Giters

find-sec-bugs / find-sec-bugs

The SpotBugs plugin for security audits of Java web applications and Android applications. (Also work with Kotlin, Groovy and Scala projects)

Home Page:https://find-sec-bugs.github.io/

Geek Repo:Geek Repo

Github PK Tool:Github PK Tool

Exception during SpringEntityLeakDetector

nkavian opened this issue · comments

commented

Environment

Component Version
Java 17 via Eclipse JRE
SpotBugs 4.7.1
FindSecBugs 1.12.0

Problem

I ran SpotBugs through Eclipse and the Eclipse log generated this output

Exception analyzing com.example.MyController using detector com.h3xstream.findsecbugs.spring.SpringEntityLeakDetector
java.lang.IllegalArgumentException: Invalid class name java/lang/String;Ljava/lang/String
	at edu.umd.cs.findbugs.classfile.ClassDescriptor.<init>(ClassDescriptor.java:59)
	at edu.umd.cs.findbugs.classfile.DescriptorFactory.getClassDescriptor(DescriptorFactory.java:128)
	at edu.umd.cs.findbugs.AnalysisCacheToRepositoryAdapter.loadClass(AnalysisCacheToRepositoryAdapter.java:90)
	at org.apache.bcel.Repository.lookupClass(Repository.java:65)
	at com.h3xstream.findsecbugs.spring.SignatureParserWithGeneric.typeToJavaClass(SignatureParserWithGeneric.java:75)
	at com.h3xstream.findsecbugs.spring.SignatureParserWithGeneric.getArgumentsClasses(SignatureParserWithGeneric.java:54)
	at com.h3xstream.findsecbugs.spring.SpringEntityLeakDetector.analyzeMethod(SpringEntityLeakDetector.java:108)
	at com.h3xstream.findsecbugs.spring.SpringEntityLeakDetector.visitClassContext(SpringEntityLeakDetector.java:69)
	at edu.umd.cs.findbugs.DetectorToDetector2Adapter.visitClass(DetectorToDetector2Adapter.java:76)
	at edu.umd.cs.findbugs.FindBugs2.lambda$analyzeApplication$1(FindBugs2.java:1108)
	at java.base/java.util.concurrent.FutureTask.run(FutureTask.java:264)
	at edu.umd.cs.findbugs.CurrentThreadExecutorService.execute(CurrentThreadExecutorService.java:86)
	at java.base/java.util.concurrent.AbstractExecutorService.invokeAll(AbstractExecutorService.java:247)
	at edu.umd.cs.findbugs.FindBugs2.analyzeApplication(FindBugs2.java:1118)
	at edu.umd.cs.findbugs.FindBugs2.execute(FindBugs2.java:309)
	at de.tobject.findbugs.builder.FindBugsWorker.runFindBugs(FindBugsWorker.java:314)
	at de.tobject.findbugs.builder.FindBugsWorker.work(FindBugsWorker.java:220)
	at de.tobject.findbugs.actions.FindBugsAction$StartedFromViewJob.runWithProgress(FindBugsAction.java:275)
	at de.tobject.findbugs.FindBugsJob.run(FindBugsJob.java:142)
	at org.eclipse.core.internal.jobs.Worker.run(Worker.java:63)
commented

Can you provide part of the from com.example.MyController ?

The function name can be anonymize and the "body" from those functions can also be stripped if needed.

commented

At the time. I was upgrading laptops and installing a new Eclipse. When I encountered this issue I decided to downgrade to Spotbugs 4.40 and 1.11.0. I dare not mess with Eclipse in case I can't reinstall these versions, sorry. I'll understand if the ticket is closed since I can't produce more details.

commented

With this controller

@RestController
public class DemoController {

    @GetMapping
    public Map<String, String> demo() {
        return null;
    }
}

I get the error

The following errors occurred during analysis:
  Exception analyzing com.example.demo.DemoController using detector com.h3xstream.findsecbugs.spring.SpringEntityLeakDetector
    java.lang.IllegalArgumentException: Invalid class name java/lang/String;Ljava/lang/String
      At edu.umd.cs.findbugs.classfile.ClassDescriptor.<init>(ClassDescriptor.java:59)
      At edu.umd.cs.findbugs.classfile.DescriptorFactory.getClassDescriptor(DescriptorFactory.java:128)
      At edu.umd.cs.findbugs.AnalysisCacheToRepositoryAdapter.loadClass(AnalysisCacheToRepositoryAdapter.java:90)
      At org.apache.bcel.Repository.lookupClass(Repository.java:65)
      At com.h3xstream.findsecbugs.spring.SignatureParserWithGeneric.typeToJavaClass(SignatureParserWithGeneric.java:75)
      At com.h3xstream.findsecbugs.spring.SignatureParserWithGeneric.getReturnClasses(SignatureParserWithGeneric.java:60)
      At com.h3xstream.findsecbugs.spring.SpringEntityLeakDetector.analyzeMethod(SpringEntityLeakDetector.java:112)
      At com.h3xstream.findsecbugs.spring.SpringEntityLeakDetector.visitClassContext(SpringEntityLeakDetector.java:69)
      At edu.umd.cs.findbugs.DetectorToDetector2Adapter.visitClass(DetectorToDetector2Adapter.java:76)
      At edu.umd.cs.findbugs.FindBugs2.lambda$analyzeApplication$1(FindBugs2.java:1108)
      At java.base/java.util.concurrent.FutureTask.run(FutureTask.java:264)
      At edu.umd.cs.findbugs.CurrentThreadExecutorService.execute(CurrentThreadExecutorService.java:86)
      At java.base/java.util.concurrent.AbstractExecutorService.invokeAll(AbstractExecutorService.java:242)
      At edu.umd.cs.findbugs.FindBugs2.analyzeApplication(FindBugs2.java:1118)
      At edu.umd.cs.findbugs.FindBugs2.execute(FindBugs2.java:309)
      At edu.umd.cs.findbugs.FindBugs.runMain(FindBugs.java:395)
      At edu.umd.cs.findbugs.FindBugs2.main(FindBugs2.java:1231)

No error if return type is e.g List<String>.

commented

It seems to me that this was fixed by #680