Skip to content

Commit d827745

Browse files
authored
Report new remediation data in CodeTF (#335)
This change populates CodeTF with new remediation metadata specified [here](pixee/codemodder-specs#25 (review)).
1 parent 45164f6 commit d827745

30 files changed

+246
-82
lines changed

core-codemods/src/main/java/io/codemodder/codemods/AddMissingOverrideCodemod.java

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -29,7 +29,7 @@ public AddMissingOverrideCodemod(
2929
}
3030

3131
@Override
32-
protected DetectorRule getDetectorRule() {
32+
public DetectorRule getDetectorRule() {
3333
return new DetectorRule(
3434
"java:S1161",
3535
"`@Override` should be used on overriding and implementing methods",

core-codemods/src/main/java/io/codemodder/codemods/AvoidImplicitPublicConstructorCodemod.java

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -33,7 +33,8 @@ public AvoidImplicitPublicConstructorCodemod(
3333
super(issues, SimpleName.class);
3434
}
3535

36-
protected DetectorRule getDetectorRule() {
36+
@Override
37+
public DetectorRule getDetectorRule() {
3738
return new DetectorRule(
3839
"java:S1118",
3940
"Utility classes should not have public constructors",

core-codemods/src/main/java/io/codemodder/codemods/DeclareVariableOnSeparateLineCodemod.java

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -31,7 +31,7 @@ public DeclareVariableOnSeparateLineCodemod(
3131
}
3232

3333
@Override
34-
protected DetectorRule getDetectorRule() {
34+
public DetectorRule getDetectorRule() {
3535
return new DetectorRule(
3636
"java:S1659",
3737
"Multiple variables should not be declared on the same line",

core-codemods/src/main/java/io/codemodder/codemods/DefectDojoSqlInjectionCodemod.java

Lines changed: 44 additions & 28 deletions
Original file line numberDiff line numberDiff line change
@@ -3,9 +3,9 @@
33
import com.github.javaparser.ast.CompilationUnit;
44
import com.github.javaparser.ast.expr.MethodCallExpr;
55
import io.codemodder.*;
6-
import io.codemodder.codetf.DetectionTool;
7-
import io.codemodder.codetf.DetectorFinding;
86
import io.codemodder.codetf.DetectorRule;
7+
import io.codemodder.codetf.FixedFinding;
8+
import io.codemodder.codetf.UnfixedFinding;
99
import io.codemodder.javaparser.JavaParserChanger;
1010
import io.codemodder.providers.defectdojo.DefectDojoScan;
1111
import io.codemodder.providers.defectdojo.Finding;
@@ -34,13 +34,16 @@ public DefectDojoSqlInjectionCodemod(
3434
}
3535

3636
@Override
37-
public DetectionTool getDetectionTool() {
38-
DetectorRule semgrepSqliRule =
39-
new DetectorRule(
40-
"java.lang.security.audit.sqli.jdbc-sqli.jdbc-sqli",
41-
"java.lang.security.audit.sqli.jdbc-sqli.jdbc-sqli",
42-
null);
43-
return new DetectionTool("DefectDojo", semgrepSqliRule, List.of());
37+
public String vendorName() {
38+
return "DefectDojo / Semgrep";
39+
}
40+
41+
@Override
42+
public DetectorRule getDetectorRule() {
43+
return new DetectorRule(
44+
"java.lang.security.audit.sqli.jdbc-sqli.jdbc-sqli",
45+
"java.lang.security.audit.sqli.jdbc-sqli.jdbc-sqli",
46+
"https://semgrep.dev/r?q=java.lang.security.audit.sqli.jdbc-sqli.jdbc-sqli");
4447
}
4548

4649
@Override
@@ -54,16 +57,17 @@ public CodemodFileScanningResult visit(
5457
return CodemodFileScanningResult.none();
5558
}
5659

57-
List<DetectorFinding> allFindings = new ArrayList<>();
60+
List<UnfixedFinding> unfixedFindings = new ArrayList<>();
5861

5962
List<CodemodChange> changes = new ArrayList<>();
6063
for (Finding finding : findingsForThisPath) {
6164
String id = String.valueOf(finding.getId());
6265
Integer line = finding.getLine();
6366
if (line == null) {
64-
DetectorFinding unfixableFinding =
65-
new DetectorFinding(id, false, "No line number provided");
66-
allFindings.add(unfixableFinding);
67+
UnfixedFinding unfixableFinding =
68+
new UnfixedFinding(
69+
id, getDetectorRule(), context.path().toString(), null, "No line number provided");
70+
unfixedFindings.add(unfixableFinding);
6771
continue;
6872
}
6973

@@ -74,33 +78,45 @@ public CodemodFileScanningResult visit(
7478
.toList();
7579

7680
if (supportedSqlMethodCallsOnThatLine.isEmpty()) {
77-
DetectorFinding unfixableFinding =
78-
new DetectorFinding(id, false, "No supported SQL methods found on the given line");
79-
allFindings.add(unfixableFinding);
81+
UnfixedFinding unfixableFinding =
82+
new UnfixedFinding(
83+
id,
84+
getDetectorRule(),
85+
context.path().toString(),
86+
line,
87+
"No supported SQL methods found on the given line");
88+
unfixedFindings.add(unfixableFinding);
8089
continue;
8190
}
8291

