Skip to content

Commit 2249ea0

Browse files
alban-auzeillalban-auzeill
committed
SONARJAVA-5601 Update rule metadata
1 parent a1dcb90 commit 2249ea0

20 files changed

Lines changed: 78 additions & 48 deletions

File tree

‎java-symbolic-execution/java-symbolic-execution-plugin/src/main/resources/org/sonar/l10n/java/rules/javase/S2755.html‎

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -170,9 +170,13 @@ <h3>Standards</h3>
170170
<li> OWASP - <a href="https://owasp.org/Top10/A05_2021-Security_Misconfiguration/">Top 10 2021 Category A5 - Security Misconfiguration</a> </li>
171171
<li> OWASP - <a href="https://owasp.org/www-project-top-ten/2017/A4_2017-XML_External_Entities_(XXE)">Top 10 2017 Category A4 - XML External
172172
Entities (XXE)</a> </li>
173+
<li> OWASP - <a href="https://owasp.org/www-project-mobile-top-10/2023-risks/m4-insufficient-input-output-validation">Mobile Top 10 2024 Category M4
174+
- Insufficient Input/Output Validation</a> </li>
175+
<li> OWASP - <a href="https://owasp.org/www-project-mobile-top-10/2023-risks/m8-security-misconfiguration">Mobile Top 10 2024 Category M8 - Security
176+
Misconfiguration</a> </li>
173177
<li> CWE - <a href="https://cwe.mitre.org/data/definitions/611">CWE-611 - Information Exposure Through XML External Entity Reference</a> </li>
174178
<li> CWE - <a href="https://cwe.mitre.org/data/definitions/827">CWE-827 - Improper Control of Document Type Definition</a> </li>
175-
<li> STIG Viewer - <a href="https://stigviewer.com/stig/application_security_and_development/2023-06-08/finding/V-222608">Application Security and
179+
<li> STIG Viewer - <a href="https://stigviewer.com/stigs/application_security_and_development/2024-12-06/finding/V-222608">Application Security and
176180
Development: V-222608</a> - The application must not be vulnerable to XML-oriented attacks. </li>
177181
</ul>
178182

‎java-symbolic-execution/java-symbolic-execution-plugin/src/main/resources/org/sonar/l10n/java/rules/javase/S2755.json‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -31,6 +31,10 @@
3131
"OWASP Top 10 2021": [
3232
"A5"
3333
],
34+
"OWASP Mobile Top 10 2024": [
35+
"M4",
36+
"M8"
37+
],
3438
"PCI DSS 3.2": [
3539
"6.5.1"
3640
],

‎java-symbolic-execution/java-symbolic-execution-plugin/src/main/resources/org/sonar/l10n/java/rules/javase/S3518.html‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -52,7 +52,7 @@ <h3>Standards</h3>
5252
<li> CWE - <a href="https://cwe.mitre.org/data/definitions/369">CWE-369 - Divide by zero</a> </li>
5353
<li> <a href="https://wiki.sei.cmu.edu/confluence/x/CTZGBQ">CERT, NUM02-J.</a> - Ensure that division and remainder operations do not result in
5454
divide-by-zero errors </li>
55-
<li> STIG Viewer - <a href="https://stigviewer.com/stig/application_security_and_development/2023-06-08/finding/V-222612">Application Security and
55+
<li> STIG Viewer - <a href="https://stigviewer.com/stigs/application_security_and_development/2024-12-06/finding/V-222612">Application Security and
5656
Development: V-222612</a> - The application must not be vulnerable to overflow attacks. </li>
5757
</ul>
5858

‎java-symbolic-execution/java-symbolic-execution-plugin/src/main/resources/org/sonar/l10n/java/rules/javase/S6373.html‎

