hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-04-30 19:26:02 +02:00
Code Issues Packages Projects Releases Wiki Activity

Java: Autoformat most queries.

Browse Source
This commit is contained in:
Anders Schack-Mulligen
2018-10-10 17:49:12 +02:00
parent 85cca69721
commit dd5a8f0c14
443 changed files with 2548 additions and 2043 deletions
Download Patch File Download Diff File Expand all files Collapse all files

1
java/ql/src/Likely Bugs/Serialization/IncorrectSerialVersionUID.ql
View File

@@ -10,6 +10,7 @@
* maintainability
* language-features
*/
import java
from Field f

1
java/ql/src/Likely Bugs/Serialization/IncorrectSerializableMethods.ql
View File

@@ -10,6 +10,7 @@
* maintainability
* language-features
*/
import java
from Method m, TypeSerializable serializable

1
java/ql/src/Likely Bugs/Serialization/MissingVoidConstructorOnExternalizable.ql
View File

@@ -10,6 +10,7 @@
* maintainability
* language-features
*/
import java
from Class extern, Interface externalizable

6
java/ql/src/Likely Bugs/Serialization/MissingVoidConstructorsOnSerializable.ql
View File

@@ -11,6 +11,7 @@
* maintainability
* language-features
*/
import java
from Class serial, Class nonserial, TypeSerializable serializable
@@ -21,10 +22,9 @@ where
not exists(Constructor c |
c = nonserial.getSourceDeclaration().getAConstructor() and
c.hasNoParameters() and
not(c.isPrivate())
not (c.isPrivate())
) and
serial.fromSource()
select serial,
"This class is serializable, but its non-serializable " +
"super-class $@ does not declare a no-argument constructor.",
nonserial, nonserial.getName()
"super-class $@ does not declare a no-argument constructor.", nonserial, nonserial.getName()

6
java/ql/src/Likely Bugs/Serialization/NonSerializableComparator.ql
View File

@@ -10,6 +10,7 @@
* maintainability
* language-features
*/
import java
predicate nonSerializableComparator(Class c) {
@@ -34,7 +35,8 @@ predicate sortedCollectionType(RefType t) {
string nameFor(Class c) {
nonSerializableComparator(c) and
(
(c instanceof AnonymousClass and result = "This comparator") or
(c instanceof AnonymousClass and result = "This comparator")
or
(not c instanceof AnonymousClass and result = c.getName())
)
}
@@ -47,4 +49,4 @@ where
sortedCollectionType(cie.getType())
select arg,
nameFor(c) + " is not serializable, so should not be used as the comparator in a " +
cie.getType().getName() + "."
cie.getType().getName() + "."

