diff --git a/build.properties b/build.properties new file mode 100644 index 0000000..4baf76b --- /dev/null +++ b/build.properties @@ -0,0 +1,60 @@ +# ---------------------------------------------------------------------------------------------------------------------------------------------------------------------- +# Copyright 2015, Seshagiri Sriram. All rights reserved. +# +# Created on: Feb 02, 2015, Seshagiri Sriram +# Updated: June 20,2016 fixed some property paths.. +# File Name : build.properties +# +# ---------------------------------------------------------------------------------------------------------------------------------------------------------------------- +# ****** NOTE: ALL PARAMETERS AND VALUES IN THIS FILE ARE CASE SENSITIVE ****** +# ---------------------------------------------------------------------------------------------------------------------------------------------------------------------- +# Properties file +# Modify the following properties before calling the ant build +# +# This build drops all the existing directories (mentioned in this properties file) before creating them +# The JAR file structure created by this build is +# |-- ReportGenerator.jar This is defined in build.xml +# | |-- META-INF +# |-- lib Third party jars +# |-- All property files go in here..... +# +# ---------------------------------------------------------------------------------------------------------------------------------------------------------------------- +# Build Details +# ---------------------------------------------------------------------------------------------------------------------------------------------------------------------- +# The below are general for *** ALL *** Projects and defined inside build.xml or passed via -D options. DO NOT CHANGE +# ---------------------------------------------------------------------------------------------------------------------------------------------------------------------- +# |Property Description +# ---------------------------------------------------------------------------------------------------------------------------------------------------------------------- +# |build.basesrcdir Location where the project is found. Passed to this script via -Dbasesrcdir= +# |maven.build.finalName Final name - hardcoded into build.xml e.g. X-1.0.0-SNAPSHOT.jar +# |maven.build.dir Location relative to buildsrcdir where build will be done. usually target +# |maven.build.outputDir Usually target/classes. +# |maven.build.srcdir location of source under buid.basesrcdir +# |maven.build.resourceDir location of resources under build.basesrcdir +# |maven.build.testDir Location of test classes +# |maven.build.testResourceDir Location of test resources +# |maven.build.testOutputDir Location of test class compilation +# |maven.test.reports Where test reports (from JUNIT) will be located. +# |maven.build.pmddir Location where PMD rules and XSL will belocated. +# |maven.reporting.outputDirectory Location of reports from PMD +# |project.3rdpartylibdir lib under build.basesrcdir +# |build.type dev,qa, or prod. passed via -Dbuildtype={dev|qa|prod} +# |environment.type.default Value if build.type is not passed. defaults to dev -- DO NOT CHANGE +# ---------------------------------------------------------------------------------------------------------------------------------------------------------------------- + +# ---------------------------------------------------------------------------------------------------------------------------------------------------------------------- +# Per User configuration..... Change for local environmnent +# ---------------------------------------------------------------------------------------------------------------------------------------------------------------------- +# +# ---------------------------------------------------------------------------------------------------------------------------------------------------------------------- +ant.home=c:/Apps/ant +project.build.outputDirectory=${maven.build.outputDir} +project.build.directory=${maven.build.dir} +maven.repo.local=c\:/repos +maven.settings.offline=false +project.build.sourceEncoding=UTF-8 +maven.settings.interactiveMode=false +maven.build.version=V1.2 +maven.test.skip=false +pmd.installpath=c:/Apps/pmd-bin-5.2.3/lib +# ---------------------------------------------------------------------------------------------------------------------------------------------------------------------- diff --git a/build.xml b/build.xml new file mode 100644 index 0000000..246417e --- /dev/null +++ b/build.xml @@ -0,0 +1,474 @@ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + =================================== WARNING ========================================== + JUnit is not present in the test classpath or your $ANT_HOME/lib directory. Tests not executed. + ======================================================================================= + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + Class Path: ${toString:cobertura.classpath} + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/pom.xml b/pom.xml index 748b5f9..bb90d2b 100644 --- a/pom.xml +++ b/pom.xml @@ -117,7 +117,7 @@ junit junit - 4.12 + 4.7 test diff --git a/src/main/pmd/pmd.xsl b/src/main/pmd/pmd.xsl new file mode 100644 index 0000000..5035d4d --- /dev/null +++ b/src/main/pmd/pmd.xsl @@ -0,0 +1,275 @@ + + + + + + + + + + + + + - + + + + + + + + + PMD <xsl:value-of select="//pmd/@version"/> Report: Demo Utilities + + + + + + + + + +
+

PMD Report: Demo Utilities. Generated on

+
+ + + +
+ + + +
+ + + +
+ + + + +
+ + + + + + + + + +

Rules

+ + + + + + + + + + + + + + + + + + + + + + + +
RuleViolationsSeverity
+ [] + + +
+ +
+
+ + + + + +

