The following issues were found

java/core/src/main/java/com/google/protobuf/RepeatedFieldBuilderV3.java
27 issues
This class has too many methods, consider refactoring it.
Design

Line: 65

                      MType extends AbstractMessage,
        BType extends AbstractMessage.Builder,
        IType extends MessageOrBuilder>
    implements AbstractMessage.BuilderParent {

  // Parent to send changes to.
  private AbstractMessage.BuilderParent parent;

  // List of messages. Never null. It may be immutable, in which case

            

Reported by PMD.

Found non-transient, non-static member. Please mark as transient or provide accessors.
Error

Line: 68

                  implements AbstractMessage.BuilderParent {

  // Parent to send changes to.
  private AbstractMessage.BuilderParent parent;

  // List of messages. Never null. It may be immutable, in which case
  // isMessagesListMutable will be false. See note below.
  private List<MType> messages;


            

Reported by PMD.

Found non-transient, non-static member. Please mark as transient or provide accessors.
Error

Line: 72

              
  // List of messages. Never null. It may be immutable, in which case
  // isMessagesListMutable will be false. See note below.
  private List<MType> messages;

  // Whether messages is an mutable array that can be modified.
  private boolean isMessagesListMutable;

  // List of builders. May be null, in which case, no nested builders were

            

Reported by PMD.

Found non-transient, non-static member. Please mark as transient or provide accessors.
Error

Line: 75

                private List<MType> messages;

  // Whether messages is an mutable array that can be modified.
  private boolean isMessagesListMutable;

  // List of builders. May be null, in which case, no nested builders were
  // created. If not null, entries represent the builder for that index.
  private List<SingleFieldBuilderV3<MType, BType, IType>> builders;


            

Reported by PMD.

Found non-transient, non-static member. Please mark as transient or provide accessors.
Error

Line: 79

              
  // List of builders. May be null, in which case, no nested builders were
  // created. If not null, entries represent the builder for that index.
  private List<SingleFieldBuilderV3<MType, BType, IType>> builders;

  // Here are the invariants for messages and builders:
  // 1. messages is never null and its count corresponds to the number of items
  //    in the repeated field.
  // 2. If builders is non-null, messages and builders MUST always

            

Reported by PMD.

Found non-transient, non-static member. Please mark as transient or provide accessors.
Error

Line: 97

              
  // Indicates that we've built a message and so we are now obligated
  // to dispatch dirty invalidations. See AbstractMessage.BuilderListener.
  private boolean isClean;

  // A view of this builder that exposes a List interface of messages. This is
  // initialized on demand. This is fully backed by this object and all changes
  // are reflected in it. Access to any item converts it to a message if it
  // was a builder.

            

Reported by PMD.

Found non-transient, non-static member. Please mark as transient or provide accessors.
Error

Line: 103

                // initialized on demand. This is fully backed by this object and all changes
  // are reflected in it. Access to any item converts it to a message if it
  // was a builder.
  private MessageExternalList<MType, BType, IType> externalMessageList;

  // A view of this builder that exposes a List interface of builders. This is
  // initialized on demand. This is fully backed by this object and all changes
  // are reflected in it. Access to any item converts it to a builder if it
  // was a message.

            

Reported by PMD.

Found non-transient, non-static member. Please mark as transient or provide accessors.
Error

Line: 109

                // initialized on demand. This is fully backed by this object and all changes
  // are reflected in it. Access to any item converts it to a builder if it
  // was a message.
  private BuilderExternalList<MType, BType, IType> externalBuilderList;

  // A view of this builder that exposes a List interface of the interface
  // implemented by messages and builders. This is initialized on demand. This
  // is fully backed by this object and all changes are reflected in it.
  // Access to any item returns either a builder or message depending on

            

Reported by PMD.

Found non-transient, non-static member. Please mark as transient or provide accessors.
Error

Line: 116

                // is fully backed by this object and all changes are reflected in it.
  // Access to any item returns either a builder or message depending on
  // what is most efficient.
  private MessageOrBuilderExternalList<MType, BType, IType> externalMessageOrBuilderList;

  /**
   * Constructs a new builder with an empty list of messages.
   *
   * @param messages the current list of messages

            

Reported by PMD.

Assigning an Object to null is a code smell. Consider refactoring.
Error

Line: 139

              
  public void dispose() {
    // Null out parent so we stop sending it invalidations.
    parent = null;
  }

  /**
   * Ensures that the list of messages is mutable so it can be updated. If it's immutable, a copy is
   * made.

            

Reported by PMD.

java/core/src/main/java/com/google/protobuf/RepeatedFieldBuilder.java
27 issues
This class has too many methods, consider refactoring it.
Design

Line: 65

                      MType extends GeneratedMessage,
        BType extends GeneratedMessage.Builder,
        IType extends MessageOrBuilder>
    implements GeneratedMessage.BuilderParent {

  // Parent to send changes to.
  private GeneratedMessage.BuilderParent parent;

  // List of messages. Never null. It may be immutable, in which case

            

Reported by PMD.

Found non-transient, non-static member. Please mark as transient or provide accessors.
Error

Line: 68

                  implements GeneratedMessage.BuilderParent {

  // Parent to send changes to.
  private GeneratedMessage.BuilderParent parent;

  // List of messages. Never null. It may be immutable, in which case
  // isMessagesListMutable will be false. See note below.
  private List<MType> messages;


            

Reported by PMD.

Found non-transient, non-static member. Please mark as transient or provide accessors.
Error

Line: 72

              
  // List of messages. Never null. It may be immutable, in which case
  // isMessagesListMutable will be false. See note below.
  private List<MType> messages;

  // Whether messages is an mutable array that can be modified.
  private boolean isMessagesListMutable;

  // List of builders. May be null, in which case, no nested builders were

            

Reported by PMD.

Found non-transient, non-static member. Please mark as transient or provide accessors.
Error

Line: 75

                private List<MType> messages;

  // Whether messages is an mutable array that can be modified.
  private boolean isMessagesListMutable;

  // List of builders. May be null, in which case, no nested builders were
  // created. If not null, entries represent the builder for that index.
  private List<SingleFieldBuilder<MType, BType, IType>> builders;


            

Reported by PMD.

