Skip to content

Commit 4523e2c

Browse files
antonioaversaantonioaversa
authored
SONARKT-633 More extensive testing for S6363 (#594)
1 parent fa7c9b7 commit 4523e2c

File tree

3 files changed

+265
-38
lines changed

3 files changed

+265
-38
lines changed

‎kotlin-checks-test-sources/src/main/kotlin/checks/WebViewsFileAccessCheckSample.kt

Lines changed: 156 additions & 37 deletions
Original file line numberDiff line numberDiff line change
@@ -2,55 +2,174 @@ package checks
22

33
import android.webkit.WebSettings
44

5-
private const val MY_TRUE = true
5+
private val topLevelTrueVal = true
6+
private var topLevelTrueVar = true
67

78
class WebViewsFileAccessCheckSample {
8-
fun foo(settings: WebSettings, value: Boolean) {
9+
10+
private val classLevelTrueVal = true
11+
private var classLevelTrueVar = true
12+
13+
// region non compliant scenarios
14+
15+
fun setPropertiesToTrue(settings: WebSettings) {
916
settings.allowFileAccess = true // Noncompliant {{Make sure that enabling file access is safe here.}}
10-
// ^^^^
11-
settings.setAllowFileAccess(MY_TRUE) // Noncompliant {{Make sure that enabling file access is safe here.}}
12-
// ^^^^^^^
17+
// ^^^^
18+
settings.allowFileAccessFromFileURLs = true // Noncompliant
19+
settings.allowUniversalAccessFromFileURLs = true // Noncompliant
20+
settings.allowContentAccess = true // Noncompliant
21+
}
1322

14-
settings.allowFileAccess = false // Compliant
15-
settings.setAllowFileAccess(false) // Compliant
16-
settings.allowFileAccess = value // Compliant
17-
settings.setAllowFileAccess(value) // Compliant
23+
fun setPropertiesToTrueVal(settings: WebSettings) {
24+
val trueVal = true
25+
settings.allowFileAccess = trueVal // Noncompliant
26+
settings.allowFileAccessFromFileURLs = trueVal // Noncompliant
27+
settings.allowUniversalAccessFromFileURLs = trueVal // Noncompliant
28+
settings.allowContentAccess = trueVal // Noncompliant
1829

19-
settings.allowContentAccess = true // Noncompliant {{Make sure that enabling file access is safe here.}}
20-
// ^^^^
21-
settings.setAllowContentAccess(true) // Noncompliant {{Make sure that enabling file access is safe here.}}
22-
// ^^^^
30+
settings.allowFileAccess = topLevelTrueVal // Noncompliant
31+
settings.allowFileAccess = classLevelTrueVal // Noncompliant
32+
}
2333

24-
settings.allowContentAccess = false // Compliant
25-
settings.setAllowContentAccess(false) // Compliant
26-
settings.allowContentAccess = value // Compliant
27-
settings.setAllowContentAccess(value) // Compliant
34+
fun setPropertiesToTrueVar(settings: WebSettings) {
35+
var trueVar = true
36+
settings.allowFileAccess = trueVar // FN, trueVar may have been changed since previous assignment
37+
settings.allowFileAccessFromFileURLs = trueVar // FN, trueVar may have been changed since previous assignment
38+
settings.allowUniversalAccessFromFileURLs = trueVar // FN, trueVar may have been changed since previous assignment
39+
settings.allowContentAccess = trueVar // FN, trueVar may have been changed since previous assignment
2840

29-
settings.allowFileAccessFromFileURLs = true // Noncompliant {{Make sure that enabling file access is safe here.}}
30-
// ^^^^
31-
settings.setAllowFileAccessFromFileURLs(true) // Noncompliant {{Make sure that enabling file access is safe here.}}
32-
// ^^^^
41+
settings.allowFileAccess = topLevelTrueVar // FN, topLevelTrueVar may have been changed since top-level assignment
42+
settings.allowFileAccess = classLevelTrueVar // FN, classLevelTrueVar may have been changed since instance init
43+
}
3344

