ืืืจ ืคืึธืจืืขืฆื ืฆื ืืึทืื ืื ื ืืฆื ืคืื PVS-Studio ืืขืจ ืืึทืงืืืขื. ืืื ืืืขืจ ืึทื ืึทืืืืขืจ ืืื ืืืฆื ืื ืืืฆื ืืื Chocolatey, ืึท ืคึผืขืงื ืคืึทืจืืืึทืืืขืจ ืคึฟืึทืจ Windows. ืืืจ ืืืืืื ืึทื ืืึธืก ืืืขื ืคืึทืกืืืึทืืืื ืื ืืืคึผืืืืืึทื ื ืคืื PVS-Studio, ืกืคึผืขืฆืืขื ืืื ืืืึธืืงื ืืึทืืื ืื ืืก. ืืื ืกืืจ ื ืืฉื ืฆื ืืืื ืืืืึทื, ืืึธืืืจ ืงืึธื ืืจืึธืืืจื ืื ืืงืืจ ืงืึธื ืคืื ืืขืจ ืืขืืืืงืขืจ ืืฉืึธืงืืึทื. Azure DevOps ืืืขื ืฉืคึผืืื ืืื ืึท ืกื ืกืืกืืขื.
ืืึธ ืืื ืึท ืจืฉืืื ืคืื ืืื ืืืขืจ ืื ืืขืจืข ืึทืจืืืงืืขื ืืืืฃ ืืขืจ ืืขืืข ืคืื โโืื ืึทืืจืืืฉืึทื ืืื ืืืึธืืงื ืกืืกืืขืืขื:
ืืื ืจืขืงืึธืืขื ืืืจื ืืืจ ืฆื ืืึทืฆืึธืื ืืคืืขืจืงืืึทืืงืืื ืฆื ืืขืจ ืขืจืฉืืขืจ ืึทืจืืืงื ืืืขืื ืื ืึทืืจืืืฉืึทื ืืื Azure DevOps, ืืืืึทื ืืื ืืขื ืคืึทื ืขืืืขืืข ืคืื ืงืื ืืขื ืขื ืืืืขืจืืขืืืคึผืขืจื ืึทืืื ื ืืฉื ืฆื ืืืื ืืืคึผืืืงืืืืื.
ืึทืืื, ืื ืืขืืื ืคืื ืืขื ืึทืจืืืงื:
ืืื ืึท ืกืืึทืืืง ืงืึธื ืึทื ืึทืืืกืืก ืืขืฆืืึทื ืืืืืื ื ืฆื ืืืขื ืืืคืืฆืืจื ืขืจืจืึธืจืก ืืื ืคึผืึธืืขื ืฆืืขื ืืืึทืื ืขืจืึทืืืืืืื ืืื ืืืืื ืืขืฉืจืืื ืืื C, C ++, C # ืืื Java. ืืืืคื ืืืืฃ 64-ืืืกื ืืืื ืืึธืื, ืืื ืืงืก ืืื ืืึทืงืึธืก ืกืืกืืขืืขื, ืืื ืงืขื ืขื ืึทื ืึทืืืื ืงืึธื ืืืืืื ื ืคึฟืึทืจ 32-ืืืกื, 64-ืืืกื ืืื ืขืืืขืืื ARM ืคึผืืึทืืคืึธืจืืก. ืืืื ืืึธืก ืืื ืืืื ืขืจืฉืืขืจ ืืึธื ืืืจ ืคึผืจืืืืจื ืกืืึทืืืง ืงืึธื ืึทื ืึทืืืกืืก ืฆื ืงืึธื ืืจืึธืืืจื ืืืื ืคึผืจืึทืืืฉืขืงืก, ืืืจ ืจืขืงืึธืืขื ืืืจื ืืืจ ืืืงืขื ืขื ืืื ืืื ืืืขืื ืืื ืฆื ืืขืฉืืืื ื ืืขื ืื ืืขืจืกื ืืฉืืงืึทืืืข ืืืึธืจื ืื ืื ืคืื PVS-Studio ืืื ืึธืคึผืฉืึทืฆื ืื ืงืืืคึผืึทืืืืึทืืื ืคืื ืืขื ืืขืฆืืึทื.
- ืึท ืกืืื ืคืื ืืืึธืืงื ืืึทืืื ืื ืืก ืืืึธืก ืฆืืืึทืืขื ืืขืงื ืื ืืื ืฆืข ืึทื ืืืืืงืืื ื ืคึผืจืึธืฆืขืก. ืื ืคึผืืึทืืคืึธืจืืข ืืืื ืืืฉืืจืื ืึทืืึท ืืื Azure Pipelines, Azure Boards, Azure Artifacts, Azure Repos, Azure Test Plans, ืืืึธืก ืืึธืื ืืืจ ืฆื ืคืึทืจืืืืขืจื ืืขื ืคึผืจืึธืฆืขืก ืคืื ืงืจืืืืืื ื ืืืืืืืืืจื ืืื ืคึฟืึทืจืืขืกืขืจื ืื ืงืืืึทืืืืขื.
