Skip to content

Commit 0330cc7

Browse files
nbihan-mediwarenbihan-mediware
authored
Upgrade to CFlint 1.4.1 (#5)
1 parent 10dd4e5 commit 0330cc7

File tree

4 files changed

+65
-58
lines changed

4 files changed

+65
-58
lines changed

‎pom.xml

+2-2
Original file line numberDiff line numberDiff line change
@@ -6,7 +6,7 @@
66
<groupId>com.stepstone.sonar.plugin</groupId>
77
<artifactId>sonar-coldfusion-plugin</artifactId>
88
<packaging>sonar-plugin</packaging>
9-
<version>1.6.8-SNAPSHOT</version>
9+
<version>1.7.0-SNAPSHOT</version>
1010

1111
<name>SonarQube Coldfusion Analyzer</name>
1212
<description>Enables scanning of ColdFusion source files</description>
@@ -40,7 +40,7 @@
4040
<maven.compiler.source>1.8</maven.compiler.source>
4141
<maven.compiler.target>1.8</maven.compiler.target>
4242
<sonar.version>6.7.6</sonar.version>
43-
<cflint.version>1.2.3</cflint.version>
43+
<cflint.version>1.4.1</cflint.version>
4444
</properties>
4545

4646
<dependencies>

‎src/main/java/com/stepstone/sonar/plugin/coldfusion/ColdFusionSensor.java

+11-6
Original file line numberDiff line numberDiff line change
@@ -26,7 +26,6 @@
2626
import org.sonar.api.batch.sensor.SensorContext;
2727
import org.sonar.api.batch.sensor.SensorDescriptor;
2828
import org.sonar.api.measures.CoreMetrics;
29-
import org.sonar.api.measures.Metric;
3029
import org.sonar.api.profiles.RulesProfile;
3130
import org.sonar.api.utils.log.Logger;
3231
import org.sonar.api.utils.log.Loggers;
@@ -39,7 +38,10 @@
3938
import java.nio.file.Files;
4039
import java.util.ArrayList;
4140
import java.util.List;
42-
import java.util.concurrent.*;
41+
import java.util.concurrent.Callable;
42+
import java.util.concurrent.ExecutorService;
43+
import java.util.concurrent.Executors;
44+
import java.util.concurrent.TimeUnit;
4345

4446
public class ColdFusionSensor implements Sensor {
4547

@@ -75,9 +77,12 @@ public void execute(SensorContext context) {
7577

7678
private void analyze(SensorContext context) throws IOException, XMLStreamException {
7779
File configFile = generateCflintConfig();
78-
new CFLintAnalyzer(context).analyze(configFile);
79-
//when analysis is done we delete the created file
80-
deleteFile(configFile);
80+
try {
81+
new CFLintAnalyzer(context).analyze(configFile);
82+
} finally {
83+
//when analysis is done we delete the created file
84+
deleteFile(configFile);
85+
}
8186
}
8287

8388
private File generateCflintConfig() throws IOException, XMLStreamException {
@@ -105,7 +110,7 @@ private void importResults(SensorContext sensorContext) throws IOException {
105110
private void measureProcessor(SensorContext context) {
106111
LOGGER.info("Starting measure processor");
107112

108-
ExecutorService executorService = Executors.newFixedThreadPool(2);
113+
ExecutorService executorService = Executors.newSingleThreadExecutor();
109114
List<Callable<Integer>> callableTasks = new ArrayList<>();
110115

111116
for (InputFile inputFile : fs.inputFiles(fs.predicates().hasLanguage(ColdFusionPlugin.LANGUAGE_KEY))) {

