Dear Johan,
thanks a lot for your cool queries. I really like them and we should probably add them to our library of prepackaged queries or perhaps you will create one of your own and share your XML bundle of queries here.
I would just like to suggest the same two queries, but in a style that utilizes more the object-oriented nature of the language. Which style you prefer more is of course up to you:
I first define a new .QL class StringClass for java type java.lang.String. Note that we are also looking for subtypes of type String:
class StringClass extends Class {
StringClass() { this.getASupertype*().hasQualifiedName("java.lang","String") }
Constructor getArrayByteConstructor() {
result.getDeclaringType() = this and
result.getNumberOfParameters() = 0 and
exists(PrimitiveType b | b.hasName("byte") and
((Array)result.getAParameter().
getType()) = b)
}
Method getBytesMethod() {
result.getDeclaringType() = this and
result.hasName("getBytes") and
result.getNumberOfParameters() = 0
}
}
and then use that class in both of your queries.
Query 1:
from Callable m
where m.fromSource() and
exists(StringClass sc | m.calls(sc.getBytesMethod()))
select m,
"warning: string to byte array conversion without encoding in:" +
m.toString()
Query 2:
from Callable m
where m.fromSource() and
exists(StringClass sc | m.calls(sc.getArrayByteConstructor()))
select m,
"warning: string to byte array conversion without encoding in:" +
m.toString()
These queries can then be executed to be shown in Eclipse Error view as warnings.
Please do let us know what you think.
