ScratchLog/spotbugs-exclude.xml at github · se2p/ScratchLog · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
<?xml version="1.0" encoding="UTF-8"?>
<!--
    SpotBugs findings that are false positives for this code base. Every entry states why it does not apply, so that
    the filter can be revisited instead of growing silently. Prefer a narrow, class-scoped match over a global one.
-->
<FindBugsFilter
        xmlns="https://github.com/spotbugs/filter/3.0.0"
        xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
        xsi:schemaLocation="https://github.com/spotbugs/filter/3.0.0 https://raw.githubusercontent.com/spotbugs/spotbugs/3.1.0/spotbugs/etc/findbugsfilter.xsd">

    <!-- ===== Global: patterns that clash with Spring, JPA and Lombok idioms ===== -->

    <!--
        Spring beans receive their collaborators through the constructor and keep them, and JPA entities and DTOs
        expose their (Lombok-generated) accessors by design. Defensive copies would break both.
    -->
    <Match>
        <Bug pattern="EI_EXPOSE_REP,EI_EXPOSE_REP2"/>
    </Match>

    <!--
        Finalizer attacks need an attacker-controlled subclass of a partially constructed object. Spring beans are
        instantiated by the container only, so a constructor that validates its configuration and throws is fine.
    -->
    <Match>
        <Bug pattern="CT_CONSTRUCTOR_THROW"/>
    </Match>

    <!-- Informational list of every request mapping, not a defect. -->
    <Match>
        <Bug pattern="SPRING_ENDPOINT"/>
    </Match>

    <!--
        Log injection is handled once, in the logging pattern: logging.pattern.console and logging.pattern.file in
        src/main/resources/application.properties wrap the message in %replace(%m){'[\r\n]', '_'}, so CR and LF in a
        logged value cannot forge log lines. FindSecBugs flags the call sites regardless, hence the exclusion.
    -->
    <Match>
        <Bug pattern="CRLF_INJECTION_LOGS"/>
    </Match>

    <!-- ===== Class-scoped false positives ===== -->

    <!--
        The queries are assembled only from compile-time constants (the EventSource enum), and every value is passed
        as a bind parameter.
    -->
    <Match>
        <Class name="de.uni_passau.fim.se2.scratchlog.persistence.repository.DashboardEventReadRepository"/>
        <Bug pattern="SQL_INJECTION_SPRING_JDBC,VA_FORMAT_STRING_USES_NEWLINE"/>
    </Match>

    <!--
        MD5 is the content-addressing scheme Scratch uses for costumes and sounds, not a security measure, and the
        compared hash is not a secret.
    -->
    <Match>
        <Class name="de.uni_passau.fim.se2.scratchlog.application.service.TutorialService"/>
        <Bug pattern="WEAK_MESSAGE_DIGEST_MD5,UNSAFE_HASH_EQUALS"/>
    </Match>

    <!-- The key and certificate paths come from the operator's application configuration, not from a request. -->
    <Match>
        <Class name="de.uni_passau.fim.se2.scratchlog.spring.configuration.SAML2Configuration"/>
        <Bug pattern="PATH_TRAVERSAL_IN"/>
    </Match>

    <!-- Spring application events are published in-process and never serialized. -->
    <Match>
        <Class name="de.uni_passau.fim.se2.scratchlog.spring.events.TestExecutionFinishedEvent"/>
        <Bug pattern="SE_BAD_FIELD"/>
    </Match>

    <!-- The switch covers every ParticipantProgress constant, so a default branch would be dead code. -->
    <Match>
        <Class name="de.uni_passau.fim.se2.scratchlog.application.service.DashboardSessionService"/>
        <Method name="progress"/>
        <Bug pattern="SF_SWITCH_NO_DEFAULT"/>
    </Match>

</FindBugsFilter>