ืืื ืึทื ืึธืคึฟื ืืงืืจ ืคึผืขืงื ืคืึทืจืืืึทืืืขืจ ืคึฟืึทืจ Windows. ืืขืจ ืฆืื ืคืื ืื ืคึผืจืืืขืงื ืืื ืฆื ืึธืืึทืืืื ืื ืืื ืฆืข ืืืืืืืืืจื ืืืืคืกืืืง ืคืื ืืึทื ืืึธื ืืืจืื ื ืฆื ืึทืคึผืืืืืื ื ืืื ืื ืื ืกืืึทืืืึทืืืึธื ืืืืฃ Windows ืึธืคึผืขืจืืืืื ื ืกืืกืืขืืขื.
ืืืขืื ื ืืฆื ืืฉืึธืงืืึทื
ืืืจ ืงืขื ืขื ืืขื ืืื ืฆื ืื ืกืืึทืืืจื ืื ืคึผืขืงื ืคืึทืจืืืึทืืืขืจ ืืื ืืื ืืขื . ืืึทื ืฅ ืืึทืงืืืืขื ืืืืฉืึทื ืคึฟืึทืจ ืื ืกืืึธืืื ื ืื ืึทื ืึทืืืืขืจ ืืื ืื ืืืฆื ืืื ืืขื ืื ืื ืกืืึทืืืจืื ื ืืื ืื Chocolatey ืคึผืขืงื ืคืึทืจืืืึทืืืขืจ ืึธืคึผืืืืืื ื. ืืื ืืืขื ืคืื ืืืจืื ืืงืืฆืืจ ืืืืขืจืืืจื ืขืืืขืืข ื ืงืืืืช.
ืืึทืคึฟืขื ืฆื ืื ืกืืึทืืืจื ืื ืืขืฆืืข ืืืขืจืกืืข ืคืื โโโโืื ืึทื ืึทืืืืขืจ:
choco install pvs-studioืืึทืคึฟืขื ืฆื ืื ืกืืึทืืืจื ืึท ืกืคึผืขืฆืืคืืฉ ืืืขืจืกืืข ืคืื โโโโืื PVS-Studio ืคึผืขืงื:
choco install pvs-studio --version=7.05.35617.2075ืืืจื ืคืขืืืงืืึทื, ืืืืื ืื ืืึทืจืฅ ืคืื ืื ืึทื ืึทืืืืขืจ, ืื ืงืึธืจ ืงืึธืืคึผืึธื ืขื ื, ืืื ืืื ืกืืึทืืืจื. ืึทืืข ืื ืืขืจืข ืคืืึทืืก (ืกืืึทื ืืึทืืึธื ืข, JavaCore, IDEA, MSVS2010, MSVS2012, MSVS2013, MSVS2015, MSVS2017, MSVS2019) ืงืขื ืขื ืืืื ืืืจืืืขืืื ืืขื ืืื --ืคึผืึทืงืงืึทืืข-ืคึผืึทืจืึทืืขืืขืจืก.
ืึท ืืืืฉืคึผืื ืคืื ืึท ืืึทืคึฟืขื ืืืึธืก ืืืขื ืื ืกืืึทืืืจื ืึท ืึทื ืึทืืืืขืจ ืืื ืึท ืคึผืืืืื ืคึฟืึทืจ ืืืืกืืึทื ืกืืืืืึธ 2019:
choco install pvs-studio --package-parameters="'/MSVS2019'"ืืืฆื ืืึธืืืจ ืืขื ืึท ืืืืฉืคึผืื ืคืื ืืึทืงืืืขื ื ืืฆื ืคืื ืื ืึทื ืึทืืืืขืจ ืืื ืืขืจ Azure DevOps.
Customize
ืืึธืื ืืืจ ืืขืจืืึธื ืขื ืืืจ ืึทื ืขืก ืืื ืึท ืืึทืืื ืืขืจ ืึธืคึผืืืืืื ื ืืืขืื ืึทืืึท ืืฉืื ืืื ืจืขืืืฉืืกืืขืจืื ื ืึท ืืฉืืื, ืงืจืืืืืื ื ืึท ืืืื ืคึผืืืคึผืืืื ืืื ืกืื ืืงืจืึทื ืืื ืืืื ืืฉืืื ืืื ืึท ืคึผืจืืืขืงื ืืื ืื GitHub ืจืืคึผืึทืืึทืืึธืจื. . ืืื ืืืขืจ ืกืขืืึทืคึผ ืืืขื ืืื ืึธื ืืืืื ืืื ืฉืจืืืื ืึท ืงืึทื ืคืืืืขืจืืืฉืึทื ืืขืงืข.
