The following issues were found

src/google/protobuf/text_format.cc
18 issues
StrCat - Does not check for buffer overflows when concatenating to destination [MS-banned]
Security

Line: 657 Column: 11 CWE codes: 120

                                         const FieldDescriptor* field) {
    if (--recursion_limit_ < 0) {
      ReportError(
          StrCat("Message is too deep, the parser exceeded the "
                       "configured recursion limit of ",
                       initial_recursion_limit_, "."));
      return false;
    }
    // If the parse information tree is not nullptr, create a nested one

            

Reported by FlawFinder.

StrCat - Does not check for buffer overflows when concatenating to destination [MS-banned]
Security

Line: 693 Column: 11 CWE codes: 120

                bool SkipFieldMessage() {
    if (--recursion_limit_ < 0) {
      ReportError(
          StrCat("Message is too deep, the parser exceeded the "
                       "configured recursion limit of ",
                       initial_recursion_limit_, "."));
      return false;
    }


            

Reported by FlawFinder.

StrCat - Does not check for buffer overflows when concatenating to destination [MS-banned]
Security

Line: 807 Column: 19 CWE codes: 120

                      } else if (LookingAt("-") ||
                   LookingAtType(io::Tokenizer::TYPE_INTEGER)) {
          DO(ConsumeSignedInteger(&int_value, kint32max));
          value = StrCat(int_value);  // for error reporting
          enum_value = enum_type->FindValueByNumber(int_value);
        } else {
          ReportError("Expected integer or identifier, got: " +
                      tokenizer_.current().text);
          return false;

            

Reported by FlawFinder.

StrCat - Does not check for buffer overflows when concatenating to destination [MS-banned]
Security

Line: 853 Column: 11 CWE codes: 120

                bool SkipFieldValue() {
    if (--recursion_limit_ < 0) {
      ReportError(
          StrCat("Message is too deep, the parser exceeded the "
                       "configured recursion limit of ",
                       initial_recursion_limit_, "."));
      return false;
    }


            

Reported by FlawFinder.

StrCat - Does not check for buffer overflows when concatenating to destination [MS-banned]
Security

Line: 1517 Column: 9 CWE codes: 120

                if (input.size() > INT_MAX) {
    error_collector->AddError(
        -1, 0,
        StrCat(
            "Input size too large: ", static_cast<int64_t>(input.size()),
            " bytes", " > ", INT_MAX, " bytes."));
    return false;
  }
  return true;

            

Reported by FlawFinder.

StrCat - Does not check for buffer overflows when concatenating to destination [MS-banned]
Security

Line: 1731 Column: 26 CWE codes: 120

              }
void TextFormat::FastFieldValuePrinter::PrintInt32(
    int32_t val, BaseTextGenerator* generator) const {
  generator->PrintString(StrCat(val));
}
void TextFormat::FastFieldValuePrinter::PrintUInt32(
    uint32_t val, BaseTextGenerator* generator) const {
  generator->PrintString(StrCat(val));
}

            

Reported by FlawFinder.

StrCat - Does not check for buffer overflows when concatenating to destination [MS-banned]
Security

Line: 1735 Column: 26 CWE codes: 120

              }
void TextFormat::FastFieldValuePrinter::PrintUInt32(
    uint32_t val, BaseTextGenerator* generator) const {
  generator->PrintString(StrCat(val));
}
void TextFormat::FastFieldValuePrinter::PrintInt64(
    int64_t val, BaseTextGenerator* generator) const {
  generator->PrintString(StrCat(val));
}

            

Reported by FlawFinder.

StrCat - Does not check for buffer overflows when concatenating to destination [MS-banned]
Security

Line: 1739 Column: 26 CWE codes: 120

              }
void TextFormat::FastFieldValuePrinter::PrintInt64(
    int64_t val, BaseTextGenerator* generator) const {
  generator->PrintString(StrCat(val));
}
void TextFormat::FastFieldValuePrinter::PrintUInt64(
    uint64_t val, BaseTextGenerator* generator) const {
  generator->PrintString(StrCat(val));
}

            

Reported by FlawFinder.

StrCat - Does not check for buffer overflows when concatenating to destination [MS-banned]
Security

Line: 1743 Column: 26 CWE codes: 120

              }
void TextFormat::FastFieldValuePrinter::PrintUInt64(
    uint64_t val, BaseTextGenerator* generator) const {
  generator->PrintString(StrCat(val));
}
void TextFormat::FastFieldValuePrinter::PrintFloat(
    float val, BaseTextGenerator* generator) const {
  generator->PrintString(!std::isnan(val) ? SimpleFtoa(val) : "nan");
}

            

Reported by FlawFinder.

StrCat - Does not check for buffer overflows when concatenating to destination [MS-banned]
Security

Line: 2421 Column: 28 CWE codes: 120

                // if use_field_number_ is true, prints field number instead
  // of field name.
  if (use_field_number_) {
    generator->PrintString(StrCat(field->number()));
    return;
  }

  const FastFieldValuePrinter* printer = GetFieldPrinter(field);
  printer->PrintFieldName(message, field_index, field_count, reflection, field,

            

Reported by FlawFinder.

java/core/src/main/java/com/google/protobuf/NioByteString.java
18 issues
Avoid reassigning parameters such as 'h'
Design

Line: 213

                }

  @Override
  protected int partialHash(int h, int offset, int length) {
    for (int i = offset; i < offset + length; i++) {
      h = h * 31 + buffer.get(i);
    }
    return h;
  }

            

Reported by PMD.