Found non-transient, non-static member. Please mark as transient or provide accessors.
Error

Line: 79

              
  // List of builders. May be null, in which case, no nested builders were
  // created. If not null, entries represent the builder for that index.
  private List<SingleFieldBuilder<MType, BType, IType>> builders;

  // Here are the invariants for messages and builders:
  // 1. messages is never null and its count corresponds to the number of items
  //    in the repeated field.
  // 2. If builders is non-null, messages and builders MUST always

            

Reported by PMD.

Found non-transient, non-static member. Please mark as transient or provide accessors.
Error

Line: 97

              
  // Indicates that we've built a message and so we are now obligated
  // to dispatch dirty invalidations. See GeneratedMessage.BuilderListener.
  private boolean isClean;

  // A view of this builder that exposes a List interface of messages. This is
  // initialized on demand. This is fully backed by this object and all changes
  // are reflected in it. Access to any item converts it to a message if it
  // was a builder.

            

Reported by PMD.

Found non-transient, non-static member. Please mark as transient or provide accessors.
Error

Line: 103

                // initialized on demand. This is fully backed by this object and all changes
  // are reflected in it. Access to any item converts it to a message if it
  // was a builder.
  private MessageExternalList<MType, BType, IType> externalMessageList;

  // A view of this builder that exposes a List interface of builders. This is
  // initialized on demand. This is fully backed by this object and all changes
  // are reflected in it. Access to any item converts it to a builder if it
  // was a message.

            

Reported by PMD.

Found non-transient, non-static member. Please mark as transient or provide accessors.
Error

Line: 109

                // initialized on demand. This is fully backed by this object and all changes
  // are reflected in it. Access to any item converts it to a builder if it
  // was a message.
  private BuilderExternalList<MType, BType, IType> externalBuilderList;

  // A view of this builder that exposes a List interface of the interface
  // implemented by messages and builders. This is initialized on demand. This
  // is fully backed by this object and all changes are reflected in it.
  // Access to any item returns either a builder or message depending on

            

Reported by PMD.

Found non-transient, non-static member. Please mark as transient or provide accessors.
Error

Line: 116

                // is fully backed by this object and all changes are reflected in it.
  // Access to any item returns either a builder or message depending on
  // what is most efficient.
  private MessageOrBuilderExternalList<MType, BType, IType> externalMessageOrBuilderList;

  /**
   * Constructs a new builder with an empty list of messages.
   *
   * @param messages the current list of messages

            

Reported by PMD.

Assigning an Object to null is a code smell. Consider refactoring.
Error

Line: 139

              
  public void dispose() {
    // Null out parent so we stop sending it invalidations.
    parent = null;
  }

  /**
   * Ensures that the list of messages is mutable so it can be updated. If it's immutable, a copy is
   * made.

            

Reported by PMD.

java/core/src/test/java/com/google/protobuf/IsValidUtf8Test.java
27 issues
This class has too many methods, consider refactoring it.
Design

Line: 57

               * also includes some other more targeted tests.
 */
@RunWith(JUnit4.class)
public class IsValidUtf8Test {
  /** Tests that round tripping of all two byte permutations work. */
  @Test
  public void testIsValidUtf8_1Byte() {
    testBytes(LITERAL_FACTORY, 1, EXPECTED_ONE_BYTE_ROUNDTRIPPABLE_COUNT);
    testBytes(HEAP_NIO_FACTORY, 1, EXPECTED_ONE_BYTE_ROUNDTRIPPABLE_COUNT);

            

Reported by PMD.

JUnit tests should include assert() or fail()
Design

Line: 60

              public class IsValidUtf8Test {
  /** Tests that round tripping of all two byte permutations work. */
  @Test
  public void testIsValidUtf8_1Byte() {
    testBytes(LITERAL_FACTORY, 1, EXPECTED_ONE_BYTE_ROUNDTRIPPABLE_COUNT);
    testBytes(HEAP_NIO_FACTORY, 1, EXPECTED_ONE_BYTE_ROUNDTRIPPABLE_COUNT);
    testBytes(DIRECT_NIO_FACTORY, 1, EXPECTED_ONE_BYTE_ROUNDTRIPPABLE_COUNT);
  }


            

Reported by PMD.

JUnit tests should include assert() or fail()
Design

Line: 68

              
  /** Tests that round tripping of all two byte permutations work. */
  @Test
  public void testIsValidUtf8_2Bytes() {
    testBytes(LITERAL_FACTORY, 2, IsValidUtf8TestUtil.EXPECTED_TWO_BYTE_ROUNDTRIPPABLE_COUNT);
    testBytes(HEAP_NIO_FACTORY, 2, IsValidUtf8TestUtil.EXPECTED_TWO_BYTE_ROUNDTRIPPABLE_COUNT);
    testBytes(DIRECT_NIO_FACTORY, 2, IsValidUtf8TestUtil.EXPECTED_TWO_BYTE_ROUNDTRIPPABLE_COUNT);
  }


            

Reported by PMD.

JUnit tests should include assert() or fail()
Design

Line: 76

              
  /** Tests that round tripping of all three byte permutations work. */
  @Test
  public void testIsValidUtf8_3Bytes() {
    // Travis' OOM killer doesn't like this test
    if (System.getenv("TRAVIS") == null) {
      testBytes(LITERAL_FACTORY, 3, EXPECTED_THREE_BYTE_ROUNDTRIPPABLE_COUNT);
      testBytes(HEAP_NIO_FACTORY, 3, EXPECTED_THREE_BYTE_ROUNDTRIPPABLE_COUNT);
      testBytes(DIRECT_NIO_FACTORY, 3, EXPECTED_THREE_BYTE_ROUNDTRIPPABLE_COUNT);

            

Reported by PMD.

Unit tests should not contain more than 1 assert(s).
Design

Line: 91

                 * full coverage. This method tests specific four-byte cases.
   */
  @Test
  public void testIsValidUtf8_4BytesSamples() {
    // Valid 4 byte.
    assertValidUtf8(0xF0, 0xA4, 0xAD, 0xA2);

    // Bad trailing bytes
    assertInvalidUtf8(0xF0, 0xA4, 0xAD, 0x7F);

            

Reported by PMD.

