Examples with Expressions org.sonar.python.checks.Expressions used on opensource projects

Example 1 with Expressions

use of org.sonar.python.checks.Expressions in project sonar-python by SonarSource.

the class CsrfDisabledCheck method flaskWtfCsrfEnabledFalseCheck.

/**
 * Checks that <code>'WTF_CSRF_ENABLED'</code> setting is not switched off.
 */
private static void flaskWtfCsrfEnabledFalseCheck(SubscriptionContext subscriptionContext) {
    AssignmentStatement asgn = (AssignmentStatement) subscriptionContext.syntaxNode();
    // Checks that the left hand side is some kind of subscription of `something['WTF_CSRF_ENABLED']`
    // Does not check what `something` is - overtainting seems extremely unlikely in this case.
    boolean isWtfCsrfEnabledSubscription = asgn.lhsExpressions().stream().flatMap(exprList -> exprList.expressions().stream()).filter(expr -> expr.is(Tree.Kind.SUBSCRIPTION)).flatMap(s -> ((SubscriptionExpression) s).subscripts().expressions().stream()).anyMatch(isStringSatisfying(s -> "WTF_CSRF_ENABLED".equals(s) || "WTF_CSRF_CHECK_DEFAULT".equals(s)));
    if (isWtfCsrfEnabledSubscription && Expressions.isFalsy(asgn.assignedValue())) {
        subscriptionContext.addIssue(asgn.assignedValue(), MESSAGE);
    }
}

Example 2 with Expressions

use of org.sonar.python.checks.Expressions in project sonar-python by SonarSource.

the class CorsCheck method checkAllowOriginProperty.

private static void checkAllowOriginProperty(SubscriptionContext ctx) {
    AssignmentStatement assignment = (AssignmentStatement) ctx.syntaxNode();
    Optional<Expression> lhs = getOnlyAssignedLhs(assignment);
    if (lhs.isPresent() && lhs.get().is(SUBSCRIPTION)) {
        SubscriptionExpression subscription = (SubscriptionExpression) lhs.get();
        List<Expression> subscripts = subscription.subscripts().expressions();
        if (subscripts.size() != 1) {
            return;
        }
        if (subscription.object().is(NAME) && TYPES_TO_CHECK.stream().anyMatch(t -> subscription.object().type().canOnlyBe(t))) {
            reportIfAllowOriginIsSet(ctx, assignment, subscripts.get(0));
        } else {
            checkAllowOriginPropertyQualifiedExpr(ctx, assignment, subscription, subscripts);
        }
    }
}

Example 3 with Expressions

use of org.sonar.python.checks.Expressions in project sonar-python by SonarSource.

the class PubliclyWritableDirectoriesCheck method initialize.

@Override
public void initialize(Context context) {
    context.registerSyntaxNodeConsumer(Kind.STRING_ELEMENT, ctx -> {
        StringElement tree = (StringElement) ctx.syntaxNode();
        String stringElement = Expressions.unescape(tree).toLowerCase(Locale.ENGLISH);
        if (UNIX_WRITABLE_DIRECTORIES.stream().anyMatch(dir -> containsDirectory(stringElement, dir)) || WINDOWS_WRITABLE_DIRECTORIES.matcher(stringElement).matches()) {
            ctx.addIssue(tree, MESSAGE);
        }
    });
    context.registerSyntaxNodeConsumer(Kind.CALL_EXPR, ctx -> {
        CallExpression tree = (CallExpression) ctx.syntaxNode();
        List<Argument> arguments = tree.arguments();
        if (isOsEnvironGetter(tree) && arguments.stream().filter(arg -> arg.is(Kind.REGULAR_ARGUMENT)).map(RegularArgument.class::cast).map(RegularArgument::expression).anyMatch(PubliclyWritableDirectoriesCheck::isNonCompliantOsEnvironArgument)) {
            ctx.addIssue(tree, MESSAGE);
        }
    });
    context.registerSyntaxNodeConsumer(Kind.SUBSCRIPTION, ctx -> {
        SubscriptionExpression tree = (SubscriptionExpression) ctx.syntaxNode();
        if (isOsEnvironQualifiedExpression(tree.object()) && tree.subscripts().expressions().stream().anyMatch(PubliclyWritableDirectoriesCheck::isNonCompliantOsEnvironArgument)) {
            ctx.addIssue(tree, MESSAGE);
        }
    });
}

Example 4 with Expressions

use of org.sonar.python.checks.Expressions in project sonar-python by SonarSource.

the class HttpOnlyCookieCheck method subscriptionSessionCookieHttponlyCheck.

private void subscriptionSessionCookieHttponlyCheck(SubscriptionContext ctx) {
    AssignmentStatement assignmentStatement = (AssignmentStatement) ctx.syntaxNode();
    boolean isSubscriptionToSessionCookieHttponly = assignmentStatement.lhsExpressions().stream().flatMap(exprList -> exprList.expressions().stream()).filter(expr -> expr.is(Tree.Kind.SUBSCRIPTION)).flatMap(subscription -> ((SubscriptionExpression) subscription).subscripts().expressions().stream()).anyMatch(HttpOnlyCookieCheck::isSessionCookieHttponlyStringLiteral);
    if (isSubscriptionToSessionCookieHttponly && Expressions.isFalsy(assignmentStatement.assignedValue())) {
        ctx.addIssue(assignmentStatement.assignedValue(), message());
    }
}