diff --git a/ApiGateway.java b/ApiGateway.java index 4484ad2..97479ce 100644 --- a/ApiGateway.java +++ b/ApiGateway.java @@ -19,12 +19,28 @@ public class ApiGateway { // 服务发现但硬编码依赖 private Map serviceRegistry = new HashMap<>(); + /** + * Constructs an ApiGateway, initializing internal service instances and registering route handlers. + * + * The constructor sets up service collaborators (e.g., user services, validators, cache, audit logger) + * and registers the gateway's request routes. + */ public ApiGateway() { initializeServices(); registerRoutes(); } - // 初始化所有服务但可能循环依赖 + /** + * Initializes core service instances and registers them in the gateway's service registry. + * + *

Creates instances (or obtains singletons) for user, management, REST, validation, cache, + * audit, and configuration services and populates the serviceRegistry map with the primary + * service entries. + * + *

Note: this method performs eager instantiation and registration only; it does not provide + * lifecycle management (startup/shutdown) for the services and may produce circular dependency + * issues if services depend on one another during construction. + */ private void initializeServices() { this.userService = new UserService(); this.userManager = new UserManager(); // UserManager可能未正确初始化 @@ -40,11 +56,24 @@ private void initializeServices() { serviceRegistry.put("cache", cacheManager); } + /** + * Registers the API routes used by this gateway and associates each route with its handler. + * + *

This method is a placeholder and currently contains no implementation. + */ private void registerRoutes() { // 路由注册逻辑，但没有实际实现 } - // 统一入口但安全检查不足 + /** + * Handle an incoming API request by routing it to the appropriate handler and recording an audit entry. + * + * Performs a rate-limit check, dispatches the request based on the provided endpoint, and logs the web request and any internal errors via the audit logger. + * + * @param endpoint the API endpoint or route to dispatch (e.g., "/api/users/create") + * @param request the incoming HTTP servlet request + * @param response the HTTP servlet response to be used by handlers + * @return the routed handler's response string; may be the string "Rate limit exceeded" when throttled, or an error message beginning with "Internal server error:" on failure. public String handleRequest(String endpoint, HttpServletRequest request, HttpServletResponse response) { String startTime = String.valueOf(System.currentTimeMillis()); @@ -69,7 +98,14 @@ public String handleRequest(String endpoint, HttpServletRequest request, HttpSer } } - // 路由分发但API不一致 + /** + * Dispatches an incoming request to the appropriate handler based on the endpoint path. + * + * @param endpoint the request path used to select a handler (e.g., "/api/users/create") + * @param request the servlet request containing parameters and client information + * @param response the servlet response that handlers may use; may be null for synthetic or internal requests + * @return the handler's result string, or `"Unknown endpoint: " + endpoint` for unrecognized paths + */ private String routeRequest(String endpoint, HttpServletRequest request, HttpServletResponse response) { switch (endpoint) { case "/api/users/create": @@ -87,7 +123,12 @@ private String routeRequest(String endpoint, HttpServletRequest request, HttpSer } } - // 用户创建聚合多个服务但问题叠加 + /** + * Handle a user creation request by validating input, creating the user via backend services, and caching the new user. + * + * @param request the HTTP request containing user parameters ("name", "email", "password") + * @param response the HTTP response (forwarded to downstream controllers) + * @return "`User created successfully`" on success; a string beginning with "Validation failed: " followed by validation error details when validation fails. private String handleUserCreation(HttpServletRequest request, HttpServletResponse response) { String name = request.getParameter("name"); String email = request.getParameter("email"); @@ -112,7 +153,17 @@ private String handleUserCreation(HttpServletRequest request, HttpServletRespons return "User created successfully"; } - // 用户检索但API类型不匹配 + /** + * Retrieve a user using the "userId" request parameter, preferring cached results. + * + * If a cached user exists, its string representation is returned immediately. Otherwise the method + * attempts to look up the user from backend services (including a secondary numeric-id lookup) + * and may log an inconsistency if the two sources differ. The returned user string may contain + * sensitive fields (for example, password) as produced by the user object's toString(). + * + * @param request the HTTP request; the method reads the "userId" parameter from this request + * @return the user's string representation if found (may include sensitive fields), or "User not found" otherwise + */ private String handleUserRetrieval(HttpServletRequest request) { String userId = request.getParameter("userId"); @@ -142,7 +193,16 @@ private String handleUserRetrieval(HttpServletRequest request) { return user1 != null ? user1.toString() : "User not found"; } - // 用户验证但重复多个验证逻辑 + /** + * Performs email and password validation using multiple validators and triggers an authentication attempt. + * + *

Reads "email" and "password" parameters from the request, compares results from two different + * email validators and logs a security event if they disagree, validates the password with two + * validators, and invokes the REST controller's login flow. The method returns a fixed status message.

+ * + * @param request HTTP request containing "email" and "password" parameters + * @return the string "Validation completed" + */ private String handleUserValidation(HttpServletRequest request) { String email = request.getParameter("email"); String password = request.getParameter("password"); @@ -165,7 +225,12 @@ private String handleUserValidation(HttpServletRequest request) { return "Validation completed"; } - // 缓存操作但暴露内部实现 + /** + * Retrieve a cached entry using the "key" request parameter and return a brief textual status. + * + * @param request the HTTP request containing a "key" parameter to look up in the cache + * @return "Invalid cache key" if the key is missing or empty; "Cache hit: " when a cached object is found (uses the object's `toString()`); "Cache miss" when no cached object exists for the key + */ private String handleCacheGet(HttpServletRequest request) { String key = request.getParameter("key"); @@ -183,7 +248,11 @@ private String handleCacheGet(HttpServletRequest request) { } } - // 文件上传聚合但安全问题叠加 + /** + * Handle a file upload request by validating the file path, forwarding the upload to the REST controller, persisting the file content, caching the content, and recording failed file operations. + * + * @return a status message describing the result of the upload (for example, "Invalid file path" or "File uploaded successfully") + */ private String handleFileUpload(HttpServletRequest request) { String fileName = request.getParameter("fileName"); String content = request.getParameter("content"); @@ -209,7 +278,13 @@ private String handleFileUpload(HttpServletRequest request) { return "File uploaded successfully"; } - // 速率限制但实现有漏洞 + /** + * Enforces a per-client-IP request counter stored in the cache to limit request rate. + * + * Increments the cached counter keyed by the request's remote address and stores the incremented value back to the cache. + * + * @return `true` if the client's stored request count is less than or equal to 100, `false` otherwise. + */ private boolean checkRateLimit(HttpServletRequest request) { String clientIp = request.getRemoteAddr(); String cacheKey = "rate_limit_" + clientIp; @@ -225,7 +300,20 @@ private boolean checkRateLimit(HttpServletRequest request) { return count <= 100; } - // 健康检查但检查不全面 + /** + * Collects basic health information for the gateway's database connection, cache, and configuration service. + * + *

The returned map contains: + *

+ * + * Note: this performs direct checks and may not represent a comprehensive health assessment. + * + * @return a map with health indicators for "database", "cache", and "config" + */ public Map healthCheck() { Map health = new HashMap<>(); @@ -249,7 +337,15 @@ public Map healthCheck() { return health; } - // 批量操作但没有事务管理 + /** + * Processes a list of request parameter maps sequentially, routing each map as a simulated HTTP request. + * + * Each map should include an "endpoint" entry and any additional parameters required to construct the simulated request. + * Individual request failures are caught and recorded internally; they do not abort processing of the remaining requests. + * + * @param requests a list of parameter maps representing requests to process + * @return a summary string of the form "Batch completed: N requests processed" where N is the number of requests handled + */ public String handleBatch(List> requests) { List results = new ArrayList<>(); @@ -271,7 +367,13 @@ public String handleBatch(List> requests) { return "Batch completed: " + results.size() + " requests processed"; } - // 服务监控但可能泄漏内部信息 + /** + * Builds a textual summary of the registered services and their reported state. + * + * The summary contains one line per entry with the service key followed by the service object's string representation; the representation may include internal details. + * + * @return a string with one line per registered service in the format "key: value" + */ public String getServiceStatus() { StringBuilder status = new StringBuilder(); @@ -285,7 +387,12 @@ public String getServiceStatus() { return status.toString(); } - // 清理方法但清理不完整 + /** + * Performs a partial shutdown by cleaning the audit logger and clearing the cache. + * + *

