The following issues were found

python/protobuf_distutils/protobuf_distutils/generate_py_protobufs.py
9 issues
Unused import sys
Error

Line: 36 Column: 1

              __author__ = 'dlj@google.com (David L. Jones)'

import glob
import sys
import os
import distutils.spawn as spawn
from distutils.cmd import Command
from distutils.errors import DistutilsOptionError, DistutilsExecError


            

Reported by Pylint.

Unused DistutilsExecError imported from distutils.errors
Error

Line: 40 Column: 1

              import os
import distutils.spawn as spawn
from distutils.cmd import Command
from distutils.errors import DistutilsOptionError, DistutilsExecError

class generate_py_protobufs(Command):
    """Generates Python sources for .proto files."""

    description = 'Generate Python sources for .proto files'

            

Reported by Pylint.

Attribute 'output_dir' defined outside __init__
Error

Line: 75 Column: 13

                      self.ensure_string_list('extra_proto_paths')

        if self.output_dir is None:
            self.output_dir = '.'
        self.ensure_dirname('output_dir')

        # SUBTLE: if 'source_dir' is a subdirectory of any entry in
        # 'extra_proto_paths', then in general, the shortest --proto_path prefix
        # (and the longest relative .proto filenames) must be used for

            

Reported by Pylint.

Attribute 'proto_root_path' defined outside __init__
Error

Line: 108 Column: 13

                      # DiskSourceTree class.)

        if self.proto_root_path is None:
            self.proto_root_path = os.path.normpath(self.source_dir)
            for root_candidate in self.extra_proto_paths:
                root_candidate = os.path.normpath(root_candidate)
                if self.proto_root_path.startswith(root_candidate):
                    self.proto_root_path = root_candidate
            if self.proto_root_path != self.source_dir:

            

Reported by Pylint.

Attribute 'proto_root_path' defined outside __init__
Error

Line: 112 Column: 21

                          for root_candidate in self.extra_proto_paths:
                root_candidate = os.path.normpath(root_candidate)
                if self.proto_root_path.startswith(root_candidate):
                    self.proto_root_path = root_candidate
            if self.proto_root_path != self.source_dir:
                self.announce('using computed proto_root_path: ' + self.proto_root_path, level=2)

        if not self.source_dir.startswith(self.proto_root_path):
            raise DistutilsOptionError('source_dir ' + self.source_dir +

            

Reported by Pylint.

Attribute 'proto_files' defined outside __init__
Error

Line: 124 Column: 13

                          files = glob.glob(os.path.join(self.source_dir, '*.proto'))
            if self.recurse:
                files.extend(glob.glob(os.path.join(self.source_dir, '**', '*.proto')))
            self.proto_files = [f.partition(self.proto_root_path + os.path.sep)[-1] for f in files]
            if not self.proto_files:
                raise DistutilsOptionError('no .proto files were found under ' + self.source_dir)

        self.ensure_string_list('proto_files')


            

Reported by Pylint.

Attribute 'protoc' defined outside __init__
Error

Line: 131 Column: 13

                      self.ensure_string_list('proto_files')

        if self.protoc is None:
            self.protoc = os.getenv('PROTOC')
        if self.protoc is None:
            self.protoc = spawn.find_executable('protoc')

    def run(self):
        # All proto file paths were adjusted in finalize_options to be relative

            

Reported by Pylint.

Attribute 'protoc' defined outside __init__
Error

Line: 133 Column: 13

                      if self.protoc is None:
            self.protoc = os.getenv('PROTOC')
        if self.protoc is None:
            self.protoc = spawn.find_executable('protoc')

    def run(self):
        # All proto file paths were adjusted in finalize_options to be relative
        # to self.proto_root_path.
        proto_paths = ['--proto_path=' + self.proto_root_path]

            

Reported by Pylint.

Class name "generate_py_protobufs" doesn't conform to PascalCase naming style
Error

Line: 42 Column: 1

              from distutils.cmd import Command
from distutils.errors import DistutilsOptionError, DistutilsExecError

class generate_py_protobufs(Command):
    """Generates Python sources for .proto files."""

    description = 'Generate Python sources for .proto files'
    user_options = [
        ('extra-proto-paths=', None,

            

Reported by Pylint.

java/core/src/test/java/com/google/protobuf/Proto3MessageLiteInfoFactory.java
9 issues
Avoid throwing raw exception types.
Design

Line: 801

                  try {
      return clazz.getDeclaredField(name);
    } catch (NoSuchFieldException | SecurityException e) {
      throw new RuntimeException(e);
    }
  }

  private static FieldInfo mapFieldInfo(Class<?> clazz, String fieldName, int fieldNumber) {
    try {

            

Reported by PMD.

Avoid throwing raw exception types.
Design

Line: 813

                        SchemaUtil.getMapDefaultEntry(clazz, fieldName),
          null);
    } catch (Throwable t) {
      throw new RuntimeException(t);
    }
  }
}

            

Reported by PMD.

Found non-transient, non-static member. Please mark as transient or provide accessors.
Error

Line: 58

                  return instanceForStructuralMessageInfo;
  }

  private final boolean produceRawMessageInfo;

  private Proto3MessageLiteInfoFactory(boolean produceRawMessageInfo) {
    this.produceRawMessageInfo = produceRawMessageInfo;
  }


            

Reported by PMD.

