apisec-code-bolt 0.1.0__py3-none-any.whl

apisec_code_bolt/parsing/jvm/parser.py

@@ -0,0 +1,774 @@
+"""
+Java parser using the javalang library.
+
+Parses .java source files into the language-agnostic ParsedFile dataclass.
+Extracts classes, methods, fields, imports, call sites, and assignments.
+"""
+
+from __future__ import annotations
+
+import logging
+import time
+from pathlib import Path
+from typing import Any
+
+from ...core.types import (
+    CodeLocation,
+    Language,
+    ParseError,
+    QualifiedName,
+)
+from ..base import (
+    BaseParser,
+    ParsedArgument,
+    ParsedAssignment,
+    ParsedCallSite,
+    ParsedClass,
+    ParsedDecorator,
+    ParsedField,
+    ParsedFile,
+    ParsedFunction,
+    ParsedImport,
+    ParsedParameter,
+)
+
+logger = logging.getLogger(__name__)
+
+
+# =============================================================================
+# Java Extractor
+# =============================================================================
+
+
+class JavaExtractor:
+    """
+    Walks a javalang CompilationUnit and extracts ParsedFile data.
+    """
+
+    def __init__(self, file_path: Path, source: str, tree: Any) -> None:
+        self.file_path = file_path
+        self.source = source
+        self.tree = tree  # javalang CompilationUnit
+        self.lines = source.splitlines()
+
+    def extract(self) -> ParsedFile:
+
+        start = time.perf_counter()
+
+        module_name = self._get_package_name()
+        imports = self._extract_imports()
+        classes, call_sites, assignments = self._extract_types(module_name)
+
+        # Flatten methods from all classes as top-level functions
+        functions: list[ParsedFunction] = []
+        for cls in classes:
+            functions.extend(cls.methods)
+
+        parse_time_ms = int((time.perf_counter() - start) * 1000)
+
+        return ParsedFile(
+            path=self.file_path,
+            language=Language.JAVA,
+            success=True,
+            module_name=module_name,
+            imports=imports,
+            classes=classes,
+            functions=functions,
+            call_sites=call_sites,
+            assignments=assignments,
+            line_count=len(self.lines),
+            parse_time_ms=parse_time_ms,
+        )
+
+    # -------------------------------------------------------------------------
+    # Package / module
+    # -------------------------------------------------------------------------
+
+    def _get_package_name(self) -> str | None:
+        pkg = getattr(self.tree, "package", None)
+        if pkg is None:
+            return None
+        name = getattr(pkg, "name", None)
+        return name
+
+    # -------------------------------------------------------------------------
+    # Imports
+    # -------------------------------------------------------------------------
+
+    def _extract_imports(self) -> list[ParsedImport]:
+        imports: list[ParsedImport] = []
+        for imp in getattr(self.tree, "imports", None) or []:
+            path: str = imp.path or ""
+            wildcard: bool = bool(imp.wildcard)
+            pos = getattr(imp, "position", None)
+            location = self._make_location(pos)
+
+            if wildcard:
+                # removesuffix removes the exact ".*" trailer; rstrip(".*")
+                # would strip individual '.' and '*' characters and over-strip
+                # paths with multiple trailing dots.
+                module = path.removesuffix(".*") if path.endswith(".*") else path
+                imports.append(
+                    ParsedImport(
+                        module=module,
+                        names=[],
+                        location=location,
+                    )
+                )
+            else:
+                dot = path.rfind(".")
