public BugInstance generateBugInstance ( boolean taintedInsideMethod ) { BugInstance bug = new BugInstance ( detector , bugType , originalPriority ) ; bug . addClassAndMethod ( classContext . getJavaClass ( ) , method ) ; bug . addSourceLine ( SourceLineAnnotation . fromVisitedInstruction ( classContext , method , instructionHandle ) ) ; addMessage ( bug , "Sink method" , sinkMethod ) ; addMessage ( bug , "Sink parameter" , String . valueOf ( parameterOffset ) ) ; for ( UnknownSource source : sources ) { if ( source . getSourceType ( ) == UnknownSourceType . FIELD ) { addMessage ( bug , "Unknown source" , source . getSignatureField ( ) ) ; } else if ( source . getSourceType ( ) == UnknownSourceType . RETURN ) { if ( isExclude ( source . getSignatureMethod ( ) ) ) continue ; addMessage ( bug , "Unknown source" , source . getSignatureMethod ( ) ) ; } // if(isExclude(source.getTaintSource())) { continue; } // addMessage(bug, "Unknown source", source.getTaintSource()); } if ( sinkPriority != UNKNOWN_SINK_PRIORITY ) { // higher priority is represented by lower integer if ( sinkPriority < originalPriority ) { bug . setPriority ( sinkPriority ) ; addMessage ( bug , "Method usage" , "with tainted arguments detected" ) ; } else if ( sinkPriority > originalPriority ) { bug . setPriority ( Priorities . LOW_PRIORITY ) ; addMessage ( bug , "Method usage" , "detected only with safe arguments" ) ; } } else if ( ! taintedInsideMethod ) { addMessage ( bug , "Method usage" , "not detected" ) ; } Collections . sort ( lines ) ; SourceLineAnnotation annotation = null ; for ( Iterator < SourceLineAnnotation > it = lines . iterator ( ) ; it . hasNext ( ) ; ) { SourceLineAnnotation prev = annotation ; annotation = it . next ( ) ; if ( prev != null && prev . getClassName ( ) . equals ( annotation . getClassName ( ) ) && prev . getStartLine ( ) == annotation . getStartLine ( ) ) { // keep only one annotation per line it . remove ( ) ; } } for ( SourceLineAnnotation sourceLine : lines ) { bug . addSourceLine ( sourceLine ) ; } return bug ; }
Uses immutable values updated priority and added lines for reporting