34-
settings.allowFileAccessFromFileURLs = false // Compliant
35-
settings.setAllowFileAccessFromFileURLs(false) // Compliant
36-
settings.allowFileAccessFromFileURLs = value // Compliant
37-
settings.setAllowFileAccessFromFileURLs(value) // Compliant
45+
fun usingSettersWithTrue(settings: WebSettings) {
46+
settings.setAllowFileAccess(true) // Noncompliant
47+
// ^^^^
48+
settings.setAllowFileAccessFromFileURLs(true) // Noncompliant
49+
settings.setAllowUniversalAccessFromFileURLs(true) // Noncompliant
50+
settings.setAllowContentAccess(true) // Noncompliant
51+
}
3852

39-
settings.allowUniversalAccessFromFileURLs = true // Noncompliant {{Make sure that enabling file access is safe here.}}
40-
// ^^^^
41-
settings.setAllowUniversalAccessFromFileURLs(true) // Noncompliant {{Make sure that enabling file access is safe here.}}
42-
// ^^^^
53+
fun usingApplyWithTrue(settings: WebSettings) {
54+
settings.apply {
55+
allowFileAccess = true // Noncompliant
56+
// ^^^^
57+
allowFileAccessFromFileURLs = true // Noncompliant
58+
allowUniversalAccessFromFileURLs = true // Noncompliant
59+
allowContentAccess = true // Noncompliant
60+
}
61+
}
4362

44-
settings.allowUniversalAccessFromFileURLs = false // Compliant
45-
settings.setAllowUniversalAccessFromFileURLs(false) // Compliant
46-
settings.allowUniversalAccessFromFileURLs = value // Compliant
47-
settings.setAllowUniversalAccessFromFileURLs(value) // Compliant
63+
fun usingSettersWithTrueViaApply(settings: WebSettings) {
64+
settings.apply {
65+
setAllowFileAccess(true) // Noncompliant
66+
// ^^^^
67+
setAllowFileAccessFromFileURLs(true) // Noncompliant
68+
setAllowUniversalAccessFromFileURLs(true) // Noncompliant
69+
setAllowContentAccess(true) // Noncompliant
70+
}
71+
}
72+
73+
fun usingWithWithTrue(settings: WebSettings) {
74+
with(settings) {
75+
allowFileAccess = true // Noncompliant
76+
// ^^^^
77+
allowFileAccessFromFileURLs = true // Noncompliant
78+
allowUniversalAccessFromFileURLs = true // Noncompliant
79+
allowContentAccess = true // Noncompliant
80+
}
81+
}
82+
83+
fun usingLetWithTrue(settings: WebSettings) {
84+
settings.let {
85+
it.allowFileAccess = true // Noncompliant
86+
// ^^^^
87+
it.allowFileAccessFromFileURLs = true // Noncompliant
88+
it.allowUniversalAccessFromFileURLs = true // Noncompliant
89+
it.allowContentAccess = true // Noncompliant
90+
}
4891
}
4992