Unit tests should not contain more than 1 assert(s).
Design

Line: 106

              
  /** Tests some hard-coded test cases. */
  @Test
  public void testSomeSequences() {
    // Empty
    assertThat(asBytes("").isValidUtf8()).isTrue();

    // One-byte characters, including control characters
    assertThat(asBytes("\u0000abc\u007f").isValidUtf8()).isTrue();

            

Reported by PMD.

Potential violation of Law of Demeter (method chain calls)
Design

Line: 108

                @Test
  public void testSomeSequences() {
    // Empty
    assertThat(asBytes("").isValidUtf8()).isTrue();

    // One-byte characters, including control characters
    assertThat(asBytes("\u0000abc\u007f").isValidUtf8()).isTrue();

    // Two-byte characters

            

Reported by PMD.

Potential violation of Law of Demeter (method chain calls)
Design

Line: 108

                @Test
  public void testSomeSequences() {
    // Empty
    assertThat(asBytes("").isValidUtf8()).isTrue();

    // One-byte characters, including control characters
    assertThat(asBytes("\u0000abc\u007f").isValidUtf8()).isTrue();

    // Two-byte characters

            

Reported by PMD.

Potential violation of Law of Demeter (method chain calls)
Design

Line: 111

                  assertThat(asBytes("").isValidUtf8()).isTrue();

    // One-byte characters, including control characters
    assertThat(asBytes("\u0000abc\u007f").isValidUtf8()).isTrue();

    // Two-byte characters
    assertThat(asBytes("\u00a2\u00a2").isValidUtf8()).isTrue();

    // Three-byte characters

            

Reported by PMD.

Potential violation of Law of Demeter (method chain calls)
Design

Line: 111

                  assertThat(asBytes("").isValidUtf8()).isTrue();

    // One-byte characters, including control characters
    assertThat(asBytes("\u0000abc\u007f").isValidUtf8()).isTrue();

    // Two-byte characters
    assertThat(asBytes("\u00a2\u00a2").isValidUtf8()).isTrue();

    // Three-byte characters

            

Reported by PMD.

php/ext/google/protobuf/php-upb.h
26 issues
printf - If format strings can be influenced by an attacker, they can be exploited
Security

Line: 111 Column: 62 CWE codes: 134
Suggestion: Use a constant for the format specification

              #define UPB_FORCEINLINE __inline__ __attribute__((always_inline))
#define UPB_NOINLINE __attribute__((noinline))
#define UPB_NORETURN __attribute__((__noreturn__))
#define UPB_PRINTF(str, first_vararg) __attribute__((format (printf, str, first_vararg)))
#elif defined(_MSC_VER)
#define UPB_NOINLINE
#define UPB_FORCEINLINE
#define UPB_NORETURN __declspec(noreturn)
#define UPB_PRINTF(str, first_vararg)

            

Reported by FlawFinder.

char - Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues
Security

Line: 306 Column: 3 CWE codes: 119 120
Suggestion: Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length

              
typedef struct {
  bool ok;
  char msg[UPB_STATUS_MAX_MESSAGE];  /* Error message; NULL-terminated. */
} upb_status;

const char *upb_status_errmsg(const upb_status *status);
bool upb_ok(const upb_status *status);


            

Reported by FlawFinder.

memcpy - Does not check for buffer overflows when copying to destination
Security

Line: 483 Column: 5 CWE codes: 120
Suggestion: Make sure destination can always hold the source data

                void *ret = upb_arena_malloc(a, size);

  if (ret && oldsize > 0) {
    memcpy(ret, ptr, oldsize);
  }

  return ret;
}


            

Reported by FlawFinder.

memcpy - Does not check for buffer overflows when copying to destination
Security

Line: 825 Column: 3 CWE codes: 120
Suggestion: Make sure destination can always hold the source data

              #undef FUNCS

UPB_INLINE void upb_value_setfloat(upb_value *val, float cval) {
  memcpy(&val->val, &cval, sizeof(cval));
}

UPB_INLINE void upb_value_setdouble(upb_value *val, double cval) {
  memcpy(&val->val, &cval, sizeof(cval));
}

            

Reported by FlawFinder.

memcpy - Does not check for buffer overflows when copying to destination
Security

Line: 829 Column: 3 CWE codes: 120
Suggestion: Make sure destination can always hold the source data

              }

UPB_INLINE void upb_value_setdouble(upb_value *val, double cval) {
  memcpy(&val->val, &cval, sizeof(cval));
}

UPB_INLINE upb_value upb_value_float(float cval) {
  upb_value ret;
  upb_value_setfloat(&ret, cval);

            

Reported by FlawFinder.

memcpy - Does not check for buffer overflows when copying to destination
Security

Line: 860 Column: 12 CWE codes: 120
Suggestion: Make sure destination can always hold the source data

              
UPB_INLINE char *upb_tabstr(upb_tabkey key, uint32_t *len) {
  char* mem = (char*)key;
  if (len) memcpy(len, mem, sizeof(*len));
  return mem + sizeof(*len);
}

UPB_INLINE upb_strview upb_tabstrview(upb_tabkey key) {
  upb_strview ret;

            

Reported by FlawFinder.

char - Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues
Security

Line: 1203 Column: 8 CWE codes: 119 120
Suggestion: Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length

              } upb_msg_internal;

/* Maps upb_fieldtype_t -> memory size. */
extern char _upb_fieldtype_to_size[12];

UPB_INLINE size_t upb_msg_sizeof(const upb_msglayout *l) {
  return l->size + sizeof(upb_msg_internal);
}


            

Reported by FlawFinder.

char - Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues
Security

Line: 1249 Column: 5 CWE codes: 119 120
Suggestion: Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length

                  upb_strview str;
    void *ptr;
    double dbl;
    char scalar_data[8];
  } data;
} upb_msg_ext;

/* Adds the given extension data to the given message. The returned extension will
 * have its "ext" member initialized according to |ext|. */