ืขืจืฉืืขืจ, ืืึธืืืจ ืฉืืขืื ืึท ืงืึทืืขืจ ืฆืื ืื, ืืืึธืก ืื ืืืงืืืฅ ืึทื ืืืจ ืงืึทืืขืจ ืืืืื ืคึฟืึทืจ ืขื ืืขืจืื ืืขื ืืื ืืึทืืขืืึธืก ืฆืืืืึทื:
trigger:
- masterืืืืึทืืขืจ ืืืจ ืืึทืจืคึฟื ืฆื ืืืืกืงืืืึทืื ืึท ืืืืจืืืึทื ืืึทืฉืื. ืืืฆื ืขืก ืืืขื ืืืื ืึท ืืืงืจืึธืกืึธืคื ืืึธืืกืืื ืึทืืขื ื ืืื Windows Server 2019 ืืื Visual Studio 2019:
pool:
vmImage: 'windows-latest'ืืึธืืืจ ืืืื ืฆื ืื ืืืฃ ืคืื ืื ืงืึทื ืคืืืืขืจืืืฉืึทื ืืขืงืข (ืืืึธืง ืืจืขืค). ืืจืึธืฅ ืืขื ืคืึทืงื ืึทื ืืืจ ืงืขื ืขื ื ืืฉื ืื ืกืืึทืืืจื ืึทืจืืืืจืึทืจืืฉ ืืืืืืืืืจื ืืื ืึท ืืืืจืืืึทื ืืึทืฉืื, ืืื ืืื ื ืืฉื ืืืืื ืึท ืืึธืงืงืขืจ ืงืึทื ืืืื ืขืจ. ืืืจ ืงืขื ืขื ืืืืื Chocolatey ืืื ืึท ืคืึทืจืืขื ืืขืจืื ื ืคึฟืึทืจ Azure DevOps. ืฆื ืืึธื ืืึธืก, ืืึธืื ืืื ืื ืืืื ืฆื . ืืจืืงื ืืึทืงืืืขื ืขืก ืคืจืื. ืืขืจื ืึธื, ืืืื ืืืจ ืืขื ื ืฉืืื ืึธืืขืจืืืื, ื ืึธืจ ืกืขืืขืงืืืจื ืืืื ืืฉืืื, ืืื ืืืื ื ืืฉื, ืืึธื ืื ืืขืืืข ืืึทื ื ืึธื ืืขืจืืืืืขื ืืฉ.
ืืึธ ืืืจ ืืึทืจืคึฟื ืฆื ืืืืกืงืืืึทืื ืืื ืืืจ ืืืขืื ืืืืื ืื ืคืึทืจืืขื ืืขืจืื ื ืืื ืืื ืื ืงื ืขืคึผื ืื ืกืืึทืืืจื.
ื ืึธื ืืฆืืื ืืึทื ืืึธื ืืืจืื ื, ืืื ืืืื ืืืืึทืืขืจ ืฆื ืึธืจืืึทื ืืืึทืฆืืข:
ืืืจ ืงืขื ื ืืืฆื ืืขื ืื ืืืกืืขืจ ืคึฟืึทืจ ืื Chocolatey ืึทืจืืขื ืืื ืื ืคึฟืขื ืฆืืขืจ ืืึทืกืงืก ืืืขื ืขืืืืื ื ืึท ืงืึทื ืคืืืืขืจืืืฉืึทื ืืขืงืข azure-pipelines.yml:
ืืจืืงื ืืืืฃ Chocolatey ืืื ืืขื ืึท ืจืฉืืื ืคืื ืคืขืืืขืจ:
ืืึธ ืืืจ ืืึทืจืคึฟื ืฆื ืืืืกืงืืืึทืื ืื ืกืืึทืืืจื ืืื ืื ืคืขืื ืืื ืื ืืืื. ืืื Nuspec ืืขืงืข ื ืึธืืขื ืึธื ืืืืึทืื ืื ื ืึธืืขื ืคืื ืื ืคืืจืืื ืื ืคึผืขืงื - pvs-studio. ืืืื ืืืจ ืืึธื ื ืื ืกืคึผืขืฆืืคืืฆืืจื ืื ืืืขืจืกืืข, ืื ืืขืฆืืข ืืืขืจืกืืข ืืืขื ืืืื ืืื ืกืืึทืืืจื, ืืืึธืก ืกืืฅ ืืื ืื ืืึธืจ. ืืึธืืืจ ืืจืืงื ืืขื ืงื ืขืคึผื ืฆืืืขืื ืืื ืืืจ ืืืขืื ืืขื ืื ืืืฉืขื ืขืจืืืืึทื ืึทืจืืขื ืืื ืื ืงืึทื ืคืืืืขืจืืืฉืึทื ืืขืงืข.
