From 6ecdafac87e63c7a2c2f281364d52b490ccc3804 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Bart=C5=82omiej=20Pluta?= <bartlomiej.p.pluta@gmail.com>
Date: Fri, 12 Apr 2019 10:51:49 +0200
Subject: [PATCH] 10: Add OrderedBroadcastPlugin

---
 .../com/bartek/esa/core/di/PluginModule.java  |  6 +++++
 .../core/plugin/OrderedBroadcastPlugin.java   | 25 +++++++++++++++++++
 src/main/resources/description.properties     |  5 +++-
 3 files changed, 35 insertions(+), 1 deletion(-)
 create mode 100644 src/main/java/com/bartek/esa/core/plugin/OrderedBroadcastPlugin.java

diff --git a/src/main/java/com/bartek/esa/core/di/PluginModule.java b/src/main/java/com/bartek/esa/core/di/PluginModule.java
index cb9e906..1248dbd 100644
--- a/src/main/java/com/bartek/esa/core/di/PluginModule.java
+++ b/src/main/java/com/bartek/esa/core/di/PluginModule.java
@@ -131,4 +131,10 @@ public class PluginModule {
     public Plugin worldAccessPermissionsPlugin(GlobMatcher globMatcher, XmlHelper xmlHelper) {
         return new WorldAccessPermissionsPlugin(globMatcher, xmlHelper);
     }
+
+    @Provides
+    @IntoSet
+    public Plugin orderedAndStickyBroadcastPlugin(GlobMatcher globMatcher, XmlHelper xmlHelper) {
+        return new OrderedBroadcastPlugin(globMatcher, xmlHelper);
+    }
 }
diff --git a/src/main/java/com/bartek/esa/core/plugin/OrderedBroadcastPlugin.java b/src/main/java/com/bartek/esa/core/plugin/OrderedBroadcastPlugin.java
new file mode 100644
index 0000000..89a91fd
--- /dev/null
+++ b/src/main/java/com/bartek/esa/core/plugin/OrderedBroadcastPlugin.java
@@ -0,0 +1,25 @@
+package com.bartek.esa.core.plugin;
+
+import com.bartek.esa.core.archetype.JavaPlugin;
+import com.bartek.esa.core.model.enumeration.Severity;
+import com.bartek.esa.core.xml.XmlHelper;
+import com.bartek.esa.file.matcher.GlobMatcher;
+import com.github.javaparser.ast.CompilationUnit;
+import com.github.javaparser.ast.expr.MethodCallExpr;
+
+import javax.inject.Inject;
+
+public class OrderedBroadcastPlugin extends JavaPlugin {
+
+    @Inject
+    public OrderedBroadcastPlugin(GlobMatcher globMatcher, XmlHelper xmlHelper) {
+        super(globMatcher, xmlHelper);
+    }
+
+    @Override
+    public void run(CompilationUnit compilationUnit) {
+        compilationUnit.findAll(MethodCallExpr.class).stream()
+                .filter(expr -> expr.getName().getIdentifier().matches("sendOrderedBroadcast|sendOrderedBroadcastAsUser|sendStickyOrderedBroadcast|sendStickyOrderedBroadcastAsUser"))
+                .forEach(expr -> addIssue(Severity.WARNING, getLineNumberFromExpression(expr), expr.toString()));
+    }
+}
diff --git a/src/main/resources/description.properties b/src/main/resources/description.properties
index a9057cb..073c154 100644
--- a/src/main/resources/description.properties
+++ b/src/main/resources/description.properties
@@ -115,4 +115,7 @@ com.bartek.esa.core.plugin.SqlInjectionPlugin='rawQuery' method detected. Potent
 com.bartek.esa.core.plugin.WorldAccessPermissionsPlugin=World access permissions detected. Potential data leakage.\n\
   The deprecated '${exprName}' constant has been found and it can be risky to use.\n\
   It grants world access permission to selected resource.\n\
-  Consider using less permissive mode.a.
\ No newline at end of file
+  Consider using less permissive mode.
+
+com.bartek.esa.core.plugin.OrderedBroadcastPlugin=Sending ordered broadcast. Potential broadcast theft.\n\
+  Malicious applications can intercept ordered broadcasts, stop their propagation and resend with malicious data.
\ No newline at end of file