|
20 | 20 | import java.util.Arrays; |
21 | 21 | import java.util.HashSet; |
22 | 22 | import java.util.List; |
23 | | -import java.util.Locale; |
24 | | -import java.util.Objects; |
25 | 23 | import java.util.Optional; |
26 | 24 | import java.util.Set; |
27 | 25 | import java.util.function.Predicate; |
28 | 26 | import java.util.regex.Pattern; |
29 | | -import java.util.stream.Stream; |
30 | 27 | import org.sonar.check.Rule; |
31 | 28 | import org.sonar.plugins.python.api.PythonSubscriptionCheck; |
32 | 29 | import org.sonar.plugins.python.api.SubscriptionContext; |
@@ -117,19 +114,14 @@ private static Predicate<Expression> isListAnyMatch(Predicate<Expression> pred) |
117 | 114 | "django.views.decorators.csrf.csrf_exempt", |
118 | 115 | "flask_wtf.csrf.CSRFProtect.exempt")); |
119 | 116 |
|
| 117 | + private static boolean isDangerousDecorator(Decorator expression) { |
| 118 | + return DANGEROUS_DECORATORS.stream().anyMatch(dangerousFqn -> TreeUtils.isDecoratorWithFQN(expression, dangerousFqn)); |
| 119 | + } |
| 120 | + |
120 | 121 | /** Raises issue whenever a decorator with something about "CSRF" and "exempt" in the combined name is found. */ |
121 | 122 | private static void decoratorCsrfExemptCheck(SubscriptionContext subscriptionContext) { |
122 | 123 | Decorator decorator = (Decorator) subscriptionContext.syntaxNode(); |
123 | | - List<String> names = Stream.of(TreeUtils.decoratorNameFromExpression(decorator.expression())) |
124 | | - .filter(Objects::nonNull) |
125 | | - .flatMap(s -> Arrays.stream(s.split("\\."))) |
126 | | - .toList(); |
127 | | - // This is a temporary workaround until symbol resolution works for decorators. |
128 | | - // Use the actual functions with FQNs from DANGEROUS_DECORATORS once that's fixed. |
129 | | - // Related ticket: https://jira.sonarsource.com/browse/SONARPY-681 |
130 | | - boolean isDangerous = names.stream().anyMatch(s -> s.toLowerCase(Locale.US).contains("csrf")) && |
131 | | - names.stream().anyMatch(s -> s.toLowerCase(Locale.US).contains("exempt")); |
132 | | - if (isDangerous) { |
| 124 | + if(isDangerousDecorator(decorator)) { |
133 | 125 | subscriptionContext.addIssue(decorator.lastToken(), MESSAGE); |
134 | 126 | } |
135 | 127 | } |
|
0 commit comments