SONARJAVA-1212 Added getInstance other signatures

Author: Wohops

java-checks/src/main/java/org/sonar/java/checks/DeprecatedHashAlgorithmCheck.java

@@ -27,6 +27,7 @@
 import org.sonar.check.Rule;
 import org.sonar.java.checks.methods.AbstractMethodDetection;
 import org.sonar.java.checks.methods.MethodMatcher;
+import org.sonar.java.checks.methods.TypeCriteria;
 import org.sonar.java.model.LiteralUtils;
 import org.sonar.plugins.java.api.tree.ExpressionTree;
 import org.sonar.plugins.java.api.tree.IdentifierTree;
@@ -49,8 +50,9 @@
 @SqaleConstantRemediation("30min")
 public class DeprecatedHashAlgorithmCheck extends AbstractMethodDetection {
 
+  private static final String JAVA_LANG_STRING = "java.lang.String";
   private static final String MD5 = "MD5";
-  private static final String SHA1 = "SHA-1";
+  private static final String SHA1 = "SHA1";
 
   private static final Map<String, String> ALGORITHM_BY_METHOD_NAME = ImmutableMap.<String, String>builder()
     .put("getMd5Digest", MD5)
@@ -70,11 +72,16 @@ protected List<MethodMatcher> getMethodInvocationMatchers() {
       .add(MethodMatcher.create()
         .typeDefinition("java.security.MessageDigest")
         .name("getInstance")
-        .addParameter("java.lang.String"))
+        .addParameter(JAVA_LANG_STRING))
+      .add(MethodMatcher.create()
+        .typeDefinition("java.security.MessageDigest")
+        .name("getInstance")
+        .addParameter(JAVA_LANG_STRING)
+        .addParameter(TypeCriteria.anyType()))
       .add(MethodMatcher.create()
         .typeDefinition("org.apache.commons.codec.digest.DigestUtils")
         .name("getDigest")
-        .addParameter("java.lang.String"));
+        .addParameter(JAVA_LANG_STRING));
     for (String methodName : ALGORITHM_BY_METHOD_NAME.keySet()) {
       builder.add(MethodMatcher.create()
         .typeDefinition("org.apache.commons.codec.digest.DigestUtils")
@@ -94,30 +101,31 @@ protected void onMethodInvocationFound(MethodInvocationTree mit) {
     String methodName = methodName(mit);
     String algorithm = ALGORITHM_BY_METHOD_NAME.get(methodName);
     if (algorithm == null) {
-      List<ExpressionTree> arguments = mit.arguments();
-      algorithm = algorithm(arguments.get(0));
+      algorithm = algorithm(mit.arguments().get(0));
     }
-    if (MD5.equals(algorithm) || SHA1.equals(algorithm)) {
-      addIssue(mit, "Use a stronger encryption algorithm than " + algorithm + ".");
+    boolean isMd5 = MD5.equalsIgnoreCase(algorithm);
+    boolean isSha1 = SHA1.equalsIgnoreCase(algorithm);
+    if (isMd5 || isSha1) {
+      String msgAlgo = isSha1 ? "SHA-1" : algorithm;
+      addIssue(mit, "Use a stronger encryption algorithm than " + msgAlgo + ".");
     }
   }
 
   private static String methodName(MethodInvocationTree mit) {
     String name = null;
     ExpressionTree methodSelect = mit.methodSelect();
     if (methodSelect.is(Tree.Kind.MEMBER_SELECT)) {
-      MemberSelectExpressionTree memberSelectExpressionTree = (MemberSelectExpressionTree) methodSelect;
-      name = memberSelectExpressionTree.identifier().name();
+      name = ((MemberSelectExpressionTree) methodSelect).identifier().name();
     } else if (methodSelect.is(Tree.Kind.IDENTIFIER)) {
-      IdentifierTree identifier = (IdentifierTree) methodSelect;
-      name = identifier.name();
+      name = ((IdentifierTree) methodSelect).name();
     }
     return name;
   }
 
   private static String algorithm(ExpressionTree invocationArgument) {
     if (invocationArgument.is(Tree.Kind.STRING_LITERAL)) {
-      return LiteralUtils.trimQuotes(((LiteralTree) invocationArgument).value());
+      String algo = LiteralUtils.trimQuotes(((LiteralTree) invocationArgument).value());
+      return algo.replaceAll("-", "");
     }
     return null;
   }

java-checks/src/test/files/checks/DeprecatedHashAlgorithmCheck.java

@@ -1,9 +1,10 @@
 import java.security.MessageDigest;
+import java.security.Provider;
 import org.apache.commons.codec.digest.DigestUtils;
 import static org.apache.commons.codec.digest.DigestUtils.md5Hex;
 
 class A {
-  void myMethod(String algorithm) {
+  void myMethod(String algorithm, Provider provider) {
     MessageDigest md = null;
     md = MessageDigest.getInstance("MD5"); // Noncompliant {{Use a stronger encryption algorithm than MD5.}}
     md = MessageDigest.getInstance("SHA-1"); // Noncompliant {{Use a stronger encryption algorithm than SHA-1.}}
@@ -29,6 +30,9 @@ void myMethod(String algorithm) {
     com.google.common.hash.Hashing.md5(); // Noncompliant
     com.google.common.hash.Hashing.sha1(); // Noncompliant
     com.google.common.hash.Hashing.sha256();
+    md = MessageDigest.getInstance("MD5", provider); // Noncompliant
+    md = MessageDigest.getInstance("SHA1", "provider"); // Noncompliant
+    md = MessageDigest.getInstance("sha-1", "provider"); // Noncompliant
   }
 
-}
+}