Skip to content

Commit 96757b4

Browse files
committed
optionally inject a static method
1 parent f5eae64 commit 96757b4

File tree

2 files changed

+17
-4
lines changed

2 files changed

+17
-4
lines changed

core-codemods/src/intTest/java/io/codemodder/integration/WebGoat20238Test.java

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -46,7 +46,7 @@ void it_remediates_webgoat_2023_8() throws Exception {
4646
.flatMap(Collection::stream)
4747
.toList();
4848

49-
assertThat(fileChanges.size(), is(50));
49+
assertThat(fileChanges.size(), is(51));
5050

5151
verifyStandardCodemodResults(fileChanges);
5252

framework/codemodder-base/src/main/java/io/codemodder/remediation/zipslip/ZipEntryStartFixStrategy.java

Lines changed: 16 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -24,14 +24,22 @@ public SuccessOrReason fix(final CompilationUnit cu, final Node node) {
2424
return SuccessOrReason.reason("No encompassing class found");
2525
}
2626

27-
addSanitizeName(classDeclRef.get());
27+
Optional<MethodDeclaration> methodAncestor = call.findAncestor(MethodDeclaration.class);
28+
if (methodAncestor.isEmpty()) {
29+
return SuccessOrReason.reason("No encompassing method found");
30+
}
31+
32+
boolean addStatic = methodAncestor.get().isStatic() || classDeclRef.get().isInterface();
33+
34+
addSanitizeName(classDeclRef.get(), addStatic);
2835
wrap(call).withScopelessMethod("sanitizeZipFilename");
2936

3037
return SuccessOrReason.success();
3138
}
3239

33-
private static void addSanitizeName(final ClassOrInterfaceDeclaration classDecl) {
34-
final String method =
40+
private static void addSanitizeName(
41+
final ClassOrInterfaceDeclaration classDecl, final boolean addStatic) {
42+
String method =
3543
"""
3644
String sanitizeZipFilename(String entryName) {
3745
if (entryName == null || entryName.trim().isEmpty()) {
@@ -43,6 +51,11 @@ String sanitizeZipFilename(String entryName) {
4351
return entryName;
4452
}
4553
""";
54+
55+
if (addStatic) {
56+
method = "static " + method;
57+
}
58+
4659
boolean sanitizeMethodPresent =
4760
classDecl.findAll(MethodDeclaration.class).stream()
4861
.anyMatch(

0 commit comments

Comments
 (0)