steps:
- task: ChocolateyCommand@0
inputs:
command: 'install'
installPackageId: 'pvs-studio'ืืขืจื ืึธื, ืืึธืื ืืื ืื ืืืื ืฆื ืื ืืืืคึผื ืืืื ืคืื ืืื ืืืขืจ ืืขืงืข:
- task: CmdLine@2
inputs:
script: ืืืฆื ืืืจ ืืึทืจืคึฟื ืฆื ืฉืึทืคึฟื ืึท ืืขืงืข ืืื ืื ืึทื ืึทืืืืขืจ ืืขืจืืืืืขื ืืฉ. ืืึธ PVSNAME ะธ PVSKEY - ื ืขืืขื ืคืื ืืืขืจืืึทืืึทืื ืืืขืืขื ืก ืืืึทืืืขืก ืืืจ ืกืคึผืขืฆืืคืืฆืืจื ืืื ืื ืกืขืืืื ืืก. ืืื ืืืขืื ืงืจืึธื ืื PVS-Studio ืืึธืืื ืืื ืืขืจืืืืืขื ืืฉ ืฉืืืกื. ืฆื ืฉืืขืื ืืืืขืจ ืืืึทืืืขืก, ืขืคืขื ืขื ืื ืืขื ืื ืืืขืจืืึทืืึทืื-> ื ืื ืืืึทืืขืืืืืง. ืืื ืก ืืึทืื ืืืขืจืืึทืืึทืื PVSNAME ืคึฟืึทืจ ืืึธืืื ืืื PVSKEY ืคึฟืึทืจ ืื ืึทื ืึทืืืืขืจ ืฉืืืกื. ืื ืืืืกื ื ืืฉื ืคืึทืจืืขืกื ืฆื ืงืึธื ืืจืึธืืืจื ืื ืงืขืกืื ืืึทืืื ืืขื ืืืขืจื ืกืื ืคืึทืจ PVSKEY. ืืึทืคึฟืขืื ืงืึธื:
ัall "C:Program Files (x86)PVS-StudioPVS-Studio_Cmd.exe" credentials
โu $(PVSNAME) โn $(PVSKEY)ืืึธืืืจ ืืืืขื ืื ืคึผืจืืืขืงื ื ืืฆื ืื ืคืืขืืขืจืืืื ืืขืงืข ืืื ืื ืจืืคึผืึทืืึทืืึธืจื:
ัall build.batืืึธืืืจ ืฉืึทืคึฟื ืึท ืืขืงืข ืืื ืืขืงืขืก ืืื ืื ืจืขืืืืืึทืื ืคืื ืื ืึทื ืึทืืืืขืจ ืืืขื ืืืื ืกืืึธืจื:
ัall mkdir PVSTestResultsืืืืืจ ืื ืืืืื ืฆื ืื ืืืืืืจื ืืขื ืคืจืืืขืงื:
ัall "C:Program Files (x86)PVS-StudioPVS-Studio_Cmd.exe"
โt .srcchocolatey.sln โo .PVSTestResultsChoco.plog ืืืจ ืืขืจ ืืื ืืืขืจ ืืึทืจืืื ืฆื HTML ืคึฟืึธืจืืึทื ืืื ืื Plogะกonverter ื ืืฆื:
ัall "C:Program Files (x86)PVS-StudioPlogConverter.exe"
โt html โo PVSTestResults .PVSTestResultsChoco.plogืืืฆื ืืืจ ืืึทืจืคึฟื ืฆื ืฉืึทืคึฟื ืึท ืึทืจืืขื ืึทืืื ืึทื ืืืจ ืงืขื ืขื ืฆืืคึฟืขืืืงืขืจ ืืขื ืืึทืจืืื.
- task: PublishBuildArtifacts@1
inputs:
pathToPublish: PVSTestResults
artifactName: PVSTestResults
condition: always()ืื ืืึทื ืฅ ืงืึทื ืคืืืืขืจืืืฉืึทื ืืขืงืข ืงืืงื ืืื ืืึธืก:
trigger:
- master
pool:
vmImage: 'windows-latest'
steps:
- task: ChocolateyCommand@0
inputs:
command: 'install'
installPackageId: 'pvs-studio'
- task: CmdLine@2
inputs:
script: |
call "C:Program Files (x86)PVS-StudioPVS-Studio_Cmd.exe"
credentials โu $(PVSNAME) โn $(PVSKEY)
call build.bat
call mkdir PVSTestResults
call "C:Program Files (x86)PVS-StudioPVS-Studio_Cmd.exe"
โt .srcchocolatey.sln โo .PVSTestResultsChoco.plog
call "C:Program Files (x86)PVS-StudioPlogConverter.exe"
โt html โo .PVSTestResults .PVSTestResultsChoco.plog
- task: PublishBuildArtifacts@1
inputs:
pathToPublish: PVSTestResults
artifactName: PVSTestResults
condition: always()ืืืืืจ ืงืืืงื ืืื-> ืืื-> ืืืืคื ืฆื ืืืืคื ืื ืึทืจืืขื. ืืึธืืืจ ืืจืืคืงืืคืืข ืืขื ืืึทืจืืื ืืืจื ืืืื ืฆื ืื ืืึทืกืงืก ืงืืืืื.
ืื Chocolatey ืคึผืจืืืขืงื ืึผืืื ืืืืื 37615 ืฉืืจืืช ืคืื C # ืงืึธื. ืืื ืก ืงืืง ืืื ืขืืืขืืข ืคืื โโืื ืขืจืจืึธืจืก ืืขืคืื ืขื.
ืืขืกื ืจืขืืืืืืื
ืืืืจืขื ืื ื N1
ืึทื ืึทืืืืขืจ ืืืืจืขื ืื ื: ืื 'ืคึผืจืึทืืืืืืขืจ' ืืืึทืืขืืืืืง ืืื ืึทืกืืื ื ืฆื ืืื. CrytpoHashProviderSpecs.cs 38
public abstract class CrytpoHashProviderSpecsBase : TinySpec
{
....
protected CryptoHashProvider Provider;
....
public override void Context()
{
Provider = Provider = new CryptoHashProvider(FileSystem.Object);
}
}ืืขืจ ืึทื ืึทืืืืขืจ ืืืืขืงืืึทื ืึท ืึทืกืืื ืืึทื ื ืคืื ืื ืืืึทืืขืืืืืง ืฆื ืืื, ืืืึธืก ืืื ื ืืฉื ืืื ืขื. ืจืืึฟ ืืกืชึผืื, ืืื ืคึผืืึทืฅ ืคืื ืืืื ืขืจ ืคืื ืื ืืืขืจืืึทืืึทืื ืขืก ืืึธื ืืืื ืขืืืขืืข ืื ืืขืจืข. ื ื, ืึธืืขืจ ืืึธืก ืืื ืึท ืืืคึผ ืืขืืช, ืืื ืื ืขืงืกืืจืข ืึทืกืืื ืืึทื ื ืงืขื ืขื ืคืฉืื ืืืื ืึทืืืขืงืืขื ืืืขื.
