Examples with ASTVariableExpression net.sourceforge.pmd.lang.apex.ast.ASTVariableExpression used on opensource projects

Example 11 with ASTVariableExpression

use of net.sourceforge.pmd.lang.apex.ast.ASTVariableExpression in project pmd by pmd.

the class ApexXSSFromURLParamRule method processBinaryExpression.

private void processBinaryExpression(AbstractApexNode<?> node, Object data) {
    ASTBinaryExpression nestedBinaryExpression = node.getFirstChildOfType(ASTBinaryExpression.class);
    if (nestedBinaryExpression != null) {
        processBinaryExpression(nestedBinaryExpression, data);
    }
    ASTMethodCallExpression methodCallAssignment = node.getFirstChildOfType(ASTMethodCallExpression.class);
    if (methodCallAssignment != null) {
        processInlineMethodCalls(methodCallAssignment, data, true);
    }
    final List<ASTVariableExpression> nodes = node.findChildrenOfType(ASTVariableExpression.class);
    for (ASTVariableExpression n : nodes) {
        if (urlParameterStrings.contains(Helper.getFQVariableName(n))) {
            addViolation(data, n);
        }
    }
}

Example 12 with ASTVariableExpression

use of net.sourceforge.pmd.lang.apex.ast.ASTVariableExpression in project pmd by pmd.

the class ApexOpenRedirectRule method findSafeLiterals.

private void findSafeLiterals(AbstractApexNode<?> node) {
    ASTBinaryExpression binaryExp = node.getFirstChildOfType(ASTBinaryExpression.class);
    if (binaryExp != null) {
        findSafeLiterals(binaryExp);
    }
    ASTLiteralExpression literal = node.getFirstChildOfType(ASTLiteralExpression.class);
    if (literal != null) {
        int index = literal.jjtGetChildIndex();
        if (index == 0) {
            if (node instanceof ASTVariableDeclaration) {
                addVariable((ASTVariableDeclaration) node);
            } else if (node instanceof ASTBinaryExpression) {
                ASTVariableDeclaration parent = node.getFirstParentOfType(ASTVariableDeclaration.class);
                if (parent != null) {
                    addVariable(parent);
                }
                ASTAssignmentExpression assignment = node.getFirstParentOfType(ASTAssignmentExpression.class);
                if (assignment != null) {
                    ASTVariableExpression var = assignment.getFirstChildOfType(ASTVariableExpression.class);
                    if (var != null) {
                        addVariable(var);
                    }
                }
            }
        }
    } else {
        if (node instanceof ASTField) {
            /*
                 * sergey.gorbaty: Apex Jorje parser is returning a null from
                 * Field.getFieldInfo(), but the info is available from an inner
                 * field. DO NOT attempt to optimize this block without checking
                 * that Jorje parser actually fixed its bug.
                 * 
                 */
            try {
                final Field f = node.getNode().getClass().getDeclaredField("fieldInfo");
                f.setAccessible(true);
                final StandardFieldInfo fieldInfo = (StandardFieldInfo) f.get(node.getNode());
                if (fieldInfo.getType().getApexName().equalsIgnoreCase("String")) {
                    if (fieldInfo.getValue() != null) {
                        addVariable(fieldInfo);
                    }
                }
            } catch (NoSuchFieldException | SecurityException | IllegalArgumentException | IllegalAccessException e) {
                throw new RuntimeException(e);
            }
        }
    }
}

Example 13 with ASTVariableExpression

use of net.sourceforge.pmd.lang.apex.ast.ASTVariableExpression in project pmd by pmd.

the class ApexSOQLInjectionRule method findSanitizedVariables.