‎src/main/resources/com/stepstone/sonar/plugin/coldfusion/rules.xml

+44-45
Original file line numberDiff line numberDiff line change
@@ -13,60 +13,60 @@
1313
<name>Variable declared in both var and argument scopes.</name>
1414
<severity>MAJOR</severity>
1515
<cardinality>SINGLE</cardinality>
16-
<description><![CDATA[ <p></p> ]]></description>
16+
<description><![CDATA[ <p>Variable should not be declared in both local and argument scopes.</p> ]]></description>
1717
<tag>bug</tag>
1818
</rule>
1919
<rule>
2020
<key>ARG_VAR_MIXED</key>
2121
<name>Variable referenced in local and argument scopes.</name>
2222
<severity>MAJOR</severity>
2323
<cardinality>SINGLE</cardinality>
24-
<description><![CDATA[ <p></p> ]]></description>
24+
<description><![CDATA[ <p>Variable should not be referenced in local and argument scope.</p> ]]></description>
2525
<tag>bug</tag>
2626
</rule>
2727
<rule>
2828
<key>NO_DEFAULT_INSIDE_SWITCH</key>
2929
<name>Missing default switch statement.</name>
3030
<severity>MAJOR</severity>
3131
<cardinality>SINGLE</cardinality>
32-
<description><![CDATA[ <p></p> ]]></description>
32+
<description><![CDATA[ <p>Not having a Default statement defined for a switch could pose potential issues.</p> ]]></description>
3333
</rule>
3434
<rule>
3535
<key>GLOBAL_VAR</key>
3636
<name>Global variable exists.</name>
3737
<severity>CRITICAL</severity>
3838
<cardinality>SINGLE</cardinality>
39-
<description><![CDATA[ <p></p> ]]></description>
39+
<description><![CDATA[ <p>Identifier is global. Referencing in a CFC or function should be avoided.</p> ]]></description>
4040
<tag>bug</tag>
4141
</rule>
4242
<rule>
4343
<key>NESTED_CFOUTPUT</key>
4444
<name>Nested cfoutput with cfquery tag.</name>
4545
<severity>MINOR</severity>
4646
<cardinality>SINGLE</cardinality>
47-
<description><![CDATA[ <p></p> ]]></description>
47+
<description><![CDATA[ <p>Nested CFOutput, outer CFOutput has <code>@query</code>.</p> ]]></description>
4848
</rule>
4949
<rule>
5050
<key>OUTPUT_ATTR</key>
5151
<name>Tag should have output='false'.</name>
5252
<severity>MAJOR</severity>
5353
<cardinality>SINGLE</cardinality>
54-
<description><![CDATA[ <p></p> ]]></description>
54+
<description><![CDATA[ <p><code><tag name="variable"></code> should have @output='false'</p> ]]></description>
5555
</rule>
5656
<rule>
5757
<key>QUERYPARAM_REQ</key>
5858
<name>SetSql() statement should use .addParam().</name>
5959
<severity>BLOCKER</severity>
6060
<cardinality>SINGLE</cardinality>
61-
<description><![CDATA[ <p></p> ]]></description>
61+
<description><![CDATA[ <p>setSql() statement should use .addParam() instead of #'s name="variable"</p> ]]></description>
6262
<tag>security</tag>
6363
</rule>
6464
<rule>
6565
<key>CFQUERYPARAM_REQ</key>
66-
<name>cfquery should use</name>
66+
<name>cfquery should use cfqueryparam</name>
6767
<severity>BLOCKER</severity>
6868
<cardinality>SINGLE</cardinality>
69-
<description><![CDATA[ <p></p> ]]></description>
69+
<description><![CDATA[ <p><code><tag></code> should use <code><cfqueryparam/></code> for variable 'variable'.</p> ]]></description>
7070
<tag>security</tag>
7171
</rule>
7272
<rule>
@@ -82,23 +82,23 @@
8282
<name>Variable is not declared with a var statement.</name>
8383
<severity>CRITICAL</severity>
8484
<cardinality>SINGLE</cardinality>