Files

+ + + + + + + + + + + + + + + + + + + + + + + + + + + +
File
5
4
3
2
1
+ + +
+ + + + + + + +

File

+ + + + + + + + + + + + + + + + +
ViolationError DescriptionLine
+
+ 		+ [.] + - + + + + + + + + - +
+ Back to top + + + + + +

Summary

+ + + + + + + + + + + + + + + + + + + + +
FilesTotal
Priority 1: ShowStopper
Priority 2:Critical
Priority 3:Important/Urgent
Priority 4:Low - Change recommended
Priority 5:Low - Change Optional
+ + + + + + a + b + + + + + + + diff --git a/src/main/pmd/ruleset_basics.xml b/src/main/pmd/ruleset_basics.xml new file mode 100644 index 0000000..99e5c5b --- /dev/null +++ b/src/main/pmd/ruleset_basics.xml @@ -0,0 +1,120 @@ + + + + These are the rules by which Applications will be built. + + + + 3 +3 +3 +3 +3 +3 +3 +5 +5 +5 +3 +5 +3 +5 +1 +2 +3 +3 +3 +2 +2 +2 +2 +3 +3 +3 +3 +3 +5 +5 +5 +5 +5 +5 +5 +5 +5 +5 +5 +5 +5 +5 +5 +5 +5 +5 + 4 + 4 + 3 + 3 + 3 + 3 + 3 + 3 + 3 + 3 + 2 + 2 + 2 + 3 + 2 + 4 +4 +2 +3 +1 +2 +3 +2 +4 +3 +3 +3 +2 +2 +3 +3 +3 +1 +3 +3 +2 +3 +3 +2 +4 +3 +3 +3 +3 +2 +2 +5 +5 + diff --git a/src/main/pmd/ruleset_j2ee.xml b/src/main/pmd/ruleset_j2ee.xml new file mode 100644 index 0000000..b249f1d --- /dev/null +++ b/src/main/pmd/ruleset_j2ee.xml @@ -0,0 +1,328 @@ + + + + These are the rules by which J2EE/Web Applications will be built. + + + + 3 + 3 + 3 + + + +Scripts should be part of Tag Libraries, rather than part of JSP pages. + + 2 + + + + 10) ] + ]]> + + + + + + + + + + + ]]> + + + + + +Scriptlets should be factored into Tag Libraries or JSP declarations, rather than being part of JSP pages. + + 3 + + + + + + + + + + +<% +response.setHeader("Pragma", "No-cache"); +%> + + + String title = "Hello world!"; + + + ]]> + + + + + or tags, or attributes like "align='center'". ]]> + + 3 + +

text

+ ]]> + + + + + + +Do not use an attribute called 'class'. Use "styleclass" for CSS styles. + + 2 + + + + + + + + + +