The method 'lookupFieldsByName(StructuralMessageInfo.Builder)' has a NCSS line count of 68.
Design

Line: 175

                  return builder.build();
  }

  private static void lookupFieldsByName(StructuralMessageInfo.Builder builder) {
    builder.withDefaultInstance(Proto3MessageLite.getDefaultInstance());
    builder.withSyntax(ProtoSyntax.PROTO3);
    builder.withField(
        forField(field(Proto3MessageLite.class, "fieldDouble1_"), 1, FieldType.DOUBLE, true));
    builder.withField(

            

Reported by PMD.

Avoid really long methods.
Design

Line: 175

                  return builder.build();
  }

  private static void lookupFieldsByName(StructuralMessageInfo.Builder builder) {
    builder.withDefaultInstance(Proto3MessageLite.getDefaultInstance());
    builder.withSyntax(ProtoSyntax.PROTO3);
    builder.withField(
        forField(field(Proto3MessageLite.class, "fieldDouble1_"), 1, FieldType.DOUBLE, true));
    builder.withField(

            

Reported by PMD.

The method 'newMessageInfoForProto3MessageLiteWithMaps()' has a NCSS line count of 208.
Design

Line: 395

                  return builder.build();
  }

  private static StructuralMessageInfo newMessageInfoForProto3MessageLiteWithMaps() {
    StructuralMessageInfo.Builder builder = StructuralMessageInfo.newBuilder();
    builder.withSyntax(ProtoSyntax.PROTO2);
    builder.withField(mapFieldInfo(Proto3MessageLiteWithMaps.class, "field_map_bool_bool_1", 1));
    builder.withField(mapFieldInfo(Proto3MessageLiteWithMaps.class, "field_map_bool_bytes_2", 2));
    builder.withField(mapFieldInfo(Proto3MessageLiteWithMaps.class, "field_map_bool_double_3", 3));

            

Reported by PMD.

Avoid really long methods.
Design

Line: 395

                  return builder.build();
  }

  private static StructuralMessageInfo newMessageInfoForProto3MessageLiteWithMaps() {
    StructuralMessageInfo.Builder builder = StructuralMessageInfo.newBuilder();
    builder.withSyntax(ProtoSyntax.PROTO2);
    builder.withField(mapFieldInfo(Proto3MessageLiteWithMaps.class, "field_map_bool_bool_1", 1));
    builder.withField(mapFieldInfo(Proto3MessageLiteWithMaps.class, "field_map_bool_bytes_2", 2));
    builder.withField(mapFieldInfo(Proto3MessageLiteWithMaps.class, "field_map_bool_double_3", 3));

            

Reported by PMD.

The method newMessageInfoForProto3MessageLiteWithMaps() has an NCSS line count of 208
Design

Line: 395

                  return builder.build();
  }

  private static StructuralMessageInfo newMessageInfoForProto3MessageLiteWithMaps() {
    StructuralMessageInfo.Builder builder = StructuralMessageInfo.newBuilder();
    builder.withSyntax(ProtoSyntax.PROTO2);
    builder.withField(mapFieldInfo(Proto3MessageLiteWithMaps.class, "field_map_bool_bool_1", 1));
    builder.withField(mapFieldInfo(Proto3MessageLiteWithMaps.class, "field_map_bool_bytes_2", 2));
    builder.withField(mapFieldInfo(Proto3MessageLiteWithMaps.class, "field_map_bool_double_3", 3));

            

Reported by PMD.

A catch statement should never catch throwable since it includes errors.
Error

Line: 812

                        fieldNumber,
          SchemaUtil.getMapDefaultEntry(clazz, fieldName),
          null);
    } catch (Throwable t) {
      throw new RuntimeException(t);
    }
  }
}

            

Reported by PMD.

java/core/src/main/java/com/google/protobuf/ByteBufferWriter.java
9 issues
Avoid reassigning parameters such as 'requestedSize'
Design

Line: 114

                  }
  }

  private static byte[] getOrCreateBuffer(int requestedSize) {
    requestedSize = max(requestedSize, MIN_CACHED_BUFFER_SIZE);

    byte[] buffer = getBuffer();
    // Only allocate if we need to.
    if (buffer == null || needToReallocate(requestedSize, buffer.length)) {

            

Reported by PMD.

Potential violation of Law of Demeter (object not created locally)
Design

Line: 138

              
  private static byte[] getBuffer() {
    SoftReference<byte[]> sr = BUFFER.get();
    return sr == null ? null : sr.get();
  }

  private static void setBuffer(byte[] value) {
    BUFFER.set(new SoftReference<byte[]>(value));
  }

            

Reported by PMD.

Ensure that resources like this WritableByteChannel object are closed after use
Error

Line: 148

                private static boolean writeToChannel(ByteBuffer buffer, OutputStream output) throws IOException {
    if (CHANNEL_FIELD_OFFSET >= 0 && FILE_OUTPUT_STREAM_CLASS.isInstance(output)) {
      // Use a channel to write out the ByteBuffer. This will automatically empty the buffer.
      WritableByteChannel channel = null;
      try {
        channel = (WritableByteChannel) UnsafeUtil.getObject(output, CHANNEL_FIELD_OFFSET);
      } catch (ClassCastException e) {
        // Absorb.
      }

            

Reported by PMD.

Avoid empty catch blocks
Error

Line: 151

                    WritableByteChannel channel = null;
      try {
        channel = (WritableByteChannel) UnsafeUtil.getObject(output, CHANNEL_FIELD_OFFSET);
      } catch (ClassCastException e) {
        // Absorb.
      }
      if (channel != null) {
        channel.write(buffer);
        return true;

            

Reported by PMD.

