Package edu.umd.cs.findbugs.detect
Class ConstructorThrow
- All Implemented Interfaces:
Detector
,Priorities
,org.apache.bcel.classfile.Visitor
This detector can find constructors that throw exception.
-
Nested Class Summary
Nested classes/interfaces inherited from class edu.umd.cs.findbugs.bcel.OpcodeStackDetector
OpcodeStackDetector.WithCustomJumpInfo
-
Field Summary
FieldsModifier and TypeFieldDescriptionprivate final BugAccumulator
The containing methods (DottedClassName complete with signature) to the methods called directly from the containing one to the caught Exceptions by the surrounding try-catches of the call sites.private boolean
private boolean
private boolean
private boolean
The DottedClassName complete with signature of the method to the set of the Exceptions thrown directly from the method.Fields inherited from class edu.umd.cs.findbugs.bcel.OpcodeStackDetector
stack
Fields inherited from class edu.umd.cs.findbugs.visitclass.DismantleBytecode
codeBytes, lineNumberTable, M_BR, M_CP, M_INT, M_PAD, M_R, M_UINT
Fields inherited from interface edu.umd.cs.findbugs.Priorities
EXP_PRIORITY, HIGH_PRIORITY, IGNORE_PRIORITY, LOW_PRIORITY, NORMAL_PRIORITY
-
Constructor Summary
Constructors -
Method Summary
Modifier and TypeMethodDescriptionprivate void
private void
addToExHandlesToMethodCallsByMethodsMap
(String containerMethod, String calledMethod, Collection<String> caughtExes) private void
addToThrownExsByMethodMap
(String containingMethod, org.apache.bcel.classfile.JavaClass thrownExClass) private void
collectExceptionsByMethods
(int seen) Fills the inner collections while visiting the method.private String
Gives back the fully qualified name (DottedClassName) of the called method complete with the signature.getSurroundingCaughtExes
(org.apache.bcel.classfile.ConstantPool cp) Gets the DottedClassNames of the Exceptions which are caught by a try-catch block at the current PC.private Set
<org.apache.bcel.classfile.JavaClass> getUnhandledExThrowsInMethod
(String method, Set<String> visitedMethods) Get the Exceptions thrown from the inside of the method, either directly or indirectly from called methods.private static boolean
hasFinalFinalizer
(org.apache.bcel.classfile.JavaClass jc) private boolean
private static boolean
Checks if the thrown Exception is handled by the caught Exception.private boolean
Checks whether the Exception is handled in all call sites.private boolean
isMethodCall
(int seen) private static boolean
isThrownExNotCaught
(org.apache.bcel.classfile.JavaClass thrownEx, Set<String> caughtExes) Checks if the thrown exception is not caught.private void
reportConstructorThrow
(int seen) Reports ConstructorThrow bug if there is an unhandled unchecked exception thrown directly or indirectly from the currently visited method.private void
void
sawOpcode
(int seen) 1.private static String
void
visit
(org.apache.bcel.classfile.JavaClass obj) Visit a class to find the constructor, then collect all the methods that gets called in it.void
visitAfter
(org.apache.bcel.classfile.JavaClass obj) Methods inherited from class edu.umd.cs.findbugs.bcel.OpcodeStackDetector
afterOpcode, beforeOpcode, getStack, isUsingCustomUserValue, visitCode
Methods inherited from class edu.umd.cs.findbugs.BytecodeScanningDetector
getClassContext, report, shouldVisitCode, visitClassContext
Methods inherited from class edu.umd.cs.findbugs.visitclass.DismantleBytecode
areOppositeBranches, atCatchBlock, getBranchFallThrough, getBranchOffset, getBranchTarget, getClassConstantOperand, getClassDescriptorOperand, getCodeByte, getConstantRefOperand, getDefaultSwitchOffset, getDottedClassConstantOperand, getFieldDescriptorOperand, getIntConstant, getLongConstant, getMaxPC, getMethodDescriptorOperand, getNameConstantOperand, getNextCodeByte, getNextOpcode, getNextPC, getOpcode, getPC, getPrevOpcode, getRefConstantOperand, getRefFieldIsStatic, getRegisterOperand, getSigConstantOperand, getStringConstantOperand, getSwitchLabels, getSwitchOffsets, getXClassOperand, getXFieldOperand, getXMethodOperand, isBranch, isMethodCall, isRegisterLoad, isRegisterStore, isRegisterStore, isReturn, isShift, isSwitch, isWideOpcode, printOpCode, sawBranchTo, sawClass, sawDouble, sawField, sawFloat, sawIMethod, sawInt, sawLong, sawMethod, sawRegister, sawString, visit