ืืืืจืขื ืื ื N2
ืึทื ืึทืืืืขืจ ืืืืจืขื ืื ื: [CWE-480] ืืขืจ '&' ืึธืคึผืขืจืึทืืึธืจ ืืืืึทืืืืืืฅ ืืืืืข ืึธืคึผืขืจืึทื ืื. ืืึธืืขืจ ืึท ืงืืจืฅ-ืงืจืืึทื '&&' ืึธืคึผืขืจืึทืืึธืจ ืืึธื ืืืื ืืขืืืืื ื ืึทื ืฉืืึธื. Platform.cs 64
public static PlatformType get_platform()
{
switch (Environment.OSVersion.Platform)
{
case PlatformID.MacOSX:
{
....
}
case PlatformID.Unix:
if(file_system.directory_exists("/Applications")
& file_system.directory_exists("/System")
& file_system.directory_exists("/Users")
& file_system.directory_exists("/Volumes"))
{
return PlatformType.Mac;
}
else
return PlatformType.Linux;
default:
return PlatformType.Windows;
}
}ืึธืคึผืขืจืึทืืึธืจ ืืืืืง & ืคืื ืืขืจ ืึธืคึผืขืจืึทืืึธืจ && ืืื ืึทื ืืืื ืื ืืื ืงืก ืืืึทื ืคืื ืื ืืืืกืืจืืง ืืื ืคืึทืืฉ, ืืขืืึธืื ืื ืจืขืื ืืืึทื ืืืขื ื ืึธื ืืืื ืงืึทืืงืืึทืืืืืื, ืืืึธืก ืืื ืืขื ืคืึทื ืืืคึผืืืื ืืื ืืืืืง ืืืคึฟื ืจืืคื system.directory_exists.
ืืื ืื ืืึทืืจืึทืื ืคืจืึทืืืขื ื, ืืึธืก ืืื ืึท ืืื ืขืจืืืขืจืืืง ืคืขืืขืจ. ืืึธ, ืืขื ืฆืืฉืืึทื ื ืงืขื ืขื ืืืื ืึธืคึผืืืืืืขื ืืืจื ืจืืคึผืืืืกืื ื ืื & ืึธืคึผืขืจืึทืืึธืจ ืืื ืื && ืึธืคึผืขืจืึทืืึธืจ, ืึธืืขืจ ืคึฟืื ืึท ืคึผืจืึทืงืืืฉ ืคืื ื ืคืื ืืืื ืื ื, ืืึธืก ืืื ื ืืฉื ืืืืจืงื ืขืคึผืขืก. ืึธืืขืจ, ืืื ืื ืืขืจืข ืงืึทืกืขืก, ืฆืขืืืฉืื ื ืฆืืืืฉื & ืืื && ืงืขื ืขื ืึธื ืืึทืื ืขืจื ืกื ืคึผืจืึธืืืขืืก ืืืขื ืื ืจืขืื ืืืึทื ืคืื ืื ืืืืกืืจืืง ืืื ืืืืื ืืื ืืื ืคืึทืืฉ / ืคืึทืจืงืจืืคึผืื ืืืึทืืืขืก. ืคึฟืึทืจ ืืืึทืฉืคึผืื, ืืื ืืื ืืืขืจ ืืขืืช ืืึทืืืื ื, , ืขืก ืืื ืืขื ืคืึทื:
if ((k < nct) & (s[k] != 0.0))ืืคืืื ืืืื ืืขืจ ืืื ืืขืงืก k ืืื ืคืึทืืฉ, ืขืก ืืืขื ืืืื ืืขืืืืื ื ืฆื ืึทืงืกืขืก ืึท ืืขื ืืข ืขืืขืืขื ื. ืืื ืึท ืจืขืืืืืึทื, ืึท ืืืกื ืขื ืืืขื ืืืื ืืจืื ืืขืืืืจืคื IndexOutOfRangeException.
ืืืึธืจื ืื ืื N3, N4
ืึทื ืึทืืืืขืจ ืืืืจืขื ืื ื: [CWE-571] ืื ืืืืกืืจืืง 'ืงืืจืฅ ืคึผืื ืืืขื' ืืื ืฉืืขื ืืืง ืืืช. InteractivePrompt.cs 101
ืึทื ืึทืืืืขืจ ืืืืจืขื ืื ื: [CWE-571] ืื ืืืืกืืจืืง 'ืงืืจืฅ ืคึผืื ืืืขื' ืืื ืฉืืขื ืืืง ืืืช. InteractivePrompt.cs 105
public static string
prompt_for_confirmation(.... bool shortPrompt = false, ....)