Potential violation of Law of Demeter (object not created locally)
Design

Line: 155

                      // Absorb.
      }
      if (channel != null) {
        channel.write(buffer);
        return true;
      }
    }
    return false;
  }

            

Reported by PMD.

Avoid empty catch blocks
Error

Line: 176

                      Field field = clazz.getDeclaredField("channel");
        return UnsafeUtil.objectFieldOffset(field);
      }
    } catch (Throwable e) {
      // Absorb
    }
    return -1;
  }
}

            

Reported by PMD.

A catch statement should never catch throwable since it includes errors.
Error

Line: 176

                      Field field = clazz.getDeclaredField("channel");
        return UnsafeUtil.objectFieldOffset(field);
      }
    } catch (Throwable e) {
      // Absorb
    }
    return -1;
  }
}

            

Reported by PMD.

Found 'DU'-anomaly for variable 'array' (lines '101'-'112').
Error

Line: 101

                    } else if (!writeToChannel(buffer, output)) {
        // Read all of the data from the buffer to an array.
        // TODO(nathanmittler): Consider performance improvements for other "known" stream types.
        final byte[] array = getOrCreateBuffer(buffer.remaining());
        while (buffer.hasRemaining()) {
          int length = min(buffer.remaining(), array.length);
          buffer.get(array, 0, length);
          output.write(array, 0, length);
        }

            

Reported by PMD.

Found 'DD'-anomaly for variable 'channel' (lines '148'-'150').
Error

Line: 148

                private static boolean writeToChannel(ByteBuffer buffer, OutputStream output) throws IOException {
    if (CHANNEL_FIELD_OFFSET >= 0 && FILE_OUTPUT_STREAM_CLASS.isInstance(output)) {
      // Use a channel to write out the ByteBuffer. This will automatically empty the buffer.
      WritableByteChannel channel = null;
      try {
        channel = (WritableByteChannel) UnsafeUtil.getObject(output, CHANNEL_FIELD_OFFSET);
      } catch (ClassCastException e) {
        // Absorb.
      }

            

Reported by PMD.

java/util/src/test/java/com/google/protobuf/util/StructsTest.java
9 issues
Potential violation of Law of Demeter (method chain calls)
Design

Line: 46

                @Test
  public void test1pair_constructsObject() throws Exception {
    Struct.Builder expected = Struct.newBuilder();
    JsonFormat.parser().merge("{\"k1\": 1}", expected);
    assertThat(Structs.of("k1", Values.of(1))).isEqualTo(expected.build());
  }

  @Test
  public void test2pair_constructsObject() throws Exception {

            

Reported by PMD.

Potential violation of Law of Demeter (method chain calls)
Design

Line: 47

                public void test1pair_constructsObject() throws Exception {
    Struct.Builder expected = Struct.newBuilder();
    JsonFormat.parser().merge("{\"k1\": 1}", expected);
    assertThat(Structs.of("k1", Values.of(1))).isEqualTo(expected.build());
  }

  @Test
  public void test2pair_constructsObject() throws Exception {
    Struct.Builder expected = Struct.newBuilder();

            

Reported by PMD.

Potential violation of Law of Demeter (object not created locally)
Design

Line: 47

                public void test1pair_constructsObject() throws Exception {
    Struct.Builder expected = Struct.newBuilder();
    JsonFormat.parser().merge("{\"k1\": 1}", expected);
    assertThat(Structs.of("k1", Values.of(1))).isEqualTo(expected.build());
  }

  @Test
  public void test2pair_constructsObject() throws Exception {
    Struct.Builder expected = Struct.newBuilder();

            

Reported by PMD.

Potential violation of Law of Demeter (method chain calls)
Design

Line: 53

                @Test
  public void test2pair_constructsObject() throws Exception {
    Struct.Builder expected = Struct.newBuilder();
    JsonFormat.parser().merge("{\"k1\": 1, \"k2\": 2}", expected);
    assertThat(Structs.of("k1", Values.of(1), "k2", Values.of(2))).isEqualTo(expected.build());
  }

  @Test
  public void test3pair_constructsObject() throws Exception {

            

Reported by PMD.

Potential violation of Law of Demeter (method chain calls)
Design

Line: 54

                public void test2pair_constructsObject() throws Exception {
    Struct.Builder expected = Struct.newBuilder();
    JsonFormat.parser().merge("{\"k1\": 1, \"k2\": 2}", expected);
    assertThat(Structs.of("k1", Values.of(1), "k2", Values.of(2))).isEqualTo(expected.build());
  }

  @Test
  public void test3pair_constructsObject() throws Exception {
    Struct.Builder expected = Struct.newBuilder();

            

Reported by PMD.

Potential violation of Law of Demeter (object not created locally)
Design

Line: 54

                public void test2pair_constructsObject() throws Exception {
    Struct.Builder expected = Struct.newBuilder();
    JsonFormat.parser().merge("{\"k1\": 1, \"k2\": 2}", expected);
    assertThat(Structs.of("k1", Values.of(1), "k2", Values.of(2))).isEqualTo(expected.build());
  }

  @Test
  public void test3pair_constructsObject() throws Exception {
    Struct.Builder expected = Struct.newBuilder();

            

Reported by PMD.

