Correctly parse method signatures with generic types #669

scottsteen · 2022-01-19T10:05:37Z

Currently, the implementation assumes the signature will be of the format
(Ljava/lang/Object,Ljava/lang/Object), using a comma , separator.
This is not the case for compiled classes. Compiled signatures use a
semicolon ; as the separator as described in JVMS 4.2.

This commit delegates the SpotBugs' signature parser to ensure the parser
expects the format it is to be provided & reduces the maintenance overhead here.

Ref #668

Currently, the implementation assumes the signature will be of the format `(Ljava/lang/Object,Ljava/lang/Object)`, using a comma `,` separator. This is not the case for compiled classes. Compiled signatures use a semicolon `;` as the separator as described in [JVMS 4.2](https://docs.oracle.com/javase/specs/jvms/se17/html/jvms-4.html#jvms-ParameterDescriptor). This commit delegates the `SpotBugs'` signature parser to ensure the parser expects the format it is to be provided & reduces the maintenance overhead here.

h3xstream

Thanks for the great PR.

h3xstream · 2022-01-25T20:17:36Z

...ecbugs-plugin/src/main/java/com/h3xstream/findsecbugs/spring/SignatureParserWithGeneric.java

-        argumentsTypes = paramAndReturn[0].split(",");
-
-        returnType = paramAndReturn[1];
+        GenericSignatureParser delegate = new GenericSignatureParser(signature);


Excellent fix ! I am also all about code reuse. 👌

r4fterman · 2023-05-21T11:01:23Z

Hi there,
I still receive this issue when verifying my spring-boot project with spotbugs using find-sec-bugs:

Downloaded from central: https://repo.maven.apache.org/maven2/com/h3xstream/findsecbugs/findsecbugs-plugin/1.12.0/findsecbugs-plugin-1.12.0.jar (467 kB at 469 kB/s)
     [java] The following errors occurred during analysis:
     [java]   Exception analyzing com.controller.ConnectorController using detector com.h3xstream.findsecbugs.spring.SpringEntityLeakDetector
     [java]     java.lang.IllegalArgumentException: Invalid class name java/lang/String;Ljava/lang/String
     [java]       At edu.umd.cs.findbugs.classfile.ClassDescriptor.<init>(ClassDescriptor.java:59)
     [java]       At edu.umd.cs.findbugs.classfile.DescriptorFactory.getClassDescriptor(DescriptorFactory.java:128)
     [java]       At edu.umd.cs.findbugs.AnalysisCacheToRepositoryAdapter.loadClass(AnalysisCacheToRepositoryAdapter.java:90)
     [java]       At org.apache.bcel.Repository.lookupClass(Repository.java:65)
     [java]       At com.h3xstream.findsecbugs.spring.SignatureParserWithGeneric.typeToJavaClass(SignatureParserWithGeneric.java:75)
     [java]       At com.h3xstream.findsecbugs.spring.SignatureParserWithGeneric.getArgumentsClasses(SignatureParserWithGeneric.java:54)
     [java]       At com.h3xstream.findsecbugs.spring.SpringEntityLeakDetector.analyzeMethod(SpringEntityLeakDetector.java:108)
     [java]       At com.h3xstream.findsecbugs.spring.SpringEntityLeakDetector.visitClassContext(SpringEntityLeakDetector.java:69)
     [java]       At edu.umd.cs.findbugs.DetectorToDetector2Adapter.visitClass(DetectorToDetector2Adapter.java:76)
     [java]       At edu.umd.cs.findbugs.FindBugs2.lambda$analyzeApplication$1(FindBugs2.java:1108)
     [java]       At java.base/java.util.concurrent.FutureTask.run(FutureTask.java:264)
     [java]       At edu.umd.cs.findbugs.CurrentThreadExecutorService.execute(CurrentThreadExecutorService.java:86)
     [java]       At java.base/java.util.concurrent.AbstractExecutorService.invokeAll(AbstractExecutorService.java:242)
     [java]       At edu.umd.cs.findbugs.FindBugs2.analyzeApplication(FindBugs2.java:1118)
     [java]       At edu.umd.cs.findbugs.FindBugs2.execute(FindBugs2.java:309)
     [java]       At edu.umd.cs.findbugs.FindBugs.runMain(FindBugs.java:395)
     [java]       At edu.umd.cs.findbugs.FindBugs2.main(FindBugs2.java:1231)
     [java]   Exception analyzing com.controller.ConnectorJarController using detector com.h3xstream.findsecbugs.spring.SpringEntityLeakDetector
     [java]     java.lang.IllegalArgumentException: Invalid class name [Lorg/springframework/web/multipart/MultipartFile
     [java]       At edu.umd.cs.findbugs.classfile.ClassDescriptor.<init>(ClassDescriptor.java:59)
     [java]       At edu.umd.cs.findbugs.classfile.DescriptorFactory.getClassDescriptor(DescriptorFactory.java:128)
     [java]       At edu.umd.cs.findbugs.AnalysisCacheToRepositoryAdapter.loadClass(AnalysisCacheToRepositoryAdapter.java:90)
     [java]       At org.apache.bcel.Repository.lookupClass(Repository.java:65)
     [java]       At com.h3xstream.findsecbugs.spring.SignatureParserWithGeneric.typeToJavaClass(SignatureParserWithGeneric.java:69)
     [java]       At com.h3xstream.findsecbugs.spring.SignatureParserWithGeneric.getArgumentsClasses(SignatureParserWithGeneric.java:54)
     [java]       At com.h3xstream.findsecbugs.spring.SpringEntityLeakDetector.analyzeMethod(SpringEntityLeakDetector.java:108)
     [java]       At com.h3xstream.findsecbugs.spring.SpringEntityLeakDetector.visitClassContext(SpringEntityLeakDetector.java:69)
     [java]       At edu.umd.cs.findbugs.DetectorToDetector2Adapter.visitClass(DetectorToDetector2Adapter.java:76)
     [java]       At edu.umd.cs.findbugs.FindBugs2.lambda$analyzeApplication$1(FindBugs2.java:1108)
     [java]       At java.base/java.util.concurrent.FutureTask.run(FutureTask.java:264)
     [java]       At edu.umd.cs.findbugs.CurrentThreadExecutorService.execute(CurrentThreadExecutorService.java:86)
     [java]       At java.base/java.util.concurrent.AbstractExecutorService.invokeAll(AbstractExecutorService.java:242)
     [java]       At edu.umd.cs.findbugs.FindBugs2.analyzeApplication(FindBugs2.java:1118)
     [java]       At edu.umd.cs.findbugs.FindBugs2.execute(FindBugs2.java:309)
     [java]       At edu.umd.cs.findbugs.FindBugs.runMain(FindBugs.java:395)
     [java]       At edu.umd.cs.findbugs.FindBugs2.main(FindBugs2.java:1231)
     [java] The following classes needed for analysis were missing:
     [java]   makeConcatWithConstants
     [java]   accept
     [java]   run
     [java]   getExitCode
     [java]   apply
[INFO] Done SpotBugs Analysis....