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -96,9 +96,13 @@ <h3>Standards</h3>
9696
<li> OWASP - <a href="https://owasp.org/www-project-top-ten/2017/A4_2017-XML_External_Entities_(XXE)">Top 10 2017 - Category A4 - XML External
9797
Entities (XXE)</a> </li>
9898
<li> OWASP - <a href="https://owasp.org/Top10/A05_2021-Security_Misconfiguration/">Top 10 2021 - Category A5 - Security Misconfiguration</a> </li>
99+
<li> OWASP - <a href="https://owasp.org/www-project-mobile-top-10/2023-risks/m4-insufficient-input-output-validation">Mobile Top 10 2024 Category M4
100+
- Insufficient Input/Output Validation</a> </li>
101+
<li> OWASP - <a href="https://owasp.org/www-project-mobile-top-10/2023-risks/m8-security-misconfiguration">Mobile Top 10 2024 Category M8 - Security
102+
Misconfiguration</a> </li>
99103
<li> CWE - <a href="https://cwe.mitre.org/data/definitions/611">CWE-611 - Improper Restriction of XML External Entity Reference</a> </li>
100104
<li> CWE - <a href="https://cwe.mitre.org/data/definitions/827">CWE-827 - Improper Control of Document Type Definition</a> </li>
101-
<li> STIG Viewer - <a href="https://stigviewer.com/stig/application_security_and_development/2023-06-08/finding/V-222608">Application Security and
105+
<li> STIG Viewer - <a href="https://stigviewer.com/stigs/application_security_and_development/2024-12-06/finding/V-222608">Application Security and
102106
Development: V-222608</a> - The application must not be vulnerable to XML-oriented attacks. </li>
103107
</ul>
104108

‎java-symbolic-execution/java-symbolic-execution-plugin/src/main/resources/org/sonar/l10n/java/rules/javase/S6373.json‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -30,6 +30,10 @@
3030
"OWASP Top 10 2021": [
3131
"A5"
3232
],
33+
"OWASP Mobile Top 10 2024": [
34+
"M4",
35+
"M8"
36+
],
3337
"PCI DSS 3.2": [
3438
"6.5.1"
3539
],

‎java-symbolic-execution/java-symbolic-execution-plugin/src/main/resources/org/sonar/l10n/java/rules/javase/S6376.html‎

Lines changed: 7 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -84,13 +84,17 @@ <h3>Standards</h3>
8484
<li> OWASP - <a href="https://owasp.org/Top10/A05_2021-Security_Misconfiguration/">Top 10 2021 Category A5 - Security Misconfiguration</a> </li>
8585
<li> OWASP - <a href="https://owasp.org/www-project-top-ten/2017/A4_2017-XML_External_Entities_(XXE)">Top 10 2017 Category A4 - XML External
8686
Entities (XXE)</a> </li>
87+
<li> OWASP - <a href="https://owasp.org/www-project-mobile-top-10/2023-risks/m4-insufficient-input-output-validation">Mobile Top 10 2024 Category M4
88+
- Insufficient Input/Output Validation</a> </li>
89+
<li> OWASP - <a href="https://owasp.org/www-project-mobile-top-10/2023-risks/m8-security-misconfiguration">Mobile Top 10 2024 Category M8 - Security
90+
Misconfiguration</a> </li>
8791
<li> CWE - <a href="https://cwe.mitre.org/data/definitions/776">CWE-776 - Improper Restriction of Recursive Entity References in DTDs ('XML Entity
8892
Expansion')</a> </li>
89-
<li> STIG Viewer - <a href="https://stigviewer.com/stig/application_security_and_development/2023-06-08/finding/V-222593">Application Security and
93+
<li> STIG Viewer - <a href="https://stigviewer.com/stigs/application_security_and_development/2024-12-06/finding/V-222593">Application Security and
9094
Development: V-222593</a> - XML-based applications must mitigate DoS attacks by using XML filters, parser options, or gateways. </li>
91-
<li> STIG Viewer - <a href="https://stigviewer.com/stig/application_security_and_development/2023-06-08/finding/V-222667">Application Security and
95+
<li> STIG Viewer - <a href="https://stigviewer.com/stigs/application_security_and_development/2024-12-06/finding/V-222667">Application Security and
9296
Development: V-222667</a> - Protections against DoS attacks must be implemented. </li>
93-
<li> STIG Viewer - <a href="https://stigviewer.com/stig/application_security_and_development/2023-06-08/finding/V-222608">Application Security and
97+
<li> STIG Viewer - <a href="https://stigviewer.com/stigs/application_security_and_development/2024-12-06/finding/V-222608">Application Security and
9498
Development: V-222608</a> - The application must not be vulnerable to XML-oriented attacks. </li>
9599
</ul>
96100

