如何在 Sonarqube 自定义规则上使用 Android 类

Question

我正在尝试为 SonarQube Java 插件开发自定义规则，它将在其中分析 Android 代码。我已经创建了一些规则来识别 Java 的基本功能，如下例所示：

@Override
public void visitNode(Tree tree){
  MethodInvocationTree method = (MethodInvocationTree) tree;
  Symbol symbol = method.symbol();

  if (symbol.name() != null && symbol.name().equalsIgnoreCase("createTempFile")){
      reportIssue(method.firstToken(), "Criação de arquivo temporário identificada. Analisar!");
  }

}

根据另一条规则，我正在尝试获取使用 SharedPreferences 的代码的所有情况，并且我正在使用以下逻辑：

@Override
public List<Kind> nodesToVisit() {
  return ImmutableList.of(Kind.METHOD_INVOCATION);
}

@Override
public void visitNode(Tree tree){
    MethodInvocationTree kindTree = (MethodInvocationTree) tree;
    Symbol symbol = (Symbol) kindTree.symbol();

    TypeSymbol classe = symbol.owner().enclosingClass();

    if (classe != null && classe.equals("SharedPreferences")){
        reportIssue(kindTree.firstToken(), "SharedPreferences sendo utilizado no código. Analisar!!");
    }

}

当我运行在 JUnit 上进行测试时，它不起作用。当找到指定的种类时，我打印了符号的名称（应该是调用的方法的名称）和封闭的 class。结果是：

====================== Kind Finded ======================
Name >>>>>>>>>>>>>null
Class >>>>>>>>>>>>> !unknownSymbol!

这是另一个文件的示例，它可以毫无问题地打印其他 classes 和方法：

====================== Kind Finded ======================
Name >>>>>>>>>>>>>createTempFile
Class >>>>>>>>>>>>> File
====================== Kind Finded ======================
Name >>>>>>>>>>>>>setReadable
Class >>>>>>>>>>>>> File
====================== Kind Finded ======================
Name >>>>>>>>>>>>>setWritable
Class >>>>>>>>>>>>> File
====================== Kind Finded ======================
Name >>>>>>>>>>>>>write
Class >>>>>>>>>>>>> Writer

似乎在我进行测试时运行，JUnit 或 Maven 无法从代码中识别 Android classes。我已经尝试将 Android lib 和 Sonarqube Android 插件的 jar 导入到我的项目中，但没有成功。

这是我正在测试的目标文件（是的，我也尝试在目标中导入我的规则代码包，但没有成功。我认为值得一试）：

package jakhar.aseem.diva;

import org.sonar.template.java.checks.SharedPreferencesCheck;
import android.content.SharedPreferences;
import android.preference.PreferenceManager;
import android.support.v7.app.AppCompatActivity;
import android.os.Bundle;
import android.view.View;
import android.widget.EditText;
import android.widget.Toast;


public class InsecureDataStorage1Activity extends AppCompatActivity {

    @Override
    protected void onCreate(Bundle savedInstanceState) {
        super.onCreate(savedInstanceState);
        setContentView(R.layout.activity_insecure_data_storage1);
    }

    public void saveCredentials(View view) {
        SharedPreferences spref = PreferenceManager.getDefaultSharedPreferences(this); 
        SharedPreferences.Editor spedit = spref.edit(); // Noncompliant
        EditText usr = (EditText) findViewById(R.id.ids1Usr);
        EditText pwd = (EditText) findViewById(R.id.ids1Pwd);

        spedit.putString("user", usr.getText().toString());
        spedit.putString("password", pwd.getText().toString());
        spedit.commit();

        Toast.makeText(this,"3rd party credentials saved successfully!", Toast.LENGTH_SHORT).show();
    }
}

所以问题是：如何让测试识别 Android 类并验证我的规则？

我正在使用 SonarQube 文档中的以下模板来制定规则：https://docs.sonarqube.org/display/PLUG/Writing+Custom+Java+Rules+101

任何帮助，我将不胜感激。

从现在开始，感谢您的关注。

--------------------编辑-----------------

我已经向 Maven 添加了一些 android 依赖项，但仍然无法正常工作。关注我的项目 pom.xml:

<?xml version="1.0" encoding="UTF-8"?>
<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/maven-v4_0_0.xsd">
<modelVersion>4.0.0</modelVersion>

<groupId>org.sonar.samples</groupId>
<artifactId>java-custom-rules-template</artifactId>
<version>1.0-SNAPSHOT</version>
<packaging>sonar-plugin</packaging>

