-
Notifications
You must be signed in to change notification settings - Fork 1
Commit
Because Jargo is not maintained and cannot be used with Graalvm to build native executable. BREAKING CHANGE: Hopefully there are no breaking changes but I probably introduced some bugs when replacing Jargo with Picocli.
- Loading branch information
There are no files selected for viewing
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -1,8 +1,23 @@ | ||
| package se.bjurr.violations.main; | ||
|
|
||
| import java.util.Arrays; | ||
| import java.util.stream.Collectors; | ||
| import picocli.CommandLine; | ||
| import se.bjurr.violations.lib.reports.Parser; | ||
|
|
||
| public class Main { | ||
|
|
||
| public static void main(final String[] args) throws Exception { | ||
| new Runner().main(args); | ||
| final CommandLine commandLine = new CommandLine(new Runner()); | ||
| commandLine.setExecutionExceptionHandler(new PrintExceptionMessageHandler()); | ||
| commandLine.parseArgs(args); | ||
| if (commandLine.isUsageHelpRequested()) { | ||
| final String parsers = | ||
| Arrays.asList(Parser.values()).stream() | ||
| .map((it) -> it.name()) | ||
| .collect(Collectors.joining(", ")); | ||
| System.out.println("Available parsers are:\n" + parsers + "\n"); | ||
|
Check failure Code scanning / Violations Lib System.out.println is used Best Practices https://pmd.github.io/pmd-6.55.0/pmd_rules_java_bestpractices.html#systemprintln Error
System.out.println is used
Best Practices https://pmd.github.io/pmd-6.55.0/pmd\_rules\_java\_bestpractices.html#systemprintln
|
||
| } | ||
| System.exit(commandLine.execute(args)); | ||
| } | ||
| } | ||
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,20 @@ | ||
| package se.bjurr.violations.main; | ||
|
|
||
| import picocli.CommandLine; | ||
| import picocli.CommandLine.IExecutionExceptionHandler; | ||
| import picocli.CommandLine.ParseResult; | ||
|
|
||
| public class PrintExceptionMessageHandler implements IExecutionExceptionHandler { | ||
|
|
||
| @Override | ||
| public int handleExecutionException( | ||
| final Exception ex, final CommandLine commandLine, final ParseResult parseResult) | ||
| throws Exception { | ||
| if (ex instanceof TooManyViolationsException) { | ||
| System.err.println(ex.getMessage()); | ||
|
Check failure Code scanning / Violations Lib System.err.println is used Best Practices https://pmd.github.io/pmd-6.55.0/pmd_rules_java_bestpractices.html#systemprintln Error
System.err.println is used
Best Practices https://pmd.github.io/pmd-6.55.0/pmd\_rules\_java\_bestpractices.html#systemprintln
|
||
| } else { | ||
| ex.printStackTrace(System.err); | ||
|
Check warning Code scanning / Violations Lib Information Exposure Through An Error Message The sensitive information may be valuable information on its own (such as a password), or it may be useful for launching other, more deadly attacks. If an attack fails, an attacker may use error information provided by the server to launch another more focused attack. For example, an attempt to exploit a path traversal weakness (CWE-22) might yield the full pathname of the installed application. In turn, this could be used to select the proper number of ".." sequences to navigate to the targeted file. An attack using SQL injection (CWE-89) might not initially succeed, but an error message could reveal the malformed query, which would expose query logic and possibly even passwords or other sensitive information used within the query. Vulnerable Code: try { out = httpResponse.getOutputStream() } catch (Exception e) { e.printStackTrace(out); } References CWE-209: Information Exposure Through an Error Message CWE-211: Information Exposure Through Externally-Generated Error Message Warning
Information Exposure Through An Error Message
The sensitive information may be valuable information on its own (such as a password), or it may be useful for launching other, more deadly attacks. If an attack fails, an attacker may use error information provided by the server to launch another more focused attack. For example, an attempt to exploit a path traversal weakness (CWE-22) might yield the full pathname of the installed application. In turn, this could be used to select the proper number of ".." sequences to navigate to the targeted file. An attack using SQL injection (CWE-89) might not initially succeed, but an error message could reveal the malformed query, which would expose query logic and possibly even passwords or other sensitive information used within the query.
Vulnerable Code:
try { out = httpResponse.getOutputStream() } catch (Exception e) { e.printStackTrace(out); } References CWE-209: Information Exposure Through an Error Message CWE-211: Information Exposure Through Externally-Generated Error Message |
||
| } | ||
| return 1; | ||
| } | ||
| } | ||