Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

📝 完善帮助文档 #657

Merged
merged 5 commits into from
Oct 17, 2022
Merged

📝 完善帮助文档 #657

Show file tree
Hide file tree
Changes from 4 commits
Commits
Show all changes
5 commits
Select commit Hold shift + click to select a range
b4c6ab2
Merge branch 'main' of https://github.com/yalechen-cyw/CodeAnalysis
cyw3 Oct 14, 2022
a3fdc90
:memo: 完善帮助文档
cyw3 Oct 14, 2022
0036e1d
:memo: 调整url
cyw3 Oct 14, 2022
683d84d
:memo: 调整url
cyw3 Oct 14, 2022
1a0c5b2
:art: update tca.yml
cyw3 Oct 17, 2022
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
477 changes: 454 additions & 23 deletions doc/en/guide/代码检查/工具/TCA-Armory-C1.md
View file
Open in desktop

Large diffs are not rendered by default.

32 changes: 32 additions & 0 deletions doc/en/guide/代码检查/规则包/code_spec_oc.md
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,32 @@

# 【Objective-C】代码规范规则包

该规则包针对 Objective-C/C++ 语言进行代码规范相关检查。

## 规则列表

- [ObjectiveC/Copyright](https://tencent.github.io/CodeAnalysis/en/guide/代码检查/工具/TCA-Armory-C1.html#ObjectiveC/Copyright)
- [ObjectiveC/Indent](https://tencent.github.io/CodeAnalysis/en/guide/代码检查/工具/TCA-Armory-C1.html#ObjectiveC/Indent)
- [ObjectiveC/MaxLinesPerFunction](https://tencent.github.io/CodeAnalysis/en/guide/代码检查/工具/TCA-Armory-C1.html#ObjectiveC/MaxLinesPerFunction)
- [ObjectiveC/MissingDocInterface](https://tencent.github.io/CodeAnalysis/en/guide/代码检查/工具/TCA-Armory-C1.html#ObjectiveC/MissingDocInterface)
- [ObjectiveC/MissingDocProperty](https://tencent.github.io/CodeAnalysis/en/guide/代码检查/工具/TCA-Armory-C1.html#ObjectiveC/MissingDocProperty)
- [ObjectiveC/MissingDocProtocol](https://tencent.github.io/CodeAnalysis/en/guide/代码检查/工具/TCA-Armory-C1.html#ObjectiveC/MissingDocProtocol)
- [ObjectiveC/ParameterCount](https://tencent.github.io/CodeAnalysis/en/guide/代码检查/工具/TCA-Armory-C1.html#ObjectiveC/ParameterCount)
- [ObjectiveC/ClassNaming](https://tencent.github.io/CodeAnalysis/en/guide/代码检查/工具/TCA-Armory-C1.html#ObjectiveC/ClassNaming)
- [ObjectiveC/FunctionNaming](https://tencent.github.io/CodeAnalysis/en/guide/代码检查/工具/TCA-Armory-C1.html#ObjectiveC/FunctionNaming)
- [ObjectiveC/GlobalVariableNaming](https://tencent.github.io/CodeAnalysis/en/guide/代码检查/工具/TCA-Armory-C1.html#ObjectiveC/GlobalVariableNaming)
- [ObjectiveC/LocalVariableNaming](https://tencent.github.io/CodeAnalysis/en/guide/代码检查/工具/TCA-Armory-C1.html#ObjectiveC/LocalVariableNaming)
- [ObjectiveC/MacroNaming](https://tencent.github.io/CodeAnalysis/en/guide/代码检查/工具/TCA-Armory-C1.html#ObjectiveC/MacroNaming)
- [ObjectiveC/MethodNaming](https://tencent.github.io/CodeAnalysis/en/guide/代码检查/工具/TCA-Armory-C1.html#ObjectiveC/MethodNaming)
- [ObjectiveC/ParameterNaming](https://tencent.github.io/CodeAnalysis/en/guide/代码检查/工具/TCA-Armory-C1.html#ObjectiveC/ParameterNaming)
- [ObjectiveC/MaxLineLength](https://tencent.github.io/CodeAnalysis/en/guide/代码检查/工具/TCA-Armory-C1.html#ObjectiveC/MaxLineLength)

