dgroup / arch4u-pmd Goto Github PK

The puzzle DEV-70551f03 from #DEV has to be resolved:

The puzzle was created by @dgroup on 22-Jan-22.

role: DEV.

If you have any technical questions, don't ask me, submit new tickets instead. The task will be "done" when the problem is fixed and the text of the puzzle is removed from the source code. Here is more about PDD and about me.

The puzzle DEV-8084d74e from #DEV has to be resolved:

The puzzle was created by @dgroup on 07-Jan-22.

role: DEV.

If you have any technical questions, don't ask me, submit new tickets instead. The task will be "done" when the problem is fixed and the text of the puzzle is removed from the source code. Here is more about PDD and about me.

The puzzle DEV-7a64a11a from #DEV has to be resolved:

https://github.com/dgroup/arch4u-pmd/blob/4414e67203963403fb94eba425750fb52db3e7e7/src/main/resources/io/github/dgroup/arch4u/pmd/arch4u-recommended-third-party-ruleset.xml#L50-L50

The puzzle was created by Yurii Dubinka on 30-Jan-22.

role: DEV.

If you have any technical questions, don't ask me, submit new tickets instead. The task will be "done" when the problem is fixed and the text of the puzzle is removed from the source code. Here is more about PDD and about me.

The project could not be analyzed because of build errors. Please review the error messages here. Another build will be scheduled when a change to a manifest file^* occurs. If the build is successful this issue will be closed, otherwise the error message will be updated.

_{This is an automated GitHub Issue created by Sonatype DepShield. GitHub Apps, including DepShield, can be managed from the Developer settings of the repository administrators.}

_{* Supported manifest files are: pom.xml, package.json, package-lock.json, npm-shrinkwrap.json, Cargo.lock, Cargo.toml, main.rs, lib.rs, build.gradle, build.gradle.kts, settings.gradle, settings.gradle.kts, gradle.properties, gradle-wrapper.properties, go.mod, go.sum}

The puzzle DEV-b715b35a from #DEV has to be resolved:

https://github.com/dgroup/arch4u-pmd/blob/0d0f3378aa683a3d666c779cab97f45cb1024688/src/main/resources/io/github/dgroup/arch4u/pmd/arch4u-recommended-third-party-ruleset.xml#L92-L92

The puzzle was created by Yurii Dubinka on 30-Jan-22.

role: DEV.

If you have any technical questions, don't ask me, submit new tickets instead. The task will be "done" when the problem is fixed and the text of the puzzle is removed from the source code. Here is more about PDD and about me.

Overview

Each application should provide metrics for future application monitoring, especially if its expose API endpoints.

The rule

If we expose a particular REST endpoint, this endpoint should be monitored as well, therefore, each method with @Get, @Post, etc. annotations should have annotation @Timed with metric reference.

@Timed is just an example, in the future we'll configure several REST frameworks with different standards for monitoring (e.g micrometer, etc.).

Ruleset(s)

• arch4u-micrometer-ruleset.xml (with monitoring related test cases e.g. micrometer @Timed annotation)
• arch4u-template-ruleset.xml (with non-monitoring related test cases e.g. any other annotation like @Override)

Test case 1 [positive/right]: Expected annotation is present on the method that has another annotation

@RestController
public class MyTypicalRestController {
   
   @Timed                                          
   @GetMapping("/get")                 // ok, @Timed is present for all methods with annotation @GET
   public .. get(BigInteger id) {
      ..
   }

   @GetMapping("/getXXX")              // violation, no annotation @Timed found
   public .. getXXX(BigInteger id) {
      ..
   }
}

Test case 2 [positive/right]: Expected annotation is present on the method that has some signature like public Order getXXXX

@RestController
public class MyTypicalRestController {
   
   @Timed                                          
   @GetMapping("/get")                 // ok, @Timed is present for all methods with annotation @GET
   public .. get(BigInteger id) {
      ..
   }

   @GetMapping("/getXXX")              // violation, no annotation @Timed found for method `public Order getXXXX`
   public .. getXXX(BigInteger id) {
      ..
   }
}

The puzzle DEV-138e429d from #DEV has to be resolved:

The puzzle was created by @dgroup on 07-Jan-22.

role: DEV.

