Skip to content

Commit d1bfcc9

Browse files
andrecsilvaandrecsilva
authored
Converted remaining remediators to new API and bugfixes (#462)
1 parent 0a7867c commit d1bfcc9

File tree

64 files changed

+1476
-1501
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

64 files changed

+1476
-1501
lines changed

‎core-codemods/src/main/java/io/codemodder/codemods/SonarXXECodemod.java‎

Lines changed: 14 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -7,11 +7,14 @@
77
import io.codemodder.providers.sonar.RuleIssue;
88
import io.codemodder.providers.sonar.SonarRemediatingJavaParserChanger;
99
import io.codemodder.remediation.GenericRemediationMetadata;
10+
import io.codemodder.remediation.Remediator;
11+
import io.codemodder.remediation.WithoutScopePositionMatcher;
1012
import io.codemodder.remediation.xxe.XXERemediator;
1113
import io.codemodder.sonar.model.Issue;
1214
import io.codemodder.sonar.model.SonarFinding;
1315
import java.util.List;
1416
import java.util.Objects;
17+
import java.util.Optional;
1518
import javax.inject.Inject;
1619

1720
@Codemod(
@@ -21,14 +24,14 @@
2124
executionPriority = CodemodExecutionPriority.HIGH)
2225
public final class SonarXXECodemod extends SonarRemediatingJavaParserChanger {
2326

24-
private final XXERemediator remediationStrategy;
27+
private final Remediator<Issue> remediationStrategy;
2528
private final RuleIssue issues;
2629

2730
@Inject
2831
public SonarXXECodemod(@ProvidedSonarScan(ruleId = "java:S2755") final RuleIssue issues) {
2932
super(GenericRemediationMetadata.XXE.reporter(), issues);
3033
this.issues = Objects.requireNonNull(issues);
31-
this.remediationStrategy = XXERemediator.DEFAULT;
34+
this.remediationStrategy = new XXERemediator<>(new WithoutScopePositionMatcher());
3235
}
3336

3437
@Override
@@ -49,7 +52,14 @@ public CodemodFileScanningResult visit(
4952
detectorRule(),
5053
issuesForFile,
5154
SonarFinding::getKey,
52-
f -> f.getTextRange() != null ? f.getTextRange().getStartLine() : f.getLine(),
53-
f -> f.getTextRange().getStartOffset());
55+
i -> i.getTextRange() != null ? i.getTextRange().getStartLine() : i.getLine(),
56+
i ->
57+
i.getTextRange() != null
58+
? Optional.of(i.getTextRange().getEndLine())
59+
: Optional.empty(),
60+
i ->
61+
i.getTextRange() != null
62+
? Optional.of(i.getTextRange().getStartOffset() + 1)
63+
: Optional.empty());
5464
}
5565
}

‎core-codemods/src/main/java/io/codemodder/codemods/codeql/CodeQLXXECodemod.java‎

Lines changed: 11 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,11 +1,14 @@
11
package io.codemodder.codemods.codeql;
22

3+
import com.contrastsecurity.sarif.Result;
34
import com.github.javaparser.ast.CompilationUnit;
45
import io.codemodder.*;
56
import io.codemodder.codetf.DetectorRule;
67
import io.codemodder.providers.sarif.codeql.ProvidedCodeQLScan;
78
import io.codemodder.remediation.GenericRemediationMetadata;
9+
import io.codemodder.remediation.Remediator;
810
import io.codemodder.remediation.xxe.XXEIntermediateXMLStreamReaderRemediator;
11+
import java.util.Optional;
912
import javax.inject.Inject;
1013

1114
/** A codemod for automatically fixing SQL injection from CodeQL. */
@@ -16,12 +19,12 @@
1619
executionPriority = CodemodExecutionPriority.HIGH)
1720
public final class CodeQLXXECodemod extends CodeQLRemediationCodemod {
1821

19-
private final XXEIntermediateXMLStreamReaderRemediator remediator;
22+
private final Remediator<Result> remediator;
2023

2124
@Inject
2225
public CodeQLXXECodemod(@ProvidedCodeQLScan(ruleId = "java/xxe") final RuleSarif sarif) {
2326
super(GenericRemediationMetadata.XXE.reporter(), sarif);
24-
this.remediator = XXEIntermediateXMLStreamReaderRemediator.DEFAULT;
27+
this.remediator = new XXEIntermediateXMLStreamReaderRemediator<>();
2528
}
2629

