@abaplint/core 2.120.31 → 2.120.32

package/build/src/abap/5_syntax/_type_utils.js

@@ -377,7 +377,10 @@ class TypeUtils {
                 || source instanceof basic_1.DataType
                 || source instanceof basic_1.UnknownType;
         }
-        if (source instanceof basic_1.CharacterType) {
+        if (source instanceof cgeneric_type_1.CGenericType && target instanceof basic_1.StringType) {
+            return false;
+        }
+        else if (source instanceof basic_1.CharacterType) {
             if (target instanceof basic_1.CharacterType) {
                 if (((_b = source.getAbstractTypeData()) === null || _b === void 0 ? void 0 : _b.derivedFromConstant) === true) {
                     return source.getLength() <= target.getLength();

package/build/src/registry.js

@@ -75,7 +75,7 @@ class Registry {
     }
     static abaplintVersion() {
         // magic, see build script "version.js"
-        return "2.120.31";
+        return "2.120.32";
     }
     getDDICReferences() {
         return this.ddicReferences;

package/build/src/rules/index.js

@@ -124,6 +124,7 @@ __exportStar(require("./newline_between_methods"), exports);
 __exportStar(require("./no_aliases"), exports);
 __exportStar(require("./no_chained_assignment"), exports);
 __exportStar(require("./no_comments_between_methods"), exports);
+__exportStar(require("./no_dynamic_stuff"), exports);
 __exportStar(require("./no_external_form_calls"), exports);
 __exportStar(require("./no_inline_in_optional_branches"), exports);
 __exportStar(require("./no_macros"), exports);
@@ -203,5 +204,6 @@ __exportStar(require("./when_others_last"), exports);
 __exportStar(require("./whitespace_end"), exports);
 __exportStar(require("./xml_consistency"), exports);
 __exportStar(require("./no_exclamation_escape"), exports);
+__exportStar(require("./xml_bom"), exports);
 __exportStar(require("./no_exclamation_escape"), exports);
 //# sourceMappingURL=index.js.map