85-
<description><![CDATA[ <p></p> ]]></description>
85+
<description><![CDATA[ <p>Variable is not declared with a var statement.</p> ]]></description>
8686
<tag>bug</tag>
8787
</rule>
8888
<rule>
8989
<key>AVOID_USING_CFDUMP_TAG</key>
9090
<name>Avoid use of cfdump tags.</name>
9191
<severity>MAJOR</severity>
9292
<cardinality>SINGLE</cardinality>
93-
<description><![CDATA[ <p></p> ]]></description>
93+
<description><![CDATA[ <p>Avoid leaving <code><cfdump></code> tags in committed code. Debug information should be omitted from release code</p> ]]></description>
9494
<tag>security</tag>
9595
</rule>
9696
<rule>
9797
<key>AVOID_USING_CFEXECUTE_TAG</key>
9898
<name>Avoid use of cfexecute tags.</name>
9999
<severity>CRITICAL</severity>
100100
<cardinality>SINGLE</cardinality>
101-
<description><![CDATA[ <p></p> ]]></description>
101+
<description><![CDATA[ <p>Avoid leaving <code><cfexecute></code> tags in committed code. CFexecute can be used as an attack vector and is slow.</p> ]]></description>
102102
<tag>security</tag>
103103
</rule>
104104
<rule>
@@ -107,30 +107,30 @@
107107
<severity>MAJOR</severity>
108108
<cardinality>SINGLE</cardinality>
109109
<description><![CDATA[ <p>Avoid using the <code>isDate()</code> built-in function. It is too permissive. Use <code>isValid()</code> instead.</p> ]]></description>
110-
<tag>security</tag>
110+
<tag>bug</tag>
111111
</rule>
112112
<rule>
113113
<key>AVOID_USING_CFABORT_TAG</key>
114114
<name>Avoid use of cfabort tags.</name>
115115
<severity>CRITICAL</severity>
116116
<cardinality>SINGLE</cardinality>
117-
<description><![CDATA[ <p></p> ]]></description>
117+
<description><![CDATA[ <p>Avoid leaving <code><cfabort></code> tags in committed code.</p> ]]></description>
118118
<tag>bug</tag>
119119
</rule>
120120
<rule>
121121
<key>AVOID_USING_ABORT</key>
122122
<name>Avoid use of abort statements.</name>
123123
<severity>CRITICAL</severity>
124124
<cardinality>SINGLE</cardinality>
125-
<description><![CDATA[ <p></p> ]]></description>
125+
<description><![CDATA[ <p>Avoid using abort in production code.</p> ]]></description>
126126
<tag>bug</tag>
127127
</rule>
128128
<rule>
129129
<key>AVOID_USING_CFINSERT_TAG</key>
130130
<name>Avoid use of cfinsert tags.</name>
131131
<severity>CRITICAL</severity>
132132
<cardinality>SINGLE</cardinality>
133-
<description><![CDATA[ <p></p> ]]></description>
133+
<description><![CDATA[ <p>Avoid using <code><cfinsert></code> tags. Use cfquery and cfstoredproc instead.</p> ]]></description>
134134
<tag>bug</tag>
135135
</rule>
136136
<rule>
@@ -146,15 +146,15 @@
146146
<name>Avoid use of cfupdate tags.</name>
147147
<severity>MAJOR</severity>
148148
<cardinality>SINGLE</cardinality>
149-
<description><![CDATA[ <p></p> ]]></description>
149+
<description><![CDATA[ <p>Avoid using <code><cfupdate></code> tags. Use cfquery and cfstoredproc instead.</p> ]]></description>
150150
<tag>bug</tag>
151151
</rule>
152152
<rule>
153153
<key>AVOID_USING_CFINCLUDE_TAG</key>
154154
<name>Avoid use of cfinclude tags.</name>
155155
<severity>CRITICAL</severity>
156156
<cardinality>SINGLE</cardinality>
157-
<description><![CDATA[ <p></p> ]]></description>
157+
<description><![CDATA[ <p>Avoid using <code><cfinclude></code> tags. Use components instead.</p> ]]></description>
158158