2730
@Override
@@ -42,7 +45,11 @@ public CodemodFileScanningResult visit(
4245
ruleSarif.getResultsByLocationPath(context.path()),
4346
SarifFindingKeyUtil::buildFindingId,
4447
r -> r.getLocations().get(0).getPhysicalLocation().getRegion().getStartLine(),
45-
r -> r.getLocations().get(0).getPhysicalLocation().getRegion().getEndLine(),
46-
r -> r.getLocations().get(0).getPhysicalLocation().getRegion().getStartColumn());
48+
r ->
49+
Optional.ofNullable(
50+
r.getLocations().get(0).getPhysicalLocation().getRegion().getEndLine()),
51+
r ->
52+
Optional.ofNullable(
53+
r.getLocations().get(0).getPhysicalLocation().getRegion().getStartColumn()));
4754
}
4855
}

‎core-codemods/src/main/java/io/codemodder/codemods/semgrep/SemgrepJavaDeserializationCodemod.java‎

Lines changed: 31 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -2,6 +2,8 @@
22

33
import com.contrastsecurity.sarif.Result;
44
import com.github.javaparser.ast.CompilationUnit;
5+
import com.github.javaparser.ast.expr.MethodCallExpr;
6+
import com.github.javaparser.ast.expr.VariableDeclarationExpr;
57
import io.codemodder.Codemod;
68
import io.codemodder.CodemodExecutionPriority;
79
import io.codemodder.CodemodFileScanningResult;
@@ -12,9 +14,11 @@
1214
import io.codemodder.SarifFindingKeyUtil;
1315
import io.codemodder.codetf.DetectorRule;
1416
import io.codemodder.providers.sarif.semgrep.ProvidedSemgrepScan;
17+
import io.codemodder.remediation.FixCandidateSearcher;
1518
import io.codemodder.remediation.GenericRemediationMetadata;
1619
import io.codemodder.remediation.Remediator;
17-
import io.codemodder.remediation.javadeserialization.JavaDeserializationRemediator;
20+
import io.codemodder.remediation.SearcherStrategyRemediator;
21+
import io.codemodder.remediation.javadeserialization.JavaDeserializationFixStrategy;
1822
import java.util.Optional;
1923
import javax.inject.Inject;
2024

@@ -37,7 +41,32 @@ public SemgrepJavaDeserializationCodemod(
3741
ruleId = "java.lang.security.audit.object-deserialization.object-deserialization")
3842
final RuleSarif sarif) {
3943
super(GenericRemediationMetadata.DESERIALIZATION.reporter(), sarif);
40-
this.remediator = new JavaDeserializationRemediator<>();
44+
this.remediator =
45+
new SearcherStrategyRemediator.Builder<Result>()
46+
.withSearcherStrategyPair(
47+
// matches declarations
48+
new FixCandidateSearcher.Builder<Result>()
49+
.withMatcher(
50+
n ->
51+
Optional.empty()
52+
.or(
53+
() ->
54+
Optional.of(n)
55+
.map(
56+
m ->
57+
m instanceof VariableDeclarationExpr vde
58+
? vde
59+
: null)
60+
.filter(JavaDeserializationFixStrategy::match))
61+
.or(
62+
() ->
63+
Optional.of(n)
64+
.map(m -> m instanceof MethodCallExpr mce ? mce : null)
65+
.filter(JavaDeserializationFixStrategy::match))
66+
.isPresent())
67+
.build(),
68+
new JavaDeserializationFixStrategy())
69+
.build();
4170
}
4271

4372
@Override

‎core-codemods/src/main/java/io/codemodder/codemods/semgrep/SemgrepServletResponseWriterXSSCodemod.java‎

Lines changed: 10 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,6 @@
11
package io.codemodder.codemods.semgrep;
22

3+
import com.contrastsecurity.sarif.Result;
34
import com.github.javaparser.ast.CompilationUnit;
45
import io.codemodder.Codemod;
56
import io.codemodder.CodemodExecutionPriority;
@@ -12,7 +13,9 @@
1213
import io.codemodder.codetf.DetectorRule;
1314
import io.codemodder.providers.sarif.semgrep.ProvidedSemgrepScan;
1415
import io.codemodder.remediation.GenericRemediationMetadata;
16+
import io.codemodder.remediation.Remediator;
1517
import io.codemodder.remediation.xss.XSSRemediator;
18+
import java.util.Optional;
1619
import javax.inject.Inject;
1720

1821
/**
@@ -26,15 +29,15 @@
2629
importance = Importance.MEDIUM)
2730
public final class SemgrepServletResponseWriterXSSCodemod extends SemgrepJavaParserChanger {
2831

29-
private final XSSRemediator remediator;
32+
private final Remediator<Result> remediator;
3033

3134
@Inject
3235
public SemgrepServletResponseWriterXSSCodemod(
3336
@ProvidedSemgrepScan(
3437
ruleId = "java.lang.security.servletresponse-writer-xss.servletresponse-writer-xss")
3538
final RuleSarif sarif) {
3639
super(GenericRemediationMetadata.XSS.reporter(), sarif);
37-
this.remediator = XSSRemediator.DEFAULT;
40+
this.remediator = new XSSRemediator<>();
3841
}
3942

