openrewrite / rewrite-java-security

OpenRewrite recipes for patching Java security vulnerabilities.
Apache License 2.0
17 stars 15 forks source link

Missing import after XmlParserXXEVulnerability #107

Closed Bananeweizen closed 1 year ago

Bananeweizen commented 1 year ago

What version of OpenRewrite are you using?

I am using

What is the smallest, simplest way to reproduce the problem?

Any attempt at creating a unit test from my real life example failed, even when taking the identical source file. But that doesn't matter, I've identified the root cause.

What did you see instead?

Missing import for XmlConstants in added code: grafik

Are you interested in contributing a fix to OpenRewrite?

Yes. Root cause seems to be adding only one import in https://github.com/openrewrite/rewrite-java-security/blob/c75440d1e04d2596df61391b9e1548d1799d1598/src/main/java/org/openrewrite/java/security/xml/DBFInsertPropertyStatementVisitor.java#L24, although that visitor conditionally adds this block requiring another import: https://github.com/openrewrite/rewrite-java-security/blob/c75440d1e04d2596df61391b9e1548d1799d1598/src/main/java/org/openrewrite/java/security/xml/DBFInsertPropertyStatementVisitor.java#L104-L116. My fix attempt would be to just add XmlConstants to the list of imports in the first piece of code. But I don't know if that means we are adding an unused import in case the second block is not executed. (and running a modified version of the maven plugin with patched source doesn't work for me yet).