Hello,
Thanks for ur reply.
For the first issue, I read the web.log and found the reason is incorrect version of Java analyser. I updated it and make custom rules work normally.
For the second issue. For example, here are my custom rule codes.
FindSessionIdWithAddIssueOnFile.java
@Rule(key = "FindSessionIdWithAddIssueOnFile")
public class FindSessionIdWithAddIssueOnFile extends IssuableSubscriptionVisitor {
@Override
public List<Tree.Kind> nodesToVisit() {
return Collections.singletonList(Tree.Kind.IDENTIFIER);
}
@Override
public void visitNode(Tree tree) {
IdentifierTree identifierTree = (IdentifierTree) tree;
if (identifierTree == null) {
return;
}
String name = identifierTree.name();
if (name.toLowerCase().indexOf("sessionid") != -1) {
String message = "This variable is sessionID related at line: " + tree.firstToken().line();
addIssueOnFile(message);
}
}
}
FindSessionIdWithReportIssue.java
@Rule(key = "FindSessionIdWithReportIssue")
public class FindSessionIdWithReportIssue extends IssuableSubscriptionVisitor {
@Override
public List<Tree.Kind> nodesToVisit() {
return Collections.singletonList(Tree.Kind.IDENTIFIER);
}
@Override
public void visitNode(Tree tree) {
IdentifierTree identifierTree = (IdentifierTree) tree;
if (identifierTree == null) {
return;
}
String name = identifierTree.name();
if (name.toLowerCase().indexOf("sessionid") != -1) {
String message = "This variable is sessionID related: ";
reportIssue(tree, message);
}
}
}
The aim of these two rules are to find “sessionid” and the only difference is the ways to report issue.
Below is the result of analysing one of projects.
You can see they report different numbers of bugs.
then I read the detail of result and I found:
The rule FindSessionIdWithReportIssue using “reportIssue(tree, message);” to report issue would ignore some issues, like the line 99
but the other rule FindSessionIdWithAddIssueOnFile using “addIssueOnFile(message);” would report it:
Then I tried FindSessionIdWithReportIssue with the Java file I tried to scan in local and it works normally, the “issue” would report at line 99:
java.lang.AssertionError: Unexpected at [74, 77, 90, 93, 99, 109, 109, 117, 117, 120, 120, 137, 138, 139, 140, 149, 152, 161, 163, 177, 179, 205, 207, 222, 224, 240, 242, 263, 265, 401, 403, 404, 406, 408, 417, 417, 422]
I also printed some information for FindSessionIdWithReportIssue . I found it would report bugs nomally because issues would be printed at line 99 in terminal.
So I think maybe the promblem of displaying report on website?
That’s all. Thanks again for ur help.