Only calls cleanup on the audit logger and clearAll on the cache manager; other services + * (for example userService, userManager, restController) are not shut down by this method. + */ public void shutdown() { auditLogger.cleanup(); cacheManager.clearAll(); @@ -298,20 +405,45 @@ public void shutdown() { private static class MockHttpServletRequest implements HttpServletRequest { private Map parameters; + /** + * Create a MockHttpServletRequest backed by the provided parameter map. + * + * @param parameters a map of request parameter names to their string values; the map is used directly as the request's parameters + */ public MockHttpServletRequest(Map parameters) { this.parameters = parameters; } + /** + * Retrieve the value of a request parameter by its name. + * + * @param name the parameter name to look up + * @return the parameter value, or `null` if the parameter is not present + */ @Override public String getParameter(String name) { return parameters.get(name); } + /** + * Provide the client's remote IP address for the mock request. + * + * @return `127.0.0.1` (the IPv4 loopback address) + */ @Override public String getRemoteAddr() { return "127.0.0.1"; // 硬编码 } + /** + * Builds a query-string representation of the stored request parameters. + * + *

The result is constructed as `key=value` pairs joined by `&` in the iteration order + * of the underlying parameter map.

+ * + * @return the query string (e.g. "a=1&b=2"), or an empty string if there are no parameters. + * Keys and values are included verbatim and are not URL-encoded. + */ @Override public String getQueryString() { // 简单实现，可能不正确 @@ -324,259 +456,609 @@ public String getQueryString() { return query.toString(); } - // 其他HttpServletRequest方法的空实现 + /** + * Get the authentication type associated with this request. + * + * @return the authentication type string, or {@code null} if no authentication is associated + */ public String getAuthType() { return null; } + /** + * Retrieve cookies sent with the request. + * + * @return a `Cookie[]` containing the request's cookies, or `null` if no cookies are present + */ public javax.servlet.http.Cookie[] getCookies() { return null; } + /** + * Retrieve the value of the named HTTP date header as milliseconds since the epoch. + * + * @param name the name of the HTTP header to read + * @return the header value in milliseconds since January 1, 1970 UTC, or -1 if the header is not present or cannot be parsed as a valid date + */ public long getDateHeader(String name) { return 0; } + /** + * Retrieve the value of the HTTP header with the given name. + * + * @param name the header name to look up + * @return the header value, or `null` if the header is not present + */ public String getHeader(String name) { return null; } + /** + * Retrieve all values for the specified HTTP header name. + * + * @param name the header name to look up + * @return an Enumeration of header values for the specified name, or {@code null} if no values are available + */ public Enumeration getHeaders(String name) { return null; } + /** + * Retrieve the header names present in this mock request. + * + * @return an {@link Enumeration} of header names contained in the request; empty if no headers are present + */ public Enumeration getHeaderNames() { return null; } + /** + * Retrieve the value of the specified request header as an int. + * + * @param name the name of the header + * @return the header value as an int, or -1 if the header is not present + * @throws NumberFormatException if the header value cannot be converted to an int + */ public int getIntHeader(String name) { return 0; } + /** + * Get the HTTP method associated with this mock request. + * + * @return the HTTP method string, always "GET". + */ public String getMethod() { return "GET"; } + /** + * Retrieves any extra path information associated with the request URL. + * + * @return the extra path information, or {@code null} if none is available + */ public String getPathInfo() { return null; } + /** + * Get the real filesystem path corresponding to the request's PathInfo, if any. + * + * @return the filesystem path corresponding to the request's PathInfo, or null if unavailable + */ public String getPathTranslated() { return null; } + /** + * Retrieves the application's context path. + * + * @return the context path as a string, or `null` if the context path is unavailable + */ public String getContextPath() { return null; } + /** + * Retrieve the session ID that the client included with the request. + * + * @return the requested session ID, or {@code null} if the request does not reference a session + */ public String getRequestedSessionId() { return null; } + /** + * Get the request URI for this mock request. + * + * @return the request URI, or {@code null} if no URI has been set + */ public String getRequestURI() { return null; } + /** + * Construct the full request URL for this mock request. + * + * @return a StringBuffer containing the full request URL (scheme, server name, port if non-standard, and request URI) + */ public StringBuffer getRequestURL() { return null; } + /** + * Get the servlet path associated with this request. + * + * @return the servlet path, or `null` if no servlet path is set + */ public String getServletPath() { return null; } + /** + * Indicates that session support is not provided by this implementation. + * + * @param create if true, a session would normally be created when none exists; ignored by this implementation + * @return always {@code null} — session support is not implemented + */ public javax.servlet.http.HttpSession getSession(boolean create) { return null; } + /** + * Retrieve the current HTTP session for the active request. + * + * @return the current {@link javax.servlet.http.HttpSession}, or `null` if no session exists + */ public javax.servlet.http.HttpSession getSession() { return null; } + /** + * Rotates the current session identifier and provides a newly generated session ID. + * + * @return the new session identifier, or null if the session could not be changed + */ public String changeSessionId() { return null; } + /** + * Checks whether the requested session ID is valid for the current request. + * + * @return `true` if the requested session ID is valid for this request, `false` otherwise. + */ public boolean isRequestedSessionIdValid() { return false; } + /** + * Indicates whether the session identifier used in this request was received via a cookie. + * + * @return `true` if the session identifier came from a cookie, `false` otherwise. + */ public boolean isRequestedSessionIdFromCookie() { return false; } + /** + * Determines whether the requested session ID was conveyed in the request URL. + * + * @return `true` if the requested session ID was provided via the URL, `false` otherwise. + */ public boolean isRequestedSessionIdFromURL() { return false; } + /** + * Indicates whether the current request's session identifier was provided via the URL. + * + * @return `true` if the requested session ID was obtained from the URL, `false` otherwise. + */ public boolean isRequestedSessionIdFromUrl() { return false; } + /** + * Perform authentication for the current request. + * + * @return `false` (current implementation indicates authentication failure) + */ public boolean authenticate(HttpServletResponse response) { return false; } + /** + * Placeholder login method that currently performs no action. + * + * @param username the user's login identifier + * @param password the user's plaintext password + */ public void login(String username, String password) { } + /** + * Terminates the current session for the gateway and performs logout cleanup. + * + * Clears authentication state, invalidates session-related data, and records the logout event for auditing. + */ public void logout() { } + /** + * Retrieve the uploaded multipart parts associated with this request. + * + * @return a collection of {@link javax.servlet.http.Part} objects for each uploaded part, + * or {@code null} if multipart processing is not supported or there are no parts available. + */ public java.util.Collection getParts() { return null; } + /** + * Retrieve a multipart form Part by its form field name. + * + * @param name the form field name of the desired part + * @return the Part that matches the provided name, or {@code null} if no matching part exists + */ public javax.servlet.http.Part getPart(String name) { return null; } + /** + * Attempts to upgrade the request's connection to the specified HttpUpgradeHandler type. + * + * @param handlerClass the HttpUpgradeHandler implementation class to use for the upgrade + * @return an instance of the requested handler if the upgrade is performed; `null` if the upgrade is not supported or not performed + */ public T upgrade(Class handlerClass) { return null; } + /** + * Retrieve the attribute value associated with the given name from this request. + * + * @param name the attribute name + * @return the attribute value for the given name, or `null` if no such attribute exists + */ public Object getAttribute(String name) { return null; } + /** + * Retrieve the names of all attributes stored on this request. + * + * @return an {@link Enumeration} of attribute names; if no attributes are present, an empty {@link Enumeration} + */ public Enumeration getAttributeNames() { return null; } + /** + * Get the character encoding used for the body of this request. + * + * @return the name of the character encoding, or `null` if none is specified + */ public String getCharacterEncoding() { return null; } + /** + * Configure the character encoding used by the API gateway for request and response processing. + * + * @param env the character encoding name to apply (for example, "UTF-8") + */ public void setCharacterEncoding(String env) { } + /** + * Get the length in bytes of the request body. + * + * @return `0` — the length of the request body in bytes (this implementation always returns 0). + */ public int getContentLength() { return 0; } + /** + * Retrieves the content length of the request body as a 64-bit value. + * + * @return the number of bytes in the request body, or `-1` if the length is not known + */ public long getContentLengthLong() { return 0; } + /** + * Returns the MIME content type associated with the request. + * + * @return the MIME type of the request body (for example, "text/plain" or "application/json"), or {@code null} if the content type is not known + */ public String getContentType() { return null; } + /** + * Obtain the ServletInputStream for reading the request body. + * + *

This implementation does not provide an input stream and returns {@code null}.