+                if dot >= 0:
+                    imports.append(
+                        ParsedImport(
+                            module=path[:dot],
+                            names=[path[dot + 1 :]],
+                            location=location,
+                        )
+                    )
+                else:
+                    imports.append(
+                        ParsedImport(
+                            module=path,
+                            names=[],
+                            location=location,
+                        )
+                    )
+        return imports
+
+    # -------------------------------------------------------------------------
+    # Types (classes, enums, interfaces)
+    # -------------------------------------------------------------------------
+
+    def _extract_types(
+        self, package_name: str | None
+    ) -> tuple[list[ParsedClass], list[ParsedCallSite], list[ParsedAssignment]]:
+        import javalang
+
+        all_classes: list[ParsedClass] = []
+        all_calls: list[ParsedCallSite] = []
+        all_assigns: list[ParsedAssignment] = []
+
+        for type_decl in getattr(self.tree, "types", None) or []:
+            if isinstance(
+                type_decl,
+                (
+                    javalang.tree.ClassDeclaration,
+                    javalang.tree.InterfaceDeclaration,
+                    javalang.tree.EnumDeclaration,
+                ),
+            ):
+                cls, calls, assigns = self._extract_class(type_decl, package_name)
+                all_classes.append(cls)
+                all_calls.extend(calls)
+                all_assigns.extend(assigns)
+
+        return all_classes, all_calls, all_assigns
+
+    def _extract_class(
+        self, class_decl: Any, package_name: str | None
+    ) -> tuple[ParsedClass, list[ParsedCallSite], list[ParsedAssignment]]:
+        import javalang
+
+        module = package_name or ""
+        class_name: str = class_decl.name
+        class_fqn = f"{module}.{class_name}" if module else class_name
+        qname = QualifiedName(module=module, name=class_name)
+
+        pos = getattr(class_decl, "position", None)
+        location = self._make_location(pos)
+
+        decorators = [
+            self._extract_annotation(a) for a in (getattr(class_decl, "annotations", None) or [])
+        ]
+
+        # Base classes
+        base_classes: list[str] = []
+        ext = getattr(class_decl, "extends", None)
+        if ext is not None:
+            # ClassDeclaration: extends is a single type
+            # InterfaceDeclaration: extends is a list
+            if isinstance(ext, list):
+                for e in ext:
+                    base_classes.append(self._get_type_name(e))
+            else:
+                base_classes.append(self._get_type_name(ext))
+
+        for impl in getattr(class_decl, "implements", None) or []:
+            base_classes.append(self._get_type_name(impl))
+
+        # Detect special class kinds
+        is_enum = isinstance(class_decl, javalang.tree.EnumDeclaration)
+        isinstance(class_decl, javalang.tree.InterfaceDeclaration)
+
+        # Members
+        methods: list[ParsedFunction] = []
+        fields: list[ParsedField] = []
+        all_calls: list[ParsedCallSite] = []
+        all_assigns: list[ParsedAssignment] = []
+
+        for member in getattr(class_decl, "body", None) or []:
+            if isinstance(member, javalang.tree.MethodDeclaration):
+                method, calls, assigns = self._extract_method(member, class_fqn)
+                methods.append(method)
+                all_calls.extend(calls)
+                all_assigns.extend(assigns)
+            elif isinstance(member, javalang.tree.ConstructorDeclaration):
+                # Treat constructors like methods so their call sites and
+                # assignments (e.g. @Autowired constructor injection) are
+                # captured in the call graph and data-flow analysis.
+                _, calls, assigns = self._extract_method(member, class_fqn)
+                all_calls.extend(calls)
+                all_assigns.extend(assigns)
+            elif isinstance(member, javalang.tree.FieldDeclaration):
+                field = self._extract_field(member)
+                if field:
+                    fields.append(field)
+            elif isinstance(member, javalang.tree.ClassDeclaration):
+                # Nested class — recurse but don't add to top-level
+                nested_cls, nested_calls, nested_assigns = self._extract_class(member, class_fqn)
+                all_calls.extend(nested_calls)
+                all_assigns.extend(nested_assigns)
+
+        parsed_class = ParsedClass(
+            name=class_name,
+            qualified_name=qname,
+            location=location,
+            base_classes=base_classes,
+            decorators=decorators,
+            methods=methods,
+            fields=fields,
+            is_enum=is_enum,
+        )
+
+        return parsed_class, all_calls, all_assigns
+
+    # -------------------------------------------------------------------------
+    # Methods
+    # -------------------------------------------------------------------------
+
+    def _extract_method(
+        self, method_decl: Any, class_fqn: str
+    ) -> tuple[ParsedFunction, list[ParsedCallSite], list[ParsedAssignment]]:
+        method_name: str = method_decl.name
