Moved comment to previous line if resulting in long line

Author: fabienpe

java/ql/src/Security/CWE/CWE-023/PartialPathTraversalBad.java

@@ -1,6 +1,7 @@
 public class PartialPathTraversalBad {
     public void example(File dir, File parent) throws IOException {
-        if (!dir.getCanonicalPath().startsWith(parent.getCanonicalPath())) { // BAD: dir.getCanonicalPath() not slash-terminated
+        // BAD: dir.getCanonicalPath() not slash-terminated
+        if (!dir.getCanonicalPath().startsWith(parent.getCanonicalPath())) {
             throw new IOException("Path traversal attempt: " + dir.getCanonicalPath());
         }
     }

java/ql/src/Security/CWE/CWE-023/PartialPathTraversalGood.java

@@ -2,7 +2,8 @@
 
 public class PartialPathTraversalGood {
     public void example(File dir, File parent) throws IOException {
-        if (!dir.toPath().normalize().startsWith(parent.toPath())) {  // GOOD: Check if dir.Path() is normalised
+        // GOOD: Check if dir.Path() is normalised
+        if (!dir.toPath().normalize().startsWith(parent.toPath())) {
             throw new IOException("Path traversal attempt: " + dir.getCanonicalPath());
         }
     }

java/ql/src/Security/CWE/CWE-079/AndroidWebViewAddJavascriptInterfaceExample.java

@@ -20,4 +20,5 @@ public String studentEmail(String studentName) {
 webview.loadData("", "text/html", null);
 
 String name = "Robert'; DROP TABLE students; --";
-webview.loadUrl("javascript:alert(exposedObject.studentEmail(\""+ name +"\"))"); // BAD: Untrusted input loaded into WebView
+// BAD: Untrusted input loaded into WebView
+webview.loadUrl("javascript:alert(exposedObject.studentEmail(\""+ name +"\"))");

java/ql/src/Security/CWE/CWE-094/InstallApkWithFile.java

@@ -9,6 +9,7 @@
 File file = new File(Environment.getExternalStorageDirectory(), "myapp.apk");
 Intent intent = new Intent(Intent.ACTION_VIEW);
 /* Set the mimetype to APK */
-intent.setDataAndType(Uri.fromFile(file), "application/vnd.android.package-archive"); // BAD: The file may be altered by another app
+// BAD: The file may be altered by another app
+intent.setDataAndType(Uri.fromFile(file), "application/vnd.android.package-archive");
 
 startActivity(intent);

java/ql/src/Security/CWE/CWE-094/InstallApkWithFileProvider.java

@@ -21,7 +21,8 @@
 
 /* Expose temporary file with FileProvider */
 File toInstall = new File(this.getFilesDir(), tempFilename);
-Uri applicationUri = FileProvider.getUriForFile(this, "com.example.apkprovider", toInstall); // GOOD: The file is protected by FileProvider
+// GOOD: The file is protected by FileProvider
+Uri applicationUri = FileProvider.getUriForFile(this, "com.example.apkprovider", toInstall);
 
 /* Create Intent and set data to APK file. */
 Intent intent = new Intent(Intent.ACTION_INSTALL_PACKAGE);

java/ql/src/Security/CWE/CWE-094/SSTIBad.java

@@ -14,6 +14,7 @@ public void bad(HttpServletRequest request) {
 
 		StringWriter w = new StringWriter();
 		// evaluate( Context context, Writer out, String logTag, String instring )
-		Velocity.evaluate(context, w, "mystring", code); // BAD: code is controlled by the user
+		// BAD: code is controlled by the user
+		Velocity.evaluate(context, w, "mystring", code);
 	}
 }

java/ql/src/Security/CWE/CWE-094/SaferSpelExpressionEvaluation.java

@@ -4,9 +4,11 @@ public Object evaluate(Socket socket) throws IOException {
 
     String string = reader.readLine();
     ExpressionParser parser = new SpelExpressionParser();
-    Expression expression = parser.parseExpression(string); // AVOID: string is controlled by the user
+    // AVOID: string is controlled by the user
+    Expression expression = parser.parseExpression(string);
     SimpleEvaluationContext context 
         = SimpleEvaluationContext.forReadWriteDataBinding().build();
-    return expression.getValue(context); // OK: Untrusted expressions are evaluated in a restricted context
+    // OK: Untrusted expressions are evaluated in a restricted context
+    return expression.getValue(context);
   }
 }

java/ql/src/Security/CWE/CWE-094/UnsafeJexlExpressionEvaluation.java

@@ -4,7 +4,8 @@ public void evaluate(Socket socket) throws IOException {
 
     String input = reader.readLine();
     JexlEngine jexl = new JexlBuilder().create();
-    JexlExpression expression = jexl.createExpression(input); // BAD: input is controlled by the user
+    // BAD: input is controlled by the user
+    JexlExpression expression = jexl.createExpression(input);
     JexlContext context = new MapContext();
     expression.evaluate(context);
   }

java/ql/src/Security/CWE/CWE-094/UnsafeSpelExpressionEvaluation.java

@@ -4,7 +4,8 @@ public Object evaluate(Socket socket) throws IOException {
 
     String string = reader.readLine();
     ExpressionParser parser = new SpelExpressionParser();
-    Expression expression = parser.parseExpression(string); // BAD: string is controlled by the user
+    // BAD: string is controlled by the user
+    Expression expression = parser.parseExpression(string);
     return expression.getValue();
   }
 }