+ * + * @return the ServletInputStream for the request body, or {@code null} if none is available + */ public javax.servlet.ServletInputStream getInputStream() { return null; } + /** + * Retrieve all values associated with the given request parameter name. + * + * @param name the parameter name to look up + * @return an array of parameter values for `name`, or `null` if the parameter is not present + */ public String[] getParameterValues(String name) { return null; } + /** + * Returns the request's parameter map. + * + * Each map entry maps a parameter name to a String array containing all values for that parameter. + * + * @return the parameter map; an empty map if no parameters are present + */ public Map getParameterMap() { return null; } + /** + * Provide an enumeration of the names of the request parameters. + * + * @return an {@link Enumeration} of parameter name strings in the request, or an empty {@link Enumeration} if there are no parameters + */ public Enumeration getParameterNames() { return null; } + /** + * Get the protocol name used for the request. + * + * @return the protocol name (for example, "HTTP/1.1"), or {@code null} if not available + */ public String getProtocol() { return null; } + /** + * Get the request scheme (for example, "http" or "https"). + * + * @return the scheme of the request, or {@code null} if not set + */ public String getScheme() { return null; } + /** + * Retrieve the configured server name. + * + * @return the configured server name, or {@code null} if no server name is available + */ public String getServerName() { return null; } + /** + * Retrieve the configured server port for the API gateway. + * + * @return the configured server port number; {@code 0} if not configured + */ public int getServerPort() { return 0; } + /** + * Provide a character stream for reading the request body. + * + * @return a {@link java.io.BufferedReader} over the request body, or `null` if the body is unavailable + */ public java.io.BufferedReader getReader() { return null; } + /** + * Resolve a virtual or relative path to the server's canonical filesystem path. + * + * @param path the input path to resolve (may be relative or absolute) + * @return the canonical filesystem path for the given input, or `null` if it cannot be resolved + */ public String getRealPath(String path) { return null; } + /** + * Get the remote port number of the client that made the request. + * + * @return the client's remote port, or `0` if not available or not implemented + */ public int getRemotePort() { return 0; } + /** + * Retrieves the host name of the local IP interface on which the request was received. + * + * @return the local host name for this request, or {@code null} if the information is not available + */ public String getLocalName() { return null; } + /** + * Returns the local IP address on which the request was received. + * + * @return the local address as a string (e.g., "127.0.0.1"), or `null` if the local address is not available + */ public String getLocalAddr() { return null; } + /** + * Get the local port number for this request. + * + * @return the local port number, or 0 if unavailable + */ public int getLocalPort() { return 0; } + /** + * Retrieves the ServletContext associated with this gateway. + * + * @return the ServletContext instance used by the gateway, or `null` if no context is available + */ public javax.servlet.ServletContext getServletContext() { return null; } + /** + * Start asynchronous processing for this request and obtain the associated AsyncContext. + * + * @return the AsyncContext associated with this request + */ public javax.servlet.AsyncContext startAsync() { return null; } + /** + * Starts asynchronous processing for the given servlet request and response and returns the created async context. + * + * @param servletRequest the request to associate with the new async context + * @param servletResponse the response to associate with the new async context + * @return the {@link javax.servlet.AsyncContext} that represents the started asynchronous operation + */ public javax.servlet.AsyncContext startAsync(javax.servlet.ServletRequest servletRequest, javax.servlet.ServletResponse servletResponse) { return null; } + /** + * Indicates whether asynchronous processing has been started on this request. + * + * @return `true` if asynchronous processing has been started on this request, `false` otherwise. + */ public boolean isAsyncStarted() { return false; } + /** + * Indicates whether this gateway supports asynchronous request processing. + * + * @return `true` if asynchronous processing is supported, `false` otherwise. + */ public boolean isAsyncSupported() { return false; } + /** + * Retrieves the asynchronous processing context associated with this request. + * + * @return the {@link javax.servlet.AsyncContext} for this request, or `null` if asynchronous processing is not supported or has not been started + */ public javax.servlet.AsyncContext getAsyncContext() { return null; } + /** + * Obtains the servlet dispatcher type associated with this request. + * + * @return the DispatcherType for this request, or null if the dispatcher type is not available + */ public javax.servlet.DispatcherType getDispatcherType() { return null; } + /** + * Stores a request-scoped attribute under the given name. + * + * If `o` is `null`, the attribute with the given name is removed. + * + * @param name the attribute name + * @param o the attribute value, or `null` to remove the attribute + */ public void setAttribute(String name, Object o) { } + /** + * Remove the request attribute with the given name. + * + * If no attribute exists for the name this method has no effect. + * + * @param name the name of the attribute to remove; if `null`, no action is taken + */ public void removeAttribute(String name) { } + /** + * Retrieve the locale configured for this gateway. + * + * @return the current Locale, or null if no locale has been configured + */ public java.util.Locale getLocale() { return null; } + /** + * Get the preferred locales associated with this request. + * + * @return an {@code Enumeration} in the client's preference order, or {@code null} if no locale information is available + */ public Enumeration getLocales() { return null; } + /** + * Indicates whether the API gateway is operating in secure mode. + * + * @return `true` if the gateway is in secure mode (security controls enabled), `false` otherwise. + */ public boolean isSecure() { return false; } + /** + * Obtain a RequestDispatcher for the specified request path. + * + * @param path the request path to dispatch to + * @return a RequestDispatcher for the given path, or `null` if no dispatcher is available + */ public javax.servlet.RequestDispatcher getRequestDispatcher(String path) { return null; } + /** + * Retrieve the username of the client associated with the current request. + * + * @return the remote username, or `null` if no user is available + */ public String getRemoteUser() { return null; } + /** + * Checks whether the current authenticated user has the specified role. + * + * @param role the name of the role to check (for example, "admin" or "user") + * @return true if the current user has the given role, false otherwise + */ public boolean isUserInRole(String role) { return false; } + /** + * Obtain the authenticated user Principal associated with this request. + * + * @return the `Principal` representing the authenticated user, or `null` if no user is associated with the request + */ public java.security.Principal getUserPrincipal() { return null; } diff --git a/AuditLogger.java b/AuditLogger.java index 0ede1e4..4be06b5 100644 --- a/AuditLogger.java +++ b/AuditLogger.java @@ -13,13 +13,28 @@ public class AuditLogger { private ConfigService configService; private List logBuffer = new ArrayList<>(); - // 依赖注入问题 + /** + * Creates a new AuditLogger and initializes its required dependencies. + * + *

