From bd9136a45cad59dd021f3920353103ec6ba994d2 Mon Sep 17 00:00:00 2001 From: Kamil Patryk Kozakowski Date: Tue, 14 Jul 2026 06:06:02 +0200 Subject: [PATCH] Require package-qualified enum types for trusted valueOf widen Reject import-style polymorphic candidates when deciding whether an ambiguous valueOf widen is machine-scoped and safe to link. Co-authored-by: Cursor --- .../analysis/enricher/CallChainLinkPolicy.java | 3 ++- .../analysis/enricher/CallChainLinkPolicyTest.java | 12 ++++++++++++ 2 files changed, 14 insertions(+), 1 deletion(-) diff --git a/state_machine_exporter/src/main/java/click/kamil/springstatemachineexporter/analysis/enricher/CallChainLinkPolicy.java b/state_machine_exporter/src/main/java/click/kamil/springstatemachineexporter/analysis/enricher/CallChainLinkPolicy.java index eed03f2..d9d8e6b 100644 --- a/state_machine_exporter/src/main/java/click/kamil/springstatemachineexporter/analysis/enricher/CallChainLinkPolicy.java +++ b/state_machine_exporter/src/main/java/click/kamil/springstatemachineexporter/analysis/enricher/CallChainLinkPolicy.java @@ -61,7 +61,8 @@ public final class CallChainLinkPolicy { return false; } String enumType = pe.substring(0, pe.lastIndexOf('.')); - if (!MachineEnumCanonicalizer.enumTypesMatch(eventTypeFqn, enumType)) { + if (!enumType.contains(".") + || !MachineEnumCanonicalizer.enumTypesMatch(eventTypeFqn, enumType)) { return false; } } diff --git a/state_machine_exporter/src/test/java/click/kamil/springstatemachineexporter/analysis/enricher/CallChainLinkPolicyTest.java b/state_machine_exporter/src/test/java/click/kamil/springstatemachineexporter/analysis/enricher/CallChainLinkPolicyTest.java index 529c2fc..e3b718a 100644 --- a/state_machine_exporter/src/test/java/click/kamil/springstatemachineexporter/analysis/enricher/CallChainLinkPolicyTest.java +++ b/state_machine_exporter/src/test/java/click/kamil/springstatemachineexporter/analysis/enricher/CallChainLinkPolicyTest.java @@ -59,4 +59,16 @@ class CallChainLinkPolicyTest { assertThat(CallChainLinkPolicy.isTrustedEnumPolymorphicWiden(trigger)).isTrue(); assertThat(CallChainLinkPolicy.shouldFailClosedOnAmbiguousCallGraphWiden(trigger)).isFalse(); } + + @Test + void shouldNotTrustImportStylePolymorphicWidenWithoutPackage() { + TriggerPoint trigger = TriggerPoint.builder() + .ambiguous(true) + .event("OrderEvent.valueOf(eventStr)") + .polymorphicEvents(List.of("OrderEvent.PAY", "OrderEvent.SHIP")) + .build(); + + assertThat(CallChainLinkPolicy.isTrustedEnumPolymorphicWiden(trigger)).isFalse(); + assertThat(CallChainLinkPolicy.shouldFailClosedOnAmbiguousCallGraphWiden(trigger)).isTrue(); + } }