If you have any technical questions, don't ask me, submit new tickets instead. The task will be "done" when the problem is fixed and the text of the puzzle is removed from the source code. Here is more about PDD and about me.

The puzzle DEV-6c748374 from #DEV has to be resolved:

https://github.com/dgroup/arch4u-pmd/blob/0d0f3378aa683a3d666c779cab97f45cb1024688/src/main/resources/io/github/dgroup/arch4u/pmd/arch4u-recommended-third-party-ruleset.xml#L52-L52

The puzzle was created by Yurii Dubinka on 30-Jan-22.

role: DEV.

If you have any technical questions, don't ask me, submit new tickets instead. The task will be "done" when the problem is fixed and the text of the puzzle is removed from the source code. Here is more about PDD and about me.

The puzzle DEV-98a1620e from #DEV has to be resolved:

The puzzle was created by Yurii Dubinka on 30-Jan-22.

role: DEV.

If you have any technical questions, don't ask me, submit new tickets instead. The task will be "done" when the problem is fixed and the text of the puzzle is removed from the source code. Here is more about PDD and about me.

The puzzle DEV-61e86f59 from #DEV has to be resolved:

The puzzle was created by @dgroup on 07-Jan-22.

role: DEV.

If you have any technical questions, don't ask me, submit new tickets instead. The task will be "done" when the problem is fixed and the text of the puzzle is removed from the source code. Here is more about PDD and about me.

The puzzle DEV-5f4df571 from #DEV has to be resolved:

The puzzle was created by @dgroup on 07-Jan-22.

role: DEV.

If you have any technical questions, don't ask me, submit new tickets instead. The task will be "done" when the problem is fixed and the text of the puzzle is removed from the source code. Here is more about PDD and about me.

