undefect. CWE-407 — 63 sites patched across 27 ecosystems

Authors: russell@unturf.com · brackishbert@gmail.com · foxhop.net · TimeHexOn.com

Patches, unit tests, benchmarks, whitepaper, and outreach briefs.
Public domain — no copyright claimed. Use freely.
This commit is contained in:
russell@unturf.com 2026-03-26 17:11:57 -04:00
commit 0a580b313d
70422 changed files with 17213626 additions and 0 deletions

View file

@ -0,0 +1,86 @@
/*
* Copyright (c) 2019, 2023, Oracle and/or its affiliates. All rights reserved.
* DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
*
* This code is free software; you can redistribute it and/or modify it
* under the terms of the GNU General Public License version 2 only, as
* published by the Free Software Foundation.
*
* This code is distributed in the hope that it will be useful, but WITHOUT
* ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
* FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
* version 2 for more details (a copy is included in the LICENSE file that
* accompanied this code).
*
* You should have received a copy of the GNU General Public License version
* 2 along with this work; if not, write to the Free Software Foundation,
* Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
*
* Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
* or visit www.oracle.com if you need additional information or have any
* questions.
*/
/*
* @test
* @bug 8235457
* 8235458
* @summary javac shouldn't fail when an annotation processor report a message about an annotation on a module
* javac should process annotated module when imports statement are present
* @library /tools/lib
* @modules jdk.compiler
* @build toolbox.ToolBox
* @run main ReportOnImportedModuleAnnotation
*/
import java.io.PrintWriter;
import java.io.StringWriter;
import java.nio.file.Files;
import java.nio.file.Path;
import java.util.List;
import javax.tools.JavaCompiler;
import javax.tools.StandardJavaFileManager;
import javax.tools.StandardLocation;
import javax.tools.ToolProvider;
import toolbox.ToolBox;
public class ReportOnImportedModuleAnnotation {
public static void main(String[] args) throws Exception {
final Path testBasePath = Path.of(System.getProperty("test.src"));
final Path testOutputPath = Path.of(System.getProperty("test.classes"));
final JavaCompiler compiler = ToolProvider.getSystemJavaCompiler();
// Clean any existing files in output directory
(new ToolBox()).cleanDirectory(testOutputPath);
// Compile annotation and processor modules
StandardJavaFileManager fileManager = compiler.getStandardFileManager(null, null, null);
fileManager.setLocationFromPaths(StandardLocation.MODULE_SOURCE_PATH, List.of(testBasePath.resolve("mods-src1/")));
fileManager.setLocationFromPaths(StandardLocation.CLASS_OUTPUT, List.of(testOutputPath));
compiler.getTask(new PrintWriter(System.out), fileManager, null, List.of("--module", "annotation,processor"), null, null).call();
// Compile mod modules
fileManager = compiler.getStandardFileManager(null, null, null);
fileManager.setLocationFromPaths(StandardLocation.MODULE_SOURCE_PATH, List.of(testBasePath.resolve("mods-src2/")));
fileManager.setLocationFromPaths(StandardLocation.MODULE_PATH, List.of(testOutputPath.resolve("annotation")));
fileManager.setLocationFromPaths(StandardLocation.ANNOTATION_PROCESSOR_MODULE_PATH, List.of(testOutputPath.resolve("processor")));
fileManager.setLocationFromPaths(StandardLocation.CLASS_OUTPUT, List.of(testOutputPath));
final StringWriter outputWriter = new StringWriter();
compiler.getTask(outputWriter, fileManager, null, List.of("-XDrawDiagnostics", "--module", "mod", "-proc:full"), null, null).call();
String actualOutput = outputWriter.toString();
String expectedOutput = Files.readString(testBasePath.resolve("ReportOnImportedModuleAnnotation.out"));
String lineSep = System.getProperty("line.separator");
if(!actualOutput.replace(lineSep, "\n").equals(expectedOutput.replace(lineSep, "\n"))) {
System.err.println("Expected: [" + expectedOutput + "]");
System.err.println("Received: [" + actualOutput + "]");
throw new Exception("Invalid output");
}
}
}

View file

@ -0,0 +1,2 @@
module-info.java:5:1: compiler.warn.proc.messager: Module warning
1 warning