Methods inherited from class edu.umd.cs.findbugs.visitclass.AnnotationVisitor
getAnnotationParameterAsString, getAnnotationParameterAsStringArray, visitAnnotation, visitAnnotation, visitParameterAnnotation, visitParameterAnnotation, visitSyntheticParameterAnnotation
Methods inherited from class edu.umd.cs.findbugs.visitclass.PreorderVisitor
amVisitingMainMethod, asUnsignedByte, doVisitMethod, getClassDescriptor, getClassName, getCode, getConstantPool, getDottedClassName, getDottedFieldSig, getDottedMethodSig, getDottedSuperclassName, getField, getFieldDescriptor, getFieldIsStatic, getFieldName, getFieldSig, getFullyQualifiedFieldName, getFullyQualifiedMethodName, getMethod, getMethodDescriptor, getMethodName, getMethodSig, getMethodVisitOrder, getNumberArguments, getNumberMethodArguments, getPackageName, getSizeOfSurroundingTryBlock, getSizeOfSurroundingTryBlock, getSourceFile, getStringFromIndex, getSuperclassName, getSurroundingCaughtExceptions, getSurroundingCaughtExceptions, getSurroundingCaughtExceptionTypes, getSurroundingTryBlock, getSurroundingTryBlock, getThisClass, getXClass, getXField, getXMethod, hasInterestingClass, hasInterestingMethod, isVisitMethodsInCallOrder, setupVisitorForClass, setVisitMethodsInCallOrder, shouldVisit, toString, visitAfter, visitAnnotationDefault, visitAnnotationEntry, visitBootstrapMethods, visitConstantInvokeDynamic, visitConstantMethodHandle, visitConstantMethodType, visitConstantModule, visitConstantPackage, visitConstantPool, visitEnclosingMethod, visitingField, visitingMethod, visitInnerClasses, visitJavaClass, visitLineNumberTable, visitLocalVariableTable, visitMethodParameters, visitParameterAnnotationEntry, visitStackMap, visitStackMapEntry
Methods inherited from class edu.umd.cs.findbugs.visitclass.BetterVisitor
clone, report, visit, visit, visit, visit, visit, visit, visit, visit, visit, visit, visit, visit, visit, visit, visit, visit, visit, visit, visit, visit, visit, visit, visit, visit, visit, visit, visit, visit, visit, visit, visit, visit, visit, visitCodeException, visitConstantClass, visitConstantDouble, visitConstantFieldref, visitConstantFloat, visitConstantInteger, visitConstantInterfaceMethodref, visitConstantLong, visitConstantMethodref, visitConstantNameAndType, visitConstantString, visitConstantUtf8, visitConstantValue, visitDeprecated, visitExceptionTable, visitField, visitInnerClass, visitLineNumber, visitLocalVariable, visitLocalVariableTypeTable, visitMethod, visitSignature, visitSourceFile, visitSynthetic, visitUnknown
Methods inherited from class java.lang.Object
equals, finalize, getClass, hashCode, notify, notifyAll, wait, wait, wait
Methods inherited from interface org.apache.bcel.classfile.Visitor
visitConstantDynamic, visitMethodParameter, visitModule, visitModuleExports, visitModuleMainClass, visitModuleOpens, visitModulePackages, visitModuleProvides, visitModuleRequires, visitNestHost, visitNestMembers, visitStackMapType
-
Field Details
-
bugAccumulator
-
exHandlesToMethodCallsByMethodsMap
The containing methods (DottedClassName complete with signature) to the methods called directly from the containing one to the caught Exceptions by the surrounding try-catches of the call sites. If the call site is not inside a try-catch then an empty string. -
thrownExsByMethodMap
The DottedClassName complete with signature of the method to the set of the Exceptions thrown directly from the method. -
isFinalClass
private boolean isFinalClass -
isFinalFinalizer
private boolean isFinalFinalizer -
isFirstPass
private boolean isFirstPass -
hadObjectConstructor
private boolean hadObjectConstructor
-
-
Constructor Details
-
ConstructorThrow
-
-
Method Details
-
visit
public void visit(org.apache.bcel.classfile.JavaClass obj) Visit a class to find the constructor, then collect all the methods that gets called in it. Also, we are checking for final declaration on the class, or a final finalizer, as if present no finalizer attack can happen.- Overrides:
visit