Potential violation of Law of Demeter (method chain calls)
Design

Line: 60

                @Test
  public void test3pair_constructsObject() throws Exception {
    Struct.Builder expected = Struct.newBuilder();
    JsonFormat.parser().merge("{\"k1\": 1, \"k2\": 2, \"k3\": 3}", expected);
    assertThat(Structs.of("k1", Values.of(1), "k2", Values.of(2), "k3", Values.of(3)))
        .isEqualTo(expected.build());
  }

}

            

Reported by PMD.

Potential violation of Law of Demeter (method chain calls)
Design

Line: 61

                public void test3pair_constructsObject() throws Exception {
    Struct.Builder expected = Struct.newBuilder();
    JsonFormat.parser().merge("{\"k1\": 1, \"k2\": 2, \"k3\": 3}", expected);
    assertThat(Structs.of("k1", Values.of(1), "k2", Values.of(2), "k3", Values.of(3)))
        .isEqualTo(expected.build());
  }

}

            

Reported by PMD.

Potential violation of Law of Demeter (object not created locally)
Design

Line: 62

                  Struct.Builder expected = Struct.newBuilder();
    JsonFormat.parser().merge("{\"k1\": 1, \"k2\": 2, \"k3\": 3}", expected);
    assertThat(Structs.of("k1", Values.of(1), "k2", Values.of(2), "k3", Values.of(3)))
        .isEqualTo(expected.build());
  }

}

            

Reported by PMD.

src/google/protobuf/compiler/csharp/csharp_message.cc
9 issues
StrCat - Does not check for buffer overflows when concatenating to destination [MS-banned]
Security

Line: 164 Column: 55 CWE codes: 120

                for (int i = 0; i < has_bit_field_count_; i++) {
    // don't use arrays since all arrays are heap allocated, saving allocations
    // use ints instead of bytes since bytes lack bitwise operators, saving casts
    printer->Print("private int _hasBits$i$;\n", "i", StrCat(i));
  }

  WriteGeneratedCodeAttributes(printer);

  printer->Print(

            

Reported by FlawFinder.

StrCat - Does not check for buffer overflows when concatenating to destination [MS-banned]
Security

Line: 176 Column: 41 CWE codes: 120

                // Access the message descriptor via the relevant file descriptor or containing message descriptor.
  if (!descriptor_->containing_type()) {
    vars["descriptor_accessor"] = GetReflectionClassName(descriptor_->file())
        + ".Descriptor.MessageTypes[" + StrCat(descriptor_->index()) + "]";
  } else {
    vars["descriptor_accessor"] = GetClassName(descriptor_->containing_type())
        + ".Descriptor.NestedTypes[" + StrCat(descriptor_->index()) + "]";
  }


            

Reported by FlawFinder.

StrCat - Does not check for buffer overflows when concatenating to destination [MS-banned]
Security

Line: 179 Column: 40 CWE codes: 120

                      + ".Descriptor.MessageTypes[" + StrCat(descriptor_->index()) + "]";
  } else {
    vars["descriptor_accessor"] = GetClassName(descriptor_->containing_type())
        + ".Descriptor.NestedTypes[" + StrCat(descriptor_->index()) + "]";
  }

  WriteGeneratedCodeAttributes(printer);
  printer->Print(
    vars,

            

Reported by FlawFinder.

StrCat - Does not check for buffer overflows when concatenating to destination [MS-banned]
Security

Line: 219 Column: 16 CWE codes: 120

                    "public const int $field_constant_name$ = $index$;\n",
      "field_name", fieldDescriptor->name(),
      "field_constant_name", GetFieldConstantName(fieldDescriptor),
      "index", StrCat(fieldDescriptor->number()));
    std::unique_ptr<FieldGeneratorBase> generator(
        CreateFieldGeneratorInternal(fieldDescriptor));
    generator->GenerateMembers(printer);
    printer->Print("\n");
  }

            

Reported by FlawFinder.

StrCat - Does not check for buffer overflows when concatenating to destination [MS-banned]
Security

Line: 243 Column: 31 CWE codes: 120

                    const FieldDescriptor* field = oneof->field(j);
      printer->Print("$field_property_name$ = $index$,\n",
                     "field_property_name", GetPropertyName(field),
                     "index", StrCat(field->number()));
    }
    printer->Outdent();
    printer->Print("}\n");
    // TODO: Should we put the oneof .proto comments here?
    // It's unclear exactly where they should go.

            

Reported by FlawFinder.

StrCat - Does not check for buffer overflows when concatenating to destination [MS-banned]
Security

Line: 385 Column: 63 CWE codes: 120

                  "public $class_name$($class_name$ other) : this() {\n");
  printer->Indent();
  for (int i = 0; i < has_bit_field_count_; i++) {
    printer->Print("_hasBits$i$ = other._hasBits$i$;\n", "i", StrCat(i));
  }
  // Clone non-oneof fields first (treating optional proto3 fields as non-oneof)
  for (int i = 0; i < descriptor_->field_count(); i++) {
    const FieldDescriptor* field = descriptor_->field(i);
    if (field->real_containing_oneof()) {

            

Reported by FlawFinder.

StrCat - Does not check for buffer overflows when concatenating to destination [MS-banned]
Security

Line: 701 Column: 20 CWE codes: 120

                  printer->Print(
        "case $end_tag$:\n"
        "  return;\n",
        "end_tag", StrCat(end_tag_));
  }
  if (has_extension_ranges_) {
    printer->Print(vars,
      "default:\n"
      "  if (!pb::ExtensionSet.TryMergeFieldFrom(ref _extensions, $maybe_ref_input$)) {\n"

            

Reported by FlawFinder.

