SONARJAVA-6783: Implement rule S9345 Classes with throwing constructors should be protected against Finalizer attacks

its/ruling/src/test/resources/commons-beanutils/java-S9345.json

@@ -0,0 +1,32 @@
+{
+"commons-beanutils:commons-beanutils:src/main/java/org/apache/commons/beanutils2/BeanPropertyValueChangeClosure.java": [
+79
+],
+"commons-beanutils:commons-beanutils:src/main/java/org/apache/commons/beanutils2/BeanPropertyValueEqualsPredicate.java": [
+110
+],
+"commons-beanutils:commons-beanutils:src/main/java/org/apache/commons/beanutils2/BeanToPropertyValueTransformer.java": [
+71
+],
+"commons-beanutils:commons-beanutils:src/main/java/org/apache/commons/beanutils2/FluentPropertyBeanIntrospector.java": [
+78
+],
+"commons-beanutils:commons-beanutils:src/main/java/org/apache/commons/beanutils2/MappedPropertyDescriptor.java": [
+44
+],
+"commons-beanutils:commons-beanutils:src/main/java/org/apache/commons/beanutils2/MethodUtils.java": [
+1304
+],
+"commons-beanutils:commons-beanutils:src/main/java/org/apache/commons/beanutils2/ResultSetDynaClass.java": [
+82
+],
+"commons-beanutils:commons-beanutils:src/main/java/org/apache/commons/beanutils2/RowSetDynaClass.java": [
+66
+],
+"commons-beanutils:commons-beanutils:src/main/java/org/apache/commons/beanutils2/SuppressPropertiesBeanIntrospector.java": [
+38
+],
+"commons-beanutils:commons-beanutils:src/main/java/org/apache/commons/beanutils2/converters/ArrayConverter.java": [
+129
+]
+}