4043
@Override
@@ -48,13 +51,16 @@ public DetectorRule detectorRule() {
4851
@Override
4952
public CodemodFileScanningResult visit(
5053
final CodemodInvocationContext context, final CompilationUnit cu) {
51-
return remediator.remediateJava(
54+
return remediator.remediateAll(
5255
cu,
5356
context.path().toString(),
5457
detectorRule(),
5558
ruleSarif.getResultsByLocationPath(context.path()),
5659
SarifFindingKeyUtil::buildFindingId,
5760
r -> r.getLocations().get(0).getPhysicalLocation().getRegion().getStartLine(),
58-
r -> r.getLocations().get(0).getPhysicalLocation().getRegion().getStartColumn());
61+
r -> Optional.of(r.getLocations().get(0).getPhysicalLocation().getRegion().getEndLine()),
62+
r ->
63+
Optional.of(
64+
r.getLocations().get(0).getPhysicalLocation().getRegion().getStartColumn()));
5965
}
6066
}

‎core-codemods/src/main/java/io/codemodder/codemods/semgrep/SemgrepWeakRandomCodemod.java‎

Lines changed: 9 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,6 @@
11
package io.codemodder.codemods.semgrep;
22

3+
import com.contrastsecurity.sarif.Result;
34
import com.github.javaparser.ast.CompilationUnit;
45
import io.codemodder.Codemod;
56
import io.codemodder.CodemodExecutionPriority;
@@ -11,7 +12,9 @@
1112
import io.codemodder.SarifFindingKeyUtil;
1213
import io.codemodder.codetf.DetectorRule;
1314
import io.codemodder.providers.sarif.semgrep.ProvidedSemgrepScan;
15+
import io.codemodder.remediation.Remediator;
1416
import io.codemodder.remediation.weakrandom.WeakRandomRemediator;
17+
import java.util.Optional;
1518
import javax.inject.Inject;
1619

1720
/**
@@ -25,14 +28,14 @@
2528
importance = Importance.MEDIUM)
2629
public final class SemgrepWeakRandomCodemod extends SemgrepJavaParserChanger {
2730

28-
private final WeakRandomRemediator remediator;
31+
private final Remediator<Result> remediator;
2932

3033
@Inject
3134
public SemgrepWeakRandomCodemod(
3235
@ProvidedSemgrepScan(ruleId = "java.lang.security.audit.crypto.weak-random.weak-random")
3336
final RuleSarif sarif) {
3437
super(io.codemodder.remediation.GenericRemediationMetadata.WEAK_RANDOM.reporter(), sarif);
35-
this.remediator = WeakRandomRemediator.DEFAULT;
38+
this.remediator = new WeakRandomRemediator<>();
3639
}
3740

3841
@Override
@@ -53,6 +56,9 @@ public CodemodFileScanningResult visit(
5356
ruleSarif.getResultsByLocationPath(context.path()),
5457
SarifFindingKeyUtil::buildFindingId,
5558
r -> r.getLocations().get(0).getPhysicalLocation().getRegion().getStartLine(),
56-
r -> r.getLocations().get(0).getPhysicalLocation().getRegion().getStartColumn());
59+
r -> Optional.of(r.getLocations().get(0).getPhysicalLocation().getRegion().getEndLine()),
60+
r ->
61+
Optional.of(
62+
r.getLocations().get(0).getPhysicalLocation().getRegion().getStartColumn()));
5763
}
5864
}

‎core-codemods/src/main/java/io/codemodder/codemods/semgrep/SemgrepXXECodemod.java‎

Lines changed: 12 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,6 @@
11
package io.codemodder.codemods.semgrep;
22

3+
import com.contrastsecurity.sarif.Result;
34
import com.github.javaparser.ast.CompilationUnit;
45
import io.codemodder.Codemod;
56
import io.codemodder.CodemodExecutionPriority;
@@ -13,7 +14,10 @@
1314
import io.codemodder.codetf.DetectorRule;
1415
import io.codemodder.providers.sarif.semgrep.ProvidedSemgrepScan;
1516
import io.codemodder.remediation.GenericRemediationMetadata;
17+
import io.codemodder.remediation.Remediator;
18+
import io.codemodder.remediation.WithoutScopePositionMatcher;
1619
import io.codemodder.remediation.xxe.XXERemediator;
20+
import java.util.Optional;
1721
import javax.inject.Inject;
1822

1923
/** Fixes some Semgrep XXE issues. */
@@ -35,7 +39,7 @@ public SemgrepXXECodemod(
3539
}
3640

3741
public static class SemgrepXXEDocumentBuilderFactoryCodemod extends SemgrepJavaParserChanger {
38-
private final XXERemediator remediator;
42+
private final Remediator<Result> remediator;
3943