Avoid reassigning parameters such as 'len'
Design

Line: 258

                    }

      @Override
      public int read(byte[] bytes, int off, int len) throws IOException {
        if (!buf.hasRemaining()) {
          return -1;
        }

        len = Math.min(len, buf.remaining());

            

Reported by PMD.

The class 'NioByteString' has a Modified Cyclomatic Complexity of 2 (Highest = 10).
Design

Line: 49

              import java.util.List;

/** A {@link ByteString} that wraps around a {@link ByteBuffer}. */
final class NioByteString extends ByteString.LeafByteString {
  private final ByteBuffer buffer;

  NioByteString(ByteBuffer buffer) {
    checkNotNull(buffer, "buffer");


            

Reported by PMD.

Classes implementing Serializable should set a serialVersionUID
Error

Line: 49

              import java.util.List;

/** A {@link ByteString} that wraps around a {@link ByteBuffer}. */
final class NioByteString extends ByteString.LeafByteString {
  private final ByteBuffer buffer;

  NioByteString(ByteBuffer buffer) {
    checkNotNull(buffer, "buffer");


            

Reported by PMD.

The class 'NioByteString' has a Standard Cyclomatic Complexity of 2 (Highest = 10).
Design

Line: 49

              import java.util.List;

/** A {@link ByteString} that wraps around a {@link ByteBuffer}. */
final class NioByteString extends ByteString.LeafByteString {
  private final ByteBuffer buffer;

  NioByteString(ByteBuffer buffer) {
    checkNotNull(buffer, "buffer");


            

Reported by PMD.

This class has too many methods, consider refactoring it.
Design

Line: 49

              import java.util.List;

/** A {@link ByteString} that wraps around a {@link ByteBuffer}. */
final class NioByteString extends ByteString.LeafByteString {
  private final ByteBuffer buffer;

  NioByteString(ByteBuffer buffer) {
    checkNotNull(buffer, "buffer");


            

Reported by PMD.

Found non-transient, non-static member. Please mark as transient or provide accessors.
Error

Line: 50

              
/** A {@link ByteString} that wraps around a {@link ByteBuffer}. */
final class NioByteString extends ByteString.LeafByteString {
  private final ByteBuffer buffer;

  NioByteString(ByteBuffer buffer) {
    checkNotNull(buffer, "buffer");

    // Use native byte order for fast fixed32/64 operations.

            

Reported by PMD.

A catch statement that catches an exception only to rethrow it should be avoided.
Design

Line: 78

                public byte byteAt(int index) {
    try {
      return buffer.get(index);
    } catch (ArrayIndexOutOfBoundsException e) {
      throw e;
    } catch (IndexOutOfBoundsException e) {
      throw new ArrayIndexOutOfBoundsException(e.getMessage());
    }
  }

            

Reported by PMD.

New exception is thrown in catch block, original stack trace may be lost
Design

Line: 81

                  } catch (ArrayIndexOutOfBoundsException e) {
      throw e;
    } catch (IndexOutOfBoundsException e) {
      throw new ArrayIndexOutOfBoundsException(e.getMessage());
    }
  }

  @Override
  public byte internalByteAt(int index) {

            

Reported by PMD.

A catch statement that catches an exception only to rethrow it should be avoided.
Design

Line: 102

                  try {
      ByteBuffer slice = slice(beginIndex, endIndex);
      return new NioByteString(slice);
    } catch (ArrayIndexOutOfBoundsException e) {
      throw e;
    } catch (IndexOutOfBoundsException e) {
      throw new ArrayIndexOutOfBoundsException(e.getMessage());
    }
  }

            

Reported by PMD.

benchmarks/util/big_query_utils.py
18 issues
Unable to import 'apiclient'
Error

Line: 9 Column: 1

              import uuid
import httplib2

from apiclient import discovery
from apiclient.errors import HttpError
from oauth2client.client import GoogleCredentials

# 30 days in milliseconds
_EXPIRATION_MS = 30 * 24 * 60 * 60 * 1000

            

Reported by Pylint.

Unable to import 'apiclient.errors'
Error

Line: 10 Column: 1

              import httplib2

from apiclient import discovery
from apiclient.errors import HttpError
from oauth2client.client import GoogleCredentials

# 30 days in milliseconds
_EXPIRATION_MS = 30 * 24 * 60 * 60 * 1000
NUM_RETRIES = 3

            

Reported by Pylint.

Unable to import 'oauth2client.client'
Error

Line: 11 Column: 1

              
from apiclient import discovery
from apiclient.errors import HttpError
from oauth2client.client import GoogleCredentials

# 30 days in milliseconds
_EXPIRATION_MS = 30 * 24 * 60 * 60 * 1000
NUM_RETRIES = 3


            

Reported by Pylint.

Unused import argparse
Error

Line: 4 Column: 1

              #!/usr/bin/env python2.7

from __future__ import print_function
import argparse
import json
import uuid
import httplib2

from apiclient import discovery

            

Reported by Pylint.

Unused import json
Error

Line: 5 Column: 1

              
from __future__ import print_function
import argparse
import json
import uuid
import httplib2

from apiclient import discovery
from apiclient.errors import HttpError

            

Reported by Pylint.

Unused import uuid
Error

Line: 6 Column: 1

              from __future__ import print_function
import argparse
import json
import uuid
import httplib2

from apiclient import discovery
from apiclient.errors import HttpError
from oauth2client.client import GoogleCredentials

            

Reported by Pylint.

Unused import httplib2
Error

Line: 7 Column: 1

              import argparse
import json
import uuid
import httplib2

from apiclient import discovery
from apiclient.errors import HttpError
from oauth2client.client import GoogleCredentials


            

Reported by Pylint.