{
....
if (shortPrompt)
{
var choicePrompt = choice.is_equal_to(defaultChoice) //1
?
shortPrompt //2
?
"[[{0}]{1}]".format_with(choice.Substring(0, 1).ToUpperInvariant(), //3
choice.Substring(1,choice.Length - 1))
:
"[{0}]".format_with(choice.ToUpperInvariant()) //0
:
shortPrompt //4
?
"[{0}]{1}".format_with(choice.Substring(0,1).ToUpperInvariant(), //5
choice.Substring(1,choice.Length - 1))
:
choice; //0
....
}
....
}ืืื ืืขื ืคืึทื, ืขืก ืืื ืึท ืืึธืื ืข ืืึธืืืง ืืื ืืขืจ ืื ืึธืคึผืขืจืึทืฆืืข ืคืื โโืื ืืขืจื ืขืจื ืึธืคึผืขืจืึทืืึธืจ. ืืึธืืืจ ืงืืงื ืืขืจ ื ืขื ืืขืจ: ืืืื ืืขืจ ืืึทืืื ื ืืืึธืก ืืื ืืึธื ืึธื ืืขืฆืืืื ื ืืื ื ืืืขืจ 1 ืืื ืืงืืื, ืืืจ ืืืขืื ืืึทื ืืืืฃ ืฆื ืฆืืฉืืึทื ื 2, ืืืึธืก ืืื ืฉืืขื ืืืง ืจืืืืืง, ืืืืก ืืืื ื ืื ืืื ืืข 3 ืืืขื ืืืจืืืขืคืืจื ืืืขืจื, ืืืื ืฆืืฉืืื ื 1 ืืืขื ืืื ืืืืกืคืืจื ืคืืืฉ, ืืืขืื ืืืจ ืืื ืืจืืืขืจืืืื ืฆื ืืขืจ ืืื ืืข ืื ืืขืฆืืืื ื ืืื ื ืืืขืจ 4, ืืขืจ ืฆืืฉืืื ื ืืื ืืืขืืืขืจ ืืื ืืืื ืฉืืขื ืืืง ืจืืืืืง, ืืืืก ืืืื ื ืื ืื ืืื ืืข 5 ืืืขื ืืืจืืืขืคืืจื ืืืขืจื, ืืืื ืืืขืื ืื ืืืืื ืืื ืืขื ืื ืืขืฆืืืื ื ืืื ืงืืืขื ืืืจ 0 ืงืืื ืืื ื ืืฉื ืืงืืื ืืืขืจื, ืืืืก ืืื ืืคืฉืจ ื ืืฉื ืืขื ืื ืื ืืืืืง ืคืื ืืคืขืจืืฆืืข ืืืืก ืืขืจ ืคืจืืืจืื ืืื ืขืจืืืืจืืขื.
ืืืืจืขื ืื ื N5
ืึทื ืึทืืืืขืจ ืืืืจืขื ืื ื: [CWE-783] ืืึธืืขืจ ืืขืจ '?:' ืึธืคึผืขืจืึทืืึธืจ ืึทืจืืขื ืืื ืึท ืึทื ืืขืจืฉ ืืืขื ืืื ืขืก ืืื ืืขืืืขื ืืขืจืืืึทืจื. ืืืื ืืืืืขืจืงืืึทื ืืื ื ืืืขืจืืงืขืจ ืืื ืืืืืขืจืงืืึทื ืคืื ืื ืืขืจืข ืึธืคึผืขืจืืืืขืจื ืืื ืืืื ืฆืืฉืืึทื ื. Options.cs 1019
private static string GetArgumentName (...., string description)
{
string[] nameStart;
if (maxIndex == 1)
{
nameStart = new string[]{"{0:", "{"};
}
else
{
nameStart = new string[]{"{" + index + ":"};
}
for (int i = 0; i < nameStart.Length; ++i)
{
int start, j = 0;
do
{
start = description.IndexOf (nameStart [i], j);
}
while (start >= 0 && j != 0 ? description [j++ - 1] == '{' : false);
....
return maxIndex == 1 ? "VALUE" : "VALUE" + (index + 1);
}
}ืื ืืืึทืื ืึธืกืืืง ืืขืืจืืขื ืคึฟืึทืจ ืื ืฉืืจื:
while (start >= 0 && j != 0 ? description [j++ - 1] == '{' : false)ืืื ื ืื ืืืึทืืขืืืืืง j ืขืืืขืืข ืฉืืจืืช ืืืืื ืืื ืื ืืืืึทืืืืื ืฆื ื ืื, ืื ืืขืจื ืขืจื ืึธืคึผืขืจืึทืืึธืจ ืืืขื ืฆืืจืืงืงืืืขื ืื ืืืขืจื ืคืึทืืฉ. ืืืืึทื ืคืื ืืขื ืฆืืฉืืึทื ื, ืืขืจ ืืืฃ ืคืื ืื ืฉืืืืฃ ืืืขื ืืืื ืขืงืกืึทืงืืืืึทื ืืืืื ืึทืืึธื. ืขืก ืืืื ื ืฆื ืืืจ ืึทื ืืึธืก ืฉืืืง ืคืื ืงืึธื ืืื ื ืืฉื ืึทืจืืขืื ืืื ืืขืจ ืคึผืจืึธืืจืึทืืืกื ืืืขื.