8392
if (supportedSqlMethodCallsOnThatLine.size() > 1) {
84-
DetectorFinding unfixableFinding =
85-
new DetectorFinding(
86-
id, false, "Multiple supported SQL methods found on the given line");
87-
allFindings.add(unfixableFinding);
93+
UnfixedFinding unfixableFinding =
94+
new UnfixedFinding(
95+
id,
96+
getDetectorRule(),
97+
context.path().toString(),
98+
line,
99+
"Multiple supported SQL methods found on the given line");
100+
unfixedFindings.add(unfixableFinding);
88101
continue;
89102
}
90103

91104
MethodCallExpr methodCallExpr = supportedSqlMethodCallsOnThatLine.get(0);
92-
93105
if (SQLParameterizerWithCleanup.checkAndFix(methodCallExpr)) {
94-
DetectorFinding fixedFinding = new DetectorFinding(id, true, null);
95-
allFindings.add(fixedFinding);
96-
changes.add(CodemodChange.from(line, "Fixes issue " + id + " by parameterizing SQL"));
106+
FixedFinding fixedFinding = new FixedFinding(id, getDetectorRule());
107+
changes.add(CodemodChange.from(line, fixedFinding));
97108
} else {
98-
DetectorFinding unfixableFinding =
99-
new DetectorFinding(id, false, "Fixing may have side effects");
100-
allFindings.add(unfixableFinding);
109+
UnfixedFinding unfixableFinding =
110+
new UnfixedFinding(
111+
id,
112+
getDetectorRule(),
113+
context.path().toString(),
114+
line,
115+
"State changing effects possible or unrecognized code shape");
116+
unfixedFindings.add(unfixableFinding);
101117
}
102118
}
103119

104-
return CodemodFileScanningResult.from(changes, allFindings);
120+
return CodemodFileScanningResult.from(changes, unfixedFindings);
105121
}
106122
}

core-codemods/src/main/java/io/codemodder/codemods/DefineConstantForLiteralCodemod.java

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -27,7 +27,7 @@ public DefineConstantForLiteralCodemod(
2727
}
2828

2929
@Override
30-
protected DetectorRule getDetectorRule() {
30+
public DetectorRule getDetectorRule() {
3131
return new DetectorRule(
3232
"java:S1192",
3333
"String literals should not be duplicated",

core-codemods/src/main/java/io/codemodder/codemods/FixRedundantStaticOnEnumCodemod.java

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -27,7 +27,7 @@ public FixRedundantStaticOnEnumCodemod(
2727
}
2828

2929
@Override
30-
protected DetectorRule getDetectorRule() {
30+
public DetectorRule getDetectorRule() {
3131
return new DetectorRule(
3232
"java:S2786",
3333
"Nested `enum`s should not be declared static",

core-codemods/src/main/java/io/codemodder/codemods/HardenStringParseToPrimitivesCodemod.java

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -63,7 +63,7 @@ public HardenParseForConstructorChanger(
6363
}
6464

6565
@Override
66-
protected DetectorRule getDetectorRule() {
66+
public DetectorRule getDetectorRule() {
6767
return new DetectorRule(
6868
"java:S2130",
6969
"Parsing should be used to convert `String`s to primitives",
@@ -125,7 +125,7 @@ public HardenParseForValueOfChanger(
125125
}
126126

127127
@Override
128-
protected DetectorRule getDetectorRule() {
128+
public DetectorRule getDetectorRule() {
129129
return new DetectorRule(
130130
"java:S2130",
131131
"Parsing should be used to convert `String`s to primitives",

core-codemods/src/main/java/io/codemodder/codemods/OverridesMatchParentSynchronizationCodemod.java

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -33,7 +33,7 @@ public OverridesMatchParentSynchronizationCodemod(
3333
}
3434

3535
@Override
36-
protected DetectorRule getDetectorRule() {
36+
public DetectorRule getDetectorRule() {
3737
return new DetectorRule(
3838
"java:S3551",
3939
"Overrides should match their parent class methods in synchronization",

core-codemods/src/main/java/io/codemodder/codemods/RemoveCommentedCodeCodemod.java

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -42,7 +42,7 @@ public RemoveCommentedCodeCodemod(
4242
}
4343

4444
@Override
45-
protected DetectorRule getDetectorRule() {
45+
public DetectorRule getDetectorRule() {
4646
return new DetectorRule(
4747
"java:S125",
4848
"Sections of code should not be commented out",

core-codemods/src/main/java/io/codemodder/codemods/RemoveRedundantVariableCreationCodemod.java

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -29,7 +29,7 @@ public RemoveRedundantVariableCreationCodemod(
2929
}
3030

3131
@Override
32-
protected DetectorRule getDetectorRule() {
32+
public DetectorRule getDetectorRule() {
3333
return new DetectorRule(
3434
"java:S1488",
3535
"Local variables should not be declared and then immediately returned or thrown",

0 commit comments

Comments
 (0)