Unused variable 'http_error'
Error

Line: 165 Column: 5

                      if res.get('insertErrors', None):
            print('Error inserting rows! Response: %s' % res)
            is_success = False
    except HttpError as http_error:
        print('Error inserting rows to the table %s' % table_id)
        is_success = False

    return is_success


            

Reported by Pylint.

Missing module docstring
Error

Line: 1 Column: 1

              #!/usr/bin/env python2.7

from __future__ import print_function
import argparse
import json
import uuid
import httplib2

from apiclient import discovery

            

Reported by Pylint.

Missing function or method docstring
Error

Line: 26 Column: 1

                      'bigquery', 'v2', credentials=creds, cache_discovery=False)


def create_dataset(biq_query, project_id, dataset_id):
    is_success = True
    body = {
        'datasetReference': {
            'projectId': project_id,
            'datasetId': dataset_id

            

Reported by Pylint.

python/docs/conf.py
18 issues
Module 'google.protobuf' has no '__version__' member
Error

Line: 58 Column: 11

              # The short X.Y version
version = u""
# The full version, including alpha/beta/rc tags
release = google.protobuf.__version__


# -- General configuration ---------------------------------------------------

# If your documentation needs a minimal Sphinx version, state it here.

            

Reported by Pylint.

Redefining built-in 'copyright'
Error

Line: 52 Column: 1

              # -- Project information -----------------------------------------------------

project = u"Protocol Buffers"
copyright = u"2008, Google LLC"
author = u"Google LLC"

# The short X.Y version
version = u""
# The full version, including alpha/beta/rc tags

            

Reported by Pylint.

Missing module docstring
Error

Line: 1 Column: 1

              # -*- coding: utf-8 -*-
# Protocol Buffers - Google's data interchange format
# Copyright 2019 Google LLC.  All rights reserved.
# https://developers.google.com/protocol-buffers/
#
# Redistribution and use in source and binary forms, with or without
# modification, are permitted provided that the following conditions are
# met:
#

            

Reported by Pylint.

Constant name "project" doesn't conform to UPPER_CASE naming style
Error

Line: 51 Column: 1

              
# -- Project information -----------------------------------------------------

project = u"Protocol Buffers"
copyright = u"2008, Google LLC"
author = u"Google LLC"

# The short X.Y version
version = u""

            

Reported by Pylint.

Constant name "copyright" doesn't conform to UPPER_CASE naming style
Error

Line: 52 Column: 1

              # -- Project information -----------------------------------------------------

project = u"Protocol Buffers"
copyright = u"2008, Google LLC"
author = u"Google LLC"

# The short X.Y version
version = u""
# The full version, including alpha/beta/rc tags

            

Reported by Pylint.

Constant name "author" doesn't conform to UPPER_CASE naming style
Error

Line: 53 Column: 1

              
project = u"Protocol Buffers"
copyright = u"2008, Google LLC"
author = u"Google LLC"

# The short X.Y version
version = u""
# The full version, including alpha/beta/rc tags
release = google.protobuf.__version__

            

Reported by Pylint.

Constant name "version" doesn't conform to UPPER_CASE naming style
Error

Line: 56 Column: 1

              author = u"Google LLC"

# The short X.Y version
version = u""
# The full version, including alpha/beta/rc tags
release = google.protobuf.__version__


# -- General configuration ---------------------------------------------------

            

Reported by Pylint.

Constant name "source_suffix" doesn't conform to UPPER_CASE naming style
Error

Line: 84 Column: 1

              # You can specify multiple suffix as a list of string:
#
# source_suffix = ['.rst', '.md']
source_suffix = ".rst"

# The master toctree document.
master_doc = "index"

# The language for content autogenerated by Sphinx. Refer to documentation

            

Reported by Pylint.

Constant name "master_doc" doesn't conform to UPPER_CASE naming style
Error

Line: 87 Column: 1

              source_suffix = ".rst"

# The master toctree document.
master_doc = "index"

# The language for content autogenerated by Sphinx. Refer to documentation
# for a list of supported languages.
#
# This is also used if you do content translation via gettext catalogs.

            

Reported by Pylint.

Constant name "language" doesn't conform to UPPER_CASE naming style
Error

Line: 94 Column: 1

              #
# This is also used if you do content translation via gettext catalogs.
# Usually you set "language" from the command line for these cases.
language = None

# List of patterns, relative to source directory, that match files and
# directories to ignore when looking for source files.
# This pattern also affects html_static_path and html_extra_path.
exclude_patterns = [u"_build", "Thumbs.db", ".DS_Store"]

            

Reported by Pylint.

ruby/src/main/java/com/google/protobuf/jruby/RubyFieldDescriptor.java
18 issues
Potential violation of Law of Demeter (static property access)
Design

Line: 232

              
    protected void setDescriptor(ThreadContext context, FieldDescriptor descriptor, RubyDescriptorPool pool) {
        this.descriptor = descriptor;
        this.name = context.runtime.newString(descriptor.getName());
        this.pool = pool;
    }

    private void calculateLabel(ThreadContext context) {
        if (descriptor.isRepeated()) {

            

Reported by PMD.

Potential violation of Law of Demeter (static property access)
Design

Line: 238

              
    private void calculateLabel(ThreadContext context) {
        if (descriptor.isRepeated()) {
            this.label = context.runtime.newSymbol("repeated");
        } else if (descriptor.isOptional()) {
            this.label = context.runtime.newSymbol("optional");
        } else {
            this.label = context.nil;
        }

            

Reported by PMD.

