public boolean isServletWriter() { if (getSpecialKind() == Item.SERVLET_OUTPUT) { return true; } if ("Ljavax/servlet/ServletOutputStream;".equals(getSignature())) { return true; } XMethod writingToSource = getReturnValueOf(); return writingToSource != null && "javax.servlet.http.HttpServletResponse".equals(writingToSource.getClassName()) && ("getWriter".equals(writingToSource.getName()) || "getOutputStream".equals(writingToSource.getName())); }
private int taintPriority(OpcodeStack.Item writing) { if (writing == null) { return Priorities.NORMAL_PRIORITY; } XMethod method = writing.getReturnValueOf(); if (method != null && "getParameter".equals(method.getName()) && "javax.servlet.http.HttpServletRequest".equals(method.getClassName())) { return Priorities.HIGH_PRIORITY; } return Priorities.NORMAL_PRIORITY; }
private static boolean newlyConstructedObject(OpcodeStack.Item item) { XMethod method = item.getReturnValueOf(); if (method == null) { return false; } return Const.CONSTRUCTOR_NAME.equals(method.getName()); }
private int taintPriority(OpcodeStack.Item writing) { if (writing == null) { return Priorities.NORMAL_PRIORITY; } XMethod method = writing.getReturnValueOf(); if (method != null && "getParameter".equals(method.getName()) && "javax.servlet.http.HttpServletRequest".equals(method.getClassName())) { return Priorities.HIGH_PRIORITY; } return Priorities.NORMAL_PRIORITY; }
public boolean isServletWriter() { if (getSpecialKind() == Item.SERVLET_OUTPUT) { return true; } if ("Ljavax/servlet/ServletOutputStream;".equals(getSignature())) { return true; } XMethod writingToSource = getReturnValueOf(); return writingToSource != null && "javax.servlet.http.HttpServletResponse".equals(writingToSource.getClassName()) && ("getWriter".equals(writingToSource.getName()) || "getOutputStream".equals(writingToSource.getName())); }
) { String primitiveType = ClassName.getPrimitiveType(called.getClassDescriptor().getClassName()); XMethod rvo = stack.getStackItem(1).getReturnValueOf(); XField field = stack.getStackItem(1).getXField(); String signature; XMethod returnValueOf = item0.getReturnValueOf(); if (constant1 instanceof Integer && returnValueOf != null
XMethod xMethod = item.getReturnValueOf(); if(xMethod != null && xMethod.getName().equals(Const.CONSTRUCTOR_NAME) && ClassName.isAnonymous(xMethod.getClassName())) { List<BugAnnotation> annotations = anonymousClassAnnotation.get(xMethod.getClassName());
|| (seen == Const.INVOKEVIRTUAL || seen == Const.INVOKEINTERFACE) && "addAll".equals(getNameConstantOperand()) && "(Ljava/util/Collection;)Z".equals(getSigConstantOperand())) { OpcodeStack.Item top = stack.getStackItem(0); XMethod returnValueOf = top.getReturnValueOf(); if (returnValueOf != null && "entrySet".equals(returnValueOf.getName())) { String name = returnValueOf.getClassName(); as.add(fieldAnnotation); } else { XMethod m = item.getReturnValueOf(); if (m != null) { MethodAnnotation methodAnnotation = MethodAnnotation.fromXMethod(m); XMethod m = top.getReturnValueOf(); if (m != null) { if ("compareTo".equals(m.getName()) || "compare".equals(m.getName())) {
&& stack.getStackDepth() >= 2) { Item left = stack.getStackItem(1); XMethod leftM = left.getReturnValueOf(); Item right = stack.getStackItem(0); XMethod rightM = right.getReturnValueOf(); if (leftM != null && rightM != null && "getName".equals(leftM.getName()) && "getClass".equals(rightM.getName())) { dangerDanger = true;
XMethod xMethod = rv.getReturnValueOf(); if (xMethod == null) { returnSelf++;
System.out.println("Stack top: " + top); XMethod m = top.getReturnValueOf(); if (m != null && "java.util.concurrent.ConcurrentHashMap".equals(m.getClassName()) && "containsKey".equals(m.getName())) { System.out.println("Stack top: " + top); XMethod m = top.getReturnValueOf(); if (DEBUG) { System.out.println("Found null check");