            

Reported by FlawFinder.

memcpy - Does not check for buffer overflows when copying to destination
Security

Line: 1442 Column: 3 CWE codes: 120
Suggestion: Make sure destination can always hold the source data

                  return _upb_array_append_fallback(arr_ptr, value, elem_size_lg2, arena);
  }
  ptr = _upb_array_ptr(arr);
  memcpy(UPB_PTR_AT(ptr, arr->len * elem_size, char), value, elem_size);
  arr->len++;
  return true;
}

/* Used by old generated code, remove once all code has been regenerated. */

            

Reported by FlawFinder.

memcpy - Does not check for buffer overflows when copying to destination
Security

Line: 1533 Column: 5 CWE codes: 120
Suggestion: Make sure destination can always hold the source data

              
UPB_INLINE void _upb_map_fromkey(upb_strview key, void* out, size_t size) {
  if (size == UPB_MAPTYPE_STRING) {
    memcpy(out, &key, sizeof(key));
  } else {
    memcpy(out, key.data, size);
  }
}


            

Reported by FlawFinder.

python/google/protobuf/text_encoding.py
26 issues
Bad indentation. Found 2 spaces, expected 4
Style

Line: 47 Column: 1

              # Lookup table for unicode
_cescape_unicode_to_str = [chr(i) for i in range(0, 256)]
for byte, string in _cescape_chr_to_symbol_map.items():
  _cescape_unicode_to_str[byte] = string

# Lookup table for non-utf8, with necessary escapes at (o >= 127 or o < 32)
_cescape_byte_to_str = ([r'\%03o' % i for i in range(0, 32)] +
                        [chr(i) for i in range(32, 127)] +
                        [r'\%03o' % i for i in range(127, 256)])

            

Reported by Pylint.

Bad indentation. Found 2 spaces, expected 4
Style

Line: 54 Column: 1

                                      [chr(i) for i in range(32, 127)] +
                        [r'\%03o' % i for i in range(127, 256)])
for byte, string in _cescape_chr_to_symbol_map.items():
  _cescape_byte_to_str[byte] = string
del byte, string


def CEscape(text, as_utf8):
  # type: (...) -> str

            

Reported by Pylint.

Function name "CEscape" doesn't conform to snake_case naming style
Error

Line: 58 Column: 1

              del byte, string


def CEscape(text, as_utf8):
  # type: (...) -> str
  """Escape a bytes string for use in an text protocol buffer.

  Args:
    text: A byte string to be escaped.

            

Reported by Pylint.

Bad indentation. Found 2 spaces, expected 4
Style

Line: 60 Column: 1

              
def CEscape(text, as_utf8):
  # type: (...) -> str
  """Escape a bytes string for use in an text protocol buffer.

  Args:
    text: A byte string to be escaped.
    as_utf8: Specifies if result may contain non-ASCII characters.
        In Python 3 this allows unescaped non-ASCII Unicode characters.

            

Reported by Pylint.

Bad indentation. Found 2 spaces, expected 4
Style

Line: 75 Column: 1

                # escapes whereas our C++ unescaping function allows hex escapes to be any
  # length.  So, "\0011".encode('string_escape') ends up being "\\x011", which
  # will be decoded in C++ as a single-character string with char code 0x11.
  if six.PY3:
    text_is_unicode = isinstance(text, str)
    if as_utf8 and text_is_unicode:
      # We're already unicode, no processing beyond control char escapes.
      return text.translate(_cescape_chr_to_symbol_map)
    ord_ = ord if text_is_unicode else lambda x: x  # bytes iterate as ints.

            

Reported by Pylint.

Bad indentation. Found 4 spaces, expected 8
Style

Line: 76 Column: 1

                # length.  So, "\0011".encode('string_escape') ends up being "\\x011", which
  # will be decoded in C++ as a single-character string with char code 0x11.
  if six.PY3:
    text_is_unicode = isinstance(text, str)
    if as_utf8 and text_is_unicode:
      # We're already unicode, no processing beyond control char escapes.
      return text.translate(_cescape_chr_to_symbol_map)
    ord_ = ord if text_is_unicode else lambda x: x  # bytes iterate as ints.
  else:

            

Reported by Pylint.

Bad indentation. Found 4 spaces, expected 8
Style

Line: 77 Column: 1

                # will be decoded in C++ as a single-character string with char code 0x11.
  if six.PY3:
    text_is_unicode = isinstance(text, str)
    if as_utf8 and text_is_unicode:
      # We're already unicode, no processing beyond control char escapes.
      return text.translate(_cescape_chr_to_symbol_map)
    ord_ = ord if text_is_unicode else lambda x: x  # bytes iterate as ints.
  else:
    ord_ = ord  # PY2

            

Reported by Pylint.

Bad indentation. Found 6 spaces, expected 12
Style

Line: 79 Column: 1

                  text_is_unicode = isinstance(text, str)
    if as_utf8 and text_is_unicode:
      # We're already unicode, no processing beyond control char escapes.
      return text.translate(_cescape_chr_to_symbol_map)
    ord_ = ord if text_is_unicode else lambda x: x  # bytes iterate as ints.
  else:
    ord_ = ord  # PY2
  if as_utf8:
    return ''.join(_cescape_unicode_to_str[ord_(c)] for c in text)

            

Reported by Pylint.

Bad indentation. Found 4 spaces, expected 8
Style

Line: 80 Column: 1

                  if as_utf8 and text_is_unicode:
      # We're already unicode, no processing beyond control char escapes.
      return text.translate(_cescape_chr_to_symbol_map)
    ord_ = ord if text_is_unicode else lambda x: x  # bytes iterate as ints.
  else:
    ord_ = ord  # PY2
  if as_utf8:
    return ''.join(_cescape_unicode_to_str[ord_(c)] for c in text)
  return ''.join(_cescape_byte_to_str[ord_(c)] for c in text)

            

Reported by Pylint.