Potential violation of Law of Demeter (static property access)
Design

Line: 240

                      if (descriptor.isRepeated()) {
            this.label = context.runtime.newSymbol("repeated");
        } else if (descriptor.isOptional()) {
            this.label = context.runtime.newSymbol("optional");
        } else {
            this.label = context.nil;
        }
    }


            

Reported by PMD.

Potential violation of Law of Demeter (static property access)
Design

Line: 249

                  private void calculateSubtype(ThreadContext context) {
        FieldDescriptor.Type fdType = descriptor.getType();
        if (fdType == FieldDescriptor.Type.MESSAGE) {
            RubyString messageName = context.runtime.newString(descriptor.getMessageType().getFullName());
            this.subtype = pool.lookup(context, messageName);
        } else if (fdType == FieldDescriptor.Type.ENUM) {
            RubyString enumName = context.runtime.newString(descriptor.getEnumType().getFullName());
            this.subtype = pool.lookup(context, enumName);
        } else {

            

Reported by PMD.

Potential violation of Law of Demeter (method chain calls)
Design

Line: 249

                  private void calculateSubtype(ThreadContext context) {
        FieldDescriptor.Type fdType = descriptor.getType();
        if (fdType == FieldDescriptor.Type.MESSAGE) {
            RubyString messageName = context.runtime.newString(descriptor.getMessageType().getFullName());
            this.subtype = pool.lookup(context, messageName);
        } else if (fdType == FieldDescriptor.Type.ENUM) {
            RubyString enumName = context.runtime.newString(descriptor.getEnumType().getFullName());
            this.subtype = pool.lookup(context, enumName);
        } else {

            

Reported by PMD.

Potential violation of Law of Demeter (static property access)
Design

Line: 252

                          RubyString messageName = context.runtime.newString(descriptor.getMessageType().getFullName());
            this.subtype = pool.lookup(context, messageName);
        } else if (fdType == FieldDescriptor.Type.ENUM) {
            RubyString enumName = context.runtime.newString(descriptor.getEnumType().getFullName());
            this.subtype = pool.lookup(context, enumName);
        } else {
            this.subtype = context.nil;
        }
    }

            

Reported by PMD.

Potential violation of Law of Demeter (method chain calls)
Design

Line: 252

                          RubyString messageName = context.runtime.newString(descriptor.getMessageType().getFullName());
            this.subtype = pool.lookup(context, messageName);
        } else if (fdType == FieldDescriptor.Type.ENUM) {
            RubyString enumName = context.runtime.newString(descriptor.getEnumType().getFullName());
            this.subtype = pool.lookup(context, enumName);
        } else {
            this.subtype = context.nil;
        }
    }

            

Reported by PMD.

Avoid unused private fields such as 'DOT'.
Design

Line: 259

                      }
    }

    private static final String DOT = ".";

    private FieldDescriptor descriptor;
    private IRubyObject name;
    private IRubyObject label;
    private IRubyObject number;

            

Reported by PMD.

Found non-transient, non-static member. Please mark as transient or provide accessors.
Error

Line: 261

              
    private static final String DOT = ".";

    private FieldDescriptor descriptor;
    private IRubyObject name;
    private IRubyObject label;
    private IRubyObject number;
    private IRubyObject subtype;
    private RubyDescriptorPool pool;

            

Reported by PMD.

Found non-transient, non-static member. Please mark as transient or provide accessors.
Error

Line: 262

                  private static final String DOT = ".";

    private FieldDescriptor descriptor;
    private IRubyObject name;
    private IRubyObject label;
    private IRubyObject number;
    private IRubyObject subtype;
    private RubyDescriptorPool pool;
}

            

Reported by PMD.

src/google/protobuf/util/internal/protostream_objectsource.cc
17 issues
StrCat - Does not check for buffer overflows when concatenating to destination [MS-banned]
Security

Line: 320 Column: 32 CWE codes: 120

                int64_t seconds = p.first;
  int32_t nanos = p.second;
  if (seconds > kTimestampMaxSeconds || seconds < kTimestampMinSeconds) {
    return util::InternalError(StrCat(
        "Timestamp seconds exceeds limit for field: ", field_name));
  }

  if (nanos < 0 || nanos >= kNanosPerSecond) {
    return util::InternalError(

            

Reported by FlawFinder.

StrCat - Does not check for buffer overflows when concatenating to destination [MS-banned]
Security

Line: 326 Column: 9 CWE codes: 120

              
  if (nanos < 0 || nanos >= kNanosPerSecond) {
    return util::InternalError(
        StrCat("Timestamp nanos exceeds limit for field: ", field_name));
  }

  ow->RenderString(field_name,
                   ::google::protobuf::internal::FormatTime(seconds, nanos));


            

Reported by FlawFinder.

StrCat - Does not check for buffer overflows when concatenating to destination [MS-banned]
Security

Line: 343 Column: 9 CWE codes: 120

                int32_t nanos = p.second;
  if (seconds > kDurationMaxSeconds || seconds < kDurationMinSeconds) {
    return util::InternalError(
        StrCat("Duration seconds exceeds limit for field: ", field_name));
  }

  if (nanos <= -kNanosPerSecond || nanos >= kNanosPerSecond) {
    return util::InternalError(
        StrCat("Duration nanos exceeds limit for field: ", field_name));

            

Reported by FlawFinder.