4044
@Inject
4145
public SemgrepXXEDocumentBuilderFactoryCodemod(
@@ -44,7 +48,7 @@ public SemgrepXXEDocumentBuilderFactoryCodemod(
4448
"java.lang.security.audit.xxe.documentbuilderfactory-disallow-doctype-decl-missing.documentbuilderfactory-disallow-doctype-decl-missing")
4549
final RuleSarif sarif) {
4650
super(GenericRemediationMetadata.WEAK_RANDOM.reporter(), sarif);
47-
this.remediator = XXERemediator.DEFAULT;
51+
this.remediator = new XXERemediator<>(new WithoutScopePositionMatcher());
4852
}
4953

5054
@Override
@@ -65,15 +69,14 @@ public CodemodFileScanningResult visit(
6569
ruleSarif.getResultsByLocationPath(context.path()),
6670
SarifFindingKeyUtil::buildFindingId,
6771
r -> r.getLocations().get(0).getPhysicalLocation().getRegion().getStartLine(),
68-
// we don't pass the column because it's deceiving as the column points to beginning of
69-
// statement, not call
70-
r -> null);
72+
r -> Optional.of(r.getLocations().get(0).getPhysicalLocation().getRegion().getEndLine()),
73+
r -> Optional.empty());
7174
}
7275
}
7376

7477
public static class SemgrepXXESaxParserFactoryCodemod extends SemgrepJavaParserChanger {
7578

76-
private final XXERemediator remediator;
79+
private final Remediator<Result> remediator;
7780

7881
@Inject
7982
public SemgrepXXESaxParserFactoryCodemod(
@@ -82,7 +85,7 @@ public SemgrepXXESaxParserFactoryCodemod(
8285
"java.lang.security.audit.xxe.saxparserfactory-disallow-doctype-decl-missing.saxparserfactory-disallow-doctype-decl-missing")
8386
final RuleSarif sarif) {
8487
super(GenericRemediationMetadata.WEAK_RANDOM.reporter(), sarif);
85-
this.remediator = XXERemediator.DEFAULT;
88+
this.remediator = new XXERemediator<>();
8689
}
8790

8891
@Override
@@ -103,9 +106,8 @@ public CodemodFileScanningResult visit(
103106
ruleSarif.getResultsByLocationPath(context.path()),
104107
SarifFindingKeyUtil::buildFindingId,
105108
r -> r.getLocations().get(0).getPhysicalLocation().getRegion().getStartLine(),
106-
// we don't pass the column because it's deceiving as the column points to beginning of
107-
// statement, not call
108-
r -> null);
109+
r -> Optional.of(r.getLocations().get(0).getPhysicalLocation().getRegion().getEndLine()),
110+
r -> Optional.empty());
109111
}
110112
}
111113
}

‎core-codemods/src/test/resources/semgrep-missing-secure-flag/JWTVotesEndpoint.java.after‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -134,6 +134,7 @@ public class JWTVotesEndpoint extends AssignmentEndpoint {
134134
response.setContentType(MediaType.APPLICATION_JSON_VALUE);
135135
} else {
136136
Cookie cookie = new Cookie("access_token", "");
137+
cookie.setSecure(true);
137138
response.addCookie(cookie);
138139
response.setStatus(HttpStatus.UNAUTHORIZED.value());
139140
response.setContentType(MediaType.APPLICATION_JSON_VALUE);

‎framework/codemodder-base/src/main/java/io/codemodder/ast/ASTs.java‎

Lines changed: 27 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -883,6 +883,33 @@ public boolean hasNext() {
883883
}
884884
}
885885

886+
/**
887+
* Checks if a node is a MethodCallExpr that is the initialization of a declaration with one of
888+
* the types in assignedToTypes.
889+
*
890+
* @param node
891+
* @param methodName
892+
* @param assignedToTypes
893+
* @return
894+
*/
895+
public static Optional<MethodCallExpr> isInitializedToType(
896+
final Node node, final String methodName, final List<String> assignedToTypes) {
897+
return Optional.of(node)
898+
.map(n -> n instanceof MethodCallExpr ? (MethodCallExpr) n : null)
899+
.filter(m -> methodName.equals(m.getNameAsString()))
900+
.filter(
901+
m -> {
902+
Optional<VariableDeclarator> newFactoryVariableRef =
903+
expect(m).toBeMethodCallExpression().initializingVariable().result();
904+
if (newFactoryVariableRef.isEmpty()) {
905+
return false;
906+
}
907+
String type = newFactoryVariableRef.get().getTypeAsString();
908+
return assignedToTypes.contains(type)
909+
|| assignedToTypes.stream().anyMatch(type::endsWith);
910+
});
911+
}
912+
886913
/**
887914
* This finds all methods that match the given location, with the given name, and is assigned to a
888915
* variable of one of the given types.

0 commit comments

Comments
 (0)