+        pos = getattr(method_decl, "position", None)
+        location = self._make_location(pos)
+        qname = QualifiedName(module=class_fqn, name=method_name)
+
+        decorators = [
+            self._extract_annotation(a) for a in (getattr(method_decl, "annotations", None) or [])
+        ]
+
+        parameters = [
+            self._extract_parameter(p) for p in (getattr(method_decl, "parameters", None) or [])
+        ]
+
+        return_type = self._get_type_name(getattr(method_decl, "return_type", None))
+
+        modifiers: set[str] = getattr(method_decl, "modifiers", None) or set()
+        binding = "static" if "static" in modifiers else "instance"
+
+        # Extract call sites and assignments from method body
+        calls = self._extract_call_sites_from_body(method_decl, qname.full)
+        assigns = self._extract_assignments_from_body(method_decl, qname.full)
+
+        func = ParsedFunction(
+            name=method_name,
+            qualified_name=qname,
+            location=location,
+            parameters=parameters,
+            return_type=return_type,
+            decorators=decorators,
+            binding=binding,
+            owner_type=class_fqn,
+            is_async=False,
+        )
+
+        return func, calls, assigns
+
+    # -------------------------------------------------------------------------
+    # Parameters
+    # -------------------------------------------------------------------------
+
+    def _extract_parameter(self, param: Any) -> ParsedParameter:
+        name: str = getattr(param, "name", "")
+        type_name = self._get_type_name(getattr(param, "type", None))
+        varargs: bool = bool(getattr(param, "varargs", False))
+        pos = getattr(param, "position", None)
+        location = self._make_location(pos)
+
+        # Extract annotation metadata (for Spring @PathVariable, @RequestParam, etc.)
+        # Use the full _extract_annotation path so named attributes are preserved:
+        #   @Size(min=3, max=50) → {"Size": {"min": 3, "max": 50}}
+        #   @RequestParam("name") → {"RequestParam": "name"}
+        #   @NotNull → {"NotNull": None}
+        metadata: dict[str, Any] = {}
+        for ann in getattr(param, "annotations", None) or []:
+            dec = self._extract_annotation(ann)
+            if dec.arguments:
+                metadata[dec.name] = dec.arguments
+            elif dec.positional_args:
+                val = (
+                    dec.positional_args[0] if len(dec.positional_args) == 1 else dec.positional_args
+                )
+                metadata[dec.name] = val
+            else:
+                metadata[dec.name] = None
+
+        return ParsedParameter(
+            name=name,
+            type_annotation=type_name,
+            is_variadic=varargs,
+            location=location,
+            metadata=metadata,
+        )
+
+    # -------------------------------------------------------------------------
+    # Fields
+    # -------------------------------------------------------------------------
+
+    def _extract_field(self, field_decl: Any) -> ParsedField | None:
+        field_type = self._get_type_name(getattr(field_decl, "type", None))
+        # Capture field-level annotations (e.g. @Value, @Column, @NotNull)
+        decorators = [
+            self._extract_annotation(ann) for ann in getattr(field_decl, "annotations", None) or []
+        ]
+        for declarator in getattr(field_decl, "declarators", None) or []:
+            name = getattr(declarator, "name", None)
+            if name:
+                default_val = None
+                initializer = getattr(declarator, "initializer", None)
+                if initializer is not None:
+                    default_val = self._expr_to_str(initializer)
+                return ParsedField(
+                    name=name,
+                    type_annotation=field_type,
+                    default_value=default_val,
+                    decorators=decorators,
+                )
+        return None
+
+    # -------------------------------------------------------------------------
+    # Annotations → ParsedDecorator
+    # -------------------------------------------------------------------------
+
+    def _extract_annotation(self, annotation: Any) -> ParsedDecorator:
+        name: str = getattr(annotation, "name", "")
+        element = getattr(annotation, "element", None)
+
+        args: dict[str, Any] = {}
+        positional: list[Any] = []
+
+        if element is None:
+            pass
+        elif isinstance(element, list):
+            for item in element:
+                item_name = getattr(item, "name", None)
+                item_val = self._extract_element_value(getattr(item, "value", item))
+                if item_name:
+                    args[item_name] = item_val
+                else:
+                    positional.append(item_val)
+        else:
+            # Single element (Literal, MemberReference, etc.)
+            val = self._extract_element_value(element)
+            if val is not None:
+                positional.append(val)
+
+        return ParsedDecorator(
+            name=name,
+            arguments=args,
+            positional_args=positional,
+        )
+
+    def _extract_element_value(self, element: Any) -> Any:
+        """Extract a scalar value from a javalang annotation element."""
