|
20 | 20 | import java.util.Arrays;
|
21 | 21 | import java.util.HashSet;
|
22 | 22 | import java.util.List;
|
23 |
| -import java.util.Locale; |
24 |
| -import java.util.Objects; |
25 | 23 | import java.util.Optional;
|
26 | 24 | import java.util.Set;
|
27 | 25 | import java.util.function.Predicate;
|
28 | 26 | import java.util.regex.Pattern;
|
29 |
| -import java.util.stream.Stream; |
30 | 27 | import org.sonar.check.Rule;
|
31 | 28 | import org.sonar.plugins.python.api.PythonSubscriptionCheck;
|
32 | 29 | import org.sonar.plugins.python.api.SubscriptionContext;
|
@@ -117,19 +114,14 @@ private static Predicate<Expression> isListAnyMatch(Predicate<Expression> pred)
|
117 | 114 | "django.views.decorators.csrf.csrf_exempt",
|
118 | 115 | "flask_wtf.csrf.CSRFProtect.exempt"));
|
119 | 116 |
|
| 117 | + private static boolean isDangerousDecorator(Decorator expression) { |
| 118 | + return DANGEROUS_DECORATORS.stream().anyMatch(dangerousFqn -> TreeUtils.isDecoratorWithFQN(expression, dangerousFqn)); |
| 119 | + } |
| 120 | + |
120 | 121 | /** Raises issue whenever a decorator with something about "CSRF" and "exempt" in the combined name is found. */
|
121 | 122 | private static void decoratorCsrfExemptCheck(SubscriptionContext subscriptionContext) {
|
122 | 123 | Decorator decorator = (Decorator) subscriptionContext.syntaxNode();
|
123 |
| - List<String> names = Stream.of(TreeUtils.decoratorNameFromExpression(decorator.expression())) |
124 |
| - .filter(Objects::nonNull) |
125 |
| - .flatMap(s -> Arrays.stream(s.split("\\."))) |
126 |
| - .toList(); |
127 |
| - // This is a temporary workaround until symbol resolution works for decorators. |
128 |
| - // Use the actual functions with FQNs from DANGEROUS_DECORATORS once that's fixed. |
129 |
| - // Related ticket: https://jira.sonarsource.com/browse/SONARPY-681 |
130 |
| - boolean isDangerous = names.stream().anyMatch(s -> s.toLowerCase(Locale.US).contains("csrf")) && |
131 |
| - names.stream().anyMatch(s -> s.toLowerCase(Locale.US).contains("exempt")); |
132 |
| - if (isDangerous) { |
| 124 | + if(isDangerousDecorator(decorator)) { |
133 | 125 | subscriptionContext.addIssue(decorator.lastToken(), MESSAGE);
|
134 | 126 | }
|
135 | 127 | }
|
|
0 commit comments