Thanks to visit codestin.com
Credit goes to github.com

Skip to content

Commit 67af9b0

Browse files
committed
Add comments and update JavaDocs of GenericServlet using the source JAR
1 parent 93d1393 commit 67af9b0

3 files changed

Lines changed: 110 additions & 109 deletions

File tree

Lines changed: 8 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -1,11 +1,11 @@
11
edges
2-
| UncaughtServletException.java:12:15:12:43 | getParameter(...) : String | UncaughtServletException.java:13:44:13:45 | ip |
3-
| UncaughtServletException.java:15:19:15:41 | getRemoteUser(...) : String | UncaughtServletException.java:16:20:16:25 | userId |
2+
| UncaughtServletException.java:13:15:13:43 | getParameter(...) : String | UncaughtServletException.java:14:44:14:45 | ip |
3+
| UncaughtServletException.java:16:19:16:41 | getRemoteUser(...) : String | UncaughtServletException.java:17:20:17:25 | userId |
44
nodes
5-
| UncaughtServletException.java:12:15:12:43 | getParameter(...) : String | semmle.label | getParameter(...) : String |
6-
| UncaughtServletException.java:13:44:13:45 | ip | semmle.label | ip |
7-
| UncaughtServletException.java:15:19:15:41 | getRemoteUser(...) : String | semmle.label | getRemoteUser(...) : String |
8-
| UncaughtServletException.java:16:20:16:25 | userId | semmle.label | userId |
5+
| UncaughtServletException.java:13:15:13:43 | getParameter(...) : String | semmle.label | getParameter(...) : String |
6+
| UncaughtServletException.java:14:44:14:45 | ip | semmle.label | ip |
7+
| UncaughtServletException.java:16:19:16:41 | getRemoteUser(...) : String | semmle.label | getRemoteUser(...) : String |
8+
| UncaughtServletException.java:17:20:17:25 | userId | semmle.label | userId |
99
#select
10-
| UncaughtServletException.java:13:44:13:45 | ip | UncaughtServletException.java:12:15:12:43 | getParameter(...) : String | UncaughtServletException.java:13:44:13:45 | ip | $@ flows to here and can throw uncaught exception. | UncaughtServletException.java:12:15:12:43 | getParameter(...) | User-provided value |
11-
| UncaughtServletException.java:16:20:16:25 | userId | UncaughtServletException.java:15:19:15:41 | getRemoteUser(...) : String | UncaughtServletException.java:16:20:16:25 | userId | $@ flows to here and can throw uncaught exception. | UncaughtServletException.java:15:19:15:41 | getRemoteUser(...) | User-provided value |
10+
| UncaughtServletException.java:14:44:14:45 | ip | UncaughtServletException.java:13:15:13:43 | getParameter(...) : String | UncaughtServletException.java:14:44:14:45 | ip | $@ flows to here and can throw uncaught exception. | UncaughtServletException.java:13:15:13:43 | getParameter(...) | User-provided value |
11+
| UncaughtServletException.java:17:20:17:25 | userId | UncaughtServletException.java:16:19:16:41 | getRemoteUser(...) : String | UncaughtServletException.java:17:20:17:25 | userId | $@ flows to here and can throw uncaught exception. | UncaughtServletException.java:16:19:16:41 | getRemoteUser(...) | User-provided value |

java/ql/test/experimental/query-tests/security/CWE-600/UncaughtServletException.java

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -8,6 +8,7 @@
88
import javax.servlet.ServletException;
99

1010
class UncaughtServletException extends HttpServlet {
11+
// BAD - Tests `doGet` without catching exceptions
1112
public void doGet(HttpServletRequest request, HttpServletResponse response) throws IOException, ServletException {
1213
String ip = request.getParameter("srcIP");
1314
InetAddress addr = InetAddress.getByName(ip); // BAD: getByName(String) throws UnknownHostException
@@ -16,6 +17,7 @@ public void doGet(HttpServletRequest request, HttpServletResponse response) thro
1617
Integer.parseInt(userId); //BAD: Integer.parse(String) throws RuntimeException
1718
}
1819