## 启用规则包
分析方案 -> 代码检查 ->【Objective-C】代码规范规则包 -> 启用/查看规则。

## 格式化工具
为了帮助你正确地格式化代码，我们建议你使用clang-format进行代码自动格式化。工具可直接通过 Homebrew 进行安装：
```bash
brew install clang-format
```
安装完成后将 .clang-format 配置文件置于工程根目录，执行 clang-format -i FILE.m 即可完成自动格式化。目前格式化工具配置仅支持11.0版本。
19 changes: 9 additions & 10 deletions doc/en/guide/代码检查/规则包/cpp_doc.md
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,13 +1,12 @@
# Cpp代码质量缺陷规则包
# 【C/C++】代码质量缺陷规则包
采用自研工具检查Cpp代码缺陷，需要使用license；属于 TCA 增强分析模块的能力之一，请参考[增强分析模块部署](https://tencent.github.io/CodeAnalysis/zh/quickStarted/enhanceDeploy.html)文档进行部署。

## 规则列表

## 规则

- [array_overflow](https://tencent.github.io/CodeAnalysis/zh/guide/代码检查/工具/TCA-Armory-Q1.html#array_overflow)
- [buff_overflow](https://tencent.github.io/CodeAnalysis/zh/guide/代码检查/工具/TCA-Armory-Q1.html#buff_overflow)
- [dead_lock](https://tencent.github.io/CodeAnalysis/zh/guide/代码检查/工具/TCA-Armory-Q1.html#dead_lock)
- [func_ret_null](https://tencent.github.io/CodeAnalysis/zh/guide/代码检查/工具/TCA-Armory-Q1.html#func_ret_null)
- [missing_lock](https://tencent.github.io/CodeAnalysis/zh/guide/代码检查/工具/TCA-Armory-Q1.html#missing_lock)
- [resource_leak](https://tencent.github.io/CodeAnalysis/zh/guide/代码检查/工具/TCA-Armory-Q1.html#resource_leak)
- [unused_value](https://tencent.github.io/CodeAnalysis/zh/guide/代码检查/工具/TCA-Armory-Q1.html#unused_value)
- [array_overflow](https://tencent.github.io/CodeAnalysis/en/guide/代码检查/工具/TCA-Armory-Q1.html#array_overflow)
- [buff_overflow](https://tencent.github.io/CodeAnalysis/en/guide/代码检查/工具/TCA-Armory-Q1.html#buff_overflow)
- [dead_lock](https://tencent.github.io/CodeAnalysis/en/guide/代码检查/工具/TCA-Armory-Q1.html#dead_lock)
- [func_ret_null](https://tencent.github.io/CodeAnalysis/en/guide/代码检查/工具/TCA-Armory-Q1.html#func_ret_null)
- [missing_lock](https://tencent.github.io/CodeAnalysis/en/guide/代码检查/工具/TCA-Armory-Q1.html#missing_lock)
- [resource_leak](https://tencent.github.io/CodeAnalysis/en/guide/代码检查/工具/TCA-Armory-Q1.html#resource_leak)
- [unused_value](https://tencent.github.io/CodeAnalysis/en/guide/代码检查/工具/TCA-Armory-Q1.html#unused_value)
137 changes: 7 additions & 130 deletions doc/en/guide/代码检查/规则包/enhanced_safety_java.md
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,133 +1,10 @@
# 【Java】强化安全规则包-使用手册
# 【Java】强化安全规则包
针对 Java 语言的强化代码安全规则包，属于 TCA 增强分析模块的能力之一，请参考[增强分析模块部署](https://tencent.github.io/CodeAnalysis/zh/quickStarted/enhanceDeploy.html)文档进行部署。

## 规则列表

## CmdInject
### 概述
支持的语言：Java

CmdInject 规则用于检查代码中是否存在[`命令行注入漏洞`](https://owasp.org/www-community/attacks/Command_Injection)。
当使用 childprocess 等模块执行命令时，拼接了用户可控的输入，会导致命令执行漏洞。攻击者利用漏洞可以控制目标主机或者容器。

### 示例
```java
void bad(HttpServletRequest req, HttpServletResponse resp){
String cmd = req.getParameter("cmd");
Runtime rt = Runtime.getRuntime();
rt.exec(cmd); // 触发规则
}
```

### 修复建议
需要评估 childprocess 等模块执行命令的使用，应限定或校验命令和参数的内容。

## PathTraversal

### 概述
支持的语言：Java

PathTraversal 规则用于检查代码中是否存在[`路径穿越漏洞`](https://owasp.org/www-community/attacks/Path_Traversal)。
操作文件时，应该限定文件的路径范围，如果拼接用户输入到文件路径，可能导致路径穿越漏洞。攻击者利用漏洞可以访问到文件系统上的任意文件，这可能导致信息泄漏等问题。