Is the fix release with version 1.12.0 or coming later?

Regards, R4FT3R

ctmay4 · 2023-09-26T14:39:18Z

I'm also still getting this error so definitely not fixed in 1.12.0.

     [java] The following errors occurred during analysis:
     [java]   Exception analyzing com.imsweb.seertransfer.controller.CustomErrorController using detector com.h3xstream.findsecbugs.spring.SpringEntityLeakDetector
     [java]     java.lang.IllegalArgumentException: Invalid class name java/lang/String;Ljava/lang/String
     [java]       At edu.umd.cs.findbugs.classfile.ClassDescriptor.<init>(ClassDescriptor.java:59)
     [java]       At edu.umd.cs.findbugs.classfile.DescriptorFactory.getClassDescriptor(DescriptorFactory.java:128)
     [java]       At edu.umd.cs.findbugs.AnalysisCacheToRepositoryAdapter.loadClass(AnalysisCacheToRepositoryAdapter.java:90)
     [java]       At org.apache.bcel.Repository.lookupClass(Repository.java:180)
     [java]       At com.h3xstream.findsecbugs.spring.SignatureParserWithGeneric.typeToJavaClass(SignatureParserWithGeneric.java:75)
     [java]       At com.h3xstream.findsecbugs.spring.SignatureParserWithGeneric.getArgumentsClasses(SignatureParserWithGeneric.java:54)
     [java]       At com.h3xstream.findsecbugs.spring.SpringEntityLeakDetector.analyzeMethod(SpringEntityLeakDetector.java:108)
     [java]       At com.h3xstream.findsecbugs.spring.SpringEntityLeakDetector.visitClassContext(SpringEntityLeakDetector.java:69)
     [java]       At edu.umd.cs.findbugs.DetectorToDetector2Adapter.visitClass(DetectorToDetector2Adapter.java:76)
     [java]       At edu.umd.cs.findbugs.FindBugs2.lambda$analyzeApplication$1(FindBugs2.java:1108)
     [java]       At java.base/java.util.concurrent.FutureTask.run(FutureTask.java:264)
     [java]       At edu.umd.cs.findbugs.CurrentThreadExecutorService.execute(CurrentThreadExecutorService.java:86)
     [java]       At java.base/java.util.concurrent.AbstractExecutorService.invokeAll(AbstractExecutorService.java:247)
     [java]       At edu.umd.cs.findbugs.FindBugs2.analyzeApplication(FindBugs2.java:1118)
     [java]       At edu.umd.cs.findbugs.FindBugs2.execute(FindBugs2.java:309)
     [java]       At edu.umd.cs.findbugs.FindBugs.runMain(FindBugs.java:395)
     [java]       At edu.umd.cs.findbugs.FindBugs2.main(FindBugs2.java:1231)

