boughtonp / qpscanner Goto Github PK

It would probably speed up the scanning process if qpscanner kept a note of last modified dates of files (and any relevant results), and on subsequent scans it only scans the files which have been modified, appending the cached details of any unmodified files.

It appears that the scanner reports false positives triggered by schema and/or table names when parameterized (scoped or not):

Is this not optimally acceptable^?

When I try to scan a directory on a UNC path, e.g. //server/share/path, QueryParam Scanner drops the first slash and throws an error:

Specified path [/server/share/path] cannot be accessed or does not exist.

I traced the issue to the following line in cfcs/settings.cfc, in the normalizePath method:
<cfset var Result = Arguments.Path.replaceAll('[\/]+','/') />

(I removed the plus sign in the regex to get this to work in my scenario, but that may or may not allow other problematic paths.)

A query such as

SELECT column
FROM #application.tablename#
WHERE id = cfqueryparam cf_sql_type="cf_sql_integer" value="4"

is flagged as invalid. I've been trying to figure out a workaround (aside from excluding from the query output), but I haven't figured out a good solution yet.

(Sorry not quite sure how to format my cfqueryparam code style.)

For database like Sybase, temp table started with hash:
delete ##my_temp_table

For some reason qpscanner thinks it needs cfqueryparam
v0.8 (RC)

https://wiki.jenkins-ci.org/display/JENKINS/Warnings+Plugin

Defining a new parser using the user interface

Since release 3.8 you can define new parsers dynamically in the system configuration section of Jenkins. Just navigate to http://[jenkins-url]/configure and create a new parser in section Compiler Warnings. The UI should be self explanatory, if there is something missing, please let me know on the mailing lists.
Writing a new parser that should be included in the warnings plug-in

Extending the existing set of supported warning formats is quite easy. If the format of the warnings messages could be parsed by an regular expression, then you only need to provide a new parser class and a corresponding test case:

1. Set up your developing environment as described in the Plugin tutorial
2. Clone the warnings plug-in from GitHub
3. Run maven with the command mvn install to see if the plug-in builds before you change anything
4. Add a new class YourFormatParser to the package hudson.plugins.warnings, see GccParser or JavacParser as examples
5. Add a new test case YourFormatParserTest to the package hudson.plugins.warnings, see GccParserTest or JavacParserTest as examples.
6. Register the new parser in the method getAllParsers() of the registry ParserRegistry
7. Send a pull request to get your changes integrated

When a scan error is thrown it should render this in the output format requested. For example, in the case of an invalid directory, requesting:

/?action=scan.go&OutputFormat=JSON&StartingDir=invalid

...should return something similar to:

{"error":"Specified path [invalid] cannot be accessed or does not exist."}

...and so on.

The code is incorrectly doing an exact match check instead of a partial check.

It is also checking the entire query code instead of just the opening tag.

When I try running qpscanner against a directory, I get the following error:
'/qpscanner-rc0.8/views/scan/go.cfm' does not exist.

(The scans directory indeed does not exist within the views directory in the repo or the downloadable .zip file, unless I'm misunderstanding.)

Any ideas? I'm using CF10 on Windows Server 2008R2, IIS7.

Additionally, if I do not supply a URL startingdir parameter I get the following error:
"Element STARTINGDIR is undefined in RC."

Any chance of including scans for scripted queries?:

q = new Query(datasource=mydatasource);
q.setSQL(
"select col1, col2, #col3#
from #schema#.tblname
where fee = :qpFa
and foo = :qpLa
and fum = '#so#'"
);
q.addParam(name="qpFa", value="#val1#", cfsqltype="cf_sql_varchar");
q.addParam(name="qpLa", value="#val2#", cfsqltype="cf_sql_varchar");

I have tried several different regexes to try to exclude a directory called admin. but nothing seems to work. Do you have an example of a regex to use to exclude the admin directory?

Thank You

I'm running Railo 4.0.4.001 and as of Railo 4 the init() method is called automatically and it's missing required arguments.

I will take a closer look at this later this week and attempt to fix, but just wanted to put this out there in case anyone already had a fix for this.