StrCat - Does not check for buffer overflows when concatenating to destination [MS-banned]
Security

Line: 730 Column: 9 CWE codes: 120

                    printer->Print(
        "case $packed_tag$:\n",
        "packed_tag",
        StrCat(
            internal::WireFormatLite::MakeTag(
                field->number(),
                internal::WireFormatLite::WIRETYPE_LENGTH_DELIMITED)));
    }


            

Reported by FlawFinder.

StrCat - Does not check for buffer overflows when concatenating to destination [MS-banned]
Security

Line: 736 Column: 46 CWE codes: 120

                              internal::WireFormatLite::WIRETYPE_LENGTH_DELIMITED)));
    }

    printer->Print("case $tag$: {\n", "tag", StrCat(tag));
    printer->Indent();
    std::unique_ptr<FieldGeneratorBase> generator(
        CreateFieldGeneratorInternal(field));
    generator->GenerateParsingCode(printer, use_parse_context);
    printer->Print("break;\n");

            

Reported by FlawFinder.

src/google/protobuf/util/internal/datapiece.cc
9 issues
StrCat - Does not check for buffer overflows when concatenating to destination [MS-banned]
Security

Line: 176 Column: 41 CWE codes: 120

                  if (value.ok() && !std::isfinite(value.value())) {
      // safe_strtod converts out-of-range values to +inf/-inf, but we want
      // to report them as errors.
      return util::InvalidArgumentError(StrCat("\"", str_, "\""));
    } else {
      return value;
    }
  }
  return GenericConvert<double>();

            

Reported by FlawFinder.

StrCat - Does not check for buffer overflows when concatenating to destination [MS-banned]
Security

Line: 230 Column: 14 CWE codes: 120

                  StringPiece default_string) const {
  switch (type_) {
    case TYPE_INT32:
      return StrCat(i32_);
    case TYPE_INT64:
      return StrCat(i64_);
    case TYPE_UINT32:
      return StrCat(u32_);
    case TYPE_UINT64:

            

Reported by FlawFinder.

StrCat - Does not check for buffer overflows when concatenating to destination [MS-banned]
Security

Line: 232 Column: 14 CWE codes: 120

                  case TYPE_INT32:
      return StrCat(i32_);
    case TYPE_INT64:
      return StrCat(i64_);
    case TYPE_UINT32:
      return StrCat(u32_);
    case TYPE_UINT64:
      return StrCat(u64_);
    case TYPE_DOUBLE:

            

Reported by FlawFinder.

StrCat - Does not check for buffer overflows when concatenating to destination [MS-banned]
Security

Line: 234 Column: 14 CWE codes: 120

                  case TYPE_INT64:
      return StrCat(i64_);
    case TYPE_UINT32:
      return StrCat(u32_);
    case TYPE_UINT64:
      return StrCat(u64_);
    case TYPE_DOUBLE:
      return DoubleAsString(double_);
    case TYPE_FLOAT:

            

Reported by FlawFinder.

StrCat - Does not check for buffer overflows when concatenating to destination [MS-banned]
Security

Line: 236 Column: 14 CWE codes: 120

                  case TYPE_UINT32:
      return StrCat(u32_);
    case TYPE_UINT64:
      return StrCat(u64_);
    case TYPE_DOUBLE:
      return DoubleAsString(double_);
    case TYPE_FLOAT:
      return FloatAsString(float_);
    case TYPE_BOOL:

            

Reported by FlawFinder.

StrCat - Does not check for buffer overflows when concatenating to destination [MS-banned]
Security

Line: 244 Column: 14 CWE codes: 120

                  case TYPE_BOOL:
      return SimpleBtoa(bool_);
    case TYPE_STRING:
      return StrCat("\"", str_.ToString(), "\"");
    case TYPE_BYTES: {
      std::string base64;
      WebSafeBase64Escape(str_, &base64);
      return StrCat("\"", base64, "\"");
    }

            

Reported by FlawFinder.

StrCat - Does not check for buffer overflows when concatenating to destination [MS-banned]
Security

Line: 248 Column: 14 CWE codes: 120

                  case TYPE_BYTES: {
      std::string base64;
      WebSafeBase64Escape(str_, &base64);
      return StrCat("\"", base64, "\"");
    }
    case TYPE_NULL:
      return "null";
    default:
      return std::string(default_string);

            

Reported by FlawFinder.

StrCat - Does not check for buffer overflows when concatenating to destination [MS-banned]
Security

Line: 357 Column: 39 CWE codes: 120

              util::StatusOr<To> DataPiece::StringToNumber(bool (*func)(StringPiece,
                                                          To*)) const {
  if (str_.size() > 0 && (str_[0] == ' ' || str_[str_.size() - 1] == ' ')) {
    return util::InvalidArgumentError(StrCat("\"", str_, "\""));
  }
  To result;
  if (func(str_, &result)) return result;
  return util::InvalidArgumentError(
      StrCat("\"", std::string(str_), "\""));

            

Reported by FlawFinder.