20+
// GOOD - Tests `doPost` with catching exceptions
1921
public void doPost(HttpServletRequest request, HttpServletResponse response) throws IOException, ServletException {
2022
try {
2123
String ip = request.getParameter("srcIP");

java/ql/test/stubs/servlet-api-2.4/javax/servlet/GenericServlet.java

Lines changed: 100 additions & 101 deletions
Original file line numberDiff line numberDiff line change
@@ -25,193 +25,192 @@
2525

2626
import java.io.IOException;
2727
import java.util.Enumeration;
28-
import java.util.ResourceBundle;
2928

29+
/**
30+
*
31+
* Defines a generic, protocol-independent
32+
* servlet. To write an HTTP servlet for use on the
33+
* Web, extend {@link javax.servlet.http.HttpServlet} instead.
34+
*
35+
* <p><code>GenericServlet</code> implements the <code>Servlet</code>
36+
* and <code>ServletConfig</code> interfaces. <code>GenericServlet</code>
37+
* may be directly extended by a servlet, although it's more common to extend
38+
* a protocol-specific subclass such as <code>HttpServlet</code>.
39+
*
40+
* <p><code>GenericServlet</code> makes writing servlets
41+
* easier. It provides simple versions of the lifecycle methods
42+
* <code>init</code> and <code>destroy</code> and of the methods
43+
* in the <code>ServletConfig</code> interface. <code>GenericServlet</code>
44+
* also implements the <code>log</code> method, declared in the
45+
* <code>ServletContext</code> interface.
46+
*
47+
* <p>To write a generic servlet, you need only
48+
* override the abstract <code>service</code> method.
49+
*
50+
* @version $Rev: 46019 $ $Date: 2004-09-14 04:56:06 -0500 (Tue, 14 Sep 2004) $
51+
*/
3052
public abstract class GenericServlet implements Servlet, ServletConfig, java.io.Serializable {
53+
3154
/**
32-
*
33-
* Does nothing. All of the servlet initialization is done by one of the
34-
* <code>init</code> methods.
35-
*
55+
* Does nothing. All of the servlet initialization
56+
* is done by one of the <code>init</code> methods.
3657
*/
3758
public GenericServlet() {
3859
}
3960

4061
/**
41-
* Called by the servlet container to indicate to a servlet that the servlet is
42-
* being taken out of service. See {@link Servlet#destroy}.
43-
*
44-
*
62+
* Called by the servlet container to indicate to a servlet that the
63+
* servlet is being taken out of service. See {@link Servlet#destroy}.
4564
*/
4665
public void destroy() {
4766
}
4867

4968
/**
5069
* Returns a <code>String</code> containing the value of the named
51-
* initialization parameter, or <code>null</code> if the parameter does not
52-
* exist. See {@link ServletConfig#getInitParameter}.
53-
*
54-
* <p>
55-
* This method is supplied for convenience. It gets the value of the named
56-
* parameter from the servlet's <code>ServletConfig</code> object.
70+
* initialization parameter, or <code>null</code> if the parameter does
71+
* not exist. See {@link ServletConfig#getInitParameter}.
5772
*
58-
* @param name a <code>String</code> specifying the name of the initialization
59-
* parameter
73+
* <p>This method is supplied for convenience. It gets the
74+
* value of the named parameter from the servlet's
75+
* <code>ServletConfig</code> object.
6076
*
61-
* @return String a <code>String</code> containing the value of the
62-
* initialization parameter
77+
* @param name a <code>String</code> specifying the name
78+
* of the initialization parameter
6379
*
80+
* @return String a <code>String</code> containing the value
81+
* of the initalization parameter
6482
*/
6583
public String getInitParameter(String name) {
6684
return null;
6785
}
6886