in classBetterVisitor
-
hasFinalFinalizer
private static boolean hasFinalFinalizer(org.apache.bcel.classfile.JavaClass jc) -
visitAfter
public void visitAfter(org.apache.bcel.classfile.JavaClass obj) - Overrides:
visitAfter
in classPreorderVisitor
-
sawOpcode
public void sawOpcode(int seen) 1. Check for any throw expression in the constructor. 2. Check for any exception throw inside constructor, or any of the called methods. If the class is final, we are fine, no finalizer attack can happen. In the first pass the detector shouldn't report, because there could be a final finalizer and a throwing constructor. Reporting in this case would be a false positive as classes with a final finalizer are not vulnerable to the finalizer attack.- Specified by:
sawOpcode
in classOpcodeStackDetector
- See Also:
-
reportConstructorThrow
private void reportConstructorThrow(int seen) Reports ConstructorThrow bug if there is an unhandled unchecked exception thrown directly or indirectly from the currently visited method. If the exception is thrown directly, the bug is reported at the throw. If the exception is thrown indirectly (through a method call), the bug is reported at the call of the method which throws the exception. -
getUnhandledExThrowsInMethod
private Set<org.apache.bcel.classfile.JavaClass> getUnhandledExThrowsInMethod(String method, Set<String> visitedMethods) Get the Exceptions thrown from the inside of the method, either directly or indirectly from called methods. Uses inner collections which are needed to filled correctly.- Parameters:
method
- the method to visit and get the exceptions thrown out of itvisitedMethods
- the names of the already visited methods, needed to prevent stackoverflow by recursively checking method call cycles- Returns:
- the JavaClasses of the Exceptions thrown from the method
-
isHandled
Checks whether the Exception is handled in all call sites.- Parameters:
thrownEx
- the thrown Exception which needs to be handledexHandles
- the set of the dotted class names of the caught Exceptions in the call sites.- Returns:
- true if the Exception handled in all call sites.
-
isHandled
private static boolean isHandled(org.apache.bcel.classfile.JavaClass thrownEx, @NonNull @DottedClassName String caughtEx) Checks if the thrown Exception is handled by the caught Exception.- Parameters:
thrownEx
- the thrown Exception which needs to be handledcaughtEx
- the name of the caught Exception at the call site. If no Exception is caught, then it's an empty string or other nonnull string which is not a name of any Exception.- Returns:
- true if the Exception is handled.
-
getSurroundingCaughtExes
Gets the DottedClassNames of the Exceptions which are caught by a try-catch block at the current PC.- Parameters:
cp
- ConstantPool- Returns:
- Set of the DottedClassNames of the caught Exceptions.
-
isThrownExNotCaught
private static boolean isThrownExNotCaught(org.apache.bcel.classfile.JavaClass thrownEx, Set<String> caughtExes) Checks if the thrown exception is not caught.- Parameters:
thrownEx
- the Exception to catch.caughtExes
- the set of the DottedClassNames of the caught Exceptions at call site.- Returns:
- true if the exception is not caught.
-
toDotted
-
collectExceptionsByMethods
private void collectExceptionsByMethods(int seen) Fills the inner collections while visiting the method.- Parameters:
seen
- the opcode @see #sawOpcode(int)
-
addToExHandlesToMethodCallsByMethodsMap
private void addToExHandlesToMethodCallsByMethodsMap(String containerMethod, String calledMethod, Collection<String> caughtExes) -
addToThrownExsByMethodMap
private void addToThrownExsByMethodMap(String containingMethod, org.apache.bcel.classfile.JavaClass thrownExClass) -
getCalledMethodFQN
Gives back the fully qualified name (DottedClassName) of the called method complete with the signature. Needs to be called from method call opcode.- Returns:
- the fully qualified name of the method (dotted) with the signature.
-
resetState
private void resetState() -
accumulateBug
private void accumulateBug() -
isMethodCall
private boolean isMethodCall(int seen) -
isConstructor
private boolean isConstructor()
-