+        import javalang
+
+        if element is None:
+            return None
+
+        if isinstance(element, str):
+            if len(element) >= 2 and element[0] == element[-1] and element[0] in ('"', "'"):
+                return element[1:-1]
+            return element
+
+        if isinstance(element, javalang.tree.Literal):
+            val = element.value
+            if isinstance(val, str):
+                if len(val) >= 2 and val[0] == val[-1] and val[0] in ('"', "'"):
+                    return val[1:-1]
+                return val
+            return val
+
+        if isinstance(element, javalang.tree.MemberReference):
+            # e.g. RequestMethod.GET → "GET"
+            member = getattr(element, "member", None)
+            return member
+
+        if isinstance(element, javalang.tree.MethodInvocation):
+            return getattr(element, "member", None)
+
+        if isinstance(element, list):
+            return [self._extract_element_value(e) for e in element]
+
+        # ElementArrayValue: annotation array literal {"/v1", "/v2"} in
+        # @GetMapping({"/v1/users", "/v2/users"}).  javalang stores these as
+        # ElementArrayValue(values=[Literal(...), ...]) — note "values" (plural).
+        values_attr = getattr(element, "values", None)
+        if values_attr is not None and isinstance(values_attr, list):
+            return [self._extract_element_value(v) for v in values_attr]
+
+        if hasattr(element, "value"):
+            return self._extract_element_value(element.value)
+
+        return str(element)
+
+    # -------------------------------------------------------------------------
+    # Call site extraction
+    # -------------------------------------------------------------------------
+
+    def _extract_call_sites_from_body(
+        self, method_decl: Any, caller_fqn: str
+    ) -> list[ParsedCallSite]:
+        import javalang
+
+        calls: list[ParsedCallSite] = []
+        body = getattr(method_decl, "body", None)
+        if not body:
+            return calls
+
+        try:
+            for _path, node in method_decl:
+                if not isinstance(node, javalang.tree.MethodInvocation):
+                    continue
+
+                callee_name: str = node.member or ""
+                qualifier = getattr(node, "qualifier", None) or ""
+                if qualifier:
+                    callee_name = f"{qualifier}.{callee_name}"
+
+                pos = getattr(node, "position", None)
+                location = self._make_location(pos)
+
+                args: list[ParsedArgument] = []
+                for i, arg_expr in enumerate(getattr(node, "arguments", None) or []):
+                    args.append(self._extract_argument(arg_expr, i))
+
+                caller_qname = QualifiedName(
+                    module=caller_fqn.rsplit(".", 1)[0] if "." in caller_fqn else "",
+                    name=caller_fqn.rsplit(".", 1)[-1],
+                )
+
+                calls.append(
+                    ParsedCallSite(
+                        callee_name=callee_name,
+                        location=location,
+                        caller_function=caller_qname,
+                        arguments=args,
+                        is_method_call=bool(qualifier),
+                        receiver_expression=qualifier or None,
+                    )
+                )
+        except Exception:
+            pass  # Best-effort
+
+        return calls
+
+    def _extract_assignments_from_body(
+        self, method_decl: Any, caller_fqn: str
+    ) -> list[ParsedAssignment]:
+        import javalang
+
+        assigns: list[ParsedAssignment] = []
+        body = getattr(method_decl, "body", None)
+        if not body:
+            return assigns
+
+        try:
+            for _path, node in method_decl:
+                if not isinstance(node, javalang.tree.LocalVariableDeclaration):
+                    continue
+
+                type_name = self._get_type_name(getattr(node, "type", None))
+                pos = getattr(node, "position", None)
+                location = self._make_location(pos)
+
+                for declarator in getattr(node, "declarators", None) or []:
+                    target = getattr(declarator, "name", None)
+                    if not target:
+                        continue
+
+                    initializer = getattr(declarator, "initializer", None)
+                    source_type = "literal"
+                    source_value = None
+                    source_call = None
+                    source_vars: list[str] = []
+                    is_string_interp = False
+
+                    if initializer is not None:
+                        if isinstance(initializer, javalang.tree.Literal):
+                            source_type = "literal"
+                            source_value = self._extract_element_value(initializer)
+                        elif isinstance(initializer, javalang.tree.MethodInvocation):
+                            source_type = "call"
+                            source_call = initializer.member
+                        elif isinstance(initializer, javalang.tree.MemberReference):
+                            source_type = "variable"
+                            var_name = initializer.member