3mmasun · 2023-10-09T07:23:59Z

Same issue, using 1.12.0

ataraxie · 2023-11-14T01:04:21Z

Same here. Doesn't seem to be fixed in 1.12.0.

scottsteen · 2023-12-20T17:18:24Z

Can someone that is still facing this create a new issue with a minimum reproducible example? You will likely get more traction that way.

pavelorehov · 2024-02-13T13:16:06Z

Created #724

Same for me, it fails on return value of method:
public Map<String, String> test1()

Try that simple class:

import java.util.Map;

import org.springframework.http.MediaType;
import org.springframework.web.bind.annotation.GetMapping;
import org.springframework.web.bind.annotation.RestController;

@RestController
public class TestController {

	// fails
	/*
	 * [java] The following errors occurred during analysis:
     [java]   Exception analyzing TestController using detector com.h3xstream.findsecbugs.spring.SpringEntityLeakDetector
     [java]     java.lang.IllegalArgumentException: Invalid class name java/lang/String;Ljava/lang/String
     [java]       At edu.umd.cs.findbugs.classfile.ClassDescriptor.<init>(ClassDescriptor.java:59)
     [java]       At edu.umd.cs.findbugs.classfile.DescriptorFactory.getClassDescriptor(DescriptorFactory.java:128)
     [java]       At edu.umd.cs.findbugs.AnalysisCacheToRepositoryAdapter.loadClass(AnalysisCacheToRepositoryAdapter.java:90)
     [java]       At org.apache.bcel.Repository.lookupClass(Repository.java:180)
     [java]       At com.h3xstream.findsecbugs.spring.SignatureParserWithGeneric.typeToJavaClass(SignatureParserWithGeneric.java:75)
	 */
	@GetMapping(value = "/test1", produces = MediaType.APPLICATION_JSON_VALUE)
    public Map<String, String> test1() {
		return Map.of();
	}
	
	// work
	@GetMapping(value = "/test2", produces = MediaType.TEXT_PLAIN_VALUE)
    public String test2() {
		return "OK";
	}
}

scottsteen mentioned this pull request Jan 19, 2022

Some detectors broken since 4.5.3.0 spotbugs/spotbugs#1919

Closed

h3xstream approved these changes Jan 25, 2022

View reviewed changes

h3xstream merged commit 5b8713c into find-sec-bugs:master Jan 26, 2022

h3xstream added this to the version-1.12.0 milestone Jan 28, 2022

h3xstream added the bug label Jan 28, 2022

KengoTODA mentioned this pull request Apr 15, 2022

SpringEntityLeakDetector throws IllegalArgumentException for some Spring class since 4.5.3.0 spotbugs/spotbugs#2012

Open

pavelorehov mentioned this pull request Feb 13, 2024

Invalid class name exception for methods with generics #724

Open

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Correctly parse method signatures with generic types #669

Correctly parse method signatures with generic types #669

scottsteen commented Jan 19, 2022

h3xstream left a comment

h3xstream Jan 25, 2022

r4fterman commented May 21, 2023 •

edited

ctmay4 commented Sep 26, 2023

3mmasun commented Oct 9, 2023

ataraxie commented Nov 14, 2023

scottsteen commented Dec 20, 2023

pavelorehov commented Feb 13, 2024 •

edited

Correctly parse method signatures with generic types #669

Correctly parse method signatures with generic types #669

Conversation

scottsteen commented Jan 19, 2022

h3xstream left a comment

Choose a reason for hiding this comment

h3xstream Jan 25, 2022

Choose a reason for hiding this comment

r4fterman commented May 21, 2023 • edited

ctmay4 commented Sep 26, 2023

3mmasun commented Oct 9, 2023

ataraxie commented Nov 14, 2023

scottsteen commented Dec 20, 2023

pavelorehov commented Feb 13, 2024 • edited

r4fterman commented May 21, 2023 •

edited

pavelorehov commented Feb 13, 2024 •

edited