StrCat - Does not check for buffer overflows when concatenating to destination [MS-banned]
Security

Line: 348 Column: 9 CWE codes: 120

              
  if (nanos <= -kNanosPerSecond || nanos >= kNanosPerSecond) {
    return util::InternalError(
        StrCat("Duration nanos exceeds limit for field: ", field_name));
  }

  std::string sign = "";
  if (seconds < 0) {
    if (nanos > 0) {

            

Reported by FlawFinder.

StrCat - Does not check for buffer overflows when concatenating to destination [MS-banned]
Security

Line: 355 Column: 11 CWE codes: 120

                if (seconds < 0) {
    if (nanos > 0) {
      return util::InternalError(
          StrCat("Duration nanos is non-negative, but seconds is "
                       "negative for field: ",
                       field_name));
    }
    sign = "-";
    seconds = -seconds;

            

Reported by FlawFinder.

StrCat - Does not check for buffer overflows when concatenating to destination [MS-banned]
Security

Line: 738 Column: 11 CWE codes: 120

                      typeinfo_->GetTypeByTypeUrl(field->type_url());
    if (type == nullptr) {
      return util::InternalError(
          StrCat("Invalid configuration. Could not find the type: ",
                       field->type_url()));
    }

    // Short-circuit any special type rendering to save call-stack space.
    const TypeRenderer* type_renderer = FindTypeRenderer(type->name());

            

Reported by FlawFinder.

StrCat - Does not check for buffer overflows when concatenating to destination [MS-banned]
Security

Line: 906 Column: 16 CWE codes: 120

                  case google::protobuf::Field::TYPE_INT32: {
      uint32_t buffer32;
      stream_->ReadVarint32(&buffer32);
      result = StrCat(bit_cast<int32_t>(buffer32));
      break;
    }
    case google::protobuf::Field::TYPE_INT64: {
      uint64_t buffer64;
      stream_->ReadVarint64(&buffer64);

            

Reported by FlawFinder.

StrCat - Does not check for buffer overflows when concatenating to destination [MS-banned]
Security

Line: 912 Column: 16 CWE codes: 120

                  case google::protobuf::Field::TYPE_INT64: {
      uint64_t buffer64;
      stream_->ReadVarint64(&buffer64);
      result = StrCat(bit_cast<int64_t>(buffer64));
      break;
    }
    case google::protobuf::Field::TYPE_UINT32: {
      uint32_t buffer32;
      stream_->ReadVarint32(&buffer32);

            

Reported by FlawFinder.

StrCat - Does not check for buffer overflows when concatenating to destination [MS-banned]
Security

Line: 918 Column: 16 CWE codes: 120

                  case google::protobuf::Field::TYPE_UINT32: {
      uint32_t buffer32;
      stream_->ReadVarint32(&buffer32);
      result = StrCat(bit_cast<uint32_t>(buffer32));
      break;
    }
    case google::protobuf::Field::TYPE_UINT64: {
      uint64_t buffer64;
      stream_->ReadVarint64(&buffer64);

            

Reported by FlawFinder.

StrCat - Does not check for buffer overflows when concatenating to destination [MS-banned]
Security

Line: 924 Column: 16 CWE codes: 120

                  case google::protobuf::Field::TYPE_UINT64: {
      uint64_t buffer64;
      stream_->ReadVarint64(&buffer64);
      result = StrCat(bit_cast<uint64_t>(buffer64));
      break;
    }
    case google::protobuf::Field::TYPE_SINT32: {
      uint32_t buffer32;
      stream_->ReadVarint32(&buffer32);

            

Reported by FlawFinder.

php/ext/google/protobuf/message.c
17 issues
snprintf - If format strings can be influenced by an attacker, they can be exploited, and note that sprintf variations do not always \0-terminate
Security

Line: 1330 Column: 3 CWE codes: 134
Suggestion: Use a constant for the format specification

              
  // Get formatted time string.
  char formatted_time[32];
  snprintf(formatted_time, sizeof(formatted_time), "%" PRId64 ".%06" PRId32,
           seconds.int64_val, nanos.int32_val / 1000);

  // Create Datetime object.
  zval datetime;
  zval function_name;

            

Reported by FlawFinder.

memcpy - Does not check for buffer overflows when copying to destination
Security

Line: 416 Column: 3 CWE codes: 120
Suggestion: Make sure destination can always hold the source data

              
  // TODO: copy unknown fields?
  // TODO: use official upb msg copy function
  memcpy(clone, intern->msg, upb_msgdef_layout(intern->desc->msgdef)->size);
  zval ret;
  Message_GetPhpWrapper(&ret, intern->desc, clone, &intern->arena);
  return Z_OBJ_P(&ret);
}


            

Reported by FlawFinder.

memcpy - Does not check for buffer overflows when copying to destination
Security

Line: 694 Column: 3 CWE codes: 120
Suggestion: Make sure destination can always hold the source data

              
  // TODO(haberman): avoid this copy when we can make the decoder copy.
  data_copy = upb_arena_malloc(arena, data_len);
  memcpy(data_copy, data, data_len);

  if (!upb_decode(data_copy, data_len, intern->msg, l, arena)) {
    zend_throw_exception_ex(NULL, 0, "Error occurred during parsing");
    return;
  }

            

Reported by FlawFinder.

memcpy - Does not check for buffer overflows when copying to destination
Security

Line: 750 Column: 3 CWE codes: 120
Suggestion: Make sure destination can always hold the source data

              
  // TODO(haberman): avoid this copy when we can make the decoder copy.
  data_copy = upb_arena_malloc(arena, data_len + 1);
  memcpy(data_copy, data, data_len);
  data_copy[data_len] = '\0';

  if (ignore_json_unknown) {
    options |= UPB_JSONDEC_IGNOREUNKNOWN;
  }

            