package/build/src/rules/no_dynamic_stuff.js

@@ -0,0 +1,239 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.NoDynamicStuff = exports.NoDynamicStuffConf = void 0;
+const Statements = __importStar(require("../abap/2_statements/statements"));
+const Expressions = __importStar(require("../abap/2_statements/expressions"));
+const _abap_rule_1 = require("./_abap_rule");
+const _basic_rule_config_1 = require("./_basic_rule_config");
+const issue_1 = require("../issue");
+const _irule_1 = require("./_irule");
+class NoDynamicStuffConf extends _basic_rule_config_1.BasicRuleConfig {
+    constructor() {
+        super(...arguments);
+        /** Detects dynamic method calls, ie. CALL METHOD (name), SET HANDLER and CALL BADI */
+        this.callMethod = true;
+        /** Detects dynamic CALL FUNCTION, ie. the function module name is not a literal */
+        this.callFunction = true;
+        /** Detects CALL DATABASE PROCEDURE, the procedure name is always dynamic */
+        this.callDatabaseProcedure = true;
+        /** Detects dynamic CALL TRANSFORMATION */
+        this.callTransformation = true;
+        /** Detects dynamic CALL TRANSACTION, ie. the transaction code is not a literal */
+        this.callTransaction = true;
+        /** Detects dynamic PERFORM */
+        this.perform = true;
+        /** Detects dynamic SUBMIT */
+        this.submit = true;
+        /** Detects dynamic CREATE OBJECT */
+        this.createObject = true;
+        /** Detects dynamic CREATE DATA */
+        this.createData = true;
+        /** Detects dynamic GET BADI */
+        this.getBadi = true;
+        /** Detects dynamic ASSIGN, including ASSIGN COMPONENT */
+        this.assign = true;
+        /** Detects dynamic internal table access, ie. dynamic WHERE, keys, SORT BY and TRANSPORTING */
+        this.internalTable = true;
+        /** Detects dynamic EXPORT and IMPORT */
+        this.exportImport = true;
+    }
+}
+exports.NoDynamicStuffConf = NoDynamicStuffConf;
+class NoDynamicStuff extends _abap_rule_1.ABAPRule {
+    constructor() {
+        super(...arguments);
+        this.conf = new NoDynamicStuffConf();
+    }
+    getMetadata() {
+        return {
+            key: "no_dynamic_stuff",
+            title: "No dynamic stuff",
+            shortDescription: `Detects dynamic calls and other dynamic language constructs`,
+            extendedInformation: `Dynamic constructs cannot be checked statically, they are not found by
+where-used lists and refactorings, and they can introduce injection vulnerabilities.
+
+Dynamic tokens containing a literal, eg. CALL METHOD ('CL_FOO')=>('BAR'), are not reported,
+as these are equivalent to the static variant.
+
+Dynamic SQL is reported by rule dangerous_statement.`,
+            tags: [_irule_1.RuleTag.SingleFile, _irule_1.RuleTag.Security],
+            badExample: `CALL METHOD (lv_class)=>(lv_method).
+CALL FUNCTION lv_function_module.
+CREATE OBJECT ref TYPE (lv_class).
+ASSIGN (lv_name) TO <fs>.
+SORT tab BY (lv_field).`,
+            goodExample: `cl_class=>method( ).
+CALL FUNCTION 'ZFOO'.
+CREATE OBJECT ref TYPE cl_class.
+ASSIGN foo TO <fs>.
+SORT tab BY field.`,
+        };
+    }
+    getConfig() {
+        return this.conf;
+    }
+    setConfig(conf) {
+        this.conf = conf;
+    }
+    runParsed(file) {
+        const issues = [];
+        for (const statementNode of file.getStatements()) {
+            const found = this.check(statementNode);
+            if (found !== undefined) {
+                issues.push(issue_1.Issue.atStatement(file, statementNode, "Dynamic " + found, this.getMetadata().key, this.conf.severity));
+            }
+        }
+        return issues;
+    }
+    check(node) {
+        const statement = node.get();
+        // note that MethodSource is also used by SET HANDLER and CALL BADI
+        if (this.conf.callMethod === true && this.dynamicMethodSource(node) === true) {
+            return "method call";
+        }
+        if (statement instanceof Statements.CallFunction) {
+            if (this.conf.callFunction === true
+                && this.notLiteral(node.findDirectExpression(Expressions.FunctionName))) {
+                return "CALL FUNCTION";
+            }
+        }
+        else if (statement instanceof Statements.CallDatabase) {
+            if (this.conf.callDatabaseProcedure === true) {
+                return "CALL DATABASE PROCEDURE";
+            }
+        }
+        else if (statement instanceof Statements.CallTransformation) {
+            if (this.conf.callTransformation === true && this.hasDynamic(node)) {
+                return "CALL TRANSFORMATION";
+            }
+        }
+        else if (statement instanceof Statements.CallTransaction) {
+            // the transaction code is a Source, ie. there is no parenthesized dynamic variant
+            if (this.conf.callTransaction === true
+                && this.notLiteral(node.findDirectExpression(Expressions.Source))) {
+                return "CALL TRANSACTION";
+            }
+        }
+        else if (statement instanceof Statements.Perform) {
+            if (this.conf.perform === true && this.hasDynamic(node)) {
+                return "PERFORM";
+            }
+        }
+        else if (statement instanceof Statements.Submit) {
+            if (this.conf.submit === true && this.hasDynamic(node)) {
+                return "SUBMIT";
+            }
+        }
+        else if (statement instanceof Statements.CreateObject) {
+            if (this.conf.createObject === true && this.hasDynamic(node)) {
+                return "CREATE OBJECT";
+            }
+        }
+        else if (statement instanceof Statements.CreateData) {
+            if (this.conf.createData === true && this.hasDynamic(node)) {
+                return "CREATE DATA";
+            }
+        }
+        else if (statement instanceof Statements.GetBadi) {
+            if (this.conf.getBadi === true && this.hasDynamic(node)) {
+                return "GET BADI";
+            }
+        }
+        else if (statement instanceof Statements.Assign
+            || statement instanceof Statements.AssignLocalCopy) {
+            if (this.conf.assign === true
+                && (this.hasDynamic(node) || this.dynamicAssignComponent(node))) {
+                return "ASSIGN";
+            }
+        }
+        else if (statement instanceof Statements.Export) {
+            if (this.conf.exportImport === true && this.hasDynamic(node)) {
+                return "EXPORT";
+            }
+        }
+        else if (statement instanceof Statements.Import) {
+            if (this.conf.exportImport === true && this.hasDynamic(node)) {
+                return "IMPORT";
+            }
+        }
+        else if (statement instanceof Statements.At
+            || statement instanceof Statements.DeleteInternal
+            || statement instanceof Statements.InsertInternal
+            || statement instanceof Statements.Loop
+            || statement instanceof Statements.ModifyInternal
+            || statement instanceof Statements.ReadTable
+            || statement instanceof Statements.Sort
+            || statement instanceof Statements.SortDataset) {
+            if (this.conf.internalTable === true && this.hasDynamic(node)) {
+                return "internal table access";
+            }
+        }
+        return undefined;
+    }
+    dynamicMethodSource(node) {
+        for (const source of node.findAllExpressions(Expressions.MethodSource)) {
+            // Dynamic is always a direct child of MethodSource, dynamics further down
+            // are parameters of the method call and not part of the method name
+            for (const dynamic of source.findDirectExpressions(Expressions.Dynamic)) {
+                if (this.isLiteral(dynamic) === false) {
+                    return true;
+                }
+            }
+        }
+        return false;
+    }
+    dynamicAssignComponent(node) {
+        var _a;
+        const component = (_a = node.findDirectExpression(Expressions.AssignSource)) === null || _a === void 0 ? void 0 : _a.findExpressionAfterToken("COMPONENT");
+        return component !== undefined && this.isLiteral(component) === false;
+    }
+    hasDynamic(node) {
+        for (const dynamic of node.findAllExpressions(Expressions.Dynamic)) {
+            if (this.isLiteral(dynamic) === false) {
+                return true;
+            }
+        }
+        return false;
+    }
+    notLiteral(node) {
+        return node !== undefined && this.isLiteral(node) === false;
+    }
+    isLiteral(node) {
+        return node.findDirectExpression(Expressions.Constant) !== undefined;
+    }
+}
+exports.NoDynamicStuff = NoDynamicStuff;
+//# sourceMappingURL=no_dynamic_stuff.js.map

