExpressionTree = (MethodInvocationTree) parent;
Tree parent1 = memberSelectExpressionTree.parent();
if(parent1 instanceof VariableTree){
if (parent1 instanceof VariableTree) {
VariableTree variableTree = (VariableTree) parent1;
fileType = variableTree.simpleName().toString();
}
}
}else if("getSize".equals(expressionTree1.identifier().toString())){
} else if ("getSize".equals(expressionTree1.identifier().toString())) {
Tree parent = expressionTree1.parent();
if(parent instanceof MethodInvocationTree){
if (parent instanceof MethodInvocationTree) {
MethodInvocationTree memberSelectExpressionTree = (MethodInvocationTree) parent;
Tree parent1 = memberSelectExpressionTree.parent();
if(parent1 instanceof VariableTree){
if (parent1 instanceof VariableTree) {
VariableTree variableTree = (VariableTree) parent1;
sizeName = variableTree.simpleName().toString();
}
}
}else if("setExecutable".equals(expressionTree1.identifier().toString()) || "setReadable".equals(expressionTree1.identifier().toString()) || "setWritable".equals(expressionTree1.identifier().toString())){
privType = false;
} else if ("setExecutable".equals(expressionTree1.identifier().toString()) || "setReadable".equals(expressionTree1.identifier().toString()) || "setWritable".equals(expressionTree1.identifier().toString())) {
privType = false;
}
}
}
public void check(Tree tree){
this.scanTree(tree);
}
}
public class NodeIf extends IssuableSubscriptionVisitor{
public class NodeIf extends BaseTreeVisitor {
private String name;
public boolean boo = true;
@Override
public List<Tree.Kind> nodesToVisit() {
return Collections.singletonList(Tree.Kind.IF_STATEMENT);
}
public NodeIf(String name) {
this.name = name;
}
public void check(Tree tree){
this.scanTree(tree);
}
@Override
public void visitNode(Tree tree){
IfStatementTree tree1 = (IfStatementTree) tree;
// 获取到if表达式
ExpressionTree condition = tree1.condition();
if(condition instanceof BinaryExpressionTree){
public void visitIfStatement(IfStatementTree tree) {
//获取到if表达式
ExpressionTree condition = tree.condition();
if (condition instanceof BinaryExpressionTree) {
BinaryExpressionTree binaryExpressionTree = (BinaryExpressionTree) condition;
// 判断是否进行if判断
if(name.equals(binaryExpressionTree.leftOperand().toString())){
//判断是否进行if判断
if (name.equals(binaryExpressionTree.leftOperand().toString())) {
boo = false;
}else if(name.equals(binaryExpressionTree.rightOperand().toString())){
} else if (name.equals(binaryExpressionTree.rightOperand().toString())) {
boo = false;
}
}

3
sonar-keyware-plugins-java/src/test/java/com/keyware/sonar/java/rules/checkers/UploadFileVerifyCheckerTest.java
Unescape View File

@ -6,7 +6,6 @@
*/
package com.keyware.sonar.java.rules.checkers;
import com.keyware.sonar.java.utils.FilesUtils;
import org.junit.jupiter.api.Test;
import org.sonar.java.checks.verifier.CheckVerifier;
@ -31,7 +30,7 @@ public class UploadFileVerifyCheckerTest {
CheckVerifier.newVerifier()
.onFile("src/test/files/UploadFileVerifyRule.java")
.withCheck(rule)
.withClassPath(FilesUtils.getClassPath("target/test-jars"))
// .withClassPath(FilesUtils.getClassPath("target/test-jars"))
.verifyIssues();
}
}

Write Preview
Loading…
Cancel
Save