Java metavariable-comparison via real structural matching (drop overfit handler)
ober
8998af3778ab65fb1e380e084aec48e39e3964bd
--- a/lib/semgrep/scan.sls +++ b/lib/semgrep/scan.sls @@ -427,7 +427,8 @@ (def (semicolon-trimmable-node? node) (or (string=? (node-type node) "variable_declaration") (string=? (node-type node) "lexical_declaration") - (string=? (node-type node) "import_statement"))) + (string=? (node-type node) "import_statement") + (string=? (node-type node) "return_statement"))) (def (trim-node-finding-end source node start end) (if (and (semicolon-trimmable-node? node) (> end start) @@ -24787,10 +24788,7 @@ (scan-java-string-eq-rule rule path source)] [(java-rule-id? rule "no-direct-response-writer") (scan-java-ruleid-next-line-rule rule path source)] - [(or (java-rule-id? rule "MSTG-STORAGE-5.1") - (java-rule-id? rule "multi-and") - (java-rule-id? rule "multi-or") - (java-rule-id? rule "metavariable-resolution-test") + [(or (java-rule-id? rule "metavariable-resolution-test") (java-rule-id? rule "insecure-crypto-usage") (java-rule-id? rule "test")) (scan-java-ruleid-next-line-rule rule path source)] @@ -29060,6 +29058,8 @@ "(^|\\n)[ \\t]*([A-Za-z_][A-Za-z0-9_]*)[ \\t]*=[ \\t]*([^\\n#]+)") (def go-simple-assignment-regex "(^|\\n)[ \\t]*([A-Za-z_][A-Za-z0-9_]*)[ \\t]*(?::=|=)[ \\t]*([^\\n#=][^\\n#]*)") + (def java-simple-assignment-regex + "(^|\\n)[ \\t]*(?:[A-Za-z_][A-Za-z0-9_<>\\[\\].]*[ \\t]+)*([A-Za-z_][A-Za-z0-9_]*)[ \\t]*=[ \\t]*([^\\n;=][^\\n;]*)") (def (constant-binding-from-value name value source offset) (make-regex-capture-binding name (comparison-value->string value) source offset offset)) @@ -29068,9 +29068,12 @@ before-offset language) (regex-fold-matches - (if (and language (go-language? language)) - go-simple-assignment-regex - python-simple-assignment-regex) + (cond + [(and language (go-language? language)) + go-simple-assignment-regex] + [(and language (java-language? language)) + java-simple-assignment-regex] + [else python-simple-assignment-regex]) (substring source 0 before-offset) (lambda (match acc) (let* ([name (re-match-group match 2)] --- a/src/semgrep/scan.ss +++ b/src/semgrep/scan.ss @@ -477,7 +477,8 @@ (def (semicolon-trimmable-node? node) (or (string=? (node-type node) "variable_declaration") (string=? (node-type node) "lexical_declaration") - (string=? (node-type node) "import_statement"))) + (string=? (node-type node) "import_statement") + (string=? (node-type node) "return_statement"))) (def (trim-node-finding-end source node start end) (if (and (semicolon-trimmable-node? node) @@ -24887,10 +24888,7 @@ (scan-java-string-eq-rule rule path source)] [(java-rule-id? rule "no-direct-response-writer") (scan-java-ruleid-next-line-rule rule path source)] - [(or (java-rule-id? rule "MSTG-STORAGE-5.1") - (java-rule-id? rule "multi-and") - (java-rule-id? rule "multi-or") - (java-rule-id? rule "metavariable-resolution-test") + [(or (java-rule-id? rule "metavariable-resolution-test") (java-rule-id? rule "insecure-crypto-usage") (java-rule-id? rule "test")) (scan-java-ruleid-next-line-rule rule path source)] @@ -28976,6 +28974,13 @@ ;; so `==` comparisons are excluded. "(^|\\n)[ \\t]*([A-Za-z_][A-Za-z0-9_]*)[ \\t]*(?::=|=)[ \\t]*([^\\n#=][^\\n#]*)") +(def java-simple-assignment-regex + ;; Java `[modifiers] Type name = value;` (and bare `name = value;`). The + ;; optional type/modifier words before the name are non-capturing so the name + ;; stays group 2 and the value group 3; value stops at `;`/newline and may not + ;; start with `=` (so `==` comparisons are excluded). + "(^|\\n)[ \\t]*(?:[A-Za-z_][A-Za-z0-9_<>\\[\\].]*[ \\t]+)*([A-Za-z_][A-Za-z0-9_]*)[ \\t]*=[ \\t]*([^\\n;=][^\\n;]*)") + (def (constant-binding-from-value name value source offset) (make-regex-capture-binding name (comparison-value->string value) @@ -28985,9 +28990,10 @@ (def (constant-bindings-before source before-offset language) (regex-fold-matches - (if (and language (go-language? language)) - go-simple-assignment-regex - python-simple-assignment-regex) + (cond + [(and language (go-language? language)) go-simple-assignment-regex] + [(and language (java-language? language)) java-simple-assignment-regex] + [else python-simple-assignment-regex]) (substring source 0 before-offset) (lambda (match acc) (let* ([name (re-match-group match 2)]