<properties>
    <sonar.version>5.6.3</sonar.version>
    <java.plugin.version>4.2.1.6971</java.plugin.version>
    <sslr.version>1.21</sslr.version>
</properties>

<name>Berghem Custom Rules</name>
<description>Criação de Rules Customizadas para avaliação de códigos Java</description>

<dependencies>
<!-- https://mvnrepository.com/artifact/com.google.guava/guava -->

    <dependency>
        <groupId>org.sonarsource.sonarqube</groupId>
        <artifactId>sonar-plugin-api</artifactId>
        <version>${sonar.version}</version>
        <scope>provided</scope>
    </dependency>

    <dependency>
        <groupId>org.sonarsource.java</groupId>
        <artifactId>sonar-java-plugin</artifactId>
        <type>sonar-plugin</type>
        <version>${java.plugin.version}</version>
        <scope>provided</scope>
    </dependency>

    <dependency>
        <groupId>org.sonarsource.java</groupId>
        <artifactId>java-frontend</artifactId>
        <version>${java.plugin.version}</version>
    </dependency>

    <dependency>
        <groupId>org.sonarsource.sslr-squid-bridge</groupId>
        <artifactId>sslr-squid-bridge</artifactId>
        <version>2.6.1</version>
        <exclusions>
            <exclusion>
                <groupId>org.codehaus.sonar.sslr</groupId>
                <artifactId>sslr-core</artifactId>
            </exclusion>
            <exclusion>
                <groupId>org.codehaus.sonar</groupId>
                <artifactId>sonar-plugin-api</artifactId>
            </exclusion>
            <exclusion>
                <groupId>org.codehaus.sonar.sslr</groupId>
                <artifactId>sslr-xpath</artifactId>
            </exclusion>
            <exclusion>
                <groupId>org.slf4j</groupId>
                <artifactId>jcl-over-slf4j</artifactId>
            </exclusion>
            <exclusion>
                <groupId>org.slf4j</groupId>
                <artifactId>slf4j-api</artifactId>
            </exclusion>
        </exclusions>
    </dependency>

    <dependency>
        <groupId>org.sonarsource.java</groupId>
        <artifactId>java-checks-testkit</artifactId>
        <version>${java.plugin.version}</version>
        <scope>test</scope>
    </dependency>

    <dependency>
        <groupId>org.sonarsource.sslr</groupId>
        <artifactId>sslr-testing-harness</artifactId>
        <version>${sslr.version}</version>
        <scope>test</scope>
    </dependency>

    <dependency>
        <groupId>org.slf4j</groupId>
        <artifactId>slf4j-api</artifactId>
        <version>1.6.2</version>
    </dependency>

    <dependency>
        <groupId>junit</groupId>
        <artifactId>junit</artifactId>
        <version>4.11</version>
        <scope>test</scope>
    </dependency>
    <dependency>
        <groupId>org.easytesting</groupId>
        <artifactId>fest-assert</artifactId>
        <version>1.4</version>
        <scope>test</scope>
    </dependency>
    <dependency>
        <groupId>ch.qos.logback</groupId>
        <artifactId>logback-classic</artifactId>
        <version>0.9.30</version>
        <scope>test</scope>
    </dependency>
    <dependency>
        <groupId>com.android.tools</groupId>
        <artifactId>common</artifactId>
        <version>22.4.2</version>
    </dependency>
    <dependency>
        <groupId>com.android.tools</groupId>
        <artifactId>dvlib</artifactId>
        <version>22.4.2</version>
    </dependency>
    <dependency>
        <groupId>com.android.tools</groupId>
        <artifactId>sdk-common</artifactId>
        <version>22.4.2</version>
    </dependency>
    <dependency>
        <groupId>com.android.tools</groupId>
        <artifactId>sdklib</artifactId>
        <version>22.4.2</version>
    </dependency>
    <dependency>
        <groupId>org.codehaus.sonar</groupId>
        <artifactId>sonar-check-api</artifactId>
        <version>4.5.1</version>
    </dependency>
    <dependency>
        <groupId>org.codehaus.sonar-plugins.java</groupId>
        <artifactId>java-checks</artifactId>
        <version>2.0</version>
    </dependency>
    <dependency>
        <groupId>org.sonarsource.java</groupId>
        <artifactId>java-checks</artifactId>
        <version>4.2.1.6971</version>
    </dependency>
    <dependency>
        <groupId>org.codehaus.sonar.sslr-squid-bridge</groupId>
        <artifactId>sslr-squid-bridge</artifactId>
        <version>2.6</version>
    </dependency>
    <dependency>
        <groupId>org.codehaus.sonar</groupId>
        <artifactId>sonar-plugin-api</artifactId>
        <version>4.5.1</version>
    </dependency>
    <dependency>
        <groupId>com.android.tools.lint</groupId>
        <artifactId>lint-checks</artifactId>
        <version>22.4.2</version>
    </dependency>
    <dependency>
        <groupId>com.google.guava</groupId>
        <artifactId>guava</artifactId>
        <version>19.0</version>
    </dependency>
    <dependency>
        <groupId>com.android.tools.lint</groupId>
        <artifactId>lint-api</artifactId>
        <version>22.4.2</version>
    </dependency>
    <dependency>
        <groupId>com.android.tools.lint</groupId>
        <artifactId>lint</artifactId>
        <version>22.4.2</version>
    </dependency>
</dependencies>