Reported by FlawFinder.

char - Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues
Security

Line: 777 Column: 3 CWE codes: 119 120
Suggestion: Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length

                Message* intern = (Message*)Z_OBJ_P(getThis());
  size_t size;
  int options = 0;
  char buf[1024];
  zend_bool preserve_proto_fieldnames = false;
  upb_status status;

  if (zend_parse_parameters(ZEND_NUM_ARGS(), "|b",
                            &preserve_proto_fieldnames) == FAILURE) {

            

Reported by FlawFinder.

memcpy - Does not check for buffer overflows when copying to destination
Security

Line: 1223 Column: 3 CWE codes: 120
Suggestion: Make sure destination can always hold the source data

                full_name = upb_msgdef_fullname(msg->desc->msgdef);
  type_url.size = strlen(TYPE_URL_PREFIX) + strlen(full_name);
  buf = upb_arena_malloc(arena, type_url.size + 1);
  memcpy(buf, TYPE_URL_PREFIX, strlen(TYPE_URL_PREFIX));
  memcpy(buf + strlen(TYPE_URL_PREFIX), full_name, strlen(full_name));
  type_url.data = buf;
  Message_setval(intern, "type_url", StringVal(type_url));
}


            

Reported by FlawFinder.

memcpy - Does not check for buffer overflows when copying to destination
Security

Line: 1224 Column: 3 CWE codes: 120
Suggestion: Make sure destination can always hold the source data

                type_url.size = strlen(TYPE_URL_PREFIX) + strlen(full_name);
  buf = upb_arena_malloc(arena, type_url.size + 1);
  memcpy(buf, TYPE_URL_PREFIX, strlen(TYPE_URL_PREFIX));
  memcpy(buf + strlen(TYPE_URL_PREFIX), full_name, strlen(full_name));
  type_url.data = buf;
  Message_setval(intern, "type_url", StringVal(type_url));
}

PHP_METHOD(google_protobuf_Any, is) {

            

Reported by FlawFinder.

char - Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues
Security

Line: 1329 Column: 3 CWE codes: 119 120
Suggestion: Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length

                upb_msgval nanos = Message_getval(intern, "nanos");

  // Get formatted time string.
  char formatted_time[32];
  snprintf(formatted_time, sizeof(formatted_time), "%" PRId64 ".%06" PRId32,
           seconds.int64_val, nanos.int32_val / 1000);

  // Create Datetime object.
  zval datetime;

            

Reported by FlawFinder.

memcpy - Does not check for buffer overflows when copying to destination
Security

Line: 1378 Column: 3 CWE codes: 120
Suggestion: Make sure destination can always hold the source data

                message_ce = zend_register_internal_class(&tmp_ce);
  message_ce->create_object = Message_create;

  memcpy(h, &std_object_handlers, sizeof(zend_object_handlers));
  h->dtor_obj = Message_dtor;
#if PHP_VERSION_ID < 80000
  h->compare_objects = Message_compare_objects;
#else
  h->compare = Message_compare_objects;

            

Reported by FlawFinder.

strlen - Does not handle strings that are not \0-terminated; if given one it may perform an over-read (it could cause a crash if unprotected)
Security

Line: 1131 Column: 17 CWE codes: 126

              }

static bool TryStripUrlPrefix(upb_strview *str) {
  size_t size = strlen(TYPE_URL_PREFIX);
  if (str->size < size || memcmp(TYPE_URL_PREFIX, str->data, size) != 0) {
    return false;
  }
  str->data += size;
  str->size -= size;

            

Reported by FlawFinder.

java/core/src/test/java/com/google/protobuf/Proto3MessageLiteFactory.java
17 issues
Found non-transient, non-static member. Please mark as transient or provide accessors.
Error

Line: 41

              /** Creates instances of {@link Proto3MessageLite} based on the tree configuration. */
public final class Proto3MessageLiteFactory
    implements ExperimentalMessageFactory<Proto3MessageLite> {
  private final int numRepeatedFields;
  private final int branchingFactor;
  private final Proto3MessageLiteFactory nextLevel;
  private final ExperimentalTestDataProvider data;

  public Proto3MessageLiteFactory(

            

Reported by PMD.

Found non-transient, non-static member. Please mark as transient or provide accessors.
Error

Line: 42

              public final class Proto3MessageLiteFactory
    implements ExperimentalMessageFactory<Proto3MessageLite> {
  private final int numRepeatedFields;
  private final int branchingFactor;
  private final Proto3MessageLiteFactory nextLevel;
  private final ExperimentalTestDataProvider data;

  public Proto3MessageLiteFactory(
      int numRepeatedFields, int stringLength, int branchingFactor, int treeDepth) {

            

Reported by PMD.

Found non-transient, non-static member. Please mark as transient or provide accessors.
Error

Line: 43

                  implements ExperimentalMessageFactory<Proto3MessageLite> {
  private final int numRepeatedFields;
  private final int branchingFactor;
  private final Proto3MessageLiteFactory nextLevel;
  private final ExperimentalTestDataProvider data;

  public Proto3MessageLiteFactory(
      int numRepeatedFields, int stringLength, int branchingFactor, int treeDepth) {
    this(

            

Reported by PMD.

Found non-transient, non-static member. Please mark as transient or provide accessors.
Error

Line: 44

                private final int numRepeatedFields;
  private final int branchingFactor;
  private final Proto3MessageLiteFactory nextLevel;
  private final ExperimentalTestDataProvider data;

  public Proto3MessageLiteFactory(
      int numRepeatedFields, int stringLength, int branchingFactor, int treeDepth) {
    this(
        new ExperimentalTestDataProvider(stringLength),

            

Reported by PMD.