92
java/ql/src/Likely Bugs/Serialization/NonSerializableField.ql
View File

@@ -10,6 +10,7 @@
* maintainability
* language-features
*/
import java
import semmle.code.java.JDKAnnotations
import semmle.code.java.Collections
@@ -25,22 +26,24 @@ predicate serializableOrExternalizable(Interface interface) {
interface instanceof TypeSerializable
}
predicate collectionOrMapType(RefType t) {
t instanceof CollectionType or t instanceof MapType
}
predicate collectionOrMapType(RefType t) { t instanceof CollectionType or t instanceof MapType }
predicate serializableType(RefType t) {
exists(RefType sup | sup = t.getASupertype*() | serializableOrExternalizable(sup)) or
exists(RefType sup | sup = t.getASupertype*() | serializableOrExternalizable(sup))
or
(
// Collection interfaces are not serializable, but their implementations are
// likely to be.
collectionOrMapType(t) and
forall(RefType param | param = t.(ParameterizedType).getATypeArgument() | serializableType(param))
) or
forall(RefType param | param = t.(ParameterizedType).getATypeArgument() |
serializableType(param)
)
)
or
exists(BoundedType bt | bt = t | serializableType(bt.getUpperBoundType()))
}
RefType reasonForNonSerializableCollection(ParameterizedType par){
RefType reasonForNonSerializableCollection(ParameterizedType par) {
collectionOrMapType(par) and
result = par.getATypeArgument() and
not serializableType(result)
@@ -48,42 +51,44 @@ RefType reasonForNonSerializableCollection(ParameterizedType par){
string nonSerialReason(RefType t) {
not serializableType(t) and
if exists(reasonForNonSerializableCollection(t)) then
result = reasonForNonSerializableCollection(t).getName() + " is not serializable"
else
result = t.getName() + " is not serializable"
if exists(reasonForNonSerializableCollection(t))
then result = reasonForNonSerializableCollection(t).getName() + " is not serializable"
else result = t.getName() + " is not serializable"
}
predicate exceptions(Class c, Field f){
f.getDeclaringType() = c and (
// `Serializable` objects with custom `readObject` or `writeObject` methods
// may write out the "non-serializable" fields in a different way.
c.declaresMethod("readObject") or
c.declaresMethod("writeObject") or
// Exclude classes with suppressed warnings.
c.suppressesWarningsAbout("serial") or
// Exclude anonymous classes whose `ClassInstanceExpr` is assigned to
// a variable on which serialization warnings are suppressed.
exists(Variable v |
v.getAnAssignedValue() = c.(AnonymousClass).getClassInstanceExpr() and
v.suppressesWarningsAbout("serial")
) or
f.isTransient() or
f.isStatic() or
// Classes that implement `Externalizable` completely take over control during serialization.
externalizable(c.getASupertype+()) or
// Stateless session beans are not normally serialized during their usual life-cycle
// but are forced by their expected supertype to be serializable.
// Arguably, warnings for their non-serializable fields can therefore be suppressed in practice.
c instanceof StatelessSessionEJB or
// Enum types are serialized by name, so it doesn't matter if they have non-serializable fields.
c instanceof EnumType
predicate exceptions(Class c, Field f) {
f.getDeclaringType() = c and
(
// `Serializable` objects with custom `readObject` or `writeObject` methods
// may write out the "non-serializable" fields in a different way.
c.declaresMethod("readObject")
or
c.declaresMethod("writeObject")
or
// Exclude classes with suppressed warnings.
c.suppressesWarningsAbout("serial")
or
// Exclude anonymous classes whose `ClassInstanceExpr` is assigned to
// a variable on which serialization warnings are suppressed.
exists(Variable v |
v.getAnAssignedValue() = c.(AnonymousClass).getClassInstanceExpr() and
v.suppressesWarningsAbout("serial")
)
or
f.isTransient()
or
f.isStatic()
or
// Classes that implement `Externalizable` completely take over control during serialization.
externalizable(c.getASupertype+())
or
// Stateless session beans are not normally serialized during their usual life-cycle
// but are forced by their expected supertype to be serializable.
// Arguably, warnings for their non-serializable fields can therefore be suppressed in practice.
c instanceof StatelessSessionEJB
or
// Enum types are serialized by name, so it doesn't matter if they have non-serializable fields.
c instanceof EnumType
)
}
@@ -94,5 +99,6 @@ where
f.getDeclaringType() = c and
not exceptions(c, f) and
reason = nonSerialReason(f.getType())
select f, "This field is in a serializable class, "
+ " but is not serializable itself because " + reason + "."
select f,
"This field is in a serializable class, " + " but is not serializable itself because " + reason +
"."