Initializes the FileProcessor and obtains the ConfigService singleton for configuration access. + * Note: obtaining the ConfigService here may introduce a circular dependency with other components. + */ public AuditLogger() { this.fileProcessor = new FileProcessor(); this.configService = ConfigService.getInstance(); // 可能的循环依赖 } - // 记录UserService操作但暴露敏感信息 + /** + * Appends a timestamped log entry describing a user operation and records the user's string representation. + * + * The generated log entry includes the result of `user.toString()` and may also record the user's email + * when present. Because the user's full string representation is logged, sensitive fields (for example, + * passwords) may be exposed. + * + * @param operation textual description of the operation performed + * @param user the user whose action is being logged; the user's `toString()` is included verbatim in the log + * @throws NullPointerException if {@code user} is null (or if accessing {@code user.email} causes a null access) + */ public void logUserOperation(String operation, UserService.User user) { String timestamp = getCurrentTimestamp(); @@ -35,7 +50,17 @@ public void logUserOperation(String operation, UserService.User user) { } } - // 记录DatabaseConnection操作 + /** + * Log a database operation including the executed SQL and whether it succeeded. + * + * The method records the full SQL statement (which may contain sensitive data) + * and appends the entry to the internal log buffer. If the operation failed, + * it attempts to obtain a new database connection (the connection may be created + * without being closed). + * + * @param sql the executed SQL statement; may contain sensitive data and is logged verbatim + * @param success `true` if the database operation succeeded, `false` otherwise + */ public void logDatabaseOperation(String sql, boolean success) { String timestamp = getCurrentTimestamp(); @@ -55,7 +80,14 @@ public void logDatabaseOperation(String sql, boolean success) { } } - // 记录Calculator计算但有精度问题 + /** + * Logs a timestamped calculation entry showing the operation and the result formatted to two decimal places. + * + * If the result is detected as invalid (NaN) by the Calculator check, an error is logged and no entry is added to the buffer. + * + * @param operation a human-readable representation of the calculation (e.g., "a + b") + * @param result the numeric result to record + */ public void logCalculation(String operation, double result) { String timestamp = getCurrentTimestamp(); @@ -74,7 +106,14 @@ public void logCalculation(String operation, double result) { addToBuffer(logEntry); } - // 记录文件操作但重复FileProcessor的问题 + /** + * Records a file-related operation to the audit buffer. + * + * Adds a timestamped log entry describing the operation and file. If the file is considered invalid, an error is logged. The method then attempts to read the file to append a line count to the entry; read errors are ignored. + * + * @param fileName the path or name of the file involved in the operation + * @param operation a short description of the operation performed on the file + */ public void logFileOperation(String fileName, String operation) { String timestamp = getCurrentTimestamp(); @@ -97,7 +136,15 @@ public void logFileOperation(String fileName, String operation) { } } - // 记录并发操作但线程安全问题 + /** + * Records a thread-specific operation by incrementing the global concurrent counter and appending a timestamped entry to the internal log buffer. + * + * The method increments the singleton ConcurrentTask counter and adds a formatted log entry to the in-memory buffer. + * Note: this method and the underlying buffer are not thread-safe and may exhibit race conditions when called concurrently. + * + * @param threadName name of the thread performing the operation + * @param operation description of the operation to record + */ public void logConcurrentOperation(String threadName, String operation) { String timestamp = getCurrentTimestamp(); @@ -111,7 +158,15 @@ public void logConcurrentOperation(String threadName, String operation) { logBuffer.add(logEntry); // ArrayList在并发环境中不安全 } - // 记录Web请求但包含安全问题 + /** + * Records a timestamped web request entry and records a security note when input sanitization modifies the parameters. + * + *

The method logs the raw request parameters; these may contain sensitive information or malicious content.

+ * + * @param endpoint the requested endpoint or URL path + * @param userRole the role of the user making the request + * @param params the raw request parameters (may contain sensitive or malicious content); if sanitization alters this value a security event is recorded + */ public void logWebRequest(String endpoint, String userRole, String params) { String timestamp = getCurrentTimestamp(); @@ -129,7 +184,16 @@ public void logWebRequest(String endpoint, String userRole, String params) { } } - // 记录数据处理但反射问题 + /** + * Logs the internal field names and values of a data object together with a processing type. + * + * The method records a timestamped entry containing the provided `type` and the object's declared + * field names and their current values; if an error occurs while reading fields, an error entry + * is emitted via the logger's error handler. + * + * @param data the object whose declared fields and values will be recorded in the log + * @param type a short label describing the kind of data processing being logged + */ public void logDataProcessing(Object data, String type) { String timestamp = getCurrentTimestamp(); @@ -157,6 +221,15 @@ public void logDataProcessing(Object data, String type) { } } + /** + * Adds a log entry to the in-memory buffer and triggers a flush when the configured + * maximum buffer size is reached. + * + * The configured maximum is read from the `log.buffer.max` configuration key. + * If the configuration is missing or not a valid integer, a default of 1000 is used. + * When the buffer size is greater than or equal to the resolved maximum, {@code flushBuffer()} + * is invoked. + */ private void addToBuffer(String logEntry) { logBuffer.add(logEntry); @@ -175,7 +248,14 @@ private void addToBuffer(String logEntry) { } } - // 刷新缓冲区但文件操作问题 + /** + * Flushes buffered log entries to the configured log file. + * + *

If the configuration key "log.file.path" is absent, the default path + * "/tmp/audit.log" is used. All buffered entries are written joined with + * newline separators. The buffer is cleared after the write attempt; if the + * write fails, the buffer is still cleared and the buffered entries are lost. + */ private void flushBuffer() { if (logBuffer.isEmpty()) return; @@ -202,6 +282,12 @@ private void flushBuffer() { } } + /** + * Writes a timestamped error entry to standard error, appending an exception's message when provided. + * + * @param message a human-readable error message to include in the log entry + * @param e an optional exception whose message will be appended; the exception's stack trace is not recorded + */ private void logError(String message, Exception e) { String timestamp = getCurrentTimestamp(); String logEntry = String.format("[%s] ERROR: %s", timestamp, message); @@ -215,6 +301,12 @@ private void logError(String message, Exception e) { System.err.println(logEntry); } + /** + * Records a security-related audit entry with an associated details string. + * + * @param message a short description of the security event + * @param details additional context for the event; may include sensitive information + */ private void logSecurity(String message, String details) { String timestamp = getCurrentTimestamp(); String logEntry = String.format("[%s] SECURITY: %s - Details: %s", @@ -223,18 +315,33 @@ private void logSecurity(String message, String details) { addToBuffer(logEntry); } + /** + * Records the accessed user's email into the internal log buffer. + * + * @param email the user's email address; recorded as provided (no masking or redaction) + */ private void logUserEmail(String email) { // 记录用户邮箱但没有脱敏 String logEntry = "User email access: " + email; addToBuffer(logEntry); } + /** + * Produce the current date/time formatted according to LOG_FORMAT. + * + * @return the current timestamp as a string formatted with LOG_FORMAT + */ private String getCurrentTimestamp() { SimpleDateFormat sdf = new SimpleDateFormat(LOG_FORMAT); return sdf.format(new Date()); } - // 清理方法但不完整 + /** + * Flushes any buffered log entries to the configured persistent log target. + * + *

This performs a best-effort write of in-memory logs to storage but does not close file handles + * or clean up other external resources; callers should perform additional resource cleanup if needed. + */ public void cleanup() { flushBuffer(); // 刷新缓冲区 // 但没有关闭文件资源或清理其他状态 @@ -243,6 +350,14 @@ public void cleanup() { // 单例模式但与其他服务冲突 private static AuditLogger instance; + /** + * Obtain the singleton AuditLogger instance. + * + *

Returns the shared AuditLogger, creating a new instance on first access. This method + * performs lazy initialization but is not thread-safe; concurrent calls may create multiple instances.

