sourcecode 2.6.2__py3-none-any.whl → 2.6.5__py3-none-any.whl

sourcecode/spring_tx_analyzer.py

@@ -6,9 +6,8 @@ Patterns implemented (Phase 2):
   TX-003  readOnly=true boundary propagating into write-capable callee
   TX-004  NOT_SUPPORTED or NEVER invoked from transactional call chain
   TX-005  Exception swallowing inside @Transactional method (regex)
-
-Self-invocation via this.method() intentionally excluded from Phase 2:
-  requires AST-level analysis, regex produces too many false positives.
+  TX-006  Self-invocation of a @Transactional sibling — proxy bypass (Semantic-IR
+          invocation atoms; unambiguous same-class calls only)
 
 All patterns are deterministic and never raise.
 """
@@ -683,6 +682,142 @@ class _TX005ExceptionSwallowing:
         return blocks
 
 
+# ---------------------------------------------------------------------------
+# TX-006: self-invocation of a @Transactional sibling — proxy bypass
+# ---------------------------------------------------------------------------
+
+class _TX006SelfInvocation:
+    """Same-instance call to a @Transactional sibling method bypasses the proxy.
+
+    Spring TX advice is applied by a proxy that wraps the bean. A call that does
+    NOT go through that proxy — an unqualified `foo()` or an explicit `this.foo()`
+    to a method of the SAME class — reaches the target directly, so its
+    method-level @Transactional is silently ignored at runtime (Sonar S2229).
+
+    Detection is structural and VAI-clean, reading the Semantic-IR invocation
+    atoms already produced by build_canonical_ir (cir.body_facts):
+
+      - the atom's receiver is None (unqualified) or "this"          → not via a proxy
+      - resolved_fqn is set                                          → unambiguous sibling
+        (the IR only resolves a sibling when receiver∈{None,"this"} and exactly one
+         same-class method matches — overloaded/ambiguous targets stay None → skipped)
+      - the resolved sibling carries a METHOD-LEVEL @Transactional    → advice would apply
+
+    Class-level-only @Transactional is deliberately NOT flagged: the enclosing
+    proxy already applies it to the outer entry method, so the self-call runs in
+    that same transaction — no advice is lost. The self-injection workaround
+    (`self.foo()` where `self` is an injected same-type field) uses a named field
+    receiver, never None/"this", so it never resolves as a sibling → no false
+    positive on the legitimate escape hatch.
+    """
+    pattern_id = "TX-006"
+    severity = "high"   # nominal (Protocol); real severity is tiered per finding
+
+    # Propagations whose whole purpose is a distinct transaction boundary: a bypass
+    # demonstrably breaks them (a new/suspended/forbidden TX that never happens, or a
+    # runtime IllegalTransactionStateException). Everything else — a plain REQUIRED/
+    # SUPPORTS callee, or a readOnly getter (bypass loses only the read-only
+    # optimization, not correctness) — degrades to running in the caller's TX: a real
+    # bypass with lower blast radius → medium, matching TX-002/003 discipline.
+    _HIGH_IMPACT_PROPAGATION = frozenset({
+        "REQUIRES_NEW", "NESTED", "NOT_SUPPORTED", "NEVER", "MANDATORY",
+    })
+
+    def analyze(
+        self,
+        cir: "CanonicalRepositoryIR",
+        tx_index: TransactionBoundaryIndex,
+        root: Optional[Path],
+        *,
+        model: Optional[SpringSemanticModel] = None,
+    ) -> list[SpringFinding]:
+        findings: list[SpringFinding] = []
+        body_facts = getattr(cir, "body_facts", {}) or {}
+        _seen_ids: set[str] = set()
+
+        for caller_fqn, atoms in body_facts.items():
+            if not isinstance(atoms, list):
+                continue
+            for atom in atoms:
+                if not isinstance(atom, dict) or atom.get("fact") != "invocation":
+                    continue
+                # Only same-instance calls bypass the proxy: unqualified or `this.`.
+                if atom.get("receiver") not in (None, "this"):
+                    continue
+                target = atom.get("resolved_fqn")
+                if not target:
+                    continue  # ambiguous/overloaded/unresolved sibling — honest skip
+                # The bypass only matters when the sibling declares its OWN
+                # method-level @Transactional; class-level advice already covers
+                # the outer entry method and is not lost by the self-call.
+                tb = tx_index.by_symbol.get(target)
