com.cflint.plugins.core.QueryParamChecker Maven / Gradle / Ivy

Go to download

Show more of this group Show more artifacts with this name
Show all versions of CFLint Show documentation

A static code analysis tool for ColdFusion (in the spirit of FindBugs and Lint). With CFLint, you are able to analyze your ColdFusion code base for code violations.

There is a newer version: 1.5.0

Show newest version

package com.cflint.plugins.core;

import java.util.regex.Matcher;
import java.util.regex.Pattern;

import com.cflint.BugList;
import com.cflint.plugins.CFLintScannerAdapter;
import com.cflint.plugins.Context;

import cfml.parsing.cfscript.CFExpression;
import cfml.parsing.cfscript.CFFunctionExpression;
import net.htmlparser.jericho.Element;

public class QueryParamChecker extends CFLintScannerAdapter {

    @Override
    public void expression(final CFExpression expression, final Context context, final BugList bugs) {
        if (expression instanceof CFFunctionExpression) {
            final CFFunctionExpression functionExpression = (CFFunctionExpression) expression;
            if (functionExpression.getFunctionName().equalsIgnoreCase("setSql")
                    && !functionExpression.getArgs().isEmpty()) {
                final CFExpression argsExpression = functionExpression.getArgs().get(0);
                final Pattern p = Pattern.compile(".*#[^#].*", Pattern.DOTALL);
                if (p.matcher(argsExpression.Decompile(0)).matches()) {
                    context.addMessage("QUERYPARAM_REQ", functionExpression.getName());
                }
            }
        }
    }

    @Override
    public void element(final Element element, final Context context, final BugList bugs) {
        if (// element.getName().equals("cfcomponent") ||
        element.getName().equals("cfquery") && !"query".equalsIgnoreCase(element.getAttributeValue("dbtype"))) {
            final String content = element.getTextExtractor().toString();
            if (content.indexOf("#") > 0) {
                final Pattern pattern = Pattern.compile("#(.+?)#");
                final Matcher matcher = pattern.matcher(content);
                while (matcher.find()) {
                    if (matcher.groupCount() >= 1) {
                        // final String variableName = matcher.group(1);
                        context.addMessage("CFQUERYPARAM_REQ", element.getAttributeValue("NAME"));
                    }
                }
            }
        }
    }

}