Bad indentation. Found 2 spaces, expected 4
Style

Line: 81 Column: 1

                    # We're already unicode, no processing beyond control char escapes.
      return text.translate(_cescape_chr_to_symbol_map)
    ord_ = ord if text_is_unicode else lambda x: x  # bytes iterate as ints.
  else:
    ord_ = ord  # PY2
  if as_utf8:
    return ''.join(_cescape_unicode_to_str[ord_(c)] for c in text)
  return ''.join(_cescape_byte_to_str[ord_(c)] for c in text)


            

Reported by Pylint.

ruby/ext/google/protobuf_c/ruby-upb.h
26 issues
printf - If format strings can be influenced by an attacker, they can be exploited
Security

Line: 111 Column: 62 CWE codes: 134
Suggestion: Use a constant for the format specification

              #define UPB_FORCEINLINE __inline__ __attribute__((always_inline))
#define UPB_NOINLINE __attribute__((noinline))
#define UPB_NORETURN __attribute__((__noreturn__))
#define UPB_PRINTF(str, first_vararg) __attribute__((format (printf, str, first_vararg)))
#elif defined(_MSC_VER)
#define UPB_NOINLINE
#define UPB_FORCEINLINE
#define UPB_NORETURN __declspec(noreturn)
#define UPB_PRINTF(str, first_vararg)

            

Reported by FlawFinder.

char - Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues
Security

Line: 306 Column: 3 CWE codes: 119 120
Suggestion: Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length

              
typedef struct {
  bool ok;
  char msg[UPB_STATUS_MAX_MESSAGE];  /* Error message; NULL-terminated. */
} upb_status;

const char *upb_status_errmsg(const upb_status *status);
bool upb_ok(const upb_status *status);


            

Reported by FlawFinder.

memcpy - Does not check for buffer overflows when copying to destination
Security

Line: 483 Column: 5 CWE codes: 120
Suggestion: Make sure destination can always hold the source data

                void *ret = upb_arena_malloc(a, size);

  if (ret && oldsize > 0) {
    memcpy(ret, ptr, oldsize);
  }

  return ret;
}


            

Reported by FlawFinder.

memcpy - Does not check for buffer overflows when copying to destination
Security

Line: 825 Column: 3 CWE codes: 120
Suggestion: Make sure destination can always hold the source data

              #undef FUNCS

UPB_INLINE void upb_value_setfloat(upb_value *val, float cval) {
  memcpy(&val->val, &cval, sizeof(cval));
}

UPB_INLINE void upb_value_setdouble(upb_value *val, double cval) {
  memcpy(&val->val, &cval, sizeof(cval));
}

            

Reported by FlawFinder.

memcpy - Does not check for buffer overflows when copying to destination
Security

Line: 829 Column: 3 CWE codes: 120
Suggestion: Make sure destination can always hold the source data

              }

UPB_INLINE void upb_value_setdouble(upb_value *val, double cval) {
  memcpy(&val->val, &cval, sizeof(cval));
}

UPB_INLINE upb_value upb_value_float(float cval) {
  upb_value ret;
  upb_value_setfloat(&ret, cval);

            

Reported by FlawFinder.

memcpy - Does not check for buffer overflows when copying to destination
Security

Line: 860 Column: 12 CWE codes: 120
Suggestion: Make sure destination can always hold the source data

              
UPB_INLINE char *upb_tabstr(upb_tabkey key, uint32_t *len) {
  char* mem = (char*)key;
  if (len) memcpy(len, mem, sizeof(*len));
  return mem + sizeof(*len);
}

UPB_INLINE upb_strview upb_tabstrview(upb_tabkey key) {
  upb_strview ret;

            

Reported by FlawFinder.

char - Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues
Security

Line: 1207 Column: 8 CWE codes: 119 120
Suggestion: Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length

              } upb_msg_internal;

/* Maps upb_fieldtype_t -> memory size. */
extern char _upb_fieldtype_to_size[12];

UPB_INLINE size_t upb_msg_sizeof(const upb_msglayout *l) {
  return l->size + sizeof(upb_msg_internal);
}


            

Reported by FlawFinder.

char - Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues
Security

Line: 1253 Column: 5 CWE codes: 119 120
Suggestion: Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length

                  upb_strview str;
    void *ptr;
    double dbl;
    char scalar_data[8];
  } data;
} upb_msg_ext;

/* Adds the given extension data to the given message. The returned extension will
 * have its "ext" member initialized according to |ext|. */

            

Reported by FlawFinder.

memcpy - Does not check for buffer overflows when copying to destination
Security

Line: 1446 Column: 3 CWE codes: 120
Suggestion: Make sure destination can always hold the source data

                  return _upb_array_append_fallback(arr_ptr, value, elem_size_lg2, arena);
  }
  ptr = _upb_array_ptr(arr);
  memcpy(UPB_PTR_AT(ptr, arr->len * elem_size, char), value, elem_size);
  arr->len++;
  return true;
}

/* Used by old generated code, remove once all code has been regenerated. */

            

Reported by FlawFinder.

memcpy - Does not check for buffer overflows when copying to destination
Security

Line: 1537 Column: 5 CWE codes: 120
Suggestion: Make sure destination can always hold the source data

              
UPB_INLINE void _upb_map_fromkey(upb_strview key, void* out, size_t size) {
  if (size == UPB_MAPTYPE_STRING) {
    memcpy(out, &key, sizeof(key));
  } else {
    memcpy(out, key.data, size);
  }
}


            

Reported by FlawFinder.

ruby/src/main/java/com/google/protobuf/jruby/RubyDescriptor.java
26 issues
Potential violation of Law of Demeter (object not created locally)
Design

Line: 174

              
        for (FieldDescriptor fieldDescriptor : descriptor.getFields()) {
            RubyFieldDescriptor fd = (RubyFieldDescriptor) cFieldDescriptor.newInstance(context, Block.NULL_BLOCK);
            fd.setDescriptor(context, fieldDescriptor, pool);
            fieldDescriptors.put(runtime.newString(fieldDescriptor.getName()), fd);
            cache.put(fieldDescriptor, fd);
        }

        for (OneofDescriptor oneofDescriptor : descriptor.getRealOneofs()) {

            

Reported by PMD.

