SONARJAVA-4473 Check that mutable member storage is reachable by public calls for S2384 (#5130)

This is to be more precise and avoid false positives where the storage only happens in private methods, and calls to this private methods by public ones are protected in some way. We also want to reduce false negatives compared to the naive solution to entirely ignore private methods.

Author: romainbrenguier

its/ruling/src/test/resources/eclipse-jetty-similar-to-main/java-S2384.json

@@ -27,8 +27,12 @@
 45
 ],
 "org.eclipse.jetty:jetty-project:jetty-io/src/main/java/org/eclipse/jetty/io/WriteFlusher.java": [
+217,
 223
 ],
+"org.eclipse.jetty:jetty-project:jetty-io/src/main/java/org/eclipse/jetty/io/ssl/SslClientConnectionFactory.java": [
+148
+],
 "org.eclipse.jetty:jetty-project:jetty-jmx/src/main/java/org/eclipse/jetty/jmx/MetaData.java": [
 73
 ],
@@ -84,7 +88,8 @@
 196
 ],
 "org.eclipse.jetty:jetty-project:jetty-server/src/main/java/org/eclipse/jetty/server/SecureRequestCustomizer.java": [
-354
+354,
+441
 ],
 "org.eclipse.jetty:jetty-project:jetty-server/src/main/java/org/eclipse/jetty/server/handler/ContextHandler.java": [
 343,

its/ruling/src/test/resources/eclipse-jetty/java-S2384.json

@@ -27,8 +27,12 @@
 45
 ],
 "org.eclipse.jetty:jetty-project:jetty-io/src/main/java/org/eclipse/jetty/io/WriteFlusher.java": [
+217,
 223
 ],
+"org.eclipse.jetty:jetty-project:jetty-io/src/main/java/org/eclipse/jetty/io/ssl/SslClientConnectionFactory.java": [
+148
+],
 "org.eclipse.jetty:jetty-project:jetty-jmx/src/main/java/org/eclipse/jetty/jmx/MetaData.java": [
 73
 ],
@@ -84,7 +88,8 @@
 196
 ],
 "org.eclipse.jetty:jetty-project:jetty-server/src/main/java/org/eclipse/jetty/server/SecureRequestCustomizer.java": [
-354
+354,
+441
 ],
 "org.eclipse.jetty:jetty-project:jetty-server/src/main/java/org/eclipse/jetty/server/handler/ContextHandler.java": [
 343,

its/ruling/src/test/resources/guava/java-S2384.json

@@ -7,6 +7,7 @@
 4498
 ],
 "com.google.guava:guava:src/com/google/common/collect/AbstractBiMap.java": [
+63,
 69,
 96
 ],
@@ -31,6 +32,12 @@
 "com.google.guava:guava:src/com/google/common/collect/HashBiMap.java": [
 684
 ],
+"com.google.guava:guava:src/com/google/common/collect/ImmutableEnumMap.java": [
+52
+],
+"com.google.guava:guava:src/com/google/common/collect/ImmutableEnumSet.java": [
+57
+],
 "com.google.guava:guava:src/com/google/common/collect/ImmutableMapEntrySet.java": [
 42
 ],
@@ -78,9 +85,11 @@
 1146
 ],
 "com.google.guava:guava:src/com/google/common/collect/TreeRangeSet.java": [
-268
+268,
+433
 ],
 "com.google.guava:guava:src/com/google/common/collect/WellBehavedMap.java": [
+43,
 57
 ],
 "com.google.guava:guava:src/com/google/common/escape/ArrayBasedEscaperMap.java": [