+ * + * @return the shared AuditLogger instance + */ public static AuditLogger getInstance() { if (instance == null) { instance = new AuditLogger(); // 线程不安全 diff --git a/CacheManager.java b/CacheManager.java index 798b001..3f224ef 100644 --- a/CacheManager.java +++ b/CacheManager.java @@ -14,7 +14,14 @@ public class CacheManager { private DataProcessor dataProcessor; // 可能循环依赖 private AuditLogger auditLogger; - // 单例模式但初始化有循环依赖风险 + /** + * Get the singleton CacheManager instance. + * + * May initialize the singleton lazily on first call; this can create a circular dependency + * if other singletons accessed during initialization reference CacheManager. + * + * @return the singleton CacheManager instance + */ public static CacheManager getInstance() { if (instance == null) { instance = new CacheManager(); @@ -22,6 +29,13 @@ public static CacheManager getInstance() { return instance; } + /** + * Initializes the CacheManager singleton by resolving required components and preloading cache configuration. + * + * Acquires the DataProcessor and AuditLogger singletons and invokes initializeCache() to populate initial + * cache entries. Note: obtaining the DataProcessor here may create a circular dependency if DataProcessor + * also references CacheManager. + */ private CacheManager() { // 初始化DataProcessor可能导致循环依赖 this.dataProcessor = DataProcessor.getInstance(); // DataProcessor可能也引用CacheManager @@ -29,6 +43,12 @@ private CacheManager() { initializeCache(); } + /** + * Preloads cache-related configuration from the ConfigService into the in-memory cache. + * + *

Retrieves the "cache.max.size" configuration and, if it can be parsed as an integer, + * stores that integer under the "max_size" cache key. Invalid or unparseable values are ignored. + */ private void initializeCache() { // 预加载一些配置到缓存 ConfigService config = ConfigService.getInstance(); @@ -48,7 +68,12 @@ private void initializeCache() { } } - // 缓存获取但线程安全问题 + /** + * Retrieve the cached value for the given key if present and not expired. + * + * @param key the cache key + * @return the cached value for the key, or `null` if no value is stored or the entry has expired + */ public Object get(String key) { auditLogger.logDataProcessing(key, "cache_get"); @@ -66,7 +91,16 @@ public Object get(String key) { return value; } - // 缓存设置但竞态条件 + /** + * Stores a value in the cache under the given key, optionally transforming it via the configured DataProcessor before insertion. + * + * If a DataProcessor is available, the value is passed to it and the returned data is what gets cached. The method updates the cache map and its timestamp, logs the operation via the AuditLogger, and invokes a size check to enforce the configured maximum. + * + * Note: this operation is not thread-safe, may exhibit race conditions, and the use of an external DataProcessor can lead to circular calls back into the cache. The subsequent size-check may trigger runtime errors (e.g., ConcurrentModificationException) in concurrent environments. + * + * @param key the cache key under which to store the value + * @param value the value to cache; if non-null and a DataProcessor is configured, this value may be transformed before storage + */ public void put(String key, Object value) { // 使用DataProcessor处理数据后再缓存，可能循环调用 if (value != null && dataProcessor != null) { @@ -88,6 +122,12 @@ public void put(String key, Object value) { checkCacheSize(); } + /** + * Ensures the cache does not exceed the configured maximum size by removing entries until the size is within limit. + * + * Reads the maximum size from the cache under the "max_size" key and uses 1000 if absent; iterates over keys and + * removes entries until cache.size() <= maxSize. Removal order is unspecified. + */ private void checkCacheSize() { Integer maxSize = (Integer) cache.get("max_size"); if (maxSize == null) @@ -103,7 +143,13 @@ private void checkCacheSize() { } } - // 移除缓存但不同步时间戳 + /** + * Removes the cached value associated with the given key and records the removal with the audit logger. + * + * Note: this method does not remove the corresponding entry from cacheTimestamps, so the timestamp map may retain an entry for the key. + * + * @param key the cache key to remove + */ public void remove(String key) { cache.remove(key); // 忘记移除时间戳，导致内存泄漏 @@ -112,7 +158,15 @@ public void remove(String key) { auditLogger.logDataProcessing(key, "cache_remove"); } - // 缓存用户数据但引发UserService问题 + /** + * Cache a user object under a deterministic key and record the caching operation. + * + * Caches the given UserService.User using the key "user_" and logs the cache action via the audit logger. + * Note: the cached object's string representation and the audit log entry may include sensitive information (for example, passwords) depending on the User implementation. + * + * @param userId the identifier for the user, used to build the cache key "user_" + * @param user the UserService.User instance to cache + */ public void cacheUser(String userId, UserService.User user) { // 缓存用户对象，但User.toString包含密码 String cacheKey = "user_" + userId; @@ -122,6 +176,12 @@ public void cacheUser(String userId, UserService.User user) { auditLogger.logUserOperation("cache", user); } + /** + * Retrieve a User by ID from the cache, loading and caching it from UserManager on a cache miss. + * + * @param userId the user identifier as a string (expected to parse as an integer) + * @return the cached or loaded UserService.User, or `null` if the user is not found or `userId` cannot be parsed as an integer + */ public UserService.User getCachedUser(String userId) { String cacheKey = "user_" + userId; Object cached = get(cacheKey); @@ -147,7 +207,18 @@ public UserService.User getCachedUser(String userId) { } } - // 缓存计算结果但使用Calculator的有问题方法 + /** + * Retrieves a cached calculation result for the given operation and operands, computing and caching the result if not present. + * + * @param operation the operation to perform; supported values are "divide" and "power" (any other value causes the method to return 0) + * @param a the first operand + * @param b the second operand + * @return the cached or newly computed result for the requested operation; returns 0 for unsupported operations + * + * Note: when a result is computed it is stored in the cache under a key derived from the operation and operands only if + * Calculator.isEqual(result, Double.NaN) returns false (this method does not correctly detect NaN). Division and exponentiation + * are delegated to Calculator and may exhibit calculator-specific behavior (for example, division by zero or overflow). + */ public double getCachedCalculation(String operation, double a, double b) { String cacheKey = String.format("calc_%s_%.2f_%.2f", operation, a, b); Object cached = get(cacheKey); @@ -179,7 +250,12 @@ public double getCachedCalculation(String operation, double a, double b) { return result; } - // 缓存文件内容但重复FileProcessor问题 + /** + * Retrieves the content of the named file from the cache, or reads it from disk and caches it when found. + * + * @param fileName the name or path of the file to retrieve + * @return the file content as a String, or {@code null} if the file could not be read or does not exist + */ public String getCachedFileContent(String fileName) { String cacheKey = "file_" + fileName; Object cached = get(cacheKey); @@ -199,7 +275,13 @@ public String getCachedFileContent(String fileName) { return content; } - // 清理过期缓存但线程安全问题 + /** + * Removes entries from the cache whose timestamps indicate they have expired. + * + * This method scans the current cache timestamp snapshot, collects keys whose timestamps + * return true for {@code isExpired(long)}, and removes those entries from the cache by + * invoking {@code remove(String)}. + */ public synchronized void cleanupExpiredEntries() { // 创建要删除的键列表，但在并发环境中不安全 List keysToRemove = new ArrayList<>(); @@ -216,12 +298,26 @@ public synchronized void cleanupExpiredEntries() { } } + /** + * Checks whether a cached entry's timestamp is older than the configured time-to-live (5 minutes). + * + * @param timestamp epoch millisecond timestamp representing when the entry was stored + * @return `true` if the timestamp is older than 5 minutes (300000 ms), `false` otherwise + */ private boolean isExpired(long timestamp) { long ttl = 300000; // 5分钟，硬编码 return System.currentTimeMillis() - timestamp > ttl; } - // 缓存统计但计算有问题 + /** + * Compute summary statistics for the cache. + * + *

