linkedin / linkedin/qark

VARARGS method doesn't have an array as last arg!!

Open
#317 6 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

bug
Dominant language
Python
Stars
3.4k
Forks
663
PR merge metrics
No merged PRs in 30d

Description

Environment:
ubuntu 18
python 2.7
qark installed from pip

INFO: Decompiling class class_193
INFO: ... done
Running scans...
Traceback (most recent call last):
File "/home/ubuntu/.virtualenvs/secpy2/bin/qark", line 10, in
sys.exit(cli())
File "/home/ubuntu/.virtualenvs/secpy2/local/lib/python2.7/site-packages/click/core.py", line 764, in __call__
return self.main(*args, **kwargs)
File "/home/ubuntu/.virtualenvs/secpy2/local/lib/python2.7/site-packages/click/core.py", line 717, in main
rv = self.invoke(ctx)
File "/home/ubuntu/.virtualenvs/secpy2/local/lib/python2.7/site-packages/click/core.py", line 956, in invoke
return ctx.invoke(self.callback, **ctx.params)
File "/home/ubuntu/.virtualenvs/secpy2/local/lib/python2.7/site-packages/click/core.py", line 555, in invoke
return callback(*args, **kwargs)
File "/home/ubuntu/.virtualenvs/secpy2/local/lib/python2.7/site-packages/click/decorators.py", line 17, in new_func
return f(get_current_context(), *args, **kwargs)
File "/home/ubuntu/.virtualenvs/secpy2/local/lib/python2.7/site-packages/qark/qark.py", line 90, in cli
scanner.run()
File "/home/ubuntu/.virtualenvs/secpy2/local/lib/python2.7/site-packages/qark/scanner/scanner.py", line 64, in run
self._run_checks(plugins)
File "/home/ubuntu/.virtualenvs/secpy2/local/lib/python2.7/site-packages/qark/scanner/scanner.py", line 78, in _run_checks
current_file_subject.notify(filepath)
File "/home/ubuntu/.virtualenvs/secpy2/local/lib/python2.7/site-packages/qark/scanner/scanner.py", line 125, in notify
observer.update(file_path, call_run=True)
File "/home/ubuntu/.virtualenvs/secpy2/local/lib/python2.7/site-packages/qark/scanner/plugin.py", line 239, in update
super(CoroutinePlugin, self).update(file_path)
File "/home/ubuntu/.virtualenvs/secpy2/local/lib/python2.7/site-packages/qark/scanner/plugin.py", line 185, in update
JavaASTPlugin.java_ast = javalang.parse.parse(self.file_contents)
File "/home/ubuntu/.virtualenvs/secpy2/local/lib/python2.7/site-packages/javalang/parse.py", line 52, in parse
parser = Parser(tokens)
File "/home/ubuntu/.virtualenvs/secpy2/local/lib/python2.7/site-packages/javalang/parser.py", line 95, in __init__
self.tokens = util.LookAheadListIterator(tokens)
File "/home/ubuntu/.virtualenvs/secpy2/local/lib/python2.7/site-packages/javalang/util.py", line 92, in __init__
self.list = list(iterable)
File "/home/ubuntu/.virtualenvs/secpy2/local/lib/python2.7/site-packages/javalang/tokenizer.py", line 531, in tokenize
self.read_string()
File "/home/ubuntu/.virtualenvs/secpy2/local/lib/python2.7/site-packages/javalang/tokenizer.py", line 201, in read_string
self.error('Unterminated character/string literal')
File "/home/ubuntu/.virtualenvs/secpy2/local/lib/python2.7/site-packages/javalang/tokenizer.py", line 572, in error
raise error
javalang.tokenizer.LexerError: Unterminated character/string literal at "'", line 24: /* varargs */ Http2Connection$1(Http2Connection http2Connection, String string2, Object[] arrobject, int n2, org.benf.cfr.reader.util.ConfusedCFRException: VARARGS method doesn't have an array as last arg!!

Contributor guide

No contributing guide indexed for this repository

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Reproduce the crash with the decompiled input containing the VARARGS constructor, then inspect qark/scanner/plugin.py around JavaASTPlugin.update and the javalang.parse.parse call shown in the traceback. Done means the scanner handles this input without the LexerError and completes its scans, with a regression test for the failing case.

Written by the indexing model from the issue text.

Assessment

Tech stack
java, python
Domain
devtools, security
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Needs clarification
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.