Java Code Examples for edu.umd.cs.findbugs.Priorities#LOW_PRIORITY

The following examples show how to use edu.umd.cs.findbugs.Priorities#LOW_PRIORITY . These examples are extracted from open source projects. You can vote up the ones you like or vote down the ones you don't like, and go to the original project or source file by following the links above each example. You may check out the related API usage on the sidebar.
Example 1
/**=
 * All or nothing :
 * <ul>
 * <li>If the taint to sink path is found, it is mark as high</li>
 * <li>If the source is not confirm, it is mark as low. This is will be the most common case.</li>
 * </ul>
 * @param taint Taint state
 * @return High or low confidence
 */
@Override
protected int getPriority(Taint taint) {
    //**Low risk**
    //It is very common that variable are not sanetize and store in session.
    //By it self it pose little risk. The thinking is the injection or the critical operation
    //will be catch.
    //After all storing value in the session is not so different to storing value in local variables or any indirection.
    //**False positive**
    //The usual and most common configuration is to hide LOW priority (confidence).
    //This way this FP producer will not polute day to day review by developers.

    if (taint.isTainted() || !taint.isSafe()) {
        return Priorities.LOW_PRIORITY;
    }
    else {
        return Priorities.IGNORE_PRIORITY;
    }
}
 
Example 2
@Override
protected int getPriority(Taint taint) {
    if (!taint.isSafe()) {
        //(Condition extracted for clarity)
        //Either specifically safe for new line or URL encoded which encoded few other characters
        boolean newLineSafe = (taint.hasTag(Taint.Tag.CR_ENCODED) && taint.hasTag(Taint.Tag.LF_ENCODED));
        boolean urlSafe = (taint.hasTag(Taint.Tag.URL_ENCODED));
        if(newLineSafe || urlSafe) {
            return Priorities.IGNORE_PRIORITY;
        }
    }
    if (taint.isTainted()) {
        return Priorities.NORMAL_PRIORITY;
    } else if (!taint.isSafe()) {
        return Priorities.LOW_PRIORITY;
    } else {
        return Priorities.IGNORE_PRIORITY;
    }
}
 
Example 3
@Override
protected int getPriority(Taint taint) {
    if (!taint.isSafe() && taint.hasTag(Taint.Tag.XSS_SAFE)) {
        if(FindSecBugsGlobalConfig.getInstance().isReportPotentialXssWrongContext()) {
            return Priorities.LOW_PRIORITY;
        }
        else {
            return Priorities.IGNORE_PRIORITY;
        }
    } else if (!taint.isSafe()
            && (taint.hasTag(Taint.Tag.QUOTE_ENCODED) || taint.hasTag(Taint.Tag.APOSTROPHE_ENCODED))
            && taint.hasTag(Taint.Tag.LT_ENCODED)) {
        return Priorities.LOW_PRIORITY;
    } else {
        return super.getPriority(taint);
    }
}
 
Example 4
@Override
protected int getPriority(Taint taint) {
    if (!taint.isSafe() && taint.hasTag(Taint.Tag.XSS_SAFE)) {
        if (FindSecBugsGlobalConfig.getInstance().isReportPotentialXssWrongContext()) {
            return Priorities.LOW_PRIORITY;
        } else {
            return Priorities.IGNORE_PRIORITY;
        }
    } else if (!taint.isSafe()
            && (taint.hasTag(Taint.Tag.QUOTE_ENCODED) || taint.hasTag(Taint.Tag.APOSTROPHE_ENCODED))
            && taint.hasTag(Taint.Tag.LT_ENCODED)) {
        return Priorities.LOW_PRIORITY;
    } else {
        return super.getPriority(taint);
    }
}
 
Example 5
@Override
protected int getPriority(Taint taint) {
    if (!taint.isSafe() && taint.hasTag(Taint.Tag.XSS_SAFE)) {
        if(FindSecBugsGlobalConfig.getInstance().isReportPotentialXssWrongContext()) {
            return Priorities.LOW_PRIORITY;
        } else {
            return Priorities.IGNORE_PRIORITY;
        }
    } else if (!taint.isSafe()
            && (taint.hasTag(Taint.Tag.QUOTE_ENCODED) || taint.hasTag(Taint.Tag.APOSTROPHE_ENCODED))
            && taint.hasTag(Taint.Tag.LT_ENCODED)) {
        return Priorities.LOW_PRIORITY;
    } else {
        return super.getPriority(taint);
    }
}
 
