Skip to content

Commit 31fee12

Browse files
AB-xdevAB-xdev
authored
Merge pull request #180 from xdev-software/develop
Release
2 parents 77f781d + 69311a2 commit 31fee12

File tree

37 files changed

+324
-126
lines changed

37 files changed

+324
-126
lines changed

‎.config/pmd/java/ruleset.xml‎

Lines changed: 113 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -194,4 +194,117 @@
194194
</rule>
195195

196196
<rule ref="category/java/security.xml"/>
197+
198+
<rule name="AvoidSystemSetterCall"
199+
language="java"
200+
message="Setters of java.lang.System should not be called unless really needed"
201+
class="net.sourceforge.pmd.lang.rule.xpath.XPathRule">
202+
<description>
203+
Calling setters of java.lang.System usually indicates bad design and likely causes unexpected behavior.
204+
For example, it may break when multiple Threads are setting the value.
205+
It may also overwrite user defined options or properties.
206+
207+
Try to pass the value only to the place where it's really needed and use it there accordingly.
208+
</description>
209+
<priority>3</priority>
210+
<properties>
211+
<property name="xpath">
212+
<value>
213+
<![CDATA[
214+
//MethodCall[starts-with(@MethodName,'set')]/TypeExpression[pmd-java:typeIsExactly('java.lang.System')]
215+
]]>
216+
</value>
217+
</property>
218+
</properties>
219+
</rule>
220+
221+
<rule name="AvoidPostConstruct"
222+
language="java"
223+
message="Avoid @PostConstruct"
224+
class="net.sourceforge.pmd.lang.rule.xpath.XPathRule">
225+
<description>
226+
Using a `@PostConstruct` method is usually only done when field injection is used and initialization needs to be performed after that.
227+
228+
It's better to do this directly in the constructor with constructor injection, so that all logic will be encapsulated there.
229+
This also makes using the bean in environments where JavaEE is not present - for example in tests - a lot easier, as forgetting to call the `@PostConstruct` method is no longer possible.
230+
</description>
231+
<priority>3</priority>
232+
<properties>
233+
<property name="xpath">
234+
<value>
235+
<![CDATA[
236+
//MethodDeclaration[pmd-java:hasAnnotation('jakarta.annotation.PostConstruct')]
237+
]]>
238+
</value>
239+
</property>
240+
</properties>
241+
</rule>
242+
243+
<rule name="AvoidPreDestroy"
244+
language="java"
245+
message="Avoid @PreDestroy"
246+
class="net.sourceforge.pmd.lang.rule.xpath.XPathRule">
247+
<description>
248+
`@PreDestroy` should be replaced by implementing `AutoCloseable` and overwriting the `close` method instead.
249+
250+
This also makes using the bean in environments where JavaEE is not present - for example in tests - a lot easier, as forgetting to call the `@PreDestroy` method is no much more difficult.
251+
</description>
252+
<priority>3</priority>
253+
<properties>
254+
<property name="xpath">
255+
<value>
256+
<![CDATA[
257+
//MethodDeclaration[pmd-java:hasAnnotation('jakarta.annotation.PreDestroy')]
258+
]]>
259+
</value>
260+
</property>
261+
</properties>
262+
</rule>
263+
264+
<rule name="AvoidUnmanagedThreads"
265+
language="java"
266+
message="Avoid unmanaged threads"
267+
class="net.sourceforge.pmd.lang.rule.xpath.XPathRule">
268+
<description>
269+
Trying to manually manage threads usually gets quickly out of control and may result in various problems like uncontrollable spawning of threads.
270+
Threads can also not be cancelled properly.
271+
272+
Use managed Thread services like `ExecutorService` and `CompletableFuture` instead.
273+
</description>
274+
<priority>3</priority>
275+
<properties>
276+
<property name="xpath">
277+
<value>
278+
<![CDATA[
279+
//MethodCall[pmd-java:matchesSig('java.lang.Thread#start()') or pmd-java:matchesSig('java.lang.Thread#startVirtualThread(java.lang.Runnable)') or pmd-java:matchesSig('java.lang.Thread$Builder#start(java.lang.Runnable)')]
280+
]]>
281+
</value>
282+
</property>
283+
</properties>
284+
</rule>
285+
286+
<rule name="JavaObjectSerializationIsUnsafe"
287+
language="java"
288+
message="Using Java Object (De-)Serialization is unsafe and has led to too many security vulnerabilities"
289+
class="net.sourceforge.pmd.lang.rule.xpath.XPathRule">
290+
<description>
291+
Nearly every known usage of (Java) Object Deserialization has resulted in [a security vulnerability](https://cloud.google.com/blog/topics/threat-intelligence/hunting-deserialization-exploits?hl=en).
292+
Vulnerabilities are so common that there are [dedicated projects for exploit payload generation](https://github.com/frohoff/ysoserial).
293+
294+
Java Object Serialization may also fail to deserialize when the underlying classes are changed.
295+
296+
Use proven data interchange formats like JSON instead.
297+
</description>
298+
<priority>2</priority>
299+
<properties>
300+
<property name="xpath">
301+
<value>
302+
<![CDATA[
303+
//ClassDeclaration[@Interface = false()]/ClassBody/FieldDeclaration/VariableDeclarator/VariableId[@Name='serialVersionUID'] |
304+
//ConstructorCall/ClassType[pmd-java:typeIsExactly('java.io.ObjectInputStream') or pmd-java:typeIsExactly('java.io.ObjectOutputStream')]
305+
]]>
306+
</value>
307+
</property>
308+
</properties>
309+
</rule>
197310
</ruleset>