[INFO] --- maven-surefire-plugin:3.0.0-M3:test (default-test) @ arch4u-pmd ---
[INFO]
[INFO] -------------------------------------------------------
[INFO]  T E S T S
[INFO] -------------------------------------------------------
[INFO] Running io.github.dgroup.arch4u.pmd.AvoidProhibitedClassesTest
java.lang.instrument.IllegalClassFormatException: Error while instrumenting java/sql/SQLException.
	at org.jacoco.agent.rt.internal_f3994fa.CoverageTransformer.transform(CoverageTransformer.java:94)
	at java.instrument/java.lang.instrument.ClassFileTransformer.transform(ClassFileTransformer.java:244)
	at java.instrument/sun.instrument.TransformerManager.transform(TransformerManager.java:188)
	at java.instrument/sun.instrument.InstrumentationImpl.transform(InstrumentationImpl.java:541)
	at java.base/java.lang.ClassLoader.defineClass2(Native Method)
	at java.base/java.lang.ClassLoader.defineClass(ClassLoader.java:1103)
	at java.base/java.security.SecureClassLoader.defineClass(SecureClassLoader.java:182)
	at java.base/jdk.internal.loader.BuiltinClassLoader.defineClass(BuiltinClassLoader.java:821)
	at java.base/jdk.internal.loader.BuiltinClassLoader.findClassInModuleOrNull(BuiltinClassLoader.java:741)
	at java.base/jdk.internal.loader.BuiltinClassLoader.loadClassOrNull(BuiltinClassLoader.java:665)
	at java.base/jdk.internal.loader.BuiltinClassLoader.loadClassOrNull(BuiltinClassLoader.java:700)
	at java.base/jdk.internal.loader.BuiltinClassLoader.loadClassOrNull(BuiltinClassLoader.java:669)
	at java.base/jdk.internal.loader.BuiltinClassLoader.loadClass(BuiltinClassLoader.java:639)
	at java.base/jdk.internal.loader.ClassLoaders$AppClassLoader.loadClass(ClassLoaders.java:188)
	at java.base/java.lang.ClassLoader.loadClass(ClassLoader.java:520)
	at net.sourceforge.pmd.testframework.RuleTst.runTestFromString(RuleTst.java:271)
	at net.sourceforge.pmd.testframework.RuleTst.runTestFromString(RuleTst.java:305)
	at net.sourceforge.pmd.testframework.RuleTst.processUsingStringReader(RuleTst.java:257)
	at net.sourceforge.pmd.testframework.RuleTst.runTest(RuleTst.java:148)
	at net.sourceforge.pmd.testframework.RuleTestRunner$2.evaluate(RuleTestRunner.java:117)
	at org.junit.runners.ParentRunner.runLeaf(ParentRunner.java:366)
	at net.sourceforge.pmd.testframework.RuleTestRunner.runChild(RuleTestRunner.java:102)
	at net.sourceforge.pmd.testframework.RuleTestRunner.runChild(RuleTestRunner.java:36)
	at org.junit.runners.ParentRunner$4.run(ParentRunner.java:331)
	at org.junit.runners.ParentRunner$1.schedule(ParentRunner.java:79)
	at org.junit.runners.ParentRunner.runChildren(ParentRunner.java:329)
	at org.junit.runners.ParentRunner.access$100(ParentRunner.java:66)
	at org.junit.runners.ParentRunner$2.evaluate(ParentRunner.java:293)
	at org.junit.runners.ParentRunner$3.evaluate(ParentRunner.java:306)
	at org.junit.runners.ParentRunner.run(ParentRunner.java:413)
	at net.sourceforge.pmd.testframework.PMDTestRunner.run(PMDTestRunner.java:97)
	at org.apache.maven.surefire.junit4.JUnit4Provider.execute(JUnit4Provider.java:365)
	at org.apache.maven.surefire.junit4.JUnit4Provider.executeWithRerun(JUnit4Provider.java:273)
	at org.apache.maven.surefire.junit4.JUnit4Provider.executeTestSet(JUnit4Provider.java:238)
	at org.apache.maven.surefire.junit4.JUnit4Provider.invoke(JUnit4Provider.java:159)
	at org.apache.maven.surefire.booter.ForkedBooter.invokeProviderInSameClassLoader(ForkedBooter.java:384)
	at org.apache.maven.surefire.booter.ForkedBooter.runSuitesInProcess(ForkedBooter.java:345)
	at org.apache.maven.surefire.booter.ForkedBooter.execute(ForkedBooter.java:126)
	at org.apache.maven.surefire.booter.ForkedBooter.main(ForkedBooter.java:418)
Caused by: java.io.IOException: Error while instrumenting java/sql/SQLException.
	at org.jacoco.agent.rt.internal_f3994fa.core.instr.Instrumenter.instrumentError(Instrumenter.java:160)
	at org.jacoco.agent.rt.internal_f3994fa.core.instr.Instrumenter.instrument(Instrumenter.java:110)
	at org.jacoco.agent.rt.internal_f3994fa.CoverageTransformer.transform(CoverageTransformer.java:92)
	... 38 more
Caused by: java.lang.IllegalArgumentException: Unsupported class file major version 61
	at org.jacoco.agent.rt.internal_f3994fa.asm.ClassReader.<init>(ClassReader.java:196)
	at org.jacoco.agent.rt.internal_f3994fa.asm.ClassReader.<init>(ClassReader.java:177)
	at org.jacoco.agent.rt.internal_f3994fa.asm.ClassReader.<init>(ClassReader.java:163)
	at org.jacoco.agent.rt.internal_f3994fa.core.internal.instr.InstrSupport.classReaderFor(InstrSupport.java:280)
	at org.jacoco.agent.rt.internal_f3994fa.core.instr.Instrumenter.instrument(Instrumenter.java:76)
	at org.jacoco.agent.rt.internal_f3994fa.core.instr.Instrumenter.instrument(Instrumenter.java:108)
	... 39 more

