Enhance static code analyzer rule to support positional and named password arguments#1425
Enhance static code analyzer rule to support positional and named password arguments#1425nureka-rodrigo wants to merge 12 commits intoballerina-platform:masterfrom
Conversation
nureka-rodrigo
requested review from
RDPerera,
niveathika and
shafreenAnfar
as code owners
nureka-rodrigo
changed the title
nureka-rodrigo
changed the title
nureka-rodrigo
changed the title
| return namedArgument.argumentName().toString().trim().equals(PASSWORD) | ||
| && namedArgument.expression().toString().trim().equals("\"\""); |
There was a problem hiding this comment.
Can't we use the Semantic API for this?
There was a problem hiding this comment.
As far as I know, the SemanticModel is primarily used to find references and usages of a given Node or Symbol. In this case, I am looking for a NamedArgumentNode with 'PASSWORD' as the argument name.
There was a problem hiding this comment.
You can access the parameters of a function using the MethodSymbol class.
I am suggesting this because that the toString, trim, etc. are not that readable, while using the Semantic API, you can easily, and cleanly check these. Check this example as well.
There was a problem hiding this comment.
@ThisaruGuruge I tried, but I wasn’t able to do this using the Semantic API. In the case of password = "test123", using semanticModel.symbol(passwordArgument) always returns empty.
There was a problem hiding this comment.
You probably cannot validate the values using the Semantic API, my suggestion was to use it for types and names.
There was a problem hiding this comment.
@ThisaruGuruge Shall we go with the current implementation?
Codecov Report❌ Patch coverage is ❌ Your project check has failed because the head coverage (72.48%) is below the target coverage (80.00%). You can increase the head coverage or adjust the target coverage. Additional details and impacted files@@ Coverage Diff @@
## master #1425 +/- ##
============================================
- Coverage 74.43% 72.48% -1.96%
Complexity 125 125
============================================
Files 27 27
Lines 669 687 +18
Branches 128 136 +8
============================================
Hits 498 498
- Misses 122 140 +18
Partials 49 49 ☔ View full report in Codecov by Sentry. 🚀 New features to boost your workflow:
|
…aticCodeAnalyzerTest
Updated the file paths in rule<x>.json to use relative paths instead of absolute paths. This change improves portability and ensures that the rules can be used in different environments without modification.
|
PR build is failing. @nureka-rodrigo can you please check? |
Introduces a new Ballerina file 'custom_prefix.bal' under rule1 test resources and updates the expected output to include a vulnerability finding for insecure database password usage. This enhances test coverage for custom import prefixes in the static code analyzer.
|
This is already addressed in the PR #1427 |
3 participants
Purpose
Fixes: ballerina-platform/ballerina-library#8103
Description
This PR includes below improvements.
SecurePasswordAnalyzerto detect empty passwords in both named and positional arguments for MySQL client initialization.balScanVersionto 0.10.0 and used scan-tool's test API to perform testing.Checklist