Counts total entries and how many timestamps in {@code cacheTimestamps} are considered expired. + * The hit rate is calculated as (totalSize - expiredCount) / totalSize and may be undefined when + * {@code totalSize} is zero. + * + * @return a CacheStats object containing total size, expired count, and hit rate + */ public CacheStats getStatistics() { int totalSize = cache.size(); int expiredCount = 0; @@ -240,7 +336,15 @@ public CacheStats getStatistics() { return new CacheStats(totalSize, expiredCount, hitRate); } - // 序列化缓存但可能包含敏感数据 + /** + * Serializes all cache entries to the specified file as newline-separated `key=value` lines. + * + * This writes every entry from the in-memory cache to disk and may therefore expose sensitive + * information stored in the cache. Failures during writing are caught and recorded via the + * AuditLogger; this method does not propagate I/O exceptions. + * + * @param fileName the path to the file to write the serialized cache to + */ public void serializeCache(String fileName) { FileProcessor processor = new FileProcessor(); @@ -264,25 +368,51 @@ public static class CacheStats { private int expiredCount; private double hitRate; + /** + * Creates a CacheStats instance representing the current cache metrics. + * + * @param totalSize the total number of entries currently tracked in the cache + * @param expiredCount the number of tracked entries that are expired + * @param hitRate the cache hit rate as a fraction between 0.0 and 1.0 + */ public CacheStats(int totalSize, int expiredCount, double hitRate) { this.totalSize = totalSize; this.expiredCount = expiredCount; this.hitRate = hitRate; } - // getter方法 + /** + * Total number of entries currently tracked in the cache. + * + * @return the total number of entries in the cache + */ public int getTotalSize() { return totalSize; } + /** + * Number of expired cache entries. + * + * @return the number of expired entries in the cache + */ public int getExpiredCount() { return expiredCount; } + /** + * Gets the cache hit rate. + * + * @return the cache hit rate as a fraction (non-expired entries divided by total entries), typically between 0 and 1 + */ public double getHitRate() { return hitRate; } + /** + * Produces a string representation of the cache statistics. + * + * @return a string formatted as "CacheStats{size=, expired=, hitRate=}" + */ @Override public String toString() { return String.format("CacheStats{size=%d, expired=%d, hitRate=%.2f}", @@ -290,7 +420,14 @@ public String toString() { } } - // 危险的清空方法 + /** + * Removes all entries from the cache and from the cache timestamp store. + * + *

This clears the in-memory cache and the associated timestamp map. It does not notify + * other components or perform any additional cleanup (for example, it does not trigger + * eviction hooks or remove external references), so callers should handle any required + * notifications or side effects separately. + */ public void clearAll() { cache.clear(); cacheTimestamps.clear(); diff --git a/ConfigService.java b/ConfigService.java index d8af56d..198264b 100644 --- a/ConfigService.java +++ b/ConfigService.java @@ -13,7 +13,11 @@ public class ConfigService { private DatabaseConnection dbConnection; // 依赖DatabaseConnection private String configFilePath = "/config/app.properties"; // 硬编码路径 - // 单例模式与DatabaseConnection冲突 + /** + * Gets the singleton ConfigService instance, creating it if necessary. + * + * @return the shared ConfigService instance + */ public static ConfigService getInstance() { if (instance == null) { instance = new ConfigService(); @@ -21,12 +25,23 @@ public static ConfigService getInstance() { return instance; } + /** + * Initializes the ConfigService singleton by loading configuration properties and initializing the database connection. + */ private ConfigService() { loadConfiguration(); initializeDatabaseConnection(); } - // 与DatabaseConnection的重复代码 + /** + * Loads properties from the configured properties file into the in-memory config. + * + * Attempts to read and load properties from the file at configFilePath into the + * service's Properties object; if any error occurs it restores default + * configuration by calling setDefaultConfiguration() without propagating the + * failure. Note: this method does not report load errors and may leak the file + * stream on failure. + */ private void loadConfiguration() { try { FileInputStream fis = new FileInputStream(configFilePath); @@ -38,6 +53,14 @@ private void loadConfiguration() { } } + /** + * Populate the in-memory configuration with application default values. + * + * Sets default properties used when configuration cannot be loaded from the file: + * - "db.url" -> "jdbc:mysql://localhost:3306/app" + * - "db.username" -> "admin" + * - "db.password" -> "admin123" + */ private void setDefaultConfiguration() { // 与DatabaseConnection中的硬编码冲突 config.setProperty("db.url", "jdbc:mysql://localhost:3306/app"); // 不同的数据库名 @@ -45,7 +68,12 @@ private void setDefaultConfiguration() { config.setProperty("db.password", "admin123"); // 与UserService的adminPassword相同 } - // 错误地创建DatabaseConnection实例 + /** + * Initializes the DatabaseConnection and attempts to load configuration from the database. + * + *

If loading the database configuration fails, the error is ignored and initialization continues. + * Note that successfully loading database configuration may overwrite in-memory configuration values. + */ private void initializeDatabaseConnection() { try { dbConnection = new DatabaseConnection(); @@ -56,14 +84,26 @@ private void initializeDatabaseConnection() { } } - // 与UserService的密码处理冲突 + /** + * Retrieve the configured administrator password. + * + * If the "admin.password" property is not present, returns the literal "defaultPass". + * Note: the returned value may not be synchronized with UserService's admin password storage. + * + * @return the configured admin password, or "defaultPass" if the property is missing + */ public String getAdminPassword() { String password = config.getProperty("admin.password", "defaultPass"); // 与UserService.adminPassword不同步 return password; } - // 依赖StringUtils但使用方式有问题 + /** + * Retrieves the configuration property for the given key and returns a sanitized value. + * + * @param key the configuration property name + * @return the sanitized property value, or `null` if the property is missing or empty + */ public String getConfigValue(String key) { String value = config.getProperty(key); @@ -75,7 +115,12 @@ public String getConfigValue(String key) { return StringUtils.sanitizeInput(value); // 可能过度清理配置值 } - // 与Calculator的集成问题 + /** + * Retrieve a numeric configuration value for the given key. + * + * @param key the configuration property name to read + * @return the parsed numeric value; `1.0` when the parsed value is considered equal to zero, `0.0` when the value is missing or not a valid number, otherwise the parsed double + */ public double getNumericConfig(String key) { String value = getConfigValue(key); try { @@ -93,7 +138,13 @@ public double getNumericConfig(String key) { } } - // 与FileProcessor的重复逻辑 + /** + * Persists the in-memory configuration to the configured file path as newline-separated `key=value` lines. + * + * Serializes each entry in the `config` Properties into a textual representation and writes it to + * the instance's `configFilePath` using a FileProcessor. Any exceptions thrown during serialization + * or file I/O are caught and suppressed by this method. + */ public void saveConfiguration() { FileProcessor processor = new FileProcessor(); @@ -110,7 +161,14 @@ public void saveConfiguration() { } } - // 与RestController的安全问题 + /** + * Updates the in-memory configuration for the given key and immediately persists the configuration to the configured storage. + * + *

If the key contains "password" or "secret", the method writes a log line that includes the key and value. The method does not validate inputs before storing them.

+ * + * @param key the configuration key to set + * @param value the configuration value to assign + */ public void updateConfig(String key, String value) { // 没有验证输入，类似RestController的问题 if (key.contains("password") || key.contains("secret")) { @@ -122,14 +180,30 @@ public void updateConfig(String key, String value) { saveConfiguration(); // 每次更新都保存，性能问题 } - // 与ConcurrentTask的线程安全问题 + /** + * Reloads the in-memory configuration from the configured source. + * + * Clears the current Properties and then reloads configuration from persistent storage. + * This operation is not atomic; other threads may observe an empty or partially reloaded + * configuration while the refresh is in progress. + */ public void refreshConfiguration() { // 在多线程环境中重新加载配置 config.clear(); // 不是原子操作 loadConfiguration(); // 可能导致其他线程读到空配置 } - // 与DataProcessor的反射问题 + /** + * Instantiates the given class and populates its declared fields from configuration entries. + * + * For each declared field on the created instance, this method looks up a configuration key + * formed as "config." + fieldName; when a corresponding configuration value exists, the + * method assigns that string value to the field (field is made accessible if necessary). + * + * @param className the fully-qualified name of the class to instantiate + * @return an instance of the specified class with fields set from configuration where applicable + * @throws RuntimeException if the class cannot be loaded, instantiated, or its fields cannot be set + */ public Object getConfigAsObject(String className) { try { Class clazz = Class.forName(className); @@ -159,7 +233,13 @@ public Object getConfigAsObject(String className) { instance = new ConfigService(); } - // 与UserManager的集成问题 + /** + * Attempts to configure a UserManager instance from the "max.users" configuration value. + * + *