50-
fun coverage(a: Boolean) {
51-
var x = false
52-
if (a != true) {
53-
x = true
93+
fun usingSafeCallToLetWithTrue(settings: WebSettings?) {
94+
settings?.let { namedIt ->
95+
namedIt.allowFileAccess = true // Noncompliant
96+
namedIt.allowFileAccessFromFileURLs = true // Noncompliant
97+
namedIt.allowUniversalAccessFromFileURLs = true // Noncompliant
98+
namedIt.allowContentAccess = true // Noncompliant
5499
}
55100
}
101+
102+
fun assigningFunToAnotherFun(settings: WebSettings) {
103+
val fun1 = settings::setAllowFileAccess
104+
fun1(true) // FN, requires data flow analysis
105+
}
106+
107+
fun assigningConstantBooleanExpression(settings: WebSettings) {
108+
settings.allowFileAccess = true || false // FN, requires resolving complex constant expressions
109+
}
110+
111+
// endregion
112+
113+
// region compliant scenarios
114+
115+
fun getProperties(settings: WebSettings) {
116+
val allowFileAccess = settings.allowFileAccess // Compliant
117+
val allowFileAccessFromFileURLs = settings.allowFileAccessFromFileURLs // Compliant
118+
val allowUniversalAccessFromFileURLs = settings.allowUniversalAccessFromFileURLs // Compliant
119+
val allowContentAccess = settings.allowContentAccess // Compliant
120+
}
121+
122+
fun toggleProperties(settings: WebSettings) {
123+
settings.allowFileAccess = !settings.allowFileAccess // Compliant
124+
settings.allowFileAccessFromFileURLs = !settings.allowFileAccessFromFileURLs // Compliant
125+
settings.allowUniversalAccessFromFileURLs = !settings.allowUniversalAccessFromFileURLs // Compliant
126+
settings.allowContentAccess = !settings.allowContentAccess // Compliant
127+
}
128+
129+
fun setPropertiesToFalse(settings: WebSettings) {
130+
settings.allowFileAccess = false // Compliant
131+
settings.allowFileAccessFromFileURLs = false // Compliant
132+
settings.allowUniversalAccessFromFileURLs = false // Compliant
133+
settings.allowContentAccess = false // Compliant
134+
}
135+
136+
fun setPropertiesToFalseVal(settings: WebSettings) {
137+
val falseVal = false
138+
settings.allowFileAccess = falseVal // Compliant, guaranteed to be false
139+
settings.allowFileAccessFromFileURLs = falseVal // Compliant, guaranteed to be false
140+
settings.allowUniversalAccessFromFileURLs = falseVal // Compliant, guaranteed to be false
141+
settings.allowContentAccess = falseVal // Compliant, guaranteed to be false
142+
}
143+
144+
fun setPropertiesToFalseVar(settings: WebSettings) {
145+
var falseVar = false
146+
settings.allowFileAccess = falseVar // Compliant, value may still be false
147+
settings.allowFileAccessFromFileURLs = falseVar // Compliant, value may still be false
148+
settings.allowUniversalAccessFromFileURLs = falseVar // Compliant, value may still be false
149+
settings.allowContentAccess = falseVar // Compliant, value may still be false
150+
}
151+
152+
fun setPropertiesToBooleanParam(settings: WebSettings, value: Boolean) {
153+
settings.allowFileAccess = value // Compliant, value may be false
154+
settings.allowFileAccessFromFileURLs = value // Compliant, value may be false
155+
settings.allowUniversalAccessFromFileURLs = value // Compliant, value may be false
156+
settings.allowContentAccess = value // Compliant, value may be false
157+
}
158+
159+
fun usingSettersWithFalse(settings: WebSettings) {
160+
settings.setAllowFileAccess(false) // Compliant, value is false
161+
settings.setAllowFileAccessFromFileURLs(false) // Compliant, value is false
162+
settings.setAllowUniversalAccessFromFileURLs(false) // Compliant, value is false
163+
settings.setAllowContentAccess(false) // Compliant, value is false
164+
}
165+
166+
fun notAWebSettingsObject(settings: NotAWebSettings) {
167+
settings.allowFileAccess = true // Compliant, not a WebSettings object from android.webkit
168+
}
169+
170+
class NotAWebSettings {
171+
var allowFileAccess: Boolean = false
172+
}
173+
174+
// endregion
56175
}

‎kotlin-checks-test-sources/src/main/kotlin/checks/WebViewsFileAccessCheckSampleNoSemantics.kt