+                            source_value = var_name
+                            source_vars = [var_name]
+                        elif isinstance(initializer, javalang.tree.BinaryOperation):
+                            # String concatenation: a + b
+                            source_type = "expression"
+                            source_value = self._expr_to_str(initializer)
+                            source_vars = self._collect_vars(initializer)
+                            is_string_interp = True
+                        else:
+                            source_type = "expression"
+                            source_value = self._expr_to_str(initializer)
+
+                    assigns.append(
+                        ParsedAssignment(
+                            target=target,
+                            location=location,
+                            source_type=source_type,
+                            source_value=str(source_value) if source_value else None,
+                            source_call=source_call,
+                            in_function=caller_fqn,
+                            type_annotation=type_name,
+                            source_variables=source_vars,
+                            is_string_interpolation=is_string_interp,
+                        )
+                    )
+        except Exception:
+            pass  # Best-effort
+
+        return assigns
+
+    # -------------------------------------------------------------------------
+    # Argument extraction
+    # -------------------------------------------------------------------------
+
+    def _extract_argument(self, expr: Any, position: int) -> ParsedArgument:
+        import javalang
+
+        if isinstance(expr, javalang.tree.Literal):
+            val = self._extract_element_value(expr)
+            return ParsedArgument(
+                position=position,
+                is_literal=True,
+                literal_value=val,
+                literal_type=self._infer_literal_type(expr.value),
+            )
+
+        if isinstance(expr, javalang.tree.MemberReference):
+            var_name = expr.member
+            return ParsedArgument(
+                position=position,
+                is_variable=True,
+                variable_name=var_name,
+                source_variables=[var_name],
+            )
+
+        if isinstance(expr, javalang.tree.MethodInvocation):
+            return ParsedArgument(
+                position=position,
+                is_call_result=True,
+                called_function=expr.member,
+            )
+
+        if isinstance(expr, javalang.tree.BinaryOperation):
+            # String concatenation
+            source_vars = self._collect_vars(expr)
+            return ParsedArgument(
+                position=position,
+                is_expression=True,
+                expression_text=self._expr_to_str(expr),
+                is_concatenation=True,
+                source_variables=source_vars,
+            )
+
+        # Generic fallback
+        return ParsedArgument(
+            position=position,
+            is_expression=True,
+            expression_text=self._expr_to_str(expr),
+        )
+
+    # -------------------------------------------------------------------------
+    # Type name helpers
+    # -------------------------------------------------------------------------
+
+    def _get_type_name(self, type_node: Any) -> str | None:
+        """Convert a javalang type node to a simple string name."""
+        if type_node is None:
+            return None
+
+        import javalang
+
+        if isinstance(type_node, str):
+            return type_node
+
+        if isinstance(type_node, javalang.tree.BasicType):
+            return type_node.name
+
+        if isinstance(type_node, javalang.tree.ReferenceType):
+            name = type_node.name
+            # Handle generics: List<String> → List<String>
+            args = getattr(type_node, "arguments", None)
+            if args:
+                inner = ", ".join(
+                    self._get_type_name(a.type) or "?" for a in args if hasattr(a, "type")
+                )
+                return f"{name}<{inner}>"
+            return name
+
+        if isinstance(type_node, javalang.tree.VoidReturn):
+            return "void"
+
+        # Fallback
+        name = getattr(type_node, "name", None)
+        return name
+
+    def _infer_literal_type(self, raw: Any) -> str | None:
+        if isinstance(raw, str):
+            s = raw.strip()
+            if s.startswith('"') or s.startswith("'"):
+                return "str"
+            if s in ("true", "false"):
+                return "bool"
+            if s == "null":
+                return "None"
+            try:
+                int(s)
+                return "int"
+            except ValueError:
+                pass
+            try:
+                float(s.rstrip("fFdD"))
+                return "float"
+            except ValueError:
+                pass
+        return None
+
+    # -------------------------------------------------------------------------
+    # Expression helpers
+    # -------------------------------------------------------------------------
+
+    def _expr_to_str(self, expr: Any) -> str:
+        """Best-effort string representation of an expression node."""