58
java/ql/src/Likely Bugs/Serialization/NonSerializableInnerClass.ql
View File

@@ -10,59 +10,55 @@
* maintainability
* language-features
*/
import java
import semmle.code.java.JDKAnnotations
predicate isSerializable(RefType t) {
exists(TypeSerializable ts | ts = t.getASupertype*())
}
predicate isSerializable(RefType t) { exists(TypeSerializable ts | ts = t.getASupertype*()) }
predicate withinStaticContext(NestedClass c) {
c.isStatic() or
c.(AnonymousClass).getClassInstanceExpr().getEnclosingCallable().isStatic() // JLS 15.9.2
}
RefType enclosingInstanceType(Class inner){
RefType enclosingInstanceType(Class inner) {
not withinStaticContext(inner) and
result = inner.(NestedClass).getEnclosingType()
}
predicate castTo(ClassInstanceExpr cie, RefType to){
exists(LocalVariableDeclExpr lvd | lvd.getInit() = cie |
to = lvd.getType()
) or
exists(Assignment a | a.getSource() = cie |
to = a.getType()
) or
exists(Call call, int n | call.getArgument(n) = cie |
to = call.getCallee().getParameterType(n)
) or
exists(ReturnStmt ret | ret.getResult() = cie |
to = ret.getEnclosingCallable().getReturnType()
) or
predicate castTo(ClassInstanceExpr cie, RefType to) {
exists(LocalVariableDeclExpr lvd | lvd.getInit() = cie | to = lvd.getType())
or
exists(Assignment a | a.getSource() = cie | to = a.getType())
or
exists(Call call, int n | call.getArgument(n) = cie | to = call.getCallee().getParameterType(n))
or
exists(ReturnStmt ret | ret.getResult() = cie | to = ret.getEnclosingCallable().getReturnType())
or
exists(ArrayCreationExpr ace | ace.getInit().getAnInit() = cie |
to = ace.getType().(Array).getComponentType()
)
}
predicate exceptions(NestedClass inner){
inner instanceof AnonymousClass or
predicate exceptions(NestedClass inner) {
inner instanceof AnonymousClass
or
// Serializable objects with custom `readObject` or `writeObject` methods may write out
// the "non-serializable" fields in a different way.
inner.declaresMethod("readObject") or
inner.declaresMethod("writeObject") or
inner.declaresMethod("readObject")
or
inner.declaresMethod("writeObject")
or
// Exclude cases where serialization warnings are deliberately suppressed.
inner.suppressesWarningsAbout("serial") or
inner.suppressesWarningsAbout("serial")
or
// The class `inner` is a local class or non-public member class and
// all its instance expressions are cast to non-serializable types.
(
(inner instanceof LocalClass or not inner.isPublic()) and
forall(ClassInstanceExpr cie, RefType target |
cie.getConstructedType() = inner and castTo(cie, target)
|
|
not isSerializable(target)
) and
// Exception 1: the expression is used as an argument to `writeObject()`.
@@ -90,9 +86,9 @@ where
not isSerializable(outer) and
not exceptions(inner) and
(
if (inner instanceof LocalClass) then
advice = "Consider implementing readObject() and writeObject()."
else
advice = "Consider making the class static or implementing readObject() and writeObject()."
if (inner instanceof LocalClass)
then advice = "Consider implementing readObject() and writeObject()."
else advice = "Consider making the class static or implementing readObject() and writeObject()."
)
select inner, "Serializable inner class of non-serializable class $@. " + advice, outer, outer.getName()
select inner, "Serializable inner class of non-serializable class $@. " + advice, outer,
outer.getName()

7
java/ql/src/Likely Bugs/Serialization/ReadResolveObject.ql
View File

@@ -11,6 +11,7 @@
* maintainability
* language-features
*/
import java
from TypeSerializable serializable, Class c, Method m
@@ -20,6 +21,6 @@ where
m.hasName("readResolve") and
m.hasNoParameters() and
not m.getReturnType() instanceof TypeObject
select m, "The method " + m.getName()
+ " must be declared with a return type of Object rather than "
+ m.getReturnType().getName() + "."
select m,
"The method " + m.getName() + " must be declared with a return type of Object rather than " +
m.getReturnType().getName() + "."

4
java/ql/src/Likely Bugs/Serialization/TransientNotSerializable.ql
View File

@@ -9,6 +9,7 @@
* maintainability
* language-features
*/
import java
from TypeSerializable serializable, Class c, Field f
@@ -16,5 +17,4 @@ where
not c.hasSupertype+(serializable) and
f.getDeclaringType() = c and
f.isTransient()
select
f, "The field " + f.getName() + " is transient but " + c.getName() + " is not Serializable."
select f, "The field " + f.getName() + " is transient but " + c.getName() + " is not Serializable."