StrCat - Does not check for buffer overflows when concatenating to destination [MS-banned]
Security

Line: 362 Column: 7 CWE codes: 120

                To result;
  if (func(str_, &result)) return result;
  return util::InvalidArgumentError(
      StrCat("\"", std::string(str_), "\""));
}

bool DataPiece::DecodeBase64(StringPiece src, std::string* dest) const {
  // Try web-safe decode first, if it fails, try the non-web-safe decode.
  if (WebSafeBase64Unescape(src, dest)) {

            

Reported by FlawFinder.

java/core/src/main/java/com/google/protobuf/SingleFieldBuilder.java
9 issues
Found non-transient, non-static member. Please mark as transient or provide accessors.
Error

Line: 62

                  implements GeneratedMessage.BuilderParent {

  // Parent to send changes to.
  private GeneratedMessage.BuilderParent parent;

  // Invariant: one of builder or message fields must be non-null.

  // If set, this is the case where we are backed by a builder. In this case,
  // message field represents a cached message for the builder (or null if

            

Reported by PMD.

Found non-transient, non-static member. Please mark as transient or provide accessors.
Error

Line: 69

                // If set, this is the case where we are backed by a builder. In this case,
  // message field represents a cached message for the builder (or null if
  // there is no cached message).
  private BType builder;

  // If builder is non-null, this represents a cached message from the builder.
  // If builder is null, this is the authoritative message for the field.
  private MType message;


            

Reported by PMD.

Found non-transient, non-static member. Please mark as transient or provide accessors.
Error

Line: 77

              
  // Indicates that we've built a message and so we are now obligated
  // to dispatch dirty invalidations. See GeneratedMessage.BuilderListener.
  private boolean isClean;

  public SingleFieldBuilder(MType message, GeneratedMessage.BuilderParent parent, boolean isClean) {
    this.message = checkNotNull(message);
    this.parent = parent;
    this.isClean = isClean;

            

Reported by PMD.

Assigning an Object to null is a code smell. Consider refactoring.
Error

Line: 87

              
  public void dispose() {
    // Null out parent so we stop sending it invalidations.
    parent = null;
  }

  /**
   * Get the message for the field. If the message is currently stored as a {@code Builder}, it is
   * converted to a {@code Message} by calling {@link Message.Builder#buildPartial} on it. If no

            

Reported by PMD.

The String literal 'unchecked' appears 4 times in this file; the first occurrence is on line 97
Error

Line: 97

                 *
   * @return the message for the field
   */
  @SuppressWarnings("unchecked")
  public MType getMessage() {
    if (message == null) {
      // If message is null, the invariant is that we must be have a builder.
      message = (MType) builder.buildPartial();
    }

            

Reported by PMD.

Assigning an Object to null is a code smell. Consider refactoring.
Error

Line: 163

                  this.message = checkNotNull(message);
    if (builder != null) {
      builder.dispose();
      builder = null;
    }
    onChanged();
    return this;
  }


            

Reported by PMD.

Use equals() to compare object references.
Error

Line: 176

                 * @return the builder
   */
  public SingleFieldBuilder<MType, BType, IType> mergeFrom(MType value) {
    if (builder == null && message == message.getDefaultInstanceForType()) {
      message = value;
    } else {
      getBuilder().mergeFrom(value);
    }
    onChanged();

            

Reported by PMD.

Assigning an Object to null is a code smell. Consider refactoring.
Error

Line: 199

                              : builder.getDefaultInstanceForType());
    if (builder != null) {
      builder.dispose();
      builder = null;
    }
    onChanged();
    return this;
  }


            

Reported by PMD.

Assigning an Object to null is a code smell. Consider refactoring.
Error

Line: 213

                  // If builder is null, this is the case where onChanged is being called
    // from setMessage or clear.
    if (builder != null) {
      message = null;
    }
    if (isClean && parent != null) {
      parent.markDirty();

      // Don't keep dispatching invalidations until build is called again.

            

Reported by PMD.

java/core/src/main/java/com/google/protobuf/SingleFieldBuilderV3.java
9 issues
Found non-transient, non-static member. Please mark as transient or provide accessors.
Error

Line: 62

                  implements AbstractMessage.BuilderParent {

  // Parent to send changes to.
  private AbstractMessage.BuilderParent parent;

  // Invariant: one of builder or message fields must be non-null.

  // If set, this is the case where we are backed by a builder. In this case,
  // message field represents a cached message for the builder (or null if

            

Reported by PMD.

Found non-transient, non-static member. Please mark as transient or provide accessors.
Error

Line: 69

                // If set, this is the case where we are backed by a builder. In this case,
  // message field represents a cached message for the builder (or null if
  // there is no cached message).
  private BType builder;

  // If builder is non-null, this represents a cached message from the builder.
  // If builder is null, this is the authoritative message for the field.
  private MType message;


            

Reported by PMD.

Found non-transient, non-static member. Please mark as transient or provide accessors.
Error

Line: 77

              
  // Indicates that we've built a message and so we are now obligated
  // to dispatch dirty invalidations. See AbstractMessage.BuilderListener.
  private boolean isClean;

  public SingleFieldBuilderV3(MType message, AbstractMessage.BuilderParent parent, boolean isClean) {
    this.message = checkNotNull(message);
    this.parent = parent;
    this.isClean = isClean;

            

Reported by PMD.

Assigning an Object to null is a code smell. Consider refactoring.
Error

Line: 87

              
  public void dispose() {
    // Null out parent so we stop sending it invalidations.
    parent = null;
  }

  /**
   * Get the message for the field. If the message is currently stored as a {@code Builder}, it is
   * converted to a {@code Message} by calling {@link Message.Builder#buildPartial} on it. If no

            

Reported by PMD.