Environment

 ~/projects/arch4u-pmd > java -version  
java version "1.8.0_181"
Java(TM) SE Runtime Environment (build 1.8.0_181-b13)
Java HotSpot(TM) 64-Bit Server VM (build 25.181-b13, mixed mode)
 ~/projects/arch4u-pmd > uname -a            
Darwin osx 21.2.0 Darwin Kernel Version 21.2.0: Sun Nov 28 20:28:54 PST 2021; root:xnu-8019.61.5~1/RELEASE_X86_64 x86_64

Test case 1 [positive/right]: Regular MDC invocation

private static final Logger LOG = ...
    
    public ... process(Order order) throws ... {
       MDC.put("order", order.getId());
       MDC.put("customer", order.getCustomerId());
       LOG.debug("Order {} initiated for {}", order.geId(), order.getCustomerId());
       
      // .. business logic
       
       MDC.remove("order");
       MDC.remove("customer");

       return ...
  }

Test case 2 [positive/right]: MDC invocation with try-finally

private static final Logger LOG = ...
    
    public ... process(Order order) throws ... {
       try {
             MDC.put("order", order.getId());
             MDC.put("customer", order.getCustomerId());
             LOG.debug("Order {} initiated for {}", order.geId(), order.getCustomerId());
       
             // .. business logic

       } finally {
             MDC.remove("order");
             MDC.remove("customer");
       }      
       return ...
  }

Test case 3 [negative/wrong]: MDC cleaning is absent during regular MDC invocation

private static final Logger LOG = ...
    
    public ... process(Order order) throws ... {
       MDC.put("order", order.getId());
       MDC.put("customer", order.getCustomerId());
       LOG.debug("Order {} initiated for {}", order.geId(), order.getCustomerId());
       
      // .. business logic
       return ...
  }

Clarification: Quite often developers forget to clean the thread-local values which leads to unexpected side effects.

The puzzle DEV-71c809fa from #DEV has to be resolved:

The puzzle was created by Yurii Dubinka on 30-Jan-22.

role: DEV.

If you have any technical questions, don't ask me, submit new tickets instead. The task will be "done" when the problem is fixed and the text of the puzzle is removed from the source code. Here is more about PDD and about me.

The puzzle DEV-cfa0d1a0 from #DEV has to be resolved:

The puzzle was created by Yurii Dubinka on 07-Jan-22.

role: DEV.

If you have any technical questions, don't ask me, submit new tickets instead. The task will be "done" when the problem is fixed and the text of the puzzle is removed from the source code. Here is more about PDD and about me.

Overview

Quite often developers writing the logs using statements like

log.debug("Processing started for customer {}", customer);
// or
log.debug("User {} not authorized for operation {} ", user, operation);

As the result, the toString() method from customer or user may have sensitive data that needs to be obfuscated before exposing it to the logs.

The proper fix should be like

log.debug("User {} not authorized for operation {} ", this.obfuscation.apply(user), operation);

Related discussion: #64.

New rule requirements

1. Rule should have a property where we may specify package or direct class name(s) for objects that should not be passed into log.debug|info|warn|error|fatal methods without obfuscation
2. Rule should have a property obfuscation where we may specify class#method names with expected obfuscation.
3. Rule should throw a violation if the object that has type or package defined in sensitiveClasses passed to logger without applying obfuscation from property obfuscationBy.

<rule name="ObfuscationRequired"
        since="0.1.0"
        language="java"
        message="Obfuscation is missing for sensitive logging arguments: https://github.com/dgroup/arch4u-pmd/discussions/64"
        class="io.github.dgroup.arch4u.pmd.ObfuscationRequired">
    ...
    <properties>
      <property name="sensitiveClasses" description="Package(s) or direct class name(s) for objects that should not be passed into logs without obfuscation" value="tbd"/>
      <property name="obfuscationBy" value="ClassA#methodA|com.company.ClassB#methodB|com.company.ClassC" />
    </properties>
  </rule>

java.lang.Object#toSting|xxxx#methodA

The puzzle DEV-87bdbb0c from #DEV has to be resolved:

https://github.com/dgroup/arch4u-pmd/blob/0d0f3378aa683a3d666c779cab97f45cb1024688/src/main/resources/io/github/dgroup/arch4u/pmd/arch4u-recommended-third-party-ruleset.xml#L90-L90

The puzzle was created by Yurii Dubinka on 30-Jan-22.

role: DEV.