Found non-transient, non-static member. Please mark as transient or provide accessors.
Error

Line: 147

                  public T getValue();
  }

  private final MapValueProvider<Integer> integerProvider =
      new MapValueProvider<Integer>() {
        @Override
        public Integer getValue() {
          return data.getInt();
        }

            

Reported by PMD.

Found non-transient, non-static member. Please mark as transient or provide accessors.
Error

Line: 154

                        return data.getInt();
        }
      };
  private final MapValueProvider<Long> longProvider =
      new MapValueProvider<Long>() {
        @Override
        public Long getValue() {
          return data.getLong();
        }

            

Reported by PMD.

Found non-transient, non-static member. Please mark as transient or provide accessors.
Error

Line: 161

                        return data.getLong();
        }
      };
  private final MapValueProvider<String> stringProvider =
      new MapValueProvider<String>() {
        @Override
        public String getValue() {
          return data.getString();
        }

            

Reported by PMD.

Found non-transient, non-static member. Please mark as transient or provide accessors.
Error

Line: 168

                        return data.getString();
        }
      };
  private final MapValueProvider<ByteString> bytesProvider =
      new MapValueProvider<ByteString>() {
        @Override
        public ByteString getValue() {
          return data.getBytes();
        }

            

Reported by PMD.

Found non-transient, non-static member. Please mark as transient or provide accessors.
Error

Line: 175

                        return data.getBytes();
        }
      };
  private final MapValueProvider<Boolean> booleanProvider =
      new MapValueProvider<Boolean>() {
        @Override
        public Boolean getValue() {
          return data.getBool();
        }

            

Reported by PMD.

Found non-transient, non-static member. Please mark as transient or provide accessors.
Error

Line: 182

                        return data.getBool();
        }
      };
  private final MapValueProvider<Float> floatProvider =
      new MapValueProvider<Float>() {
        @Override
        public Float getValue() {
          return data.getFloat();
        }

            

Reported by PMD.

java/core/src/test/java/com/google/protobuf/Proto3MessageFactory.java
17 issues
Found non-transient, non-static member. Please mark as transient or provide accessors.
Error

Line: 40

              
/** Creates instances of {@link Proto3Message} based on the tree configuration. */
public final class Proto3MessageFactory implements ExperimentalMessageFactory<Proto3Message> {
  private final int numRepeatedFields;
  private final int branchingFactor;
  private final Proto3MessageFactory nextLevel;
  private final ExperimentalTestDataProvider data;

  public Proto3MessageFactory(

            

Reported by PMD.

Found non-transient, non-static member. Please mark as transient or provide accessors.
Error

Line: 41

              /** Creates instances of {@link Proto3Message} based on the tree configuration. */
public final class Proto3MessageFactory implements ExperimentalMessageFactory<Proto3Message> {
  private final int numRepeatedFields;
  private final int branchingFactor;
  private final Proto3MessageFactory nextLevel;
  private final ExperimentalTestDataProvider data;

  public Proto3MessageFactory(
      int numRepeatedFields, int stringLength, int branchingFactor, int treeDepth) {

            

Reported by PMD.

Found non-transient, non-static member. Please mark as transient or provide accessors.
Error

Line: 42

              public final class Proto3MessageFactory implements ExperimentalMessageFactory<Proto3Message> {
  private final int numRepeatedFields;
  private final int branchingFactor;
  private final Proto3MessageFactory nextLevel;
  private final ExperimentalTestDataProvider data;

  public Proto3MessageFactory(
      int numRepeatedFields, int stringLength, int branchingFactor, int treeDepth) {
    this(

            

Reported by PMD.

Found non-transient, non-static member. Please mark as transient or provide accessors.
Error

Line: 43

                private final int numRepeatedFields;
  private final int branchingFactor;
  private final Proto3MessageFactory nextLevel;
  private final ExperimentalTestDataProvider data;

  public Proto3MessageFactory(
      int numRepeatedFields, int stringLength, int branchingFactor, int treeDepth) {
    this(
        new ExperimentalTestDataProvider(stringLength),

            

Reported by PMD.

Found non-transient, non-static member. Please mark as transient or provide accessors.
Error

Line: 145

                  public T getValue();
  }

  private final MapValueProvider<Integer> integerProvider =
      new MapValueProvider<Integer>() {
        @Override
        public Integer getValue() {
          return data.getInt();
        }

            

Reported by PMD.

Found non-transient, non-static member. Please mark as transient or provide accessors.
Error

Line: 152

                        return data.getInt();
        }
      };
  private final MapValueProvider<Long> longProvider =
      new MapValueProvider<Long>() {
        @Override
        public Long getValue() {
          return data.getLong();
        }

            

Reported by PMD.

Found non-transient, non-static member. Please mark as transient or provide accessors.
Error

Line: 159

                        return data.getLong();
        }
      };
  private final MapValueProvider<String> stringProvider =
      new MapValueProvider<String>() {
        @Override
        public String getValue() {
          return data.getString();
        }

            

Reported by PMD.

Found non-transient, non-static member. Please mark as transient or provide accessors.
Error

Line: 166

                        return data.getString();
        }
      };
  private final MapValueProvider<ByteString> bytesProvider =
      new MapValueProvider<ByteString>() {
        @Override
        public ByteString getValue() {
          return data.getBytes();
        }

            

Reported by PMD.