its/ruling/src/test/resources/eclipse-jetty/java-S9345.json

@@ -0,0 +1,107 @@
+{
+"org.eclipse.jetty:jetty-project:jetty-http/src/main/java/org/eclipse/jetty/http/HostPortHttpField.java": [
+28
+],
+"org.eclipse.jetty:jetty-project:jetty-http/src/main/java/org/eclipse/jetty/http/HttpCookie.java": [
+32
+],
+"org.eclipse.jetty:jetty-project:jetty-http/src/main/java/org/eclipse/jetty/http/PrecompressedHttpContent.java": [
+30
+],
+"org.eclipse.jetty:jetty-project:jetty-http/src/main/java/org/eclipse/jetty/http/pathmap/UriTemplatePathSpec.java": [
+41
+],
+"org.eclipse.jetty:jetty-project:jetty-io/src/main/java/org/eclipse/jetty/io/ArrayByteBufferPool.java": [
+39
+],
+"org.eclipse.jetty:jetty-project:jetty-server/src/main/java/org/eclipse/jetty/server/CustomRequestLog.java": [
+273
+],
+"org.eclipse.jetty:jetty-project:jetty-server/src/main/java/org/eclipse/jetty/server/Dispatcher.java": [
+41
+],
+"org.eclipse.jetty:jetty-project:jetty-server/src/main/java/org/eclipse/jetty/server/EncodingHttpWriter.java": [
+29
+],
+"org.eclipse.jetty:jetty-project:jetty-server/src/main/java/org/eclipse/jetty/server/HttpChannelListeners.java": [
+33
+],
+"org.eclipse.jetty:jetty-project:jetty-server/src/main/java/org/eclipse/jetty/server/MultiPartFormInputStream.java": [
+83
+],
+"org.eclipse.jetty:jetty-project:jetty-server/src/main/java/org/eclipse/jetty/server/ServletPathMapping.java": [
+38
+],
+"org.eclipse.jetty:jetty-project:jetty-util-ajax/src/main/java/org/eclipse/jetty/util/ajax/JSONPojoConvertorFactory.java": [
+29
+],
+"org.eclipse.jetty:jetty-project:jetty-util/src/main/java/org/eclipse/jetty/util/BlockingArrayQueue.java": [
+49
+],
+"org.eclipse.jetty:jetty-project:jetty-util/src/main/java/org/eclipse/jetty/util/ClassLoadingObjectInputStream.java": [
+32
+],
+"org.eclipse.jetty:jetty-project:jetty-util/src/main/java/org/eclipse/jetty/util/CountingCallback.java": [
+41
+],
+"org.eclipse.jetty:jetty-project:jetty-util/src/main/java/org/eclipse/jetty/util/HostPort.java": [
+26
+],
+"org.eclipse.jetty:jetty-project:jetty-util/src/main/java/org/eclipse/jetty/util/IncludeExcludeSet.java": [
+39
+],
+"org.eclipse.jetty:jetty-project:jetty-util/src/main/java/org/eclipse/jetty/util/InetAddressPattern.java": [
+110,
+191,
+236
+],
+"org.eclipse.jetty:jetty-project:jetty-util/src/main/java/org/eclipse/jetty/util/MultiPartOutputStream.java": [
+29
+],
+"org.eclipse.jetty:jetty-project:jetty-util/src/main/java/org/eclipse/jetty/util/MultiPartWriter.java": [
+28
+],
+"org.eclipse.jetty:jetty-project:jetty-util/src/main/java/org/eclipse/jetty/util/MultiReleaseJarFile.java": [
+38,
+154
+],
+"org.eclipse.jetty:jetty-project:jetty-util/src/main/java/org/eclipse/jetty/util/PathWatcher.java": [
+70
+],
+"org.eclipse.jetty:jetty-project:jetty-util/src/main/java/org/eclipse/jetty/util/QuotedStringTokenizer.java": [
+37
+],
+"org.eclipse.jetty:jetty-project:jetty-util/src/main/java/org/eclipse/jetty/util/RolloverFileOutputStream.java": [
+51
+],
+"org.eclipse.jetty:jetty-project:jetty-util/src/main/java/org/eclipse/jetty/util/Uptime.java": [
+36
+],
+"org.eclipse.jetty:jetty-project:jetty-util/src/main/java/org/eclipse/jetty/util/component/FileDestroyable.java": [
+32
+],
+"org.eclipse.jetty:jetty-project:jetty-util/src/main/java/org/eclipse/jetty/util/resource/PathResource.java": [
+53
+],
+"org.eclipse.jetty:jetty-project:jetty-util/src/main/java/org/eclipse/jetty/util/resource/ResourceCollection.java": [
+43
+],
+"org.eclipse.jetty:jetty-project:jetty-util/src/main/java/org/eclipse/jetty/util/security/CertificateValidator.java": [
+55
+],
+"org.eclipse.jetty:jetty-project:jetty-util/src/main/java/org/eclipse/jetty/util/ssl/KeyStoreScanner.java": [
+40
+],
+"org.eclipse.jetty:jetty-project:jetty-util/src/main/java/org/eclipse/jetty/util/ssl/X509.java": [
+37
+],
+"org.eclipse.jetty:jetty-project:jetty-util/src/main/java/org/eclipse/jetty/util/thread/QueuedThreadPool.java": [
+48
+],
+"org.eclipse.jetty:jetty-project:jetty-xml/src/main/java/org/eclipse/jetty/xml/XmlAppendable.java": [
+30
+],
+"org.eclipse.jetty:jetty-project:jetty-xml/src/main/java/org/eclipse/jetty/xml/XmlConfiguration.java": [
+87
+]
+}

its/ruling/src/test/resources/guava/java-S9345.json

@@ -0,0 +1,8 @@
+{
+"com.google.guava:guava:src/com/google/common/base/FinalizableReferenceQueue.java": [
+94
+],
+"com.google.guava:guava:src/com/google/common/io/MultiReader.java": [
+33
+]
+}

its/ruling/src/test/resources/sonar-server/java-S9345.json

@@ -0,0 +1,23 @@
+{
+"org.sonarsource.sonarqube:sonar-server:src/main/java/org/sonar/server/computation/task/projectanalysis/source/ReportIterator.java": [
+33
+],
+"org.sonarsource.sonarqube:sonar-server:src/main/java/org/sonar/server/issue/index/IssueIteratorForSingleChunk.java": [
+53
+],
+"org.sonarsource.sonarqube:sonar-server:src/main/java/org/sonar/server/platform/web/MasterServletFilter.java": [
+42
+],
+"org.sonarsource.sonarqube:sonar-server:src/main/java/org/sonar/server/plugins/UpdateCenterClient.java": [
+64
+],
+"org.sonarsource.sonarqube:sonar-server:src/main/java/org/sonar/server/user/SecurityRealmFactory.java": [
+38
+],
+"org.sonarsource.sonarqube:sonar-server:src/main/java/org/sonar/server/util/ObjectInputStreamIterator.java": [
+31
+],
+"org.sonarsource.sonarqube:sonar-server:src/main/java/org/sonar/server/util/cache/DiskCache.java": [
+37
+]
+}

java-checks-test-sources/default/src/main/java/checks/FinalizerAttackCheckSample.java

