code-analysis

The Problem

With the new model-property type and ModelPropertyRule Larastan now has the ability to check the existence of model columns that are given to a method.

Adding the model-property type to the Laravel's core methods are done with the help of PHPstan stubs. Some [examples](https://github.com/nunomaduro/larastan/blob/master/stubs/Elo

Affects PMD Version:

6.45.0

Description:

UseCollectionIsEmptyRule fails with NPE if:

1. object under test is declared as re

[spotbugs] Running SpotBugs...     
    [spotbugs] Unexpected problem occured during version sanity check         
    [spotbugs] Reported exception:         
[spotbugs] java.lang.AbstractMethodError: Receiver class org.slf4j.nop.NOPServiceProvider does not define or inherit an implementation of the resolved method 'abstract java.lang.String getRequesteApiVersion()' of interface org.slf4j.

Description

BeanUtils is a library that is doing automatic mapping to Java object.
It can cause arm when the attack controls part of the list of properties being sets. BeanUtils does not blacklist properties like class, classloader or other objects that are likely to load arbitrary classes and possibly run code.

Code

import org.apache.commons.beanutils.BeanUtils;

public

problem: the shadow classes (CtClass reflecting a binary class) built by JavaReflectionTreeBuilder can be modified. This is confusing for users, see INRIA/spoon#4664.

solution: the JavaReflectionTreeBuilder should construct immutable objects, closed to modification, where all setters throw an UnsupportedOperationException