The String literal 'unchecked' appears 4 times in this file; the first occurrence is on line 97
Error

Line: 97

                 *
   * @return the message for the field
   */
  @SuppressWarnings("unchecked")
  public MType getMessage() {
    if (message == null) {
      // If message is null, the invariant is that we must be have a builder.
      message = (MType) builder.buildPartial();
    }

            

Reported by PMD.

Assigning an Object to null is a code smell. Consider refactoring.
Error

Line: 163

                  this.message = checkNotNull(message);
    if (builder != null) {
      builder.dispose();
      builder = null;
    }
    onChanged();
    return this;
  }


            

Reported by PMD.

Use equals() to compare object references.
Error

Line: 176

                 * @return the builder
   */
  public SingleFieldBuilderV3<MType, BType, IType> mergeFrom(MType value) {
    if (builder == null && message == message.getDefaultInstanceForType()) {
      message = value;
    } else {
      getBuilder().mergeFrom(value);
    }
    onChanged();

            

Reported by PMD.

Assigning an Object to null is a code smell. Consider refactoring.
Error

Line: 199

                              : builder.getDefaultInstanceForType());
    if (builder != null) {
      builder.dispose();
      builder = null;
    }
    onChanged();
    return this;
  }


            

Reported by PMD.

Assigning an Object to null is a code smell. Consider refactoring.
Error

Line: 213

                  // If builder is null, this is the case where onChanged is being called
    // from setMessage or clear.
    if (builder != null) {
      message = null;
    }
    if (isClean && parent != null) {
      parent.markDirty();

      // Don't keep dispatching invalidations until build is called again.

            

Reported by PMD.

src/google/protobuf/compiler/java/java_helpers.cc
9 issues
Memory leak: kKotlinForbiddenNames
Error

Line: 264 CWE codes: 401

                        "try",     "typealias", "typeof", "val",   "var",      "when",
          "while",
      });
  return kKotlinForbiddenNames->find(field_name) !=
         kKotlinForbiddenNames->end();
}

std::string UniqueFileScopeIdentifier(const Descriptor* descriptor) {
  return "static_" + StringReplace(descriptor->full_name(), ".", "_", true);

            

Reported by Cppcheck.

StrCat - Does not check for buffer overflows when concatenating to destination [MS-banned]
Security

Line: 144 Column: 22 CWE codes: 120

                                          const char* var_name,
                            const char* terminating_string, bool enforce_lite) {
  std::string enum_verifier_string =
      enforce_lite ? StrCat(var_name, ".internalGetVerifier()")
                   : StrCat(
                         "new com.google.protobuf.Internal.EnumVerifier() {\n"
                         "        @java.lang.Override\n"
                         "        public boolean isInRange(int number) {\n"
                         "          return ",

            

Reported by FlawFinder.

StrCat - Does not check for buffer overflows when concatenating to destination [MS-banned]
Security

Line: 145 Column: 22 CWE codes: 120

                                          const char* terminating_string, bool enforce_lite) {
  std::string enum_verifier_string =
      enforce_lite ? StrCat(var_name, ".internalGetVerifier()")
                   : StrCat(
                         "new com.google.protobuf.Internal.EnumVerifier() {\n"
                         "        @java.lang.Override\n"
                         "        public boolean isInRange(int number) {\n"
                         "          return ",
                         var_name,

            

Reported by FlawFinder.

StrCat - Does not check for buffer overflows when concatenating to destination [MS-banned]
Security

Line: 156 Column: 7 CWE codes: 120

                                       "      }");
  printer->Print(
      variables,
      StrCat(enum_verifier_string, terminating_string).c_str());
}

std::string UnderscoresToCamelCase(const std::string& input,
                                   bool cap_next_letter) {
  GOOGLE_CHECK(!input.empty());

            

Reported by FlawFinder.

StrCat - Does not check for buffer overflows when concatenating to destination [MS-banned]
Security

Line: 576 Column: 14 CWE codes: 120

                // of FieldDescriptor to call.
  switch (field->cpp_type()) {
    case FieldDescriptor::CPPTYPE_INT32:
      return StrCat(field->default_value_int32());
    case FieldDescriptor::CPPTYPE_UINT32:
      // Need to print as a signed int since Java has no unsigned.
      return StrCat(static_cast<int32_t>(field->default_value_uint32()));
    case FieldDescriptor::CPPTYPE_INT64:
      return StrCat(field->default_value_int64()) + "L";

            

Reported by FlawFinder.

StrCat - Does not check for buffer overflows when concatenating to destination [MS-banned]
Security

Line: 579 Column: 14 CWE codes: 120

                    return StrCat(field->default_value_int32());
    case FieldDescriptor::CPPTYPE_UINT32:
      // Need to print as a signed int since Java has no unsigned.
      return StrCat(static_cast<int32_t>(field->default_value_uint32()));
    case FieldDescriptor::CPPTYPE_INT64:
      return StrCat(field->default_value_int64()) + "L";
    case FieldDescriptor::CPPTYPE_UINT64:
      return StrCat(static_cast<int64_t>(field->default_value_uint64())) +
             "L";

            

Reported by FlawFinder.