@@ -0,0 +1,189 @@
+package checks;
+
+class FinalizerAttackCheckSample {
+
+  // --- Noncompliant: non-final class with throwing constructor ---
+
+  static class SecurityService { // Secondary {{Non-final class}}
+    private final String token;
+
+    public SecurityService(String token) throws IllegalArgumentException { // Noncompliant {{Make this class "final" or make this throwing constructor "private".}}
+      if (token == null) {
+        throw new IllegalArgumentException("Invalid token");
+      }
+      this.token = token;
+    }
+  }
+
+  static class AuthProvider { // Secondary {{Non-final class}}
+    public AuthProvider(String credentials) throws Exception { // Noncompliant
+      if (credentials.isEmpty()) {
+        throw new Exception("Bad credentials");
+      }
+    }
+  }
+
+  static class ResourceLoader { // Secondary {{Non-final class}}
+    ResourceLoader(String path) { // Noncompliant
+      if (path == null) {
+        throw new NullPointerException();
+      }
+    }
+  }
+
+  static class MultiConstructorService { // Secondary {{Non-final class}}
+    MultiConstructorService(int id) throws Exception { // Noncompliant
+      if (id < 0) {
+        throw new Exception("Negative id");
+      }
+    }
+
+    MultiConstructorService(String name) {
+    }
+  }
+
+  static class ProtectedConstructorService { // Secondary {{Non-final class}}
+    protected ProtectedConstructorService(String data) throws Exception { // Noncompliant
+      if (data == null) {
+        throw new Exception("Null data");
+      }
+    }
+  }
+
+  static class ThrowsClauseOnly { // Secondary {{Non-final class}}
+    public ThrowsClauseOnly() throws Exception { // Noncompliant
+    }
+  }
+
+  // --- Compliant: final class ---
+
+  static final class SecureService {
+    public SecureService(String token) throws IllegalArgumentException {
+      if (token == null) {
+        throw new IllegalArgumentException("Invalid token");
+      }
+    }
+  }
+
+  // --- Compliant: all constructors private (factory pattern) ---
+
+  static class FactoryService {
+    private FactoryService(String data) {
+    }
+
+    public static FactoryService create(String data) throws Exception {
+      if (data == null) {
+        throw new Exception("Null");
+      }
+      return new FactoryService(data);
+    }
+  }
+
+  // --- Compliant: no throwing constructor ---
+
+  static class SafeService {
+    public SafeService(String data) {
+      // no throw
+    }
+  }
+
+  static class NoConstructor {
+    void doSomething() {
+    }
+  }
+
+  // --- Compliant: abstract class ---
+
+  static abstract class AbstractService {
+    public AbstractService(String data) throws Exception {
+      if (data == null) {
+        throw new Exception("Null");
+      }
+    }
+  }
+
+  // --- Compliant: private throwing constructor, public non-throwing constructor ---
+
+  static class MixedConstructors {
+    private MixedConstructors(String data) throws Exception {
+      if (data == null) {
+        throw new Exception("Null");
+      }
+    }
+
+    public MixedConstructors(int id) {
+    }
+  }
+
+  // --- Compliant: enum (implicitly final) ---
+
+  enum Status {
+    ACTIVE, INACTIVE;
+
+    Status() {
+    }
+  }
+
+  // --- Compliant: record (implicitly final) ---
+
+  record Credential(String value) {
+    Credential {
+      if (value == null) {
+        throw new IllegalArgumentException("Null value");
+      }
+    }
+  }
+
+  // --- Compliant: inner interface (no constructors) ---
+
+  interface Service {
+    void execute();
+  }
+
+  // --- Noncompliant: throw in constructor body without throws clause ---
+
+  static class ConfigLoader { // Secondary {{Non-final class}}
+    public ConfigLoader(String config) { // Noncompliant
+      if (config == null) {
+        throw new IllegalStateException("Missing config");
+      }
+    }
+  }
+
+  // --- Compliant: throw in a method, not in constructor ---
+
+  static class Processor {
+    public Processor() {
+    }
+
+    public void process() {
+      throw new UnsupportedOperationException();
+    }
+  }
+
+  // --- Noncompliant: nested throw in try block within constructor ---
+
+  static class DatabaseConnection { // Secondary {{Non-final class}}
+    public DatabaseConnection(String url) { // Noncompliant
+      try {
+        if (url == null) {
+          throw new RuntimeException("Null URL");
+        }
+      } catch (Exception e) {
+        throw new RuntimeException("Connection failed", e);
+      }
+    }
+  }
+
+  // --- Compliant: all throwing constructors are private ---
+
+  static class PrivateOnlyThrowers {
+    private PrivateOnlyThrowers(String s) throws Exception {
+      throw new Exception();
+    }
+
+    private PrivateOnlyThrowers(int i) {
+      throw new IllegalArgumentException();
+    }
+  }
+}