Lines changed: 108 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,108 @@
1+
package checks
2+
3+
import android.webkit.WebSettings
4+
5+
class WebViewsFileAccessCheckSampleNoSemantics {
6+
7+
// region non compliant scenarios
8+
9+
fun noSemantics_setPropertiesToTrue(settings: WebSettings) {
10+
settings.allowFileAccess = true // FN
11+
settings.allowFileAccessFromFileURLs = true // FN
12+
settings.allowUniversalAccessFromFileURLs = true // FN
13+
settings.allowContentAccess = true // FN
14+
}
15+
16+
fun noSemantics_usingApplyWithTrue(settings: WebSettings) {
17+
settings.apply {
18+
allowFileAccess = true // FN
19+
allowFileAccessFromFileURLs = true // FN
20+
allowUniversalAccessFromFileURLs = true // FN
21+
allowContentAccess = true // FN
22+
}
23+
}
24+
25+
fun noSemantics_usingWithWithTrue(settings: WebSettings) {
26+
with(settings) {
27+
allowFileAccess = true // FN
28+
allowFileAccessFromFileURLs = true // FN
29+
allowUniversalAccessFromFileURLs = true // FN
30+
allowContentAccess = true // FN
31+
}
32+
}
33+
34+
fun noSemantics_usingLetWithTrue(settings: WebSettings) {
35+
settings.let {
36+
it.allowFileAccess = true // FN
37+
it.allowFileAccessFromFileURLs = true // FN
38+
it.allowUniversalAccessFromFileURLs = true // FN
39+
it.allowContentAccess = true // FN
40+
}
41+
}
42+
43+
// endregion
44+
45+
// region compliant scenarios
46+
47+
fun noSemantics_getProperties(settings: WebSettings) {
48+
val allowFileAccess = settings.allowFileAccess // Compliant
49+
val allowFileAccessFromFileURLs = settings.allowFileAccessFromFileURLs // Compliant
50+
val allowUniversalAccessFromFileURLs = settings.allowUniversalAccessFromFileURLs // Compliant
51+
val allowContentAccess = settings.allowContentAccess // Compliant
52+
}
53+
54+
fun noSemantics_toggleProperties(settings: WebSettings) {
55+
settings.allowFileAccess = !settings.allowFileAccess // Compliant
56+
settings.allowFileAccessFromFileURLs = !settings.allowFileAccessFromFileURLs // Compliant
57+
settings.allowUniversalAccessFromFileURLs = !settings.allowUniversalAccessFromFileURLs // Compliant
58+
settings.allowContentAccess = !settings.allowContentAccess // Compliant
59+
}
60+
61+
fun noSemantics_setPropertiesToFalse(settings: WebSettings) {
62+
settings.allowFileAccess = false // Compliant
63+
settings.allowFileAccessFromFileURLs = false // Compliant
64+
settings.allowUniversalAccessFromFileURLs = false // Compliant
65+
settings.allowContentAccess = false // Compliant
66+
}
67+
68+
fun noSemantics_setPropertiesToFalseVal(settings: WebSettings) {
69+
val falseVal = false
70+
settings.allowFileAccess = falseVal // Compliant, guaranteed to be false
71+
settings.allowFileAccessFromFileURLs = falseVal // Compliant, guaranteed to be false
72+
settings.allowUniversalAccessFromFileURLs = falseVal // Compliant, guaranteed to be false
73+
settings.allowContentAccess = falseVal // Compliant, guaranteed to be false
74+
}
75+
76+
fun noSemantics_setPropertiesToFalseVar(settings: WebSettings) {
77+
var falseVar = false
78+
settings.allowFileAccess = falseVar // Compliant, value may still be false
79+
settings.allowFileAccessFromFileURLs = falseVar // Compliant, value may still be false
80+
settings.allowUniversalAccessFromFileURLs = falseVar // Compliant, value may still be false
81+
settings.allowContentAccess = falseVar // Compliant, value may still be false
82+
}
83+
84+
fun noSemantics_setPropertiesToBooleanParam(settings: WebSettings, value: Boolean) {
85+
settings.allowFileAccess = value // Compliant, value may be false
86+
settings.allowFileAccessFromFileURLs = value // Compliant, value may be false
87+
settings.allowUniversalAccessFromFileURLs = value // Compliant, value may be false
88+
settings.allowContentAccess = value // Compliant, value may be false
89+
}
90+
91+
fun noSemantics_usingSettersWithFalse(settings: WebSettings) {
92+
settings.setAllowFileAccess(false) // Compliant, value is false
93+
settings.setAllowFileAccessFromFileURLs(false) // Compliant, value is false
94+
settings.setAllowUniversalAccessFromFileURLs(false) // Compliant, value is false
95+
settings.setAllowContentAccess(false) // Compliant, value is false
96+
}
97+
98+
fun noSemantics_notAWebSettingsObject(settings: NoSemantics_NotAWebSettings) {
99+
settings.allowFileAccess = true // Compliant, not a WebSettings object from android.webkit
100+
}
101+
102+
class NoSemantics_NotAWebSettings {
103+
var allowFileAccess: Boolean = false
104+
}
105+
106+
// endregion
107+
108+
}

‎sonar-kotlin-checks/src/test/java/org/sonarsource/kotlin/checks/WebViewsFileAccessCheckTest.kt

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -16,4 +16,4 @@
1616
*/
1717
package org.sonarsource.kotlin.checks
1818

19-
class WebViewsFileAccessCheckTest : CheckTest(WebViewsFileAccessCheck())
19+
class WebViewsFileAccessCheckTest : CheckTestWithNoSemantics(WebViewsFileAccessCheck())

0 commit comments

Comments
 (0)