search

pumasecurity / puma-scan

Puma Scan is a software security Visual Studio extension that provides real time, continuous source code analysis as development teams write code. Vulnerabilities are immediately displayed in the development environment as spell check and compiler warnings, preventing security bugs from entering your applications.
https://www.pumascan.com
Mozilla Public License 2.0
447 stars 79 forks source link

Eternal loop in GetParentLocalDeclarationStatement #40

Closed JarLob closed 6 years ago

JarLob commented 6 years ago

It might be the cause of https://github.com/pumasecurity/puma-scan/issues/39 because I found it running the same project. There is no break at the end of while(true) in GetParentLocalDeclarationStatement as it is in SymbolInheritsFrom. This causes an eternal loop when an item is not null, not LocalDeclarationStatementSyntax and doesn't have a parent.

May I suggest also adding something similar to snippet below to prevent it in the future:

var analyzeTask = AnalyzeAsync();
var timeoutTask = Task.Delay(10000);
var completedTask = await Task.WhenAny(analyzeTask, timeoutTask);
if (completedTask == timeoutTask)
    throw new TimeoutException();
ejohn20 commented 6 years ago

@JarLob awesome find. I'll tinker with this and see if it resolves the issue.

@meadisu27 Do you know if this is corrected in the latest version about to be pushed?

meadisu27 commented 6 years ago

@ejohn20 No I don't believe it is. The release candidate still needs the VS2015 combatibility issues merged in. Can squeeze this in as well.

ejohn20 commented 6 years ago

I'm debugging this now. Definitely was the root of the issue. I'm going to put a check in the loop to prevent it at that layer. I also like the idea of a timeout as @JarLob describes above to prevent the analyzers from hosing up the build as well.

ejohn20 commented 6 years ago

OK - patch fix in flight. This will be in the 2.x version of the open source package to be released shortly.

ejohn20 commented 6 years ago

Deployed in 1.0.7 release this morning.