Potential violation of Law of Demeter (object not created locally)
Design

Line: 181

              
        for (OneofDescriptor oneofDescriptor : descriptor.getRealOneofs()) {
            RubyOneofDescriptor ood = (RubyOneofDescriptor) cOneofDescriptor.newInstance(context, Block.NULL_BLOCK);
            ood.setDescriptor(context, oneofDescriptor, cache);
            oneofDescriptors.put(runtime.newString(oneofDescriptor.getName()), ood);
        }

        // Make sure our class is built
        this.klazz = buildClassFromDescriptor(context);

            

Reported by PMD.

Potential violation of Law of Demeter (object not created locally)
Design

Line: 204

                      };

        // rb_define_class_id
        RubyClass klass = RubyClass.newClass(runtime, runtime.getObject());
        klass.setAllocator(allocator);
        klass.makeMetaClass(runtime.getObject().getMetaClass());
        klass.inherit(runtime.getObject());
        RubyModule messageExts = runtime.getClassFromPath("Google::Protobuf::MessageExts");
        klass.include(new IRubyObject[] {messageExts});

            

Reported by PMD.

Potential violation of Law of Demeter (object not created locally)
Design

Line: 205

              
        // rb_define_class_id
        RubyClass klass = RubyClass.newClass(runtime, runtime.getObject());
        klass.setAllocator(allocator);
        klass.makeMetaClass(runtime.getObject().getMetaClass());
        klass.inherit(runtime.getObject());
        RubyModule messageExts = runtime.getClassFromPath("Google::Protobuf::MessageExts");
        klass.include(new IRubyObject[] {messageExts});
        klass.instance_variable_set(runtime.newString(Utils.DESCRIPTOR_INSTANCE_VAR), this);

            

Reported by PMD.

Potential violation of Law of Demeter (object not created locally)
Design

Line: 206

                      // rb_define_class_id
        RubyClass klass = RubyClass.newClass(runtime, runtime.getObject());
        klass.setAllocator(allocator);
        klass.makeMetaClass(runtime.getObject().getMetaClass());
        klass.inherit(runtime.getObject());
        RubyModule messageExts = runtime.getClassFromPath("Google::Protobuf::MessageExts");
        klass.include(new IRubyObject[] {messageExts});
        klass.instance_variable_set(runtime.newString(Utils.DESCRIPTOR_INSTANCE_VAR), this);
        klass.defineAnnotatedMethods(RubyMessage.class);

            

Reported by PMD.

Potential violation of Law of Demeter (method chain calls)
Design

Line: 206

                      // rb_define_class_id
        RubyClass klass = RubyClass.newClass(runtime, runtime.getObject());
        klass.setAllocator(allocator);
        klass.makeMetaClass(runtime.getObject().getMetaClass());
        klass.inherit(runtime.getObject());
        RubyModule messageExts = runtime.getClassFromPath("Google::Protobuf::MessageExts");
        klass.include(new IRubyObject[] {messageExts});
        klass.instance_variable_set(runtime.newString(Utils.DESCRIPTOR_INSTANCE_VAR), this);
        klass.defineAnnotatedMethods(RubyMessage.class);

            

Reported by PMD.

Potential violation of Law of Demeter (object not created locally)
Design

Line: 206

                      // rb_define_class_id
        RubyClass klass = RubyClass.newClass(runtime, runtime.getObject());
        klass.setAllocator(allocator);
        klass.makeMetaClass(runtime.getObject().getMetaClass());
        klass.inherit(runtime.getObject());
        RubyModule messageExts = runtime.getClassFromPath("Google::Protobuf::MessageExts");
        klass.include(new IRubyObject[] {messageExts});
        klass.instance_variable_set(runtime.newString(Utils.DESCRIPTOR_INSTANCE_VAR), this);
        klass.defineAnnotatedMethods(RubyMessage.class);

            

Reported by PMD.

Potential violation of Law of Demeter (object not created locally)
Design

Line: 207

                      RubyClass klass = RubyClass.newClass(runtime, runtime.getObject());
        klass.setAllocator(allocator);
        klass.makeMetaClass(runtime.getObject().getMetaClass());
        klass.inherit(runtime.getObject());
        RubyModule messageExts = runtime.getClassFromPath("Google::Protobuf::MessageExts");
        klass.include(new IRubyObject[] {messageExts});
        klass.instance_variable_set(runtime.newString(Utils.DESCRIPTOR_INSTANCE_VAR), this);
        klass.defineAnnotatedMethods(RubyMessage.class);
        return klass;

            

Reported by PMD.

Potential violation of Law of Demeter (object not created locally)
Design

Line: 207

                      RubyClass klass = RubyClass.newClass(runtime, runtime.getObject());
        klass.setAllocator(allocator);
        klass.makeMetaClass(runtime.getObject().getMetaClass());
        klass.inherit(runtime.getObject());
        RubyModule messageExts = runtime.getClassFromPath("Google::Protobuf::MessageExts");
        klass.include(new IRubyObject[] {messageExts});
        klass.instance_variable_set(runtime.newString(Utils.DESCRIPTOR_INSTANCE_VAR), this);
        klass.defineAnnotatedMethods(RubyMessage.class);
        return klass;

            

Reported by PMD.

Potential violation of Law of Demeter (object not created locally)
Design

Line: 208

                      klass.setAllocator(allocator);
        klass.makeMetaClass(runtime.getObject().getMetaClass());
        klass.inherit(runtime.getObject());
        RubyModule messageExts = runtime.getClassFromPath("Google::Protobuf::MessageExts");
        klass.include(new IRubyObject[] {messageExts});
        klass.instance_variable_set(runtime.newString(Utils.DESCRIPTOR_INSTANCE_VAR), this);
        klass.defineAnnotatedMethods(RubyMessage.class);
        return klass;
    }

            

Reported by PMD.

java/core/src/test/java/com/google/protobuf/AbstractSchemaTest.java
25 issues
This class has too many methods, consider refactoring it.
Design

Line: 44

              import org.junit.Before;
import org.junit.Test;

public abstract class AbstractSchemaTest<T extends MessageLite> {
  private Schema<T> schema;

  @Before
  public void setup() {
    schema = schema();

            

Reported by PMD.