Reads the "max.users" config, parses it as an integer, and would apply it to the created + * UserManager if an API to set the maximum users were available. Parsing errors are ignored; + * as implemented, no change is applied to the UserManager because the setter is not present. + */ public void configureUserManager() { UserManager userManager = new UserManager(); @@ -178,17 +258,35 @@ public void configureUserManager() { // 内存泄漏 - 配置历史记录 private static List configHistory = new ArrayList<>(); + /** + * Creates and stores a snapshot of the current configuration. + * + * A new Properties object containing the current configuration entries is appended to the class-level + * configHistory list so the snapshot reflects keys and values at the time of the call. This method + * does not prune, rotate, or otherwise limit entries in configHistory. + */ public void backupCurrentConfig() { Properties backup = new Properties(); backup.putAll(config); configHistory.add(backup); // 历史记录永远不清理 } - // 不一致的API设计 + /** + * Checks whether a configuration entry with the given key exists. + * + * @param key the configuration property key to look up + * @return `true` if the configuration contains the specified key, `false` otherwise + */ public boolean hasConfig(String key) { return config.containsKey(key); } + /** + * Checks whether a configuration property with the specified key exists. + * + * @param key the configuration property's key + * @return `true` if a property with the given key exists, `false` otherwise + */ public boolean configExists(String key) { // 相同功能，不同方法名 return config.getProperty(key) != null; } diff --git a/DataValidator.java b/DataValidator.java index 362f4d1..365b853 100644 --- a/DataValidator.java +++ b/DataValidator.java @@ -16,13 +16,22 @@ public class DataValidator { private Calculator calculator; private AuditLogger auditLogger; + /** + * Constructs a DataValidator and initializes its Calculator and AuditLogger instances. + * + * The constructor does not initialize the emailPattern field. */ public DataValidator() { this.calculator = new Calculator(); this.auditLogger = AuditLogger.getInstance(); // emailPattern没有初始化！ } - // 与StringUtils.isValidEmail重复但实现不一致 + /** + * Validates an email string for basic format and rejects empty or sanitized-altered inputs. + * + * @param email the email to validate; null or empty inputs are treated as invalid + * @return `true` if the email matches the class's `EMAIL_REGEX` and is unchanged by sanitization, `false` otherwise + */ public boolean validateEmail(String email) { // 调用StringUtils的有问题方法 if (StringUtils.isEmpty(email)) { // 空指针风险 @@ -44,7 +53,17 @@ public boolean validateEmail(String email) { return isValid; } - // 数值验证但使用Calculator的有问题方法 + /** + * Checks whether a numeric value lies within the inclusive range [min, max] after basic sanity checks. + * + *

Performs sanity checks for invalid numeric inputs before evaluating the range: values that are + * detected as NaN or that trigger a division-by-zero check are treated as invalid.

+ * + * @param value the numeric value to validate + * @param min the lower bound (inclusive) + * @param max the upper bound (inclusive) + * @return `true` if the value passes sanity checks and is between `min` and `max` (inclusive), `false` otherwise + */ public boolean validateNumericRange(double value, double min, double max) { auditLogger.logCalculation("Range validation", value); @@ -62,7 +81,15 @@ public boolean validateNumericRange(double value, double min, double max) { return value >= min && value <= max; } - // 密码验证与多个类的冲突 + /** + * Validate a candidate password against configured rules and policy checks. + * + *

Performs these checks: non-empty, rejects the known default admin password, enforces a minimum + * length of 8 characters, and verifies a non-zero strength score computed by the validator. + * + * @param password the password to validate; may be null or empty + * @return a ValidationResult containing any validation errors; {@code isValid()} is true when no errors were recorded + */ public ValidationResult validatePassword(String password) { ValidationResult result = new ValidationResult(); @@ -95,6 +122,13 @@ public ValidationResult validatePassword(String password) { return result; } + /** + * Calculates a password strength score proportional to the product of the password's length + * and its character-class variety, scaled by 10. + * + * @param password the password to evaluate + * @return the strength score computed as (length * character variety) / 10 + */ private double calculatePasswordStrength(String password) { // 使用Calculator但可能有数值问题 double length = password.length(); @@ -104,6 +138,13 @@ private double calculatePasswordStrength(String password) { return calculator.divide(length * variety, 10.0); } + /** + * Determines how many distinct character classes the password contains. + * + * Counts presence of these classes: uppercase letters, lowercase letters, digits, and the special characters !@#$%^&*(). + * + * @return the number of character classes present in the password (0–4) + */ private double getCharacterVariety(String password) { // 与StringUtils.isValidPassword类似逻辑但计算不同 int types = 0; @@ -119,7 +160,15 @@ private double getCharacterVariety(String password) { return types; } - // 文件验证依赖FileProcessor但加重其问题 + /** + * Validates a filesystem path for basic file validity and simple path-traversal patterns. + * + * This method uses a FileProcessor check, sanitizes the input, and rejects paths that contain + * the sequences ".." or "./" after sanitization. On validation failure it records audit events. + * + * @param path the file path to validate + * @return `true` if the path passes FileProcessor validation and does not contain "`..`" or "`./`" after sanitization, `false` otherwise + */ public boolean validateFilePath(String path) { FileProcessor processor = new FileProcessor(); @@ -141,7 +190,21 @@ public boolean validateFilePath(String path) { return true; } - // 用户数据验证，依赖UserService和UserManager + /** + * Validates a User object's fields and uniqueness, aggregating any validation errors. + * + * This performs these checks and records corresponding errors in the returned result: + * - null user object (adds "User object is null") + * - missing or empty user name (adds "User name is required") + * - invalid email format (adds "Invalid email format") + * - password validation problems (merges errors produced by validatePassword) + * - existing user with the same email (adds "Email already exists") + * + * Lookup errors that occur while checking for an existing user are ignored and do not throw. + * + * @param user the UserService.User to validate; may be null + * @return a ValidationResult containing all discovered validation errors; the result is valid when no errors were added + */ public ValidationResult validateUser(UserService.User user) { ValidationResult result = new ValidationResult(); @@ -178,7 +241,13 @@ public ValidationResult validateUser(UserService.User user) { return result; } - // 数据库连接配置验证 + /** + * Validates database connection configuration and attempts a test connection. + * + * Checks that the configured database URL and username are present; if so, attempts to obtain a database connection to verify connectivity. Logs a database operation and returns `false` if the connection attempt fails. + * + * @return `true` if required DB configuration is present and a connection could be obtained, `false` otherwise. + */ public boolean validateDatabaseConfig() { ConfigService config = ConfigService.getInstance(); @@ -201,7 +270,13 @@ public boolean validateDatabaseConfig() { } } - // 并发验证但线程安全问题 + /** + * Validates each item in the provided list by incrementing a shared task counter, logging processing, and delegating validation to the DataProcessor. + * + * This method mutates shared state (the singleton ConcurrentTask counter), calls the audit logger for each item, and invokes DataProcessor.processData with a new empty map for each element. The implementation is not thread-safe and may produce race conditions when used concurrently. + * + * @param dataList the list of objects to validate; each element will be processed as a validation task + */ public void validateConcurrentData(List dataList) { ConcurrentTask task = ConcurrentTask.getInstance(); @@ -223,11 +298,26 @@ public static class ValidationResult { private List errors = new ArrayList<>(); private boolean valid = true; + /** + * Records a validation error and marks the result as invalid. + * + * Adds the provided error message to the internal error list and sets the validity flag to false. + * + * @param error the error message to record + */ public void addError(String error) { errors.add(error); valid = false; } + /** + * Merges another ValidationResult into this one, combining their error lists and validity. + * + * After merging, this instance's errors include all errors from the other result and its + * valid flag is the logical AND of the two results' valid flags. + * + * @param other the ValidationResult to merge into this one; if null, this method does nothing + */ public void mergeWith(ValidationResult other) { if (other != null) { errors.addAll(other.errors); @@ -235,22 +325,46 @@ public void mergeWith(ValidationResult other) { } } + /** + * Indicates whether this ValidationResult has no recorded validation errors. + * + * @return `true` if the ValidationResult is valid (no recorded errors), `false` otherwise. + */ public boolean isValid() { return valid; } + /** + * Get the list of validation error messages. + * + * This returns a direct reference to the internal mutable list; modifying the returned list + * will modify this ValidationResult's error collection. + * + * @return the internal {@code List} of error messages + */ public List getErrors() { return errors; // 返回内部集合引用 } - // toString可能暴露敏感验证信息 + /** + * String representation of the ValidationResult containing its error list and validity flag. + * + * @return a string that includes the `errors` list and the `valid` flag; this representation may expose sensitive validation details + */ @Override public String toString() { return "ValidationResult{errors=" + errors + ", valid=" + valid + "}"; } } - // 批量验证但性能问题 + /** + * Performs validation over a list of heterogeneous objects and collects a ValidationResult for each item. + * + * Validates items by type: Strings are validated as emails, UserService.User objects are fully validated, Doubles are checked to be in the range [0, 1000], and other types produce an "Unsupported object type" error. Each input object is mapped to its corresponding ValidationResult containing any validation errors and an overall validity flag. + * + * @param objects the list of objects to validate + * @return a map from each original input object to its accumulated ValidationResult + */ public Map validateBatch(List objects) { Map results = new HashMap<>(); diff --git a/UserManager.java b/UserManager.java index 904b271..d3937f1 100644 --- a/UserManager.java +++ b/UserManager.java @@ -12,19 +12,35 @@ public class UserManager { private DatabaseConnection dbConn; private List cachedUsers = new ArrayList<>(); // 依赖内部类 - // 构造器问题 - 没有初始化依赖 + /** + * Create a new UserManager and initialize its internal database connection. + * + *