+                if tb is None or tb.scope != "method":
+                    continue
+
+                _fid = SpringFinding.make_id(self.pattern_id, f"{caller_fqn}→{target}")
+                if _fid in _seen_ids:
+                    continue
+                _seen_ids.add(_fid)
+
+                caller_simple = caller_fqn.rsplit(".", 1)[-1].replace("#", ".")
+                callee_simple = target.rsplit(".", 1)[-1].replace("#", ".")
+
+                # Tier severity by what the bypass demonstrably breaks. A propagation
+                # that mandates a distinct boundary (or forbids an active TX) is
+                # high; a plain REQUIRED/SUPPORTS/readOnly callee degrades to the
+                # caller's TX — still a real bypass, lower blast radius → medium.
+                if tb.propagation in self._HIGH_IMPACT_PROPAGATION:
+                    sev = "high"
+                else:
+                    sev = "medium"
+
+                findings.append(SpringFinding(
+                    id=_fid,
+                    pattern_id=self.pattern_id,
+                    category="tx",
+                    severity=sev,
+                    confidence="high",
+                    title="Self-invocation of @Transactional method — Spring proxy bypass",
+                    symbol=target,
+                    source_file=tb.source_file,
+                    evidence={
+                        "caller": caller_fqn,
+                        "callee": target,
+                        "receiver": atom.get("receiver") or "(unqualified)",
+                        "annotation": "@Transactional",
+                        "callee_propagation": tb.propagation,
+                        "callee_read_only": tb.read_only,
+                        "proxy_mechanism": "proxy self-invocation",
+                        "reason": (
+                            "same-instance call does not pass through the Spring proxy"
+                        ),
+                    },
+                    explanation=(
+                        f"{caller_simple} calls sibling {callee_simple} on the same "
+                        "instance (unqualified / this.). The call does not pass through "
+                        f"the Spring proxy, so the @Transactional on {callee_simple} "
+                        f"(propagation={tb.propagation}"
+                        f"{', readOnly=true' if tb.read_only else ''}) is silently "
+                        "ignored — it executes in the caller's transaction context "
+                        "(or none at all), not the one its annotation declares. "
+                        "No new/independent transaction, propagation, or rollback boundary is applied."
+                    ),
+                    fix_hint=(
+                        "Move the @Transactional method to a separate Spring bean and "
+                        "call it through the injected dependency, or inject the bean into "
+                        "itself and call via the injected proxy reference, or use "
+                        "TransactionTemplate for programmatic transaction control."
+                    ),
+                    limitations=[
+                        "Only unambiguous sibling calls are analyzed — overloaded targets "
+                        "are reported as unresolved and skipped",
+                    ],
+                    related_symbols=[target.split("#")[0]],
+                ))
+
+        return findings
+
+
 # ---------------------------------------------------------------------------
 # Default pattern registry
 # ---------------------------------------------------------------------------
@@ -693,6 +828,7 @@ _DEFAULT_TX_PATTERNS: list[TxPattern] = [
     _TX003ReadOnlyWritePropagation(),  # type: ignore[list-item]
     _TX004TxSuspensionRisk(),   # type: ignore[list-item]
     _TX005ExceptionSwallowing(),  # type: ignore[list-item]
+    _TX006SelfInvocation(),     # type: ignore[list-item]
 ]
 
 
@@ -777,7 +913,8 @@ def run_tx_audit(
     _spring_detected = tx_index.stats()["total"] > 0 or model.bean_graph.has_spring_beans()
 
     _tx_limitations = [
-        "Self-invocation via this.method() not detected — requires AST-level analysis",
+        "Self-invocation (this.method()) detected for unambiguous same-class calls "
+        "(TX-006); overloaded targets are reported as unresolved and skipped",
         "Dynamic dispatch (interface/polymorphic calls) may produce incomplete call chains",
     ]
     for _err in getattr(engine, "_last_analysis_errors", []):