Field schema has the same name as a method
Error

Line: 45

              import org.junit.Test;

public abstract class AbstractSchemaTest<T extends MessageLite> {
  private Schema<T> schema;

  @Before
  public void setup() {
    schema = schema();
    registerSchemas();

            

Reported by PMD.

Found non-transient, non-static member. Please mark as transient or provide accessors.
Error

Line: 45

              import org.junit.Test;

public abstract class AbstractSchemaTest<T extends MessageLite> {
  private Schema<T> schema;

  @Before
  public void setup() {
    schema = schema();
    registerSchemas();

            

Reported by PMD.

Potential violation of Law of Demeter (method chain calls)
Design

Line: 56

                // Subclass should override this method if it needs to register more than one schemas.
  protected void registerSchemas() {
    // Register this schema with the runtime to support processing of nested messages.
    Protobuf.getInstance().registerSchemaOverride(schema.newInstance().getClass(), schema);
  }

  protected abstract Schema<T> schema();

  protected abstract ExperimentalMessageFactory<? extends T> messageFactory();

            

Reported by PMD.

Potential violation of Law of Demeter (method chain calls)
Design

Line: 56

                // Subclass should override this method if it needs to register more than one schemas.
  protected void registerSchemas() {
    // Register this schema with the runtime to support processing of nested messages.
    Protobuf.getInstance().registerSchemaOverride(schema.newInstance().getClass(), schema);
  }

  protected abstract Schema<T> schema();

  protected abstract ExperimentalMessageFactory<? extends T> messageFactory();

            

Reported by PMD.

JUnit tests should include assert() or fail()
Design

Line: 69

                }

  @Test
  public void randomMessageShouldRoundtrip() throws IOException {
    roundtrip("", messageFactory().newMessage());
  }

  @Test
  public void invalidUtf8StringParsing() throws IOException {

            

Reported by PMD.

Potential violation of Law of Demeter (method chain calls)
Design

Line: 70

              
  @Test
  public void randomMessageShouldRoundtrip() throws IOException {
    roundtrip("", messageFactory().newMessage());
  }

  @Test
  public void invalidUtf8StringParsing() throws IOException {
    for (ByteBuffer invalidUtf8Bytes : serializedBytesWithInvalidUtf8()) {

            

Reported by PMD.

Potential violation of Law of Demeter (method chain calls)
Design

Line: 81

                    T newMsg = schema.newInstance();
      try {
        schema.mergeFrom(newMsg, reader, ExtensionRegistryLite.getEmptyRegistry());
        assertWithMessage("should throw invalid").fail();
      } catch (InvalidProtocolBufferException expected) {
      }
    }
  }


            

Reported by PMD.

Potential violation of Law of Demeter (method chain calls)
Design

Line: 93

                    // Skip this test if not on Android.
      return;
    }
    byte[] data = messageFactory().newMessage().toByteArray();
    int exceptionCount = 0;
    for (int i = 0; i <= data.length; i++) {
      byte[] truncatedData = Arrays.copyOf(data, i);
      try {
        T message = schema.newInstance();

            

Reported by PMD.

Potential violation of Law of Demeter (method chain calls)
Design

Line: 93

                    // Skip this test if not on Android.
      return;
    }
    byte[] data = messageFactory().newMessage().toByteArray();
    int exceptionCount = 0;
    for (int i = 0; i <= data.length; i++) {
      byte[] truncatedData = Arrays.copyOf(data, i);
      try {
        T message = schema.newInstance();

            

Reported by PMD.

java/core/src/test/java/com/google/protobuf/AbstractProto3LiteSchemaTest.java
25 issues
Potential violation of Law of Demeter (object not created locally)
Design

Line: 59

                  {
      ByteBuffer buffer = ByteBuffer.allocate(100);
      CodedOutputStream codedOutput = CodedOutputStream.newInstance(buffer);
      codedOutput.writeByteArray(Proto3MessageLite.FIELD_STRING_9_FIELD_NUMBER, invalid);
      codedOutput.flush();
      buffer.flip();
      invalidBytes.add(buffer);
    }
    {

            

Reported by PMD.

Potential violation of Law of Demeter (object not created locally)
Design

Line: 60

                    ByteBuffer buffer = ByteBuffer.allocate(100);
      CodedOutputStream codedOutput = CodedOutputStream.newInstance(buffer);
      codedOutput.writeByteArray(Proto3MessageLite.FIELD_STRING_9_FIELD_NUMBER, invalid);
      codedOutput.flush();
      buffer.flip();
      invalidBytes.add(buffer);
    }
    {
      ByteBuffer buffer = ByteBuffer.allocate(100);

            

Reported by PMD.

Potential violation of Law of Demeter (object not created locally)
Design

Line: 61

                    CodedOutputStream codedOutput = CodedOutputStream.newInstance(buffer);
      codedOutput.writeByteArray(Proto3MessageLite.FIELD_STRING_9_FIELD_NUMBER, invalid);
      codedOutput.flush();
      buffer.flip();
      invalidBytes.add(buffer);
    }
    {
      ByteBuffer buffer = ByteBuffer.allocate(100);
      CodedOutputStream codedOutput = CodedOutputStream.newInstance(buffer);

            

Reported by PMD.

Potential violation of Law of Demeter (object not created locally)
Design

Line: 67

                  {
      ByteBuffer buffer = ByteBuffer.allocate(100);
      CodedOutputStream codedOutput = CodedOutputStream.newInstance(buffer);
      codedOutput.writeByteArray(Proto3MessageLite.FIELD_STRING_LIST_26_FIELD_NUMBER, invalid);
      codedOutput.flush();
      buffer.flip();
      invalidBytes.add(buffer);
    }
    return invalidBytes;

            

Reported by PMD.

Potential violation of Law of Demeter (object not created locally)
Design

Line: 68

                    ByteBuffer buffer = ByteBuffer.allocate(100);
      CodedOutputStream codedOutput = CodedOutputStream.newInstance(buffer);
      codedOutput.writeByteArray(Proto3MessageLite.FIELD_STRING_LIST_26_FIELD_NUMBER, invalid);
      codedOutput.flush();
      buffer.flip();
      invalidBytes.add(buffer);
    }
    return invalidBytes;
  }

            

Reported by PMD.