StrCat - Does not check for buffer overflows when concatenating to destination [MS-banned]
Security

Line: 581 Column: 14 CWE codes: 120

                    // Need to print as a signed int since Java has no unsigned.
      return StrCat(static_cast<int32_t>(field->default_value_uint32()));
    case FieldDescriptor::CPPTYPE_INT64:
      return StrCat(field->default_value_int64()) + "L";
    case FieldDescriptor::CPPTYPE_UINT64:
      return StrCat(static_cast<int64_t>(field->default_value_uint64())) +
             "L";
    case FieldDescriptor::CPPTYPE_DOUBLE: {
      double value = field->default_value_double();

            

Reported by FlawFinder.

StrCat - Does not check for buffer overflows when concatenating to destination [MS-banned]
Security

Line: 583 Column: 14 CWE codes: 120

                  case FieldDescriptor::CPPTYPE_INT64:
      return StrCat(field->default_value_int64()) + "L";
    case FieldDescriptor::CPPTYPE_UINT64:
      return StrCat(static_cast<int64_t>(field->default_value_uint64())) +
             "L";
    case FieldDescriptor::CPPTYPE_DOUBLE: {
      double value = field->default_value_double();
      if (value == std::numeric_limits<double>::infinity()) {
        return "Double.POSITIVE_INFINITY";

            

Reported by FlawFinder.

StrCat - Does not check for buffer overflows when concatenating to destination [MS-banned]
Security

Line: 702 Column: 14 CWE codes: 120

              
std::string GetBitFieldName(int index) {
  std::string varName = "bitField";
  varName += StrCat(index);
  varName += "_";
  return varName;
}

std::string GetBitFieldNameForBit(int bitIndex) {

            

Reported by FlawFinder.

java/core/src/main/java/com/google/protobuf/ExtensionRegistryLite.java
9 issues
Avoid using redundant field initializer for 'eagerlyParseMessageSets'
Performance

Line: 77

                // TODO(xiangl): Now we use a global flag to control whether enable lazy
  // parsing feature for MessageSet, which may be too crude for some
  // applications. Need to support this feature on smaller granularity.
  private static volatile boolean eagerlyParseMessageSets = false;

  // short circuit the ExtensionRegistryFactory via assumevalues trickery
  @SuppressWarnings("JavaOptionalSuggestions")
  private static boolean doFullRuntimeInheritanceCheck = true;


            

Reported by PMD.

All methods are static. Consider using a utility class instead. Alternatively, you could add a private constructor or make the class abstract to silence this warning.
Design

Line: 86

                // Visible for testing.
  static final String EXTENSION_CLASS_NAME = "com.google.protobuf.Extension";

  private static class ExtensionClassHolder {
    static final Class<?> INSTANCE = resolveExtensionClass();

    static Class<?> resolveExtensionClass() {
      try {
        return Class.forName(EXTENSION_CLASS_NAME);

            

Reported by PMD.

Avoid catching generic exceptions such as NullPointerException, RuntimeException, Exception in try-catch block
Design

Line: 179

                  if (doFullRuntimeInheritanceCheck && ExtensionRegistryFactory.isFullRegistry(this)) {
      try {
        this.getClass().getMethod("add", ExtensionClassHolder.INSTANCE).invoke(this, extension);
      } catch (Exception e) {
        throw new IllegalArgumentException(
            String.format("Could not invoke ExtensionRegistry#add for %s", extension), e);
      }
    }
  }

            

Reported by PMD.

Use equals() to compare object references.
Error

Line: 200

                static final ExtensionRegistryLite EMPTY_REGISTRY_LITE = new ExtensionRegistryLite(true);

  ExtensionRegistryLite(ExtensionRegistryLite other) {
    if (other == EMPTY_REGISTRY_LITE) {
      this.extensionsByNumber = Collections.emptyMap();
    } else {
      this.extensionsByNumber = Collections.unmodifiableMap(other.extensionsByNumber);
    }
  }

            

Reported by PMD.

Found non-transient, non-static member. Please mark as transient or provide accessors.
Error

Line: 208

                }

  private final Map<ObjectIntPair, GeneratedMessageLite.GeneratedExtension<?, ?>>
      extensionsByNumber;

  ExtensionRegistryLite(boolean empty) {
    this.extensionsByNumber = Collections.emptyMap();
  }


            

Reported by PMD.

Avoid unused constructor parameters such as 'empty'.
Design

Line: 210

                private final Map<ObjectIntPair, GeneratedMessageLite.GeneratedExtension<?, ?>>
      extensionsByNumber;

  ExtensionRegistryLite(boolean empty) {
    this.extensionsByNumber = Collections.emptyMap();
  }

  /** A (Object, int) pair, used as a map key. */
  private static final class ObjectIntPair {

            

Reported by PMD.

Found non-transient, non-static member. Please mark as transient or provide accessors.
Error

Line: 216

              
  /** A (Object, int) pair, used as a map key. */
  private static final class ObjectIntPair {
    private final Object object;
    private final int number;

    ObjectIntPair(final Object object, final int number) {
      this.object = object;
      this.number = number;

            

Reported by PMD.

Found non-transient, non-static member. Please mark as transient or provide accessors.
Error

Line: 217

                /** A (Object, int) pair, used as a map key. */
  private static final class ObjectIntPair {
    private final Object object;
    private final int number;

    ObjectIntPair(final Object object, final int number) {
      this.object = object;
      this.number = number;
    }

            

Reported by PMD.

Use equals() to compare object references.
Error

Line: 235

                      return false;
      }
      final ObjectIntPair other = (ObjectIntPair) obj;
      return object == other.object && number == other.number;
    }
  }
}

            

Reported by PMD.