View file

@ -0,0 +1,35 @@
/*
* Copyright (c) 2019, Oracle and/or its affiliates. All rights reserved.
* DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
*
* This code is free software; you can redistribute it and/or modify it
* under the terms of the GNU General Public License version 2 only, as
* published by the Free Software Foundation.
*
* This code is distributed in the hope that it will be useful, but WITHOUT
* ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
* FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
* version 2 for more details (a copy is included in the LICENSE file that
* accompanied this code).
*
* You should have received a copy of the GNU General Public License version
* 2 along with this work; if not, write to the Free Software Foundation,
* Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
*
* Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
* or visit www.oracle.com if you need additional information or have any
* questions.
*/
package annotation;
import java.lang.annotation.Target;
import java.lang.annotation.Retention;
import java.lang.annotation.ElementType;
import java.lang.annotation.RetentionPolicy;
@Target(ElementType.MODULE)
@Retention(RetentionPolicy.SOURCE)
public @interface ModuleWarn {
}

View file

@ -0,0 +1,26 @@
/*
* Copyright (c) 2019, Oracle and/or its affiliates. All rights reserved.
* DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
*
* This code is free software; you can redistribute it and/or modify it
* under the terms of the GNU General Public License version 2 only, as
* published by the Free Software Foundation.
*
* This code is distributed in the hope that it will be useful, but WITHOUT
* ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
* FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
* version 2 for more details (a copy is included in the LICENSE file that
* accompanied this code).
*
* You should have received a copy of the GNU General Public License version
* 2 along with this work; if not, write to the Free Software Foundation,
* Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
*
* Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
* or visit www.oracle.com if you need additional information or have any
* questions.
*/
module annotation {
exports annotation;
}

View file

@ -0,0 +1,30 @@
/*
* Copyright (c) 2019, Oracle and/or its affiliates. All rights reserved.
* DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
*
* This code is free software; you can redistribute it and/or modify it
* under the terms of the GNU General Public License version 2 only, as
* published by the Free Software Foundation.
*
* This code is distributed in the hope that it will be useful, but WITHOUT
* ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
* FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
* version 2 for more details (a copy is included in the LICENSE file that
* accompanied this code).
*
* You should have received a copy of the GNU General Public License version
* 2 along with this work; if not, write to the Free Software Foundation,
* Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
*
* Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
* or visit www.oracle.com if you need additional information or have any
* questions.
*/
module processor {
requires java.compiler;
exports processor;
provides javax.annotation.processing.Processor with processor.ModuleWarnProcessor;
}

View file

@ -0,0 +1,53 @@
/*
* Copyright (c) 2019, Oracle and/or its affiliates. All rights reserved.
* DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
*
* This code is free software; you can redistribute it and/or modify it
* under the terms of the GNU General Public License version 2 only, as
* published by the Free Software Foundation.
*
* This code is distributed in the hope that it will be useful, but WITHOUT
* ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
* FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
* version 2 for more details (a copy is included in the LICENSE file that
* accompanied this code).
*
* You should have received a copy of the GNU General Public License version
* 2 along with this work; if not, write to the Free Software Foundation,
* Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
*
* Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
* or visit www.oracle.com if you need additional information or have any
* questions.
*/
package processor;
import javax.annotation.processing.AbstractProcessor;
import javax.annotation.processing.SupportedAnnotationTypes;
import javax.annotation.processing.SupportedSourceVersion;
import javax.lang.model.SourceVersion;
import javax.lang.model.element.TypeElement;
import java.util.Set;
import javax.annotation.processing.RoundEnvironment;
import javax.tools.Diagnostic.Kind;
import javax.lang.model.element.AnnotationMirror;
@SupportedAnnotationTypes("annotation.ModuleWarn")
public class ModuleWarnProcessor extends AbstractProcessor {
@Override
public SourceVersion getSupportedSourceVersion() {
return this.processingEnv.getSourceVersion().compareTo(SourceVersion.RELEASE_9) < 0 ? SourceVersion.RELEASE_9 : this.processingEnv.getSourceVersion();
}
public boolean process(Set<? extends TypeElement> annotations, RoundEnvironment roundEnv) {
annotations.stream().flatMap(annotation -> roundEnv.getElementsAnnotatedWith(annotation).stream()).forEach(element -> {
for(AnnotationMirror annotationMirror : element.getAnnotationMirrors()) {
this.processingEnv.getMessager().printMessage(Kind.MANDATORY_WARNING, "Module warning", element, annotationMirror);
}
});
return false;
}
}

View file

@ -0,0 +1,8 @@
/* /nodynamiccopyright/ */
import annotation.ModuleWarn;
@ModuleWarn
module mod {
requires annotation;
}