6987
/**
70-
* Returns the names of the servlet's initialization parameters as an
71-
* <code>Enumeration</code> of <code>String</code> objects, or an empty
72-
* <code>Enumeration</code> if the servlet has no initialization parameters. See
73-
* {@link ServletConfig#getInitParameterNames}.
88+
* Returns the names of the servlet's initialization parameters
89+
* as an <code>Enumeration</code> of <code>String</code> objects,
90+
* or an empty <code>Enumeration</code> if the servlet has no
91+
* initialization parameters. See {@link
92+
* ServletConfig#getInitParameterNames}.
7493
*
75-
* <p>
76-
* This method is supplied for convenience. It gets the parameter names from the
77-
* servlet's <code>ServletConfig</code> object.
94+
* <p>This method is supplied for convenience. It gets the
95+
* parameter names from the servlet's <code>ServletConfig</code> object.
7896
*
7997
*
80-
* @return Enumeration an enumeration of <code>String</code> objects containing
81-
* the names of the servlet's initialization parameters
98+
* @return Enumeration an enumeration of <code>String</code>
99+
* objects containing the names of the servlet's initialization parameters
82100
*/
83-
public Enumeration<String> getInitParameterNames() {
101+
public Enumeration getInitParameterNames() {
84102
return null;
85103
}
86104

87105
/**
88106
* Returns this servlet's {@link ServletConfig} object.
89107
*
90-
* @return ServletConfig the <code>ServletConfig</code> object that initialized
91-
* this servlet
108+
* @return ServletConfig the <code>ServletConfig</code> object
109+
* that initialized this servlet
92110
*/
93111
public ServletConfig getServletConfig() {
94112
return null;
95113
}
96114

115+
97116
/**
98-
* Returns a reference to the {@link ServletContext} in which this servlet is
99-
* running. See {@link ServletConfig#getServletContext}.
117+
* Returns a reference to the {@link ServletContext} in which this servlet
118+
* is running. See {@link ServletConfig#getServletContext}.
100119
*
101-
* <p>
102-
* This method is supplied for convenience. It gets the context from the
103-
* servlet's <code>ServletConfig</code> object.
120+
* <p>This method is supplied for convenience. It gets the
121+
* context from the servlet's <code>ServletConfig</code> object.
104122
*
105123
*
106-
* @return ServletContext the <code>ServletContext</code> object passed to this
107-
* servlet by the <code>init</code> method
124+
* @return ServletContext the <code>ServletContext</code> object
125+
* passed to this servlet by the <code>init</code> method
108126
*/
109127
public ServletContext getServletContext() {
110128
return null;
111129
}
112130

131+
113132
/**
114-
* Returns information about the servlet, such as author, version, and
115-
* copyright. By default, this method returns an empty string. Override this
116-
* method to have it return a meaningful value. See
117-
* {@link Servlet#getServletInfo}.
133+
* Returns information about the servlet, such as
134+
* author, version, and copyright.
135+
* By default, this method returns an empty string. Override this method
136+
* to have it return a meaningful value. See {@link
137+
* Servlet#getServletInfo}.
118138
*
119139
*
120-
* @return String information about this servlet, by default an empty string
140+
* @return String information about this servlet, by default an
141+
* empty string
121142
*/
122143
public String getServletInfo() {
123144
return null;
124145
}
125146

147+
126148
/**
127-
* Called by the servlet container to indicate to a servlet that the servlet is
128-
* being placed into service. See {@link Servlet#init}.
149+
* Called by the servlet container to indicate to a servlet that the
150+
* servlet is being placed into service. See {@link Servlet#init}.
129151
*
130-
* <p>
131-
* This implementation stores the {@link ServletConfig} object it receives from
132-
* the servlet container for later use. When overriding this form of the method,
133-
* call <code>super.init(config)</code>.
152+
* <p>This implementation stores the {@link ServletConfig}
153+
* object it receives from the servlet container for later use.
154+
* When overriding this form of the method, call
155+
* <code>super.init(config)</code>.
156+
*
157+
* @param config the <code>ServletConfig</code> object
158+
* that contains configutation information for this servlet
134159
*
135-
* @param config the <code>ServletConfig</code> object that contains
136-
* configuration information for this servlet
160+
* @exception ServletException if an exception occurs that
161+
* interrupts the servlet's normal operation
137162
*
138-
* @exception ServletException if an exception occurs that interrupts the
139-
* servlet's normal operation
140-
*
141163
* @see UnavailableException
142164
*/
143165
public void init(ServletConfig config) throws ServletException {
144166
}
145167