Potential violation of Law of Demeter (object not created locally)
Design

Line: 69

                    CodedOutputStream codedOutput = CodedOutputStream.newInstance(buffer);
      codedOutput.writeByteArray(Proto3MessageLite.FIELD_STRING_LIST_26_FIELD_NUMBER, invalid);
      codedOutput.flush();
      buffer.flip();
      invalidBytes.add(buffer);
    }
    return invalidBytes;
  }


            

Reported by PMD.

Unit tests should not contain more than 1 assert(s).
Design

Line: 76

                }

  @Test
  public void mergeOptionalMessageFields() throws Exception {
    Proto3MessageLite message1 =
        newBuilder()
            .setFieldMessage10(newBuilder().setFieldInt643(123).clearFieldInt325().build())
            .build();
    Proto3MessageLite message2 =

            

Reported by PMD.

A method/constructor should not explicitly throw java.lang.Exception
Design

Line: 76

                }

  @Test
  public void mergeOptionalMessageFields() throws Exception {
    Proto3MessageLite message1 =
        newBuilder()
            .setFieldMessage10(newBuilder().setFieldInt643(123).clearFieldInt325().build())
            .build();
    Proto3MessageLite message2 =

            

Reported by PMD.

Potential violation of Law of Demeter (object not created locally)
Design

Line: 90

                          .setFieldMessage10(newBuilder().setFieldInt643(789).clearFieldInt325().build())
            .build();
    ByteArrayOutputStream output = new ByteArrayOutputStream();
    message1.writeTo(output);
    message2.writeTo(output);
    message3.writeTo(output);
    byte[] data = output.toByteArray();

    Proto3MessageLite merged =

            

Reported by PMD.

Potential violation of Law of Demeter (object not created locally)
Design

Line: 91

                          .build();
    ByteArrayOutputStream output = new ByteArrayOutputStream();
    message1.writeTo(output);
    message2.writeTo(output);
    message3.writeTo(output);
    byte[] data = output.toByteArray();

    Proto3MessageLite merged =
        ExperimentalSerializationUtil.fromByteArray(data, Proto3MessageLite.class);

            

Reported by PMD.

update_compatibility_version.py
25 issues
Bad indentation. Found 2 spaces, expected 4
Style

Line: 13 Column: 1

              import sys

if len(sys.argv) < 2 or len(sys.argv) > 3:
  print("""
[ERROR] Please specify a version.

./update_compatibility_version.py.py <MAJOR>.<MINOR>.<MICRO> [<RC version>]

Example:

            

Reported by Pylint.

Consider using sys.exit()
Error

Line: 21 Column: 3

              Example:
./update_compatibility_version.py.py 3.7.1 2
""")
  exit(1)

NEW_VERSION = sys.argv[1]
NEW_VERSION_INFO = NEW_VERSION.split('.')
if len(NEW_VERSION_INFO) != 3:
  print("""

            

Reported by Pylint.

Bad indentation. Found 2 spaces, expected 4
Style

Line: 21 Column: 1

              Example:
./update_compatibility_version.py.py 3.7.1 2
""")
  exit(1)

NEW_VERSION = sys.argv[1]
NEW_VERSION_INFO = NEW_VERSION.split('.')
if len(NEW_VERSION_INFO) != 3:
  print("""

            

Reported by Pylint.

Bad indentation. Found 2 spaces, expected 4
Style

Line: 26 Column: 1

              NEW_VERSION = sys.argv[1]
NEW_VERSION_INFO = NEW_VERSION.split('.')
if len(NEW_VERSION_INFO) != 3:
  print("""
[ERROR] Version must be in the format <MAJOR>.<MINOR>.<MICRO>

Example:
./update_compatibility_version.py.py 3.7.3
""")

            

Reported by Pylint.

Bad indentation. Found 2 spaces, expected 4
Style

Line: 32 Column: 1

              Example:
./update_compatibility_version.py.py 3.7.3
""")
  exit(1)

if len(sys.argv) > 2:
  RC_VERSION = int(sys.argv[2])
  # Do not update compatibility versions for rc release
  if RC_VERSION != 0:

            

Reported by Pylint.

Consider using sys.exit()
Error

Line: 32 Column: 3

              Example:
./update_compatibility_version.py.py 3.7.3
""")
  exit(1)

if len(sys.argv) > 2:
  RC_VERSION = int(sys.argv[2])
  # Do not update compatibility versions for rc release
  if RC_VERSION != 0:

            

Reported by Pylint.

Bad indentation. Found 2 spaces, expected 4
Style

Line: 35 Column: 1

                exit(1)

if len(sys.argv) > 2:
  RC_VERSION = int(sys.argv[2])
  # Do not update compatibility versions for rc release
  if RC_VERSION != 0:
    exit(0)



            

Reported by Pylint.

Bad indentation. Found 2 spaces, expected 4
Style

Line: 37 Column: 1

              if len(sys.argv) > 2:
  RC_VERSION = int(sys.argv[2])
  # Do not update compatibility versions for rc release
  if RC_VERSION != 0:
    exit(0)


def RewriteTextFile(filename, line_rewriter):
  lines = open(filename, 'r').readlines()

            

Reported by Pylint.

Consider using sys.exit()
Error

Line: 38 Column: 5

                RC_VERSION = int(sys.argv[2])
  # Do not update compatibility versions for rc release
  if RC_VERSION != 0:
    exit(0)


def RewriteTextFile(filename, line_rewriter):
  lines = open(filename, 'r').readlines()
  updated_lines = []

            

Reported by Pylint.

Bad indentation. Found 4 spaces, expected 8
Style

Line: 38 Column: 1

                RC_VERSION = int(sys.argv[2])
  # Do not update compatibility versions for rc release
  if RC_VERSION != 0:
    exit(0)


def RewriteTextFile(filename, line_rewriter):
  lines = open(filename, 'r').readlines()
  updated_lines = []

            

Reported by Pylint.