<build>
    <plugins>
        <plugin>
            <groupId>org.sonarsource.sonar-packaging-maven-plugin</groupId>
            <artifactId>sonar-packaging-maven-plugin</artifactId>
            <version>1.17</version>
            <extensions>true</extensions>
            <configuration>
                <pluginKey>java-template-custom</pluginKey>
                <pluginName>Java Template Custom Rules</pluginName>
                <pluginClass>org.sonar.template.java.JavaCustomRulesPlugin</pluginClass>
                <sonarLintSupported>true</sonarLintSupported>
                <sonarQubeMinVersion>5.6</sonarQubeMinVersion> <!-- allow to depend on API 6.x but run on LTS -->
            </configuration>
        </plugin>

        <plugin>
            <groupId>org.apache.maven.plugins</groupId>
            <artifactId>maven-compiler-plugin</artifactId>
            <version>3.6.0</version>
            <configuration>
                <source>1.8</source>
                <target>1.8</target>
            </configuration>
        </plugin>
    </plugins>
</build>

Answer 1

知道了！

问题出在导入 SonarQube 的依赖项上。我在 pom.xml 上添加了很多 Android 依赖项，并在更改后进行测试。在此之后，仍然无法正常工作。在一些搜索中，我发现负责解释类的是 android-maven-plugin。当我通过 Eclipse 的 pom 接口导入时，总是会出现一些错误，说缺少一些 arctifacts。出现这个问题是因为远程依赖损坏或不存在，所以我从依赖中下载了jar文件并创建了一个文件target/test-jars。有了这个，maven 识别外部依赖并通过 JUnit 进行测试。

为了验证信息，我在我的规则检查文件中打印了类的属性：

package org.sonar.template.java.checks;

import com.google.common.collect.ImmutableList;

import org.sonar.check.Priority;
import org.sonar.check.Rule;
import org.sonar.plugins.java.api.semantic.Symbol;
import org.sonar.plugins.java.api.semantic.Symbol.TypeSymbol;
import org.sonar.plugins.java.api.IssuableSubscriptionVisitor;
import org.sonar.plugins.java.api.tree.*;
import org.sonar.plugins.java.api.tree.Tree.Kind;

import java.util.List;

@Rule(
    key = "SharedPreferencesRule",
    name = "Utilização de SharedPreferences no código",
    description = "Para cada utilização de SharedPreferences, é feito um alerta para revisar o que está sendo armazenado.",
    priority = Priority.CRITICAL,
    tags = {"attention point", "security"})
public class SharedPreferencesCheck extends IssuableSubscriptionVisitor {

    @Override
  public List<Kind> nodesToVisit() {
    return ImmutableList.of(Kind.METHOD_INVOCATION);
  }

  @Override
  public void visitNode(Tree tree){
      System.out.println("====================== Kind Finded ======================");

      MethodInvocationTree kindTree = (MethodInvocationTree) tree;

      Symbol symbol = (Symbol) kindTree.symbol();

      TypeSymbol classe = symbol.owner().enclosingClass();

      System.out.println("Name >>>>>>>>>>>>> " + symbol.name());
      System.out.println("Enclosing >>>>>>>>>>>>> " + classe);

      if (classe != null && classe.equals("SharedPreferences")){
          reportIssue(kindTree.firstToken(), "SharedPreferences sendo utilizado no código. Analisar!!");
      }

  }
}

希望对遇到相同或类似问题的人有所帮助。

如果有人能给出更好的解释，那将非常有帮助。

非常感谢！

如何在 Sonarqube 自定义规则上使用 Android 类

How to use Android Classes on a Sonarqube custom rule

java

plugins

android

rules

sonarqube