Example 6
@Override
protected int getPriority(Taint taint) {
    if (!taint.isSafe() && taint.hasTag(Taint.Tag.XSS_SAFE)) {
        if(FindSecBugsGlobalConfig.getInstance().isReportPotentialXssWrongContext()) {
            return Priorities.LOW_PRIORITY;
        }
        else {
            return Priorities.IGNORE_PRIORITY;
        }
    } else if (!taint.isSafe()
            && (taint.hasTag(Taint.Tag.QUOTE_ENCODED) || taint.hasTag(Taint.Tag.APOSTROPHE_ENCODED))
            && taint.hasTag(Taint.Tag.LT_ENCODED)) {
        return Priorities.LOW_PRIORITY;
    } else {
        return super.getPriority(taint);
    }
}
 
Example 7
public int getPriority() {
    int hash = getHash();

    if ((hash & 0x1ff0) == 0) {
        hash = hash & 0xf;
        if (hash < 1) {
            return Priorities.HIGH_PRIORITY;
        } else if (hash < 1 + 2) {
            return Priorities.NORMAL_PRIORITY;
        } else if (hash < 1 + 2 + 4) {
            return Priorities.LOW_PRIORITY;
        } else {
            return Priorities.IGNORE_PRIORITY;
        }
    } else {
        return Priorities.IGNORE_PRIORITY + 1;
    }
}
 
Example 8
@Override
public void sawOpcode(int seen) {
    if (seen == Const.INVOKEVIRTUAL && "start".equals(getNameConstantOperand()) && "()V".equals(getSigConstantOperand())) {
        try {
            if (Hierarchy.isSubtype(getDottedClassConstantOperand(), "java.lang.Thread")) {
                int priority = Priorities.NORMAL_PRIORITY;
                if (getPC() + 4 >= getCode().getCode().length) {
                    priority = Priorities.LOW_PRIORITY;
                }
                BugInstance bug = new BugInstance(this, "SC_START_IN_CTOR", priority).addClassAndMethod(this)
                        .addCalledMethod(this);
                Subtypes2 subtypes2 = AnalysisContext.currentAnalysisContext().getSubtypes2();
                Set<ClassDescriptor> directSubtypes = subtypes2.getDirectSubtypes(getClassDescriptor());
                if (!directSubtypes.isEmpty()) {
                    for (ClassDescriptor sub : directSubtypes) {
                        bug.addClass(sub).describe(ClassAnnotation.SUBCLASS_ROLE);
                    }
                    bug.setPriority(Priorities.HIGH_PRIORITY);
                }
                bugAccumulator.accumulateBug(bug, this);
            }
        } catch (ClassNotFoundException e) {
            bugReporter.reportMissingClass(e);
        }
    }
}
 
Example 9
/**
 * Convert an integer warning priority threshold value to a String.
 */
public static String getIntPriorityAsString(int prio) {
    String minPriority;
    switch (prio) {
    case Priorities.EXP_PRIORITY:
        minPriority = ProjectFilterSettings.EXPERIMENTAL_PRIORITY;
        break;
    case Priorities.LOW_PRIORITY:
        minPriority = ProjectFilterSettings.LOW_PRIORITY;
        break;
    case Priorities.NORMAL_PRIORITY:
        minPriority = ProjectFilterSettings.MEDIUM_PRIORITY;
        break;
    case Priorities.HIGH_PRIORITY:
        minPriority = ProjectFilterSettings.HIGH_PRIORITY;
        break;
    default:
        minPriority = ProjectFilterSettings.DEFAULT_PRIORITY;
        break;
    }
    return minPriority;
}
 
Example 10
@Override
protected int getPriority(Taint taint) {
    boolean newLineSafe = taint.hasTag(Taint.Tag.CR_ENCODED) && taint.hasTag(Taint.Tag.LF_ENCODED);
    if (!taint.isSafe() && newLineSafe || taint.hasTag(Taint.Tag.URL_ENCODED)) {
        return Priorities.IGNORE_PRIORITY;
    } else if (taint.isTainted()) {
        return Priorities.NORMAL_PRIORITY;
    } else if (!taint.isSafe()) {
        return Priorities.LOW_PRIORITY;
    } else {
        return Priorities.IGNORE_PRIORITY;
    }
}
 