If you have any technical questions, don't ask me, submit new tickets instead. The task will be "done" when the problem is fixed and the text of the puzzle is removed from the source code. Here is more about PDD and about me.

The puzzle DEV-6f85efe2 from #DEV has to be resolved:

The puzzle was created by @dgroup on 07-Jan-22.

role: DEV.

If you have any technical questions, don't ask me, submit new tickets instead. The task will be "done" when the problem is fixed and the text of the puzzle is removed from the source code. Here is more about PDD and about me.

The puzzle DEV-187cd84d from #DEV has to be resolved:

The puzzle was created by @dgroup on 07-Jan-22.

role: DEV.

If you have any technical questions, don't ask me, submit new tickets instead. The task will be "done" when the problem is fixed and the text of the puzzle is removed from the source code. Here is more about PDD and about me.

The puzzle DEV-15c4aeea from #DEV has to be resolved:

https://github.com/dgroup/arch4u-pmd/blob/0d0f3378aa683a3d666c779cab97f45cb1024688/src/main/resources/io/github/dgroup/arch4u/pmd/arch4u-recommended-third-party-ruleset.xml#L51-L51

The puzzle was created by Yurii Dubinka on 30-Jan-22.

role: DEV.

If you have any technical questions, don't ask me, submit new tickets instead. The task will be "done" when the problem is fixed and the text of the puzzle is removed from the source code. Here is more about PDD and about me.

The puzzle DEV-508fa6be from #DEV has to be resolved:

The puzzle was created by @dgroup on 07-Jan-22.

role: DEV.

If you have any technical questions, don't ask me, submit new tickets instead. The task will be "done" when the problem is fixed and the text of the puzzle is removed from the source code. Here is more about PDD and about me.

ObjectMapper is better to have as field than a local variable due to performance reasons

The puzzle 28-822008ce from #28 has to be resolved:

The puzzle was created by @dgroup on 30-Jan-22.

role: DEV.

If you have any technical questions, don't ask me, submit new tickets instead. The task will be "done" when the problem is fixed and the text of the puzzle is removed from the source code. Here is more about PDD and about me.

The rule should not give violation when the field was initiated in the method marked by @PostConstruct annotation

public class X {
  private ObjectMapper mapper;

  @PostConstruct
  public void init() {
      mapper = new ObjectMapper();
  }
  ...
}

https://app.snyk.io/org/dgroup/project/c8b51bb3-7683-41c8-9a4e-b32a6f9069b6

The puzzle DEV-48ee7d25 from #DEV has to be resolved:

https://github.com/dgroup/arch4u-pmd/blob/0d0f3378aa683a3d666c779cab97f45cb1024688/src/main/resources/io/github/dgroup/arch4u/pmd/arch4u-recommended-third-party-ruleset.xml#L82-L82

The puzzle was created by Yurii Dubinka on 30-Jan-22.

role: DEV.

If you have any technical questions, don't ask me, submit new tickets instead. The task will be "done" when the problem is fixed and the text of the puzzle is removed from the source code. Here is more about PDD and about me.

The puzzle DEV-b245d2b6 from #DEV has to be resolved:

The puzzle was created by @dgroup on 30-Jan-22.

role: DEV.

If you have any technical questions, don't ask me, submit new tickets instead. The task will be "done" when the problem is fixed and the text of the puzzle is removed from the source code. Here is more about PDD and about me.

• https://docs.micronaut.io/2.1.1/api/io/micronaut/http/MediaType.html
• https://guava.dev/releases/19.0/api/docs/com/google/common/net/MediaType.html
• https://docs.spring.io/spring-framework/docs/current/javadoc-api/org/springframework/http/MediaType.html
• https://docs.oracle.com/javaee/7/api/javax/ws/rs/core/MediaType.html
• javax.ws.rs.core.MediaType#APPLICATION_JSON

The puzzle DEV-0529dd2e from #DEV has to be resolved:

The puzzle was created by @dgroup on 07-Jan-22.

role: DEV.