its/ruling/src/test/resources/sonar-server/java-S2384.json

@@ -162,6 +162,7 @@
 126
 ],
 "org.sonarsource.sonarqube:sonar-server:src/main/java/org/sonar/server/exceptions/BadRequestException.java": [
+38,
 52
 ],
 "org.sonarsource.sonarqube:sonar-server:src/main/java/org/sonar/server/favorite/ws/FavoritesWs.java": [
@@ -212,6 +213,7 @@
 ],
 "org.sonarsource.sonarqube:sonar-server:src/main/java/org/sonar/server/issue/Result.java": [
 70,
+95,
 119
 ],
 "org.sonarsource.sonarqube:sonar-server:src/main/java/org/sonar/server/issue/index/IssueIteratorForSingleChunk.java": [
@@ -276,6 +278,9 @@
 "org.sonarsource.sonarqube:sonar-server:src/main/java/org/sonar/server/metric/ws/MetricsWs.java": [
 31
 ],
+"org.sonarsource.sonarqube:sonar-server:src/main/java/org/sonar/server/metric/ws/SearchAction.java": [
+98
+],
 "org.sonarsource.sonarqube:sonar-server:src/main/java/org/sonar/server/notification/DefaultNotificationManager.java": [
 59
 ],
@@ -293,6 +298,7 @@
 28
 ],
 "org.sonarsource.sonarqube:sonar-server:src/main/java/org/sonar/server/permission/ApplyPermissionTemplateQuery.java": [
+34,
 47
 ],
 "org.sonarsource.sonarqube:sonar-server:src/main/java/org/sonar/server/permission/index/PermissionIndexer.java": [
@@ -347,9 +353,15 @@
 "org.sonarsource.sonarqube:sonar-server:src/main/java/org/sonar/server/project/Visibility.java": [
 68
 ],
+"org.sonarsource.sonarqube:sonar-server:src/main/java/org/sonar/server/project/ws/GhostsAction.java": [
+149
+],
 "org.sonarsource.sonarqube:sonar-server:src/main/java/org/sonar/server/project/ws/ProjectsWs.java": [
 32
 ],
+"org.sonarsource.sonarqube:sonar-server:src/main/java/org/sonar/server/project/ws/ProvisionedAction.java": [
+150
+],
 "org.sonarsource.sonarqube:sonar-server:src/main/java/org/sonar/server/project/ws/SearchMyProjectsData.java": [
 106,
 111,

java-checks-test-sources/default/src/main/java/checks/MutableMembersUsageCheckSample.java

@@ -564,16 +564,58 @@ public List<String> modifiable() {
 
 class SetThroughPrivateMethods {
   private byte[] buf;
-  private SetThroughPrivateMethods(final byte[] buf) {
-    this.buf = buf;  // Compliant: the constructor is private
+  private Map<String, String> map;
+  private List<Integer> list;
+
+  private SetThroughPrivateMethods(final byte[] buf, final Map<String, String> map) {
+    this.map = map; // Noncompliant
+    this.buf = buf; // Compliant: callers have to go through `of` which makes a clone of the parameter
+    this.list = new ArrayList<>(); // Compliant: not set from a parameter of this method
   }
 
   public static SetThroughPrivateMethods of(final byte[] buf) {
-    return new SetThroughPrivateMethods(buf.clone());
+    return new SetThroughPrivateMethods(buf.clone(), Collections.emptyMap());
+  }
+
+  public static SetThroughPrivateMethods of(final byte[] buf, final int off, final int len) {
+    return of(buf);
   }
 
-  public void set(final byte[] buf) {
+  private void set(final byte[] buf) {
+    // It is possible to call `set` from outside the class using `setBuf`
     this.buf = buf;  // Noncompliant
   }
 
+  private void setBuffer(final byte[] buf) {
+    set(buf);
+  }
+
+  public void setBuf(byte[] buf) {
+    setBuffer(buf);
+  }
+
+  private void internalSet(byte[] buf) {
+    this.buf = buf; // Compliant: this is only callable by private methods
+  }
+
+  private void internalSetBuffer(byte[] buf) {
+    internalSet(buf);
+  }
+
+  static SetThroughPrivateMethods ofMap(final Map<String, String> map) {
+    return new SetThroughPrivateMethods(null, map);
+  }
+
+  public void cycle(List<Integer> l){
+    cycleA(l, 5);
+  }
+  private void cycleA(List<Integer> l, int i){
+    cycleB(l, i);
+  }
+  private void cycleB(List<Integer> l, int i){
+    if (i > 0) {
+      cycleA(l, i - 1);
+    }
+    list = l; // Noncompliant
+  }
 }