159159
</rule>
160160
<rule>
@@ -183,14 +183,14 @@
183183
<name>Argument is missing a hint.</name>
184184
<severity>MINOR</severity>
185185
<cardinality>SINGLE</cardinality>
186-
<description><![CDATA[ <p>Use JavaDoc style annotations on cfscript functions.</p> ]]></description>
186+
<description><![CDATA[ <p>Argument is missing a hint. Use javadoc style annotations on cfscript functions.</p> ]]></description>
187187
</rule>
188188
<rule>
189189
<key>ARG_TYPE_MISSING</key>
190190
<name>Component is missing a type.</name>
191191
<severity>BLOCKER</severity>
192192
<cardinality>SINGLE</cardinality>
193-
<description><![CDATA[ <p></p> ]]></description>
193+
<description><![CDATA[ <p>Argument variable is missing a type.</p> ]]></description>
194194
<tag>bug</tag>
195195
</rule>
196196
<rule>
@@ -206,14 +206,14 @@
206206
<name>Method is too long.</name>
207207
<severity>MAJOR</severity>
208208
<cardinality>SINGLE</cardinality>
209-
<description><![CDATA[ <p></p> ]]></description>
209+
<description><![CDATA[ <p>Function should be fewer than 100 lines.</p> ]]></description>
210210
</rule>
211211
<rule>
212212
<key>EXCESSIVE_COMPONENT_LENGTH</key>
213213
<name>Component is too long.</name>
214214
<severity>MAJOR</severity>
215215
<cardinality>SINGLE</cardinality>
216-
<description><![CDATA[ <p></p> ]]></description>
216+
<description><![CDATA[ <p>Component should be fewer than 500 lines.</p> ]]></description>
217217
</rule>
218218
<rule>
219219
<key>FUNCTION_TYPE_MISSING</key>
@@ -236,21 +236,21 @@
236236
<name>Function has too many arguments.</name>
237237
<severity>MAJOR</severity>
238238
<cardinality>SINGLE</cardinality>
239-
<description><![CDATA[ <p></p> ]]></description>
239+
<description><![CDATA[ <p>Function has too many arguments. Should be fewer than 10.</p> ]]></description>
240240
</rule>
241241
<rule>
242242
<key>EXCESSIVE_FUNCTIONS</key>
243243
<name>Too many functions.</name>
244-
<severity>MAJOR</severity>
244+
<severity>MINOR</severity>
245245
<cardinality>SINGLE</cardinality>
246-
<description><![CDATA[ <p></p> ]]></description>
246+
<description><![CDATA[ <p>Component has too many functions. Should be fewer than 10.</p> ]]></description>
247247
</rule>
248248
<rule>
249249
<key>FUNCTION_TOO_COMPLEX</key>
250250
<name>Function is too complex.</name>
251251
<severity>CRITICAL</severity>
252252
<cardinality>SINGLE</cardinality>
253-
<description><![CDATA[ <p></p> ]]></description>
253+
<description><![CDATA[ <p>Function is too complex. Consider breaking the function into smaller functions.</p> ]]></description>
254254
</rule>
255255
<rule>
256256
<key>AVOID_USING_WRITEDUMP</key>
@@ -272,7 +272,7 @@
272272
<name>Avoid use of isdebugmode statements.</name>
273273
<severity>MINOR</severity>
274274
<cardinality>SINGLE</cardinality>
275-
<description><![CDATA[ <p></p> ]]></description>
275+
<description><![CDATA[ <p>Avoid using the IsDebugMode function in production code.</p> ]]></description>
276276
</rule>
277277
<rule>
278278
<key>AVOID_USING_ARRAYNEW</key>
@@ -293,22 +293,22 @@
293293
<name>Checking boolean expression explicitly.</name>
294294
<severity>MAJOR</severity>
295295
<cardinality>SINGLE</cardinality>
296-
<description><![CDATA[ <p></p> ]]></description>
296+
<description><![CDATA[ <p>Explicit check of boolean expression is not needed.</p> ]]></description>
297297
</rule>
298298
<rule>
299299
<key>VAR_INVALID_NAME</key>
300300
<name>Variable has invalid name.</name>
301301
<severity>CRITICAL</severity>
302302
<cardinality>SINGLE</cardinality>
303-
<description><![CDATA[ <p></p> ]]></description>
303+
<description><![CDATA[ <p>Variable is not a valid name. Please use camelCase or underscores.</p> ]]></description>
304304
<tag>bug</tag>
305305
</rule>
306306
<rule>
307307
<key>VAR_ALLCAPS_NAME</key>
308308
<name>Variable name is allcaps.</name>
309309
