Analyzer::Java::Cli
Inherits CliEndpointSupport < Analyzer < FileHelper < Reference < Object
Surfaces the command-line attack surface of Java programs as cli://
endpoints: one endpoint per (sub)command with named options
(param_type "flag"), positional arguments ("argument") and consumed
environment variables ("env"). Covers picocli, args4j, JCommander,
commons-cli, airline and jopt-simple, plus gated System.getenv reads.
Line-scan analyzer (Go/Ruby/Rust CLI house style) merging endpoints by URL. Subclasses Analyzer directly (JavaEngine is a module) and uses JavaEngine.test_path? to skip tests.
Constants
commons-cli (no subcommands; flags on root).
Current (non-deprecated) addOption(String opt, boolean hasArg, String description) overload used for short-only flags. The true|false
literal gate in the 2nd argument position guarantees this never
overlaps with ADD_OPTION_LL above (which requires a quoted string
there), so a given call is matched by exactly one of the two.
jopt-simple (no subcommands; flags land on root, like commons-cli).
.accepts("flag")/.acceptsAll(List.of("f","flag")) are only real CLI
flags when called on a variable that was actually bound to
new OptionParser(...) — jopt-simple's OptionParser isn't the only
class with an accepts(...) method (e.g. a FormatMatcher.accepts(fmt)
helper), so the receiver is tracked per-file in the same forward pass
and matches on an untracked receiver are dropped rather than attributed
to the root command.
Cheap pre-gate applied to the RAW file, before the comment strip.
strip_comments materialises an Array(Char) of the whole file and
rebuilds it character by character; running it on all 8,658 .java
files in spring-boot to then reject 97% of them on the gate below was
the bulk of this analyzer. Stripping only replaces characters with
' ' or '\n' and never changes the character count, so a literal
with no whitespace in it can appear in the stripped text only if it
already appears, unchanged, in the raw text. Each alternative of the
real gate requires one of these literals verbatim (the new\s+X
forms require X; the \s-carrying parts are deliberately not
relied on, since blanking a comment can manufacture whitespace).
Files that pass still go through the full, comment-aware gate.
Class methods
Instance methods
Instance-side view of the same declaration. The per-file rescues live on
this base class, which has no way to name the analyzer that is running
inside them, so a skipped file could not be attributed to a tech.
Deriving it from analyzer_for keeps the name written exactly once.