168+
146169
/**
147-
* A convenience method which can be overridden so that there's no need to call
148-
* <code>super.init(config)</code>.
170+
* A convenience method which can be overridden so that there's no need
171+
* to call <code>super.init(config)</code>.
149172
*
150-
* <p>
151-
* Instead of overriding {@link #init(ServletConfig)}, simply override this
152-
* method and it will be called by
153-
* <code>GenericServlet.init(ServletConfig config)</code>. The
154-
* <code>ServletConfig</code> object can still be retrieved via
155-
* {@link #getServletConfig}.
173+
* <p>Instead of overriding {@link #init(ServletConfig)}, simply override
174+
* this method and it will be called by
175+
* <code>GenericServlet.init(ServletConfig config)</code>.
176+
* The <code>ServletConfig</code> object can still be retrieved via {@link
177+
* #getServletConfig}.
156178
*
157-
* @exception ServletException if an exception occurs that interrupts the
158-
* servlet's normal operation
179+
* @exception ServletException if an exception occurs that
180+
* interrupts the servlet's normal operation
159181
*/
160182
public void init() throws ServletException {
161183
}
162184

163-
/**
164-
* Writes the specified message to a servlet log file, prepended by the
165-
* servlet's name. See {@link ServletContext#log(String)}.
166-
*
167-
* @param msg a <code>String</code> specifying the message to be written to the
168-
* log file
169-
*/
170-
public void log(String msg) {
171-
}
172185

173186
/**
174-
* Writes an explanatory message and a stack trace for a given
175-
* <code>Throwable</code> exception to the servlet log file, prepended by the
176-
* servlet's name. See {@link ServletContext#log(String, Throwable)}.
187+
* Called by the servlet container to allow the servlet to respond to
188+
* a request. See {@link Servlet#service}.
177189
*
178-
*
179-
* @param message a <code>String</code> that describes the error or exception
180-
*
181-
* @param t the <code>java.lang.Throwable</code> error or exception
182-
*/
183-
public void log(String message, Throwable t) {
184-
}
185-
186-
/**
187-
* Called by the servlet container to allow the servlet to respond to a request.
188-
* See {@link Servlet#service}.
189-
*
190-
* <p>
191-
* This method is declared abstract so subclasses, such as
190+
* <p>This method is declared abstract so subclasses, such as
192191
* <code>HttpServlet</code>, must override it.
193192
*
194-
* @param req the <code>ServletRequest</code> object that contains the client's
195-
* request
193+
* @param req the <code>ServletRequest</code> object
194+
* that contains the client's request
196195
*
197-
* @param res the <code>ServletResponse</code> object that will contain the
198-
* servlet's response
196+
* @param res the <code>ServletResponse</code> object
197+
* that will contain the servlet's response
199198
*
200-
* @exception ServletException if an exception occurs that interferes with the
201-
* servlet's normal operation occurred
199+
* @exception ServletException if an exception occurs that
200+
* interferes with the servlet's normal operation occurred
202201
*
203-
* @exception IOException if an input or output exception occurs
202+
* @exception IOException if an input or output
203+
* exception occurs
204204
*/
205-
206205
public abstract void service(ServletRequest req, ServletResponse res) throws ServletException, IOException;
207206

208207
/**
209-
* Returns the name of this servlet instance. See
210-
* {@link ServletConfig#getServletName}.
208+
* Returns the name of this servlet instance.
209+
* See {@link ServletConfig#getServletName}.
211210
*
212211
* @return the name of this servlet instance
213212
*/
214213
public String getServletName() {
215214
return null;
216215
}
217-
}
216+
}

0 commit comments

Comments
 (0)