<severity>MINOR</severity>
310310
<cardinality>SINGLE</cardinality>
311-
<description><![CDATA[ <p></p> ]]></description>
311+
<description><![CDATA[ <p>Variable should not be upper case.</p> ]]></description>
312312
</rule>
313313
<rule>
314314
<key>VAR_TOO_SHORT</key>
@@ -343,7 +343,7 @@
343343
<name>Variable name has prefix or postfix.</name>
344344
<severity>MINOR</severity>
345345
<cardinality>SINGLE</cardinality>
346-
<description><![CDATA[ <p></p> ]]></description>
346+
<description><![CDATA[ <p>Variable has prefix or postfix variable and could be named better.</p> ]]></description>
347347
</rule>
348348
<rule>
349349
<key>ARGUMENT_MISSING_NAME</key>
@@ -357,7 +357,7 @@
357357
<name>Argument has invalid name.</name>
358358
<severity>CRITICAL</severity>
359359
<cardinality>SINGLE</cardinality>
360-
<description><![CDATA[ <p></p> ]]></description>
360+
<description><![CDATA[ <p>Please use camelCase or underscores.</p> ]]></description>
361361
<tag>bug</tag>
362362
</rule>
363363
<rule>
@@ -493,21 +493,21 @@
493493
<name>Component name looks temporary.</name>
494494
<severity>MAJOR</severity>
495495
<cardinality>SINGLE</cardinality>
496-
<description><![CDATA[ <p></p> ]]></description>
496+
<description><![CDATA[ <p>Component name component could be named better.</p> ]]></description>
497497
</rule>
498498
<rule>
499499
<key>COMPONENT_HAS_PREFIX_OR_POSTFIX</key>
500500
<name>Component name has prefix or postfix.</name>
501501
<severity>MINOR</severity>
502502
<cardinality>SINGLE</cardinality>
503-
<description><![CDATA[ <p></p> ]]></description>
503+
<description><![CDATA[ <p>Component name has prefix or postfix and could be named better.</p> ]]></description>
504504
</rule>
505505
<rule>
506506
<key>FILE_SHOULD_START_WITH_LOWERCASE</key>
507507
<name>CFM File starts with upper case.</name>
508508
<severity>MINOR</severity>
509509
<cardinality>SINGLE</cardinality>
510-
<description><![CDATA[ <p></p> ]]></description>
510+
<description><![CDATA[ <p>Filename starts with an upper case letter. Only components (.cfc files) should start with an upper case letter.</p> ]]></description>
511511
</rule>
512512
<rule>
513513
<key>AVOID_USING_CREATEOBJECT</key>
@@ -543,7 +543,7 @@
543543
<name>Using comparison where assignment was probably meant.</name>
544544
<severity>CRITICAL</severity>
545545
<cardinality>SINGLE</cardinality>
546-
<description><![CDATA[ <p></p> ]]></description>
546+
<description><![CDATA[ <p>Comparing instead of Assigning</p> ]]></description>
547547
<tag>bug</tag>
548548
</rule>
549549
<rule>
@@ -559,7 +559,7 @@
559559
<name>Variable scope name is allcaps.</name>
560560
<severity>MINOR</severity>
561561
<cardinality>SINGLE</cardinality>
562-
<description><![CDATA[ <p></p> ]]></description>
562+
<description><![CDATA[ <p>Scope variable should not be upper case.</p> ]]></description>
563563
</rule>
564564
<rule>
565565
<key>AVOID_USING_CFSETTING_DEBUG</key>
@@ -569,14 +569,6 @@
569569
<description><![CDATA[ <p></p> ]]></description>
570570
<tag>security</tag>
571571
</rule>
572-
<rule>
573-
<key>MISSING_SEMI</key>
574-
<name>No semicolon!</name>
575-
<severity>CRITICAL</severity>
576-
<cardinality>SINGLE</cardinality>
577-
<description><![CDATA[ <p></p> ]]></description>
578-
<tag>bug</tag>
579-
</rule>
580572
<rule>
581573
<key>UNQUOTED_STRUCT_KEY</key>
582574
<name>Unquoted struct key</name>
@@ -650,4 +642,11 @@
650642
<description><![CDATA[ <p></p> ]]></description>
651643
<tag>bug</tag>
652644
</rule>
645+
<rule>
646+
<key>STRUCT_ARRAY_NOTATION</key>
647+
<name>Use array notation</name>
648+
<severity>MAJOR</severity>
649+
<cardinality>SINGLE</cardinality>
650+
<description><![CDATA[ <p>Unquoted struct key variable is not case-sensitive. Using array notation is recommended.</p> ]]></description>
651+
</rule>
653652
</rules>

0 commit comments

Comments
 (0)