ืืืืจืขื ืื ื N6
ืึทื ืึทืืืืขืจ ืืืืจืขื ืื ื: [CWE-571] ืืขืจ ืืืืกืืจืืง 'installedPackageVersions.Count != 1' ืืื ืฉืืขื ืืืง ืืืช. NugetService.cs 1405
private void remove_nuget_cache_for_package(....)
{
if (!config.AllVersions && installedPackageVersions.Count > 1)
{
const string allVersionsChoice = "All versions";
if (installedPackageVersions.Count != 1)
{
choices.Add(allVersionsChoice);
}
....
}
....
}ืขืก ืืื ืึท ืืึธืื ืข ื ืขืกืืขื ืฆืืฉืืึทื ื ืืึธ: installedPackageVersions.Count != 1ืืืึธืก ืืืขื ืฉืืขื ืืืง ืืืื ืจืืืืืง. ืึธืคื ืึทืืึท ืึท ืืืืจืขื ืื ื ืื ืืืงืืืฅ ืึท ืืึทืืืฉืืงืึทื ืืขืืช ืืื ืื ืงืึธื, ืืื ืืื ืื ืืขืจืข ืงืึทืกืขืก ืขืก ืคืฉืื ืื ืืืงืืืฅ ืืืขืจืืง ืงืึธื ืืจืึธืืืจืื ื.
ืืืืจืขื ืื ื N7
ืึทื ืึทืืืืขืจ ืืืืจืขื ืื ื: ืขืก ืืขื ืขื ืืืืขื ืืงืึทื ืกืึทื-ืืืืกืืจืืงื 'commandArguments.contains("-apikey")' ืฆื ืื ืืื ืงืก ืืื ืฆื ืื ืจืขืื ืคืื ืื '||' ืึธืคึผืขืจืึทืืึธืจ. ArgumentsUtility.cs 42
public static bool arguments_contain_sensitive_information(string
commandArguments)
{
return commandArguments.contains("-install-arguments-sensitive")
|| commandArguments.contains("-package-parameters-sensitive")
|| commandArguments.contains("apikey ")
|| commandArguments.contains("config ")
|| commandArguments.contains("push ")
|| commandArguments.contains("-p ")
|| commandArguments.contains("-p=")
|| commandArguments.contains("-password")
|| commandArguments.contains("-cp ")
|| commandArguments.contains("-cp=")
|| commandArguments.contains("-certpassword")
|| commandArguments.contains("-k ")
|| commandArguments.contains("-k=")
|| commandArguments.contains("-key ")
|| commandArguments.contains("-key=")
|| commandArguments.contains("-apikey")
|| commandArguments.contains("-api-key")
|| commandArguments.contains("-apikey")
|| commandArguments.contains("-api-key");
}ืืขืจ ืคึผืจืึธืืจืึทืืืกื ืืืึธืก ืืึธื ืืขืฉืจืืื ืืขื ืึธืคึผืืืืืื ื ืคืื ืงืึธื, ืงืึทืคึผืื ืืื ืคึผืืืกืืื ืื ืืขืฆืืข ืฆืืืื ืฉืืจืืช ืืื ืคืืจืืขืกื ืฆื ืจืขืืึทืืืจื ืืื. ืืืืึทื ืคืื ืืขื, Chocolatey ืืืืขืจื ืืขื ืขื ื ืืฉื ืืืืืืช ืฆื ืฆืืืืืื ืืขื ืคึผืึทืจืึทืืขืืขืจ ืึทืคึผืืงืื ืึท ืคึผืึธืจ ืืขืจ ืืืขืื. ืขื ืืขื ืฆื ืื ืคึผืึทืจืึทืืขืืขืจืก ืืืืื, ืืื ืงืขื ืขื ืคืึธืจืฉืืึธืื ืื ืคืืืืขื ืืข ืึธืคึผืฆืืขืก:
commandArguments.contains("-apikey=");
commandArguments.contains("-api-key=");ืงืึธืคึผื-ืคึผืึทืคึผ ืขืจืจืึธืจืก ืืึธืื ืึท ืืืื ืืขืืขืื ืืืึทื ืฆื ืืขืจืฉืืึทื ืขื ืืืืขืจ ืึธืืขืจ ืฉืคึผืขืืขืจ ืืื ืงืืื ืคึผืจืืืขืงื ืืื ืึท ืืจืืืก ืกืืืข ืคืื โโืืงืืจ ืงืึธื, ืืื ืืืื ืขืจ ืคืื ืื ืืขืกืืขืจ ืืืฉืืจืื ืฆื ืงืึทืืืึทื ืืื ืืื ืกืืึทืืืง ืึทื ืึทืืืกืืก.
ืคึผืก ืืื ืืื ืฉืืขื ืืืง, ืืขืจ ืืขืืช ืืขื ืื ืฆื ืืขืจืฉืืึทื ืขื ืืื ืื ืกืืฃ ืคืื ืึท ืืึทืืื-ืฉืืจื ืฆืืฉืืึทื ื :). ืืขื ืืืืกืืืืข "".