Some text

+ + ]]> + + + + + +Do not do a forward from within a JSP file. + + 3 + + + + + + + + + + ]]> + + + + + +IFrames which are missing a src element can cause security information popups in IE if you are accessing the page +through SSL. See http://support.microsoft.com/default.aspx?scid=kb;EN-US;Q261188 + + 2 + + + + + + + + + bad example><BODY> +<iframe></iframe> +</BODY> </HTML> + +<HTML><title>good example><BODY> +<iframe src="foo"></iframe> +</BODY> </HTML> + ]]> + </example> + </rule> + + <rule name="NoHtmlComments" language="jsp" since="3.6" + message="Use JSP comments instead of HTML comments" + class="net.sourceforge.pmd.lang.rule.XPathRule" + externalInfoUrl="http://pmd.sourceforge.net/snapshot/pmd-jsp/rules/jsp/basic.html#NoHtmlComments"> + <description> + In a production system, HTML comments increase the payload + between the application server to the client, and serve + little other purpose. Consider switching to JSP comments. + </description> + <priority>2</priority> + <properties> + <property name="xpath"> + <value> + <![CDATA[ + //CommentTag + ]]> + </value> + </property> + </properties> + <example> + <![CDATA[ +<HTML><title>bad example><BODY> +<!-- HTML comment --> +</BODY> </HTML> + +<HTML><title>good example><BODY> +<%-- JSP comment --%> +</BODY> </HTML> + ]]> + </example> + </rule> + + <rule name="DuplicateJspImports" since="3.7" + message="Avoid duplicate imports such as ''{0}''" + class="net.sourceforge.pmd.lang.jsp.rule.basic.DuplicateJspImportsRule" + externalInfoUrl="http://pmd.sourceforge.net/snapshot/pmd-jsp/rules/jsp/basic.html#DuplicateJspImports"> + <description><![CDATA[Avoid duplicate import statements inside JSP's. ]]> + </description> + <priority>3</priority> + <example> + <![CDATA[ +<%@ page import=\"com.foo.MyClass,com.foo.MyClass\"%><html><body><b><img src=\"<%=Some.get()%>/foo\">xx</img>text</b></body></html> + ]]> + </example> + </rule> + + <rule name="JspEncoding" language="jsp" since="4.0" + class="net.sourceforge.pmd.lang.rule.XPathRule" + message="JSP file should use UTF-8 encoding" + externalInfoUrl="http://pmd.sourceforge.net/snapshot/pmd-jsp/rules/jsp/basic.html#JspEncoding"> + <description> + <![CDATA[ +A missing 'meta' tag or page directive will trigger this rule, as well as a non-UTF-8 charset. + ]]> + </description> + <priority>3</priority> + <properties> + <property name="xpath"> + <value> + <![CDATA[ +//Content[ +not(Element[@Name="meta"][ + Attribute[@Name="content"]/AttributeValue[contains(lower-case(@Image),"charset=utf-8")] +]) +and + not(JspDirective[@Name='page']/JspDirectiveAttribute[@Name='contentType'][contains(lower-case(@Value),"charset=utf-8")]) +] + ]]> + </value> + </property> + </properties> + <example> + <![CDATA[ + Most browsers should be able to interpret the following headers: + + <%@ page contentType="text/html; charset=UTF-8" pageEncoding="UTF-8" %> + + <meta http-equiv="Content-Type"  content="text/html; charset=UTF-8" /> + ]]> + </example> + </rule> + + <rule + name="NoInlineScript" language="jsp" since="4.0" + class="net.sourceforge.pmd.lang.rule.XPathRule" + message="Avoiding inlining HTML script content" + externalInfoUrl="http://pmd.sourceforge.net/snapshot/pmd-jsp/rules/jsp/basic.html#NoInlineScript"> + <description> + <![CDATA[ +Avoid inlining HTML script content. Consider externalizing the HTML script using the 'src' attribute on the <script> element. +Externalized script could be reused between pages. Browsers can also cache the script, reducing overall download bandwidth. + ]]> + </description> + <priority>3</priority> + <properties> + <property name="xpath"> + <value> + <![CDATA[ +//HtmlScript[@Image != ''] + ]]> + </value> + </property> + </properties> + <example> + <![CDATA[ + Most browsers should be able to interpret the following headers: + + <%@ page contentType="text/html; charset=UTF-8" pageEncoding="UTF-8" %> + + <meta http-equiv="Content-Type"  content="text/html; charset=UTF-8" /> + ]]> + </example> + </rule> + + <rule + name="NoUnsanitizedJSPExpression" since="5.1.4" + class="net.sourceforge.pmd.lang.jsp.rule.basic.NoUnsanitizedJSPExpressionRule" + message="Using unsanitized JSP expression can lead to Cross Site Scripting (XSS) attacks" + externalInfoUrl="http://pmd.sourceforge.net/snapshot/pmd-jsp/rules/jsp/basic.html#NoUnsanitizedJSPExpression"> + <description> +Avoid using expressions without escaping / sanitizing. This could lead to cross site scripting - as the expression +would be interpreted by the browser directly (e.g. "<script>alert('hello');</script>"). + </description> + <priority>3</priority> + <example> + <![CDATA[ +<%@ page contentType="text/html; charset=UTF-8" %> +<%@ taglib prefix="fn" uri="http://java.sun.com/jsp/jstl/functions" %> +${expression} <!-- don't use this --> +${fn:escapeXml(expression)} <!-- instead, escape it --> +<c:out value="${expression}" /> <!-- or use c:out --> + ]]> + </example> + </rule> + +</ruleset> diff --git a/src/main/pmd/ruleset_security.xml b/src/main/pmd/ruleset_security.xml new file mode 100644 index 0000000..68bf2ad --- /dev/null +++ b/src/main/pmd/ruleset_security.xml @@ -0,0 +1,19 @@ +<?xml version="1.0"?> + +<ruleset name="Rule Set - Security" + xmlns="http://pmd.sourceforge.net/ruleset/2.0.0" + xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" + xsi:schemaLocation="http://pmd.sourceforge.net/ruleset/2.0.0 http://pmd.sourceforge.net/ruleset_2_0_0.xsd"> + <description>These rules check the security guidelines from Sun, published at http://java.sun.com/security/seccodeguide.html#gcg</description> + + +<!-- Priorities +HIGH :1 +MEDIUM_HIGH:2 +MEDIUM:3 +MEDIUM_LOW:4 +LOW : 5 +--> +<rule ref="rulesets/java/sunsecure.xml/MethodReturnsInternalArray"> <priority>3</priority></rule> +<rule ref="rulesets/java/sunsecure.xml/ArrayIsStoredDirectly"> <priority>3</priority></rule> +</ruleset>