OpcodeStack.Item right = stack.getStackItem(0); if (badUseOfCompareResult(left, right)) { XMethod returnValueOf = left.getReturnValueOf(); assert returnValueOf != null; bugAccumulator.accumulateBug(new BugInstance(this, "RV_CHECK_COMPARETO_FOR_SPECIFIC_RETURN_VALUE", NORMAL_PRIORITY) .addClassAndMethod(this).addMethod(returnValueOf).describe(MethodAnnotation.METHOD_CALLED).addValueSource(right, this), this); } else if (badUseOfCompareResult(right, left)) { XMethod returnValueOf = right.getReturnValueOf(); assert returnValueOf != null; bugAccumulator.accumulateBug(new BugInstance(this, "RV_CHECK_COMPARETO_FOR_SPECIFIC_RETURN_VALUE", NORMAL_PRIORITY)
if (stack.getStackDepth() >= 2) { Item left = stack.getStackItem(1); XMethod leftM = left.getReturnValueOf(); Item right = stack.getStackItem(0); XMethod rightM = right.getReturnValueOf(); if ("Ljava/lang/Class;".equals(left.getSignature()) && "Ljava/lang/Class;".equals(right.getSignature())) { boolean leftMatch = leftM != null && "getClass".equals(leftM.getName());
} else if (seen == Const.INVOKEINTERFACE && getMethodDescriptorOperand().equals(NODELIST_GET_LENGTH)) { Item item = getStack().getStackItem(0); XMethod returnValueOf = item.getReturnValueOf(); if(returnValueOf != null && returnValueOf.getClassName().startsWith("org.w3c.dom.") && returnValueOf.getName().startsWith("getElementsByTagName")) { matched.put(getPC(),
if (readObject.equals(top.getReturnValueOf())) { ClassDescriptor c = getClassDescriptorOperand(); if (!Subtypes2.instanceOf(c, Serializable.class)) {
upperBound = lowerBound = null; XMethod rvo1 = stack.getStackItem(0).getReturnValueOf(); XMethod rvo2 = stack.getStackItem(1).getReturnValueOf(); if(rvo1 != null ^ rvo2 != null) { XMethod rvo = rvo1 == null ? rvo2 : rvo1;
private boolean badUseOfCompareResult(Item left, Item right) { XMethod m = left.getReturnValueOf();
/** * @param item stack item to check * @return true if this stack item is known to be newly created */ private static boolean isNew(OpcodeStack.Item item) { if(item.isNewlyAllocated()) { return true; } XMethod returnValueOf = item.getReturnValueOf(); if(returnValueOf == null) { return false; } if("iterator".equals(returnValueOf.getName()) && "()Ljava/util/Iterator;".equals(returnValueOf.getSignature()) && Subtypes2.instanceOf(returnValueOf.getClassName(), "java.lang.Iterable")) { return true; } if(returnValueOf.getClassName().startsWith("[") && returnValueOf.getName().equals("clone")) { return true; } if(NEW_OBJECT_RETURNING_METHODS.contains(returnValueOf.getMethodDescriptor())) { return true; } return false; }
private boolean bad(Item left, Item right) { XMethod m = left.getReturnValueOf(); if (m == null) { return false; } Object value = right.getConstant(); if (!(value instanceof Integer) || ((Integer) value).intValue() == 0) { return false; } if (m.isStatic() || !m.isPublic()) { return false; } if ("compareTo".equals(m.getName()) && "(Ljava/lang/Object;)I".equals(m.getSignature())) { return true; } if ("compare".equals(m.getName()) && "(Ljava/lang/Object;Ljava/lang/Object;)I".equals(m.getSignature())) { return true; } return false; }
public static @CheckForNull BugAnnotation getFieldOrMethodValueSource(@CheckForNull OpcodeStack.Item item) { if (item == null) { return null; } XField xField = item.getXField(); if (xField != null) { FieldAnnotation a = FieldAnnotation.fromXField(xField); a.setDescription(FieldAnnotation.LOADED_FROM_ROLE); return a; } XMethod xMethod = item.getReturnValueOf(); if (xMethod != null) { MethodAnnotation a = MethodAnnotation.fromXMethod(xMethod); a.setDescription(MethodAnnotation.METHOD_RETURN_VALUE_OF); return a; } return null; }