Found non-transient, non-static member. Please mark as transient or provide accessors.
Error

Line: 173

                        return data.getBytes();
        }
      };
  private final MapValueProvider<Boolean> booleanProvider =
      new MapValueProvider<Boolean>() {
        @Override
        public Boolean getValue() {
          return data.getBool();
        }

            

Reported by PMD.

Found non-transient, non-static member. Please mark as transient or provide accessors.
Error

Line: 180

                        return data.getBool();
        }
      };
  private final MapValueProvider<Float> floatProvider =
      new MapValueProvider<Float>() {
        @Override
        public Float getValue() {
          return data.getFloat();
        }

            

Reported by PMD.

java/core/src/test/java/com/google/protobuf/Proto2MessageInfoFactory.java
17 issues
Avoid throwing raw exception types.
Design

Line: 867

                        SchemaUtil.getMapDefaultEntry(clazz, fieldName),
          fieldName.contains("_enum_") ? asVerifier(TestEnum.internalGetValueMap()) : null);
    } catch (Throwable t) {
      throw new RuntimeException(t);
    }
  }


  private static Field field(String name) {

            

Reported by PMD.

Avoid throwing raw exception types.
Design

Line: 880

                  try {
      return clazz.getDeclaredField(name);
    } catch (NoSuchFieldException | SecurityException e) {
      throw new RuntimeException(e);
    }
  }

  private static Internal.EnumVerifier asVerifier(final Internal.EnumLiteMap<?> map) {
    return new Internal.EnumVerifier() {

            

Reported by PMD.

High amount of different objects as members denotes a high coupling
Design

Line: 31

              // (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.

package com.google.protobuf;

import static com.google.protobuf.FieldInfo.forField;
import static com.google.protobuf.FieldInfo.forFieldWithEnumVerifier;
import static com.google.protobuf.FieldInfo.forMapField;
import static com.google.protobuf.FieldInfo.forOneofMemberField;

            

Reported by PMD.

This class has too many methods, consider refactoring it.
Design

Line: 55

              import java.lang.reflect.Field;

/** A factory that generates a hard-coded message info for {@link Proto2Message}. */
public final class Proto2MessageInfoFactory implements MessageInfoFactory {
  private static final Proto2MessageInfoFactory INSTANCE = new Proto2MessageInfoFactory();

  private Proto2MessageInfoFactory() {}

  public static Proto2MessageInfoFactory getInstance() {

            

Reported by PMD.

The class 'Proto2MessageInfoFactory' has a Modified Cyclomatic Complexity of 2 (Highest = 12).
Design

Line: 55

              import java.lang.reflect.Field;

/** A factory that generates a hard-coded message info for {@link Proto2Message}. */
public final class Proto2MessageInfoFactory implements MessageInfoFactory {
  private static final Proto2MessageInfoFactory INSTANCE = new Proto2MessageInfoFactory();

  private Proto2MessageInfoFactory() {}

  public static Proto2MessageInfoFactory getInstance() {

            

Reported by PMD.

The class 'Proto2MessageInfoFactory' has a Standard Cyclomatic Complexity of 2 (Highest = 12).
Design

Line: 55

              import java.lang.reflect.Field;

/** A factory that generates a hard-coded message info for {@link Proto2Message}. */
public final class Proto2MessageInfoFactory implements MessageInfoFactory {
  private static final Proto2MessageInfoFactory INSTANCE = new Proto2MessageInfoFactory();

  private Proto2MessageInfoFactory() {}

  public static Proto2MessageInfoFactory getInstance() {

            

Reported by PMD.

The method 'messageInfoFor(Class)' has a cyclomatic complexity of 13.
Design

Line: 70

                }

  @Override
  public MessageInfo messageInfoFor(Class<?> clazz) {
    if (Proto2Message.class.isAssignableFrom(clazz)) {
      return newMessageInfoForProto2Message();
    } else if (FieldGroup49.class.isAssignableFrom(clazz)) {
      return newMessageInfoForFieldGroup49();
    } else if (FieldGroupList51.class.isAssignableFrom(clazz)) {

            

Reported by PMD.

The method 'messageInfoFor' has a Standard Cyclomatic Complexity of 12.
Design

Line: 70

                }

  @Override
  public MessageInfo messageInfoFor(Class<?> clazz) {
    if (Proto2Message.class.isAssignableFrom(clazz)) {
      return newMessageInfoForProto2Message();
    } else if (FieldGroup49.class.isAssignableFrom(clazz)) {
      return newMessageInfoForFieldGroup49();
    } else if (FieldGroupList51.class.isAssignableFrom(clazz)) {

            

Reported by PMD.

The method 'messageInfoFor' has a Modified Cyclomatic Complexity of 12.
Design

Line: 70

                }

  @Override
  public MessageInfo messageInfoFor(Class<?> clazz) {
    if (Proto2Message.class.isAssignableFrom(clazz)) {
      return newMessageInfoForProto2Message();
    } else if (FieldGroup49.class.isAssignableFrom(clazz)) {
      return newMessageInfoForFieldGroup49();
    } else if (FieldGroupList51.class.isAssignableFrom(clazz)) {

            

Reported by PMD.

Avoid really long methods.
Design

Line: 114

                  return builder.build();
  }

  private static void lookupFieldsByName(StructuralMessageInfo.Builder builder) {
    Field bitField0 = field("bitField0_");

    builder.withDefaultInstance(Proto2Message.getDefaultInstance());
    builder.withSyntax(ProtoSyntax.PROTO2);
    builder.withField(

            

Reported by PMD.