If you have any technical questions, don't ask me, submit new tickets instead. The task will be "done" when the problem is fixed and the text of the puzzle is removed from the source code. Here is more about PDD and about me.

The puzzle 14-0acc3693 from #14 has to be resolved:

The puzzle was created by @dgroup on 22-Jan-22.

role: DEV.

If you have any technical questions, don't ask me, submit new tickets instead. The task will be "done" when the problem is fixed and the text of the puzzle is removed from the source code. Here is more about PDD and about me.

https://github.com/marketplace/actions/notify-telegram

The puzzle DEV-cbd9294a from #DEV has to be resolved:

The puzzle was created by @dgroup on 30-Jan-22.

role: DEV.

If you have any technical questions, don't ask me, submit new tickets instead. The task will be "done" when the problem is fixed and the text of the puzzle is removed from the source code. Here is more about PDD and about me.

The puzzle DEV-293e89ed from #DEV has to be resolved:

The puzzle was created by @dgroup on 07-Jan-22.

role: DEV.

If you have any technical questions, don't ask me, submit new tickets instead. The task will be "done" when the problem is fixed and the text of the puzzle is removed from the source code. Here is more about PDD and about me.

The puzzle DEV-f166bfda from #DEV has to be resolved:

The puzzle was created by @dgroup on 30-Jan-22.

role: DEV.

If you have any technical questions, don't ask me, submit new tickets instead. The task will be "done" when the problem is fixed and the text of the puzzle is removed from the source code. Here is more about PDD and about me.

https://pmd.github.io/latest/pmd_userdocs_suppressing_warnings.html#the-property-violationsuppressregex

The puzzle DEV-287c52fb from #DEV has to be resolved:

The puzzle was created by Yurii Dubinka on 30-Jan-22.

role: DEV.

If you have any technical questions, don't ask me, submit new tickets instead. The task will be "done" when the problem is fixed and the text of the puzzle is removed from the source code. Here is more about PDD and about me.

The puzzle DEV-7da84a11 from #DEV has to be resolved:

The puzzle was created by @dgroup on 08-Feb-22.

role: DEV.

If you have any technical questions, don't ask me, submit new tickets instead. The task will be "done" when the problem is fixed and the text of the puzzle is removed from the source code. Here is more about PDD and about me.

The puzzle DEV-27367a79 from #DEV has to be resolved:

https://github.com/dgroup/arch4u-pmd/blob/0d0f3378aa683a3d666c779cab97f45cb1024688/src/main/resources/io/github/dgroup/arch4u/pmd/arch4u-recommended-third-party-ruleset.xml#L91-L91

The puzzle was created by Yurii Dubinka on 30-Jan-22.

role: DEV.

If you have any technical questions, don't ask me, submit new tickets instead. The task will be "done" when the problem is fixed and the text of the puzzle is removed from the source code. Here is more about PDD and about me.

pmd/pmd#693

The puzzle DEV-e6044bbd from #DEV has to be resolved:

The puzzle was created by @dgroup on 22-Jan-22.

role: DEV.

If you have any technical questions, don't ask me, submit new tickets instead. The task will be "done" when the problem is fixed and the text of the puzzle is removed from the source code. Here is more about PDD and about me.

The puzzle DEV-94d5ff38 from #DEV has to be resolved:

The puzzle was created by @dgroup on 03-Feb-22.

role: DEV.

If you have any technical questions, don't ask me, submit new tickets instead. The task will be "done" when the problem is fixed and the text of the puzzle is removed from the source code. Here is more about PDD and about me.

The puzzle DEV-08faa53a from #DEV has to be resolved:

The puzzle was created by @dgroup on 07-Jan-22.

role: DEV.

If you have any technical questions, don't ask me, submit new tickets instead. The task will be "done" when the problem is fixed and the text of the puzzle is removed from the source code. Here is more about PDD and about me.