Example 11
@Override
protected int getPriority(Taint taint) {
    if (taint.isTainted()) {
        return Priorities.NORMAL_PRIORITY;
    }
    else if (!taint.isSafe()) {
        return Priorities.LOW_PRIORITY;
    }
    else {
        return Priorities.IGNORE_PRIORITY;
    }
}
 
Example 12
/**
 * All or nothing :
 * <ul>
 * <li>If the taint to sink path is found, it is mark as high</li>
 * <li>If the source is not confirm, it is mark as low. This is will be the most common case.</li>
 * </ul>
 * @param taint Taint state
 * @return High or low confidence
 */
@Override
protected int getPriority(Taint taint) {

    if (taint.isTainted()) {
        return Priorities.NORMAL_PRIORITY;
    }
    else if (!taint.isSafe()) {
        return Priorities.LOW_PRIORITY;
    }
    else {
        return Priorities.IGNORE_PRIORITY;
    }
}
 
Example 13
@Override
protected int getPriority(Taint taint) {
    if (!taint.isSafe() && taint.hasTag(Taint.Tag.SQL_INJECTION_SAFE)) {
        return Priorities.IGNORE_PRIORITY;
    } else if (!taint.isSafe() && taint.hasTag(Taint.Tag.APOSTROPHE_ENCODED)) {
        return Priorities.LOW_PRIORITY;
    } else {
        return super.getPriority(taint);
    }
}
 
Example 14
@Override
protected int getPriority(Taint taint) {
    if (!taint.isSafe() && taint.hasTag(Taint.Tag.SQL_INJECTION_SAFE)) {
        return Priorities.IGNORE_PRIORITY;
    } else if (!taint.isSafe() && taint.hasTag(Taint.Tag.APOSTROPHE_ENCODED)) {
        return Priorities.LOW_PRIORITY;
    }
    else {
        return super.getPriority(taint);
    }

}
 
Example 15
private void addToReport(Method m, ClassContext classContext, Location locationWeakness, Number n){
    JavaClass clz = classContext.getJavaClass();
    int priority = (n.intValue() < 1024) ? Priorities.NORMAL_PRIORITY : Priorities.LOW_PRIORITY;
    bugReporter.reportBug(new BugInstance(this, RSA_KEY_SIZE_TYPE, priority) //
            .addClass(clz)
            .addMethod(clz, m)
            .addSourceLine(classContext, m, locationWeakness));
}
 
Example 16
Source Project: sputnik   File: CollectorBugReporter.java    License: Apache License 2.0 5 votes vote down vote up
@NotNull
private Severity convert(int priority) {
    switch (priority) {
        case Priorities.IGNORE_PRIORITY:
            return Severity.IGNORE;
        case Priorities.EXP_PRIORITY:
        case Priorities.LOW_PRIORITY:
        case Priorities.NORMAL_PRIORITY:
            return Severity.INFO;
        case Priorities.HIGH_PRIORITY:
            return Severity.WARNING;
        default:
            throw new IllegalArgumentException("Priority " + priority + " is not supported");
    }
}
 
Example 17
@Override
public void sawOpcode(int seen) {
    int priority;
    switch (seen) {
    case Const.INVOKEINTERFACE:
    case Const.INVOKEVIRTUAL:
    case Const.INVOKESPECIAL:
    case Const.INVOKESTATIC:
        hq.pushHash(getClassConstantOperand());
        if (getNameConstantOperand().indexOf('$') == -1) {
            hq.pushHash(getNameConstantOperand());
        }
        hq.pushHash(getSigConstantOperand());