private void findSanitizedVariables(AbstractApexNode<?> node) {
    final ASTVariableExpression left = node.getFirstChildOfType(ASTVariableExpression.class);
    final ASTLiteralExpression literal = node.getFirstChildOfType(ASTLiteralExpression.class);
    final ASTMethodCallExpression right = node.getFirstChildOfType(ASTMethodCallExpression.class);
    // look for String a = 'b';
    if (literal != null) {
        if (left != null) {
            Object o = literal.getNode().getLiteral();
            if (o instanceof Integer || o instanceof Boolean || o instanceof Double) {
                safeVariables.add(Helper.getFQVariableName(left));
            }
            if (o instanceof String) {
                if (SELECT_PATTERN.matcher((String) o).matches()) {
                    selectContainingVariables.put(Helper.getFQVariableName(left), Boolean.TRUE);
                } else {
                    safeVariables.add(Helper.getFQVariableName(left));
                }
            }
        }
    }
    // look for String a = String.escapeSingleQuotes(foo);
    if (right != null) {
        if (Helper.isMethodName(right, STRING, ESCAPE_SINGLE_QUOTES)) {
            if (left != null) {
                safeVariables.add(Helper.getFQVariableName(left));
            }
        }
    }
    if (node instanceof ASTVariableDeclaration) {
        VariableDeclaration o = (VariableDeclaration) node.getNode();
        switch(o.getLocalInfo().getType().getApexName().toLowerCase(Locale.ROOT)) {
            case INTEGER:
            case ID:
            case BOOLEAN:
            case DECIMAL:
            case LONG:
            case DOUBLE:
                safeVariables.add(Helper.getFQVariableName(left));
                break;
            default:
                break;
        }
    }
}

Example 14 with ASTVariableExpression

use of net.sourceforge.pmd.lang.apex.ast.ASTVariableExpression in project pmd by pmd.

the class ApexSOQLInjectionRule method recursivelyCheckForSelect.

private void recursivelyCheckForSelect(final ASTVariableExpression var, final ASTBinaryExpression node) {
    final ASTBinaryExpression right = node.getFirstChildOfType(ASTBinaryExpression.class);
    if (right != null) {
        recursivelyCheckForSelect(var, right);
    }
    final ASTVariableExpression concatenatedVar = node.getFirstChildOfType(ASTVariableExpression.class);
    boolean isSafeVariable = false;
    if (concatenatedVar != null) {
        if (safeVariables.contains(Helper.getFQVariableName(concatenatedVar))) {
            isSafeVariable = true;
        }
    }
    final ASTMethodCallExpression methodCall = node.getFirstChildOfType(ASTMethodCallExpression.class);
    if (methodCall != null) {
        if (Helper.isMethodName(methodCall, STRING, ESCAPE_SINGLE_QUOTES)) {
            isSafeVariable = true;
        }
    }
    final ASTLiteralExpression literal = node.getFirstChildOfType(ASTLiteralExpression.class);
    if (literal != null) {
        Object o = literal.getNode().getLiteral();
        if (o instanceof String) {
            if (SELECT_PATTERN.matcher((String) o).matches()) {
                if (!isSafeVariable) {
                    // select literal + other unsafe vars
                    selectContainingVariables.put(Helper.getFQVariableName(var), Boolean.FALSE);
                } else {
                    safeVariables.add(Helper.getFQVariableName(var));
                }
            }
        }
    } else {
        if (!isSafeVariable) {
            selectContainingVariables.put(Helper.getFQVariableName(var), Boolean.FALSE);
        }
    }
}

Example 15 with ASTVariableExpression

use of net.sourceforge.pmd.lang.apex.ast.ASTVariableExpression in project pmd by pmd.

the class ApexSuggestUsingNamedCredRule method runChecks.

private void runChecks(final AbstractApexNode<?> node, Object data) {
    ASTLiteralExpression literalNode = node.getFirstChildOfType(ASTLiteralExpression.class);
    if (literalNode != null) {
        if (isAuthorizationLiteral(literalNode)) {
            addViolation(data, literalNode);
        }
    }
    final ASTVariableExpression varNode = node.getFirstChildOfType(ASTVariableExpression.class);
    if (varNode != null) {
        if (listOfAuthorizationVariables.contains(Helper.getFQVariableName(varNode))) {
            addViolation(data, varNode);
        }
    }
}