+        import javalang
+
+        if expr is None:
+            return ""
+        if isinstance(expr, javalang.tree.Literal):
+            return str(expr.value)
+        if isinstance(expr, javalang.tree.MemberReference):
+            qualifier = getattr(expr, "qualifier", "") or ""
+            member = expr.member or ""
+            return f"{qualifier}.{member}" if qualifier else member
+        if isinstance(expr, javalang.tree.MethodInvocation):
+            qualifier = getattr(expr, "qualifier", "") or ""
+            member = expr.member or ""
+            # Preserve literal string arguments so callers can inspect them
+            # (e.g. System.getenv("JWT_SECRET") stays readable downstream).
+            raw_args = getattr(expr, "arguments", None) or []
+            arg_strs: list[str] = []
+            for a in raw_args:
+                if isinstance(a, javalang.tree.Literal):
+                    arg_strs.append(str(a.value))
+                else:
+                    arg_strs.append("...")
+            inner = ", ".join(arg_strs) if arg_strs else "..."
+            callee = f"{qualifier}.{member}" if qualifier else member
+            return f"{callee}({inner})"
+        if isinstance(expr, javalang.tree.BinaryOperation):
+            left = self._expr_to_str(expr.operandl)
+            right = self._expr_to_str(expr.operandr)
+            op = getattr(expr, "operator", "+")
+            return f"{left} {op} {right}"
+        if isinstance(expr, javalang.tree.ClassCreator):
+            return f"new {self._get_type_name(expr.type)}(...)"
+        return repr(expr)
+
+    def _collect_vars(self, expr: Any) -> list[str]:
+        """Collect all MemberReference variable names from an expression tree."""
+        import javalang
+
+        vars_: list[str] = []
+        if isinstance(expr, javalang.tree.MemberReference):
+            vars_.append(expr.member)
+        elif isinstance(expr, javalang.tree.BinaryOperation):
+            vars_.extend(self._collect_vars(expr.operandl))
+            vars_.extend(self._collect_vars(expr.operandr))
+        return vars_
+
+    # -------------------------------------------------------------------------
+    # Location helper
+    # -------------------------------------------------------------------------
+
+    def _make_location(self, pos: Any) -> CodeLocation:
+        if pos is None:
+            return CodeLocation(file=self.file_path, line=0)
+        line = getattr(pos, "line", 0) or 0
+        col = getattr(pos, "column", None)
+        return CodeLocation(file=self.file_path, line=line, column=col)
+
+
+# =============================================================================
+# JavaParser
+# =============================================================================
+
+
+class JavaParser(BaseParser):
+    """
+    Parser for Java source files.
+
+    Uses the javalang library to build a CST and extract:
+    - Classes, methods, fields
+    - Imports
+    - Call sites (method invocations)
+    - Assignments (local variable declarations)
+    """
+
+    LANGUAGE: Language = Language.JAVA
+    SUPPORTED_EXTENSIONS: frozenset[str] = frozenset({".java"})
+
+    def parse_file(self, file_path: Path) -> ParsedFile:
+        try:
+            source = file_path.read_text(encoding="utf-8", errors="replace")
+        except OSError as e:
+            return ParsedFile(
+                path=file_path,
+                language=Language.JAVA,
+                success=False,
+                error=ParseError(f"Could not read file: {e}", file_path),
+            )
+        return self.parse_source(source, file_path)
+
+    def parse_source(self, source: str, file_path: Path | None = None) -> ParsedFile:
+        resolved_path = file_path or Path("<unknown>")
+        try:
+            import javalang
+
+            tree = javalang.parse.parse(source)
+        except Exception as e:
+            logger.debug("Failed to parse Java file %s: %s", file_path, e)
+            return ParsedFile(
+                path=resolved_path,
+                language=Language.JAVA,
+                success=False,
+                error=ParseError(str(e), file_path),
+            )
+
+        try:
+            extractor = JavaExtractor(resolved_path, source, tree)
+            return extractor.extract()
+        except Exception as e:
+            logger.warning("Extraction failed for %s: %s", file_path, e)
+            return ParsedFile(
+                path=resolved_path,
+                language=Language.JAVA,
+                success=False,
+                error=ParseError(f"Extraction error: {e}", file_path),
+            )