‎java-symbolic-execution/java-symbolic-execution-plugin/src/main/resources/org/sonar/l10n/java/rules/javase/S6376.json‎

Lines changed: 16 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -21,18 +21,30 @@
2121
"scope": "Main",
2222
"securityStandards": {
2323
"CWE": [
24-
776
24+
611,
25+
827
2526
],
2627
"OWASP": [
2728
"A4"
2829
],
2930
"OWASP Top 10 2021": [
3031
"A5"
3132
],
33+
"OWASP Mobile Top 10 2024": [
34+
"M4",
35+
"M8"
36+
],
37+
"PCI DSS 3.2": [
38+
"6.5.1"
39+
],
40+
"PCI DSS 4.0": [
41+
"6.2.4"
42+
],
43+
"ASVS 4.0": [
44+
"5.5.2"
45+
],
3246
"STIG ASD_V5R3": [
33-
"V-222593",
34-
"V-222608",
35-
"V-222667"
47+
"V-222608"
3648
]
3749
},
3850
"quickfix": "infeasible"

‎java-symbolic-execution/java-symbolic-execution-plugin/src/main/resources/org/sonar/l10n/java/rules/javase/S6377.html‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -59,7 +59,7 @@ <h3>Standards</h3>
5959
<li> OWASP - <a href="https://owasp.org/www-project-top-ten/2017/A3_2017-Sensitive_Data_Exposure">Top 10 2017 Category A3 - Sensitive Data
6060
Exposure</a> </li>
6161
<li> CWE - <a href="https://cwe.mitre.org/data/definitions/347">CWE-347 - Improper Verification of Cryptographic Signature</a> </li>
62-
<li> STIG Viewer - <a href="https://stigviewer.com/stig/application_security_and_development/2023-06-08/finding/V-222608">Application Security and
62+
<li> STIG Viewer - <a href="https://stigviewer.com/stigs/application_security_and_development/2024-12-06/finding/V-222608">Application Security and
6363
Development: V-222608</a> - The application must not be vulnerable to XML-oriented attacks. </li>
6464
</ul>
6565

‎java-symbolic-execution/sonarpedia.json‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -3,7 +3,7 @@
33
"languages": [
44
"JAVA"
55
],
6-
"latest-update": "2024-09-09T13:33:21.851483206Z",
6+
"latest-update": "2025-05-28T09:18:03.967696229Z",
77
"options": {
88
"no-language-in-filenames": true,
99
"preserve-filenames": false

‎sonar-java-plugin/src/main/resources/org/sonar/l10n/java/rules/java/S2384.html‎

Lines changed: 13 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -7,20 +7,22 @@ <h2>Why is this an issue?</h2>
77
<h3>Exceptions</h3>
88
<p>The rule violation is not reported for mutable values stored in private methods if no non-private methods directly passes a mutable parameter to
99
them.</p>
10+
<p>Similarly, rule violations are not reported for mutable values returned by a private getter if that getter’s value is not directly exposed by a
11+
non-private method.</p>
1012
<h3>Noncompliant code example</h3>
1113
<pre>
1214
class A {
13-
private String [] strings;
15+
private String[] strings;
1416

1517
public A () {
1618
strings = new String[]{"first", "second"};
1719
}
1820

19-
public String [] getStrings() {
21+
public String[] getStrings() {
2022
return strings; // Noncompliant
2123
}
2224

23-
public void setStrings(String [] strings) {
25+
public void setStrings(String[] strings) {
2426
this.strings = strings; // Noncompliant
2527
}
2628
}
@@ -43,15 +45,19 @@ <h3>Compliant solution</h3>
4345
strings = new String[]{"first", "second"};
4446
}
4547

46-
public String [] getStrings() {
47-
return strings.clone();
48+
public String[] getStrings() {
49+
return getStringsInternal().clone();
50+
}
51+
52+
private String[] getStringsInternal() {
53+
return strings;
4854
}
4955

50-
private void setStringsInternal(String [] strings) {
56+
private void setStringsInternal(String[] strings) {
5157
this.strings = strings;
5258
}
5359

54-
public void setStrings(String [] strings) {
60+
public void setStrings(String[] strings) {
5561
this.strings = strings.clone();
5662
}
5763
}

0 commit comments

Comments
 (0)