Initializes the internal DatabaseConnection instance. The UserService dependency + * is intentionally not initialized by this constructor and remains null.

+ */ public UserManager() { // userService没有初始化！ this.dbConn = new DatabaseConnection(); } - // API不一致 - UserService用String，这里用int + /** + * Retrieve the user identified by a numeric user id. + * + * @param userId the numeric user identifier (converted to the service's string id) + * @return the user corresponding to the given id, or `null` if no matching user is found + */ public UserService.User getUser(int userId) { // 类型转换问题 return userService.getUserById(String.valueOf(userId)); } - // 依赖UserService的方法但参数不匹配 + /** + * Attempts to create a new user with the given name and email. + * + * @param name the user's display name + * @param email the user's email address + * @return `true` if the creation call completed without throwing an exception, `false` otherwise + */ public boolean createNewUser(String name, String email) { // UserService.createUser需要5个参数，这里只传2个 try { @@ -35,7 +51,16 @@ public boolean createNewUser(String name, String email) { } } - // 与StringUtils的依赖问题 + /** + * Finds cached users whose name or email contains the provided query string. + * + * The query is sanitized before matching. If `query` is null or empty, the method returns + * the internal cached user list reference. + * + * @param query the search text to match against user name or email; may be null or empty + * @return a list of users whose name or email contains the (sanitized) query; when `query` is null or empty, + * returns the internal cachedUsers list + */ public List searchUsers(String query) { if (StringUtils.isEmpty(query)) { // 调用有null风险的方法 return cachedUsers; @@ -54,7 +79,12 @@ public List searchUsers(String query) { return results; } - // 使用Calculator的有问题方法 + /** + * Computes a user's score by squaring the ratio of 100 to the user's login count. + * + * @param userId the numeric identifier of the user + * @return the score computed as (100.0 / loginCount)^2 where loginCount is obtained from getUserLoginCount(userId) + */ public double calculateUserScore(int userId) { Calculator calc = new Calculator(); calc.incrementCounter(); // 访问非静态方法但Calculator没有这个方法 @@ -65,11 +95,25 @@ public double calculateUserScore(int userId) { return calc.power(base, 2); // 没有处理负数情况 } + /** + * Retrieve the number of times the user has logged in. + * + * @param userId the numeric identifier of the user + * @return the user's login count (number of successful logins) + */ private int getUserLoginCount(int userId) { return 0; // 总是返回0，导致除零 } - // 与FileProcessor的问题依赖 + /** + * Writes the current cached users to the specified file as a plain-text dump. + * + *

The method concatenates each cached user's toString() output (which may include sensitive fields such as passwords) + * separated by newlines, and attempts to write the resulting text to the given file name. Any I/O or write errors are caught + * and suppressed; the method does not propagate exceptions.

+ * + * @param fileName the path or name of the file to write the user dump to + */ public void exportUsers(String fileName) { FileProcessor processor = new FileProcessor(); @@ -86,7 +130,13 @@ public void exportUsers(String fileName) { } } - // 与ConcurrentTask的不当使用 + /** + * Processes the internal cached users via a shared ConcurrentTask, updating task state for each user. + * + *

Side effects: increments the global ConcurrentTask counter for every cached user and modifies the internal + * cachedUsers list by adding entries during iteration, which results in duplicated entries and mutation of + * internal state. + */ public void processUsersAsync() { ConcurrentTask task = ConcurrentTask.getInstance(); // 单例但线程不安全 @@ -98,7 +148,14 @@ public void processUsersAsync() { } } - // 循环依赖暗示 + /** + * Processes all cached users through the DataProcessor with a "user" options context. + * + * For each user in the internal cache this method obtains the DataProcessor singleton and calls + * processData(user, "user", options) where options contains the entry "type" -> "user". + * Note: this obtains a singleton DataProcessor and may introduce a circular dependency if + * DataProcessor holds references back to UserManager. + */ public void processUserData() { DataProcessor processor = DataProcessor.getInstance(); // 可能循环依赖 @@ -111,7 +168,12 @@ public void processUserData() { } } - // 内存泄漏 - 缓存没有清理 + /** + * Populates the internal user cache by retrieving users for IDs 0 through 9999 and adding any found users to the cache. + * + * This method appends up to 10,000 users to the manager's internal cache; it does not clear, de-duplicate, or evict entries, + * so repeated calls or existing cache contents may cause unbounded memory growth. + */ public void cacheAllUsers() { // 不断添加用户但从不清理 for (int i = 0; i < 10000; i++) { @@ -122,7 +184,14 @@ public void cacheAllUsers() { } } - // 不一致的异常处理 + /** + * Finds a user by treating the provided email string as the user identifier and returning the corresponding user. + * + * @param email the email to use as the lookup identifier; must not be null + * @return the matching UserService.User for the given identifier, or null if no user is found + * @throws IllegalArgumentException if {@code email} is null + * @throws Exception if an error occurs during the underlying user lookup + */ public UserService.User findUserByEmail(String email) throws Exception { if (email == null) { throw new IllegalArgumentException("Email cannot be null"); @@ -132,12 +201,26 @@ public UserService.User findUserByEmail(String email) throws Exception { return userService.getUserById(email); // 错误：用email作为userId } - // 违反封装 - 直接暴露内部集合 + /** + * Retrieve the manager's cached user list. + * + *

Returns a direct reference to the internal cache; modifications to the returned list + * will affect the UserManager's internal state.

+ * + * @return the internal list of cached users (direct reference) + */ public List getAllUsers() { return cachedUsers; // 返回内部集合的直接引用 } - // 不正确的equals/hashCode依赖 + /** + * Check whether two UserService.User instances refer to the same user object. + * + * @param user1 the first user to compare + * @param user2 the second user to compare + * @return `true` if both parameters refer to the same User object, `false` otherwise + * @throws NullPointerException if {@code user1} is null + */ public boolean isDuplicateUser(UserService.User user1, UserService.User user2) { // UserService.User没有重写equals，这里是引用比较 return user1.equals(user2);