‎.github/workflows/broken-links.yml‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -13,13 +13,13 @@ jobs:
1313
runs-on: ubuntu-latest
1414
timeout-minutes: 15
1515
steps:
16-
- uses: actions/checkout@v4
16+
- uses: actions/checkout@v5
1717

1818
- run: mv .github/.lycheeignore .lycheeignore
1919

2020
- name: Link Checker
2121
id: lychee
22-
uses: lycheeverse/lychee-action@5c4ee84814c983aa7164eaee476f014e53ff3963 # v2
22+
uses: lycheeverse/lychee-action@885c65f3dc543b57c898c8099f4e08c8afd178a2 # v2
2323
with:
2424
fail: false # Don't fail on broken links, create an issue instead
2525

@@ -29,7 +29,7 @@ jobs:
2929
echo "number=$(gh issue list -l 'bug' -l 'automated' -L 1 -S 'in:title \"Link Checker Report\"' -s 'open' --json 'number' --jq '.[].number')" >> $GITHUB_OUTPUT
3030
env:
3131
GH_TOKEN: ${{ github.token }}
32-
32+
3333
- name: Close issue if everything is fine
3434
if: steps.lychee.outputs.exit_code == 0 && steps.find-issue.outputs.number != ''
3535
run: gh issue close -r 'not planned' ${{ steps.find-issue.outputs.number }}

‎.github/workflows/check-build.yml‎

Lines changed: 50 additions & 19 deletions
Original file line numberDiff line numberDiff line change
@@ -23,25 +23,30 @@ jobs:
2323
build:
2424
runs-on: ubuntu-latest
2525
timeout-minutes: 30
26-
2726
strategy:
2827
matrix:
2928
java: [17, 21]
3029
distribution: [temurin]
31-
3230
steps:
33-
- uses: actions/checkout@v4
34-
31+
- uses: actions/checkout@v5
32+
3533
- name: Set up JDK
36-
uses: actions/setup-java@v4
34+
uses: actions/setup-java@v5
3735
with:
3836
distribution: ${{ matrix.distribution }}
3937
java-version: ${{ matrix.java }}
40-
cache: 'maven'
41-
38+
39+
- name: Cache Maven
40+
uses: actions/cache@v4
41+
with:
42+
path: ~/.m2/repository
43+
key: ${{ runner.os }}-mvn-build-${{ hashFiles('**/pom.xml') }}
44+
restore-keys: |
45+
${{ runner.os }}-mvn-build-
46+
4247
- name: Build with Maven
4348
run: ./mvnw -B clean package
44-
49+
4550
- name: Check for uncommited changes
4651
run: |
4752
if [[ "$(git status --porcelain)" != "" ]]; then
@@ -64,21 +69,34 @@ jobs:
6469
runs-on: ubuntu-latest
6570
if: ${{ github.event_name != 'pull_request' || !startsWith(github.head_ref, 'renovate/') }}
6671
timeout-minutes: 15
67-
6872
strategy:
6973
matrix:
7074
java: [17]
7175
distribution: [temurin]
72-
7376
steps:
74-
- uses: actions/checkout@v4
75-
77+
- uses: actions/checkout@v5
78+
7679
- name: Set up JDK
77-
uses: actions/setup-java@v4
80+
uses: actions/setup-java@v5
7881
with:
7982
distribution: ${{ matrix.distribution }}
8083
java-version: ${{ matrix.java }}
81-
cache: 'maven'
84+
85+
- name: Cache Maven
86+
uses: actions/cache@v4
87+
with:
88+
path: ~/.m2/repository
89+
key: ${{ runner.os }}-mvn-checkstyle-${{ hashFiles('**/pom.xml') }}
90+
restore-keys: |
91+
${{ runner.os }}-mvn-checkstyle-
92+
93+
- name: CheckStyle Cache
94+
uses: actions/cache@v4
95+
with:
96+
path: '**/target/checkstyle-cachefile'
97+
key: ${{ runner.os }}-checkstyle-${{ hashFiles('**/pom.xml') }}
98+
restore-keys: |
99+
${{ runner.os }}-checkstyle-
82100
83101
- name: Run Checkstyle
84102
run: ./mvnw -B checkstyle:check -P checkstyle -T2C
@@ -87,21 +105,34 @@ jobs:
87105
runs-on: ubuntu-latest
88106
if: ${{ github.event_name != 'pull_request' || !startsWith(github.head_ref, 'renovate/') }}
89107
timeout-minutes: 15
90-
91108
strategy:
92109
matrix:
93110
java: [17]
94111
distribution: [temurin]
95-
96112
steps:
97-
- uses: actions/checkout@v4
113+
- uses: actions/checkout@v5
98114

99115
- name: Set up JDK
100-
uses: actions/setup-java@v4
116+
uses: actions/setup-java@v5
101117
with:
102118
distribution: ${{ matrix.distribution }}
103119
java-version: ${{ matrix.java }}
104-
cache: 'maven'
120+
121+
- name: Cache Maven
122+
uses: actions/cache@v4
123+
with:
124+
path: ~/.m2/repository
125+
key: ${{ runner.os }}-mvn-pmd-${{ hashFiles('**/pom.xml') }}
126+
restore-keys: |
127+
${{ runner.os }}-mvn-pmd-
128+
129+
- name: PMD Cache
130+
uses: actions/cache@v4
131+
with:
132+
path: '**/target/pmd/pmd.cache'
133+
key: ${{ runner.os }}-pmd-${{ hashFiles('**/pom.xml') }}
134+
restore-keys: |
135+
${{ runner.os }}-pmd-
105136
106137
- name: Run PMD
107138
run: ./mvnw -B test pmd:aggregate-pmd-no-fork pmd:check -P pmd -DskipTests -T2C

0 commit comments

Comments
 (0)