        priority = hq.getPriority();
        if (priority <= Priorities.LOW_PRIORITY) {
            accumulator.accumulateBug(new BugInstance(this, "NOISE_METHOD_CALL", priority).addClassAndMethod(this)
                    .addCalledMethod(this), this);
        }
        break;
    case Const.GETFIELD:
    case Const.PUTFIELD:
    case Const.GETSTATIC:
    case Const.PUTSTATIC:
        hq.pushHash(getClassConstantOperand());
        if (getNameConstantOperand().indexOf('$') == -1) {
            hq.pushHash(getNameConstantOperand());
        }
        hq.pushHash(getSigConstantOperand());
        priority = hq.getPriority();
        if (priority <= Priorities.LOW_PRIORITY) {
            accumulator.accumulateBug(new BugInstance(this, "NOISE_FIELD_REFERENCE", priority).addClassAndMethod(this)
                    .addReferencedField(this), this);
        }
        break;
    case Const.CHECKCAST:
    case Const.INSTANCEOF:
    case Const.NEW:
        hq.pushHash(getClassConstantOperand());
        break;
    case Const.IFEQ:
    case Const.IFNE:
    case Const.IFNONNULL:
    case Const.IFNULL:
    case Const.IF_ICMPEQ:
    case Const.IF_ICMPNE:
    case Const.IF_ICMPLE:
    case Const.IF_ICMPGE:
    case Const.IF_ICMPGT:
    case Const.IF_ICMPLT:
    case Const.IF_ACMPEQ:
    case Const.IF_ACMPNE:
    case Const.RETURN:
    case Const.ARETURN:
    case Const.IRETURN:
    case Const.MONITORENTER:
    case Const.MONITOREXIT:
    case Const.IINC:
    case Const.NEWARRAY:
    case Const.TABLESWITCH:
    case Const.LOOKUPSWITCH:
    case Const.LCMP:
    case Const.INEG:
    case Const.IADD:
    case Const.IMUL:
    case Const.ISUB:
    case Const.IDIV:
    case Const.IREM:
    case Const.IXOR:
    case Const.ISHL:
    case Const.ISHR:
    case Const.IUSHR:
    case Const.IAND:
    case Const.IOR:
    case Const.LAND:
    case Const.LOR:
    case Const.LADD:
    case Const.LMUL:
    case Const.LSUB:
    case Const.LDIV:
    case Const.LSHL:
    case Const.LSHR:
    case Const.LUSHR:
    case Const.AALOAD:
    case Const.AASTORE:
    case Const.IALOAD:
    case Const.IASTORE:
    case Const.BALOAD:
    case Const.BASTORE:
        hq.push(seen);
        priority = hq.getPriority();
        if (priority <= Priorities.LOW_PRIORITY) {
            accumulator.accumulateBug(
                    new BugInstance(this, "NOISE_OPERATION", priority).addClassAndMethod(this).addString(Const.getOpcodeName(seen)),
                    this);
        }
        break;
    default:
        break;
    }
}
 
Example 18
private static int getPriorityForBeingMutable(Type type) {
    if (type instanceof ArrayType) {
        return HIGH_PRIORITY;
    } else if (type instanceof ObjectType) {
        UnreadFieldsData unreadFields = AnalysisContext.currentAnalysisContext().getUnreadFieldsData();

        ClassDescriptor cd = DescriptorFactory.getClassDescriptor((ObjectType) type);
        @SlashedClassName
        String className = cd.getClassName();
        if (immutableClassNames.contains(className)) {
            return Priorities.LOW_PRIORITY;
        }

        XClass xClass = AnalysisContext.currentXFactory().getXClass(cd);
        if (xClass == null) {
            return Priorities.IGNORE_PRIORITY;
        }
        ClassDescriptor superclassDescriptor = xClass.getSuperclassDescriptor();
        if (superclassDescriptor != null) {
            @SlashedClassName
            String superClassName = superclassDescriptor.getClassName();
            if ("java/lang/Enum".equals(superClassName)) {
                return Priorities.LOW_PRIORITY;
            }
        }
        boolean hasMutableField = false;
        boolean hasUpdates = false;
        for (XField f : xClass.getXFields()) {
            if (!f.isStatic()) {
                if (!f.isFinal() && !f.isSynthetic()) {
                    hasMutableField = true;
                    if (unreadFields.isWrittenOutsideOfInitialization(f)) {
                        hasUpdates = true;
                    }
                }
                String signature = f.getSignature();
                if (signature.startsWith("Ljava/util/concurrent") || signature.startsWith("Ljava/lang/StringB")
                        || signature.charAt(0) == '[' || signature.indexOf("Map") >= 0 || signature.indexOf("List") >= 0
                        || signature.indexOf("Set") >= 0) {
                    hasMutableField = hasUpdates = true;
                }

            }
        }

        if (!hasMutableField && !xClass.isInterface() && !xClass.isAbstract()) {
            return Priorities.LOW_PRIORITY;
        }
        if (hasUpdates || className.startsWith("java/util") || className.indexOf("Map") >= 0
                || className.indexOf("List") >= 0) {
            return Priorities.HIGH_PRIORITY;
        }
        return Priorities.NORMAL_PRIORITY;

    } else {
        return Priorities.IGNORE_PRIORITY;
    }
}