Search in sources :

Example 1 with VariableDeclaration

use of apex.jorje.semantic.ast.statement.VariableDeclaration in project pmd by pmd.

the class Helper method getFQVariableName.

static String getFQVariableName(final ASTVariableDeclaration variable) {
    VariableDeclaration n = variable.getNode();
    StringBuilder sb = new StringBuilder().append(n.getDefiningType().getApexName()).append(":").append(n.getLocalInfo().getName());
    return sb.toString();
}
Also used : VariableDeclaration(apex.jorje.semantic.ast.statement.VariableDeclaration) ASTVariableDeclaration(net.sourceforge.pmd.lang.apex.ast.ASTVariableDeclaration)

Example 2 with VariableDeclaration

use of apex.jorje.semantic.ast.statement.VariableDeclaration in project pmd by pmd.

the class ApexSOQLInjectionRule method findSanitizedVariables.

private void findSanitizedVariables(AbstractApexNode<?> node) {
    final ASTVariableExpression left = node.getFirstChildOfType(ASTVariableExpression.class);
    final ASTLiteralExpression literal = node.getFirstChildOfType(ASTLiteralExpression.class);
    final ASTMethodCallExpression right = node.getFirstChildOfType(ASTMethodCallExpression.class);
    // look for String a = 'b';
    if (literal != null) {
        if (left != null) {
            Object o = literal.getNode().getLiteral();
            if (o instanceof Integer || o instanceof Boolean || o instanceof Double) {
                safeVariables.add(Helper.getFQVariableName(left));
            }
            if (o instanceof String) {
                if (SELECT_PATTERN.matcher((String) o).matches()) {
                    selectContainingVariables.put(Helper.getFQVariableName(left), Boolean.TRUE);
                } else {
                    safeVariables.add(Helper.getFQVariableName(left));
                }
            }
        }
    }
    // look for String a = String.escapeSingleQuotes(foo);
    if (right != null) {
        if (Helper.isMethodName(right, STRING, ESCAPE_SINGLE_QUOTES)) {
            if (left != null) {
                safeVariables.add(Helper.getFQVariableName(left));
            }
        }
    }
    if (node instanceof ASTVariableDeclaration) {
        VariableDeclaration o = (VariableDeclaration) node.getNode();
        switch(o.getLocalInfo().getType().getApexName().toLowerCase(Locale.ROOT)) {
            case INTEGER:
            case ID:
            case BOOLEAN:
            case DECIMAL:
            case LONG:
            case DOUBLE:
                safeVariables.add(Helper.getFQVariableName(left));
                break;
            default:
                break;
        }
    }
}
Also used : ASTVariableExpression(net.sourceforge.pmd.lang.apex.ast.ASTVariableExpression) ASTLiteralExpression(net.sourceforge.pmd.lang.apex.ast.ASTLiteralExpression) ASTVariableDeclaration(net.sourceforge.pmd.lang.apex.ast.ASTVariableDeclaration) VariableDeclaration(apex.jorje.semantic.ast.statement.VariableDeclaration) ASTVariableDeclaration(net.sourceforge.pmd.lang.apex.ast.ASTVariableDeclaration) ASTMethodCallExpression(net.sourceforge.pmd.lang.apex.ast.ASTMethodCallExpression)

Aggregations

VariableDeclaration (apex.jorje.semantic.ast.statement.VariableDeclaration)2 ASTVariableDeclaration (net.sourceforge.pmd.lang.apex.ast.ASTVariableDeclaration)2 ASTLiteralExpression (net.sourceforge.pmd.lang.apex.ast.ASTLiteralExpression)1 ASTMethodCallExpression (net.sourceforge.pmd.lang.apex.ast.ASTMethodCallExpression)1 ASTVariableExpression (net.sourceforge.pmd.lang.apex.ast.ASTVariableExpression)1