ืืืืจืขื ืื ื N8
ืึทื ืึทืืืืขืจ ืืืืจืขื ืื ื: [CWE-476] ืื 'ืื ืกืืึทืืืขื ืคึผืึทืงืงืึทืืข' ืืืืคืขืฅ ืืื ืืขื ืืฆื ืืืืืขืจ ืขืก ืืื ืืืขืจืึทืคืืื ืงืขืื ื ืึทื. ืืฉืขืง ืฉืืจืืช: 910, 917. NugetService.cs 910
public virtual ConcurrentDictionary<string, PackageResult> get_outdated(....)
{
....
var pinnedPackageResult = outdatedPackages.GetOrAdd(
packageName,
new PackageResult(installedPackage,
_fileSystem.combine_paths(
ApplicationParameters.PackagesLocation,
installedPackage.Id)));
....
if ( installedPackage != null
&& !string.IsNullOrWhiteSpace(installedPackage.Version.SpecialVersion)
&& !config.UpgradeCommand.ExcludePrerelease)
{
....
}
....
}ืงืืึทืกืืฉ ืืจืืึทื: ืืืืคืขืฅ ืขืจืฉืืขืจ ืืื ืกืืึทืืืจื ืคึผืึทืงืงืึทืืข ืืื ืืขื ืืฆื ืืื ืืขืืึธืื ืึธืคึผืืขืฉืืขืื ืคึฟืึทืจ ื ืึทื. ืืขืจ ืืืึทืื ืึธืกืืืง ืืขืจืฆืืืื ืืื ืื ืืืขืื ืืืื ืขืจ ืคืื ืฆืืืื ืคึผืจืึธืืืขืืก ืืื ืืขื ืคึผืจืึธืืจืึทื: ืึธืืขืจ ืืื ืกืืึทืืืจื ืคึผืึทืงืงืึทืืข ืงืืื ืืึธื ืืืืึทื ื ืึทื, ืืืึธืก ืืื ืกืึธืคืขืงืืืง, ืืื ืืขืจ ืืฉืขืง ืืื ืืืขืจืืง, ืึธืืขืจ ืืืจ ืงืขื ืคึผืึทืืขื ืืฉืึทืื ืืึทืงืืืขื ืึท ืขืจื ืกื ืืขืืช ืืื ืื ืงืึธื - ืึทื ืคึผืจืืืื ืฆื ืึทืงืกืขืก ืึท ื ืึทื ืจืขืคึฟืขืจืขื ืฅ.
ืกืึธืฃ
ืึทืืื ืืืจ ืืึธืื ืืขื ืืืขื ืื ืื ืืขืจ ืงืืืื ืฉืจืื - ืืืฆื ื ืืฆื PVS-Studio ืืื ืืขืืืืจื ืืคืืื ืืจืื ืืขืจ ืืื ืืขืจ ืืึทืงืืืขื. ืืื ืืืึธืื ืืืื ืืื ืฆื ืืึธืื ืึทื Chocolatey ืืื ืึท ืืื ืคึผืขืงื ืคืึทืจืืืึทืืืขืจ ืืื ืึท ืงืืืื ื ืืืขืจ ืคืื ืขืจืจืึธืจืก ืืื ืื ืงืึธื, ืืืึธืก ืงืขื ืืืื ืืคืืื ืืืืื ืืงืขืจืข ืืืขื ืืืจ ื ืืฆื PVS-Studio.
ืืืจ ืืึทืื ืืืจ ืืื ืคึผืจืืืืจื PVS-Studio. ืจืขืืืืขืจ ื ืืฆื ืคืื ืึท ืกืืึทืืืง ืึทื ืึทืืืืขืจ ืืืขื ืคึฟืึทืจืืขืกืขืจื ืื ืงืืืึทืืืืขื ืืื ืจืืืืืึทืืืืึทืื ืคืื ืื ืงืึธื ืืืึธืก ืืืื ืืึทื ืฉืึทืคึฟื ืืขืืืขืืึธืคึผืก ืืื ืืขืืคื ืคืึทืจืืืึทืื ืคืืืข .
ืคึผืก
ืคืืจื ืืจืืืกืืขืื ืืืื ืืืจ ืืขืฉืืงื ืืขื ืืจืืืงื ืฆื ืื ืืฉืึธืงืืืืื ืืขืืืขืืึธืคึผืขืจืก, ืืื ืืื ืืืื ืขืก ืืื ืืืงืืืขื. ืืืจ ืืึธืื ื ืื ืืขืคึฟืื ืขื ืขืคึผืขืก ืงืจืืืืฉ, ืึธืืขืจ ืืื, ืืืฉื, ืืืืงื ืื ืืฉืืง ืืืึธืก ืืืจ ืืขืคึฟืื ืขื ืฉืืื ืฆื ืื "ืึทืคึผื-ืงืื" ืฉืืืกื.
ืืืื ืืืจ ืืืืื ืฆื ืืืืื ืืขื ืึทืจืืืงื ืืื ืึทื ืขื ืืืืฉ-ืืขืจืขืื ืืืืขื, ืืืืข ื ืืฆื ืื ืืืืขืจืืขืฆืื ื ืืื ืง: Vladislav Stolyarov. .
ืืงืืจ: www.habr.com