### 示例
```java
void bad(HttpServletRequest req, HttpServletResponse resp){
String image = req.getParameter("image");
File file = new File("resources/images/", image); // 触发规则

if (!file.exists()) {
return Response.status(Status.NOT_FOUND).build();
}

return Response.ok().entity(new FileInputStream(file)).build();
}
```

### 修复建议
按业务需求，使用白名单限定后缀范围，校验并限定文件路径范围。

## SQLInject

### 概述
支持的语言：Java

SQLInject 规则用于检查代码中是否存在[`SQL注入漏洞`](https://en.wikipedia.org/wiki/SQL_injection)。
错误的拼接用户可控的值到 sql 语句，可能导致 sql 注入漏洞。攻击者可以修改 sql 语法来更改查询的目标或结果，泄露数据库敏感信息，也可以使用SQL文件操作攻击底层Web服务器。如果使用该 sql 查询进行授权认证，攻击者还可以用于提权。

### 示例
```java
void bad(HttpServletRequest req, HttpServletResponse resp){
String id = req.getParameter("id");
Connection conn = null;
Statement statement = null;
ResultSet rs = null;

Class.forName("com.mysql.cj.jdbc.Driver");
conn = DriverManager.getConnection("jdbc:mysql://localhost:3306/sec_sql", "root", "admin888");
String sql = "select * from userinfo where id = " + id;
statement = conn.createStatement();
statement.executeUpdate(sql); // 触发规则
}
```

### 修复建议
SQL 语句默认使用预编译并绑定变量，使用安全的ORM操作。

## SSRF

### 概述
支持的语言：Java

SSRF 规则用于检查代码中是否存在[`服务端请求伪造漏洞 SSRF(Server-side request forgery)`](https://en.wikipedia.org/wiki/Server-side_request_forgery)。
攻击者在未能取得服务器所有权限时，利用服务器漏洞以服务器的身份发送一条构造好的请求给服务器所在内网。

### 示例
```java
import org.springframework.context.annotation.Configuration;
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter;

@EnableWebSecurity
@Configuration
public class WebSecurityConfig extends WebSecurityConfigurerAdapter {
@Override
protected void configure(HttpSecurity http) throws Exception {
http
.csrf(csrf ->
csrf.disable() // 触发规则
);
}
}
```

### 修复建议
限定访问网络资源地址范围，请求网络资源应加密传输。

## XSS

### 概述
支持的语言：Java

XSS 规则用于检查代码中是否存在[`跨站脚本攻击漏洞 XSS(Cross-site scripting)`](https://en.wikipedia.org/wiki/Cross-site_scripting)。
如果 web 页面在动态展示数据时使用了用户的输入内容，没有对输入的内容过滤或者进行转义，黑客可以通过参数传入恶意代码，当用户浏览该页面时恶意代码会被执行。

### 示例
```java
void bad(HttpServletRequest req, HttpServletResponse resp){
String id = request.getParameter("id") != null ? request.getParameter("id") : "0";
Doc doc = getdetailsById(id);
byte[] b = doc.getUploaded();
try {
response.setContentType("APPLICATION/OCTET-STREAM");
String disHeader = "Attachment;Filename=" + doc.getName();
response.setHeader("Content-Disposition", disHeader);
ServletOutputStream out = response.getOutputStream();
out.print(b); // 触发规则
}
}
```

### 修复建议

在输出所有用户可控的数据时, 对数据做转义或者编码。
- [CmdInject](https://tencent.github.io/CodeAnalysis/en/guide/代码检查/工具/TCA-Armory-C1.html#CmdInject)
- [PathTraversal](https://tencent.github.io/CodeAnalysis/en/guide/代码检查/工具/TCA-Armory-C1.html#PathTraversal)
- [SQLInject](https://tencent.github.io/CodeAnalysis/en/guide/代码检查/工具/TCA-Armory-C1.html#SQLInject)
- [SSRF](https://tencent.github.io/CodeAnalysis/en/guide/代码检查/工具/TCA-Armory-C1.html#SSRF)
- [XSS](https://tencent.github.io/CodeAnalysis/en/guide/代码检查/工具/TCA-Armory-C1.html#XSS)
2 changes: 1 addition & 1 deletion doc/en/guide/代码检查/规则包/test_case_verify_go.md
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,4 +1,4 @@
# 【Go】单元测试有效性验证 - 使用手册
# 【Go】单元测试有效性验证

## 背景

Expand Down
Loading