Skip to content

fix: scope field extraction to target class to prevent cross-class injection #1953

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
mashraf-222 merged 7 commits into from
May 4, 2026
Merged

fix: scope field extraction to target class to prevent cross-class injection #1953

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
7 commits
Select commit Hold shift + click to select a range
3bd0255
fix: scope field extraction to target class to prevent cross-class in…
mohamedashrraf222 Apr 1, 2026
fdc7a52
Merge remote-tracking branch 'origin/main' into cf-1087-field-injecti…
mohamedashrraf222 Apr 8, 2026
3b03249
Merge remote-tracking branch 'origin/main' into cf-1087-field-injecti…
mohamedashrraf222 Apr 8, 2026
0bf9229
Merge branch 'main' into cf-1087-field-injection-class-filter
mohamedashrraf222 Apr 28, 2026
efbd341
test: annotate test_replacement.py for mypy prek hook
mohamedashrraf222 Apr 28, 2026
f02b99f
fix: decode help-banner test subprocess output as UTF-8
mohamedashrraf222 Apr 28, 2026
2b90ee8
Merge branch 'main' into cf-1087-field-injection-class-filter
mohamedashrraf222 Apr 28, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
7 changes: 5 additions & 2 deletions codeflash/languages/java/replacement.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -69,7 +69,6 @@ def _parse_optimization_source(new_source: str, target_method_name: str, analyze
if classes:
# It's a class - extract components
methods = analyzer.find_methods(new_source)
fields = analyzer.find_fields(new_source)

# Find the target method and its index among all methods
target_method = None
Expand Down Expand Up @@ -128,7 +127,11 @@ def _parse_optimization_source(new_source: str, target_method_name: str, analyze
ctor_end = c.end_line
modified_constructors.append("".join(ctor_lines[ctor_start:ctor_end]))

# Extract fields
# Extract fields scoped to the target method's class only.
# Without class filtering, fields from inner/anonymous classes would be
# incorrectly injected into the outer target class.
target_class_name = target_method.class_name if target_method else None
fields = analyzer.find_fields(new_source, class_name=target_class_name)
for f in fields:
if f.source_text:
new_fields.append(f.source_text)
Expand Down
Loading