package/build/src/rules/xml_bom.js

@@ -0,0 +1,48 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.XMLBOM = exports.XMLBOMConf = void 0;
+const edit_helper_1 = require("../edit_helper");
+const issue_1 = require("../issue");
+const position_1 = require("../position");
+const _basic_rule_config_1 = require("./_basic_rule_config");
+const _irule_1 = require("./_irule");
+class XMLBOMConf extends _basic_rule_config_1.BasicRuleConfig {
+}
+exports.XMLBOMConf = XMLBOMConf;
+class XMLBOM {
+    constructor() {
+        this.conf = new XMLBOMConf();
+    }
+    getMetadata() {
+        return {
+            key: "xml_bom",
+            title: "XML UTF-8 byte order mark",
+            shortDescription: "Checks that XML files start with a UTF-8 byte order mark",
+            extendedInformation: "Checks that each XML file has a UTF-8 byte order mark (BOM) at its beginning.",
+            tags: [_irule_1.RuleTag.Syntax, _irule_1.RuleTag.Quickfix],
+        };
+    }
+    getConfig() {
+        return this.conf;
+    }
+    setConfig(conf) {
+        this.conf = conf;
+    }
+    initialize(_reg) {
+        return this;
+    }
+    run(obj) {
+        const file = obj.getXMLFile();
+        if (file === undefined || file.getRaw().startsWith("\uFEFF")) {
+            return [];
+        }
+        return [this.createIssue(file)];
+    }
+    createIssue(file) {
+        const start = new position_1.Position(1, 1);
+        const fix = edit_helper_1.EditHelper.insertAt(file, start, "\uFEFF");
+        return issue_1.Issue.atRange(file, start, start, "XML file must start with a UTF-8 byte order mark", this.getMetadata().key, this.conf.severity, fix);
+    }
+}
+exports.XMLBOM = XMLBOM;
+//# sourceMappingURL=xml_bom.js.map

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "@abaplint/core",
-    "version": "2.120.31",
+    "version": "2.120.32",
     "description": "abaplint - Core API",
     "main": "build/src/index.js",
     "typings": "build/abaplint.d.ts",