Skip to content

Commit 5e7da5f

Browse files
hashicorp-vault-sonar-prod[bot]asya-vorobevagitar-bot
authored
Update rule metadata (#6261)
Co-authored-by: asya-vorobeva <asya-vorobeva@users.noreply.github.com> Co-authored-by: Gitar <noreply@gitar.ai> Co-authored-by: hashicorp-vault-sonar-prod[bot] <111297361+hashicorp-vault-sonar-prod[bot]@users.noreply.github.com>
1 parent 3214aaf commit 5e7da5f

77 files changed

Lines changed: 311 additions & 244 deletions

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

‎sonar-java-plugin/src/main/resources/org/sonar/l10n/java/rules/java/S106.html‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -39,7 +39,7 @@ <h3>Documentation</h3>
3939
<li><a href="https://docs.oracle.com/javase/7/docs/api/java/util/logging/Logger.html">Java SE 7 API Specification: java.util.logging.Logger</a></li>
4040
<li>OWASP - <a href="https://owasp.org/Top10/A09_2021-Security_Logging_and_Monitoring_Failures/">Top 10 2021 Category A9 - Security Logging and
4141
Monitoring Failures</a></li>
42-
<li>OWASP - <a href="https://owasp.org/www-project-top-ten/2017/A3_2017-Sensitive_Data_Exposure">Top 10 2017 Category A3 - Sensitive Data
42+
<li>OWASP - <a href="https://github.com/OWASP/Top10/blob/master/2017/en/0xa3-sensitive-data-disclosure.md">Top 10 2017 Category A3 - Sensitive Data
4343
Exposure</a></li>
4444
<li><a
4545
href="https://cmu-sei.github.io/secure-coding-standards/sei-cert-oracle-coding-standard-for-java/rules/exceptional-behavior-err/err02-j">CERT,

‎sonar-java-plugin/src/main/resources/org/sonar/l10n/java/rules/java/S1166.html‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -82,8 +82,8 @@ <h2>Resources</h2>
8282
<ul>
8383
<li>OWASP - <a href="https://owasp.org/Top10/A09_2021-Security_Logging_and_Monitoring_Failures/">Top 10 2021 Category A9 - Security Logging and
8484
Monitoring Failures</a></li>
85-
<li>OWASP - <a href="https://owasp.org/www-project-top-ten/2017/A10_2017-Insufficient_Logging%2526Monitoring">Top 10 2017 Category A10 -
86-
Insufficient Logging &amp; Monitoring</a></li>
85+
<li>OWASP - <a href="https://github.com/OWASP/Top10/blob/master/2017/en/0xaa-logging-detection-response.md">Top 10 2017 Category A10 - Insufficient
86+
Logging &amp; Monitoring</a></li>
8787
<li><a
8888
href="https://cmu-sei.github.io/secure-coding-standards/sei-cert-oracle-coding-standard-for-java/rules/exceptional-behavior-err/err00-j">CERT,
8989
ERR00-J.</a> - Do not suppress or ignore checked exceptions</li>

‎sonar-java-plugin/src/main/resources/org/sonar/l10n/java/rules/java/S1313.html‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -47,7 +47,7 @@ <h3>Standards</h3>
4747
<ul>
4848
<li>CWE - <a href="https://cwe.mitre.org/data/definitions/547">CWE-547 - Use of Hard-coded, Security-relevant Constants</a></li>
4949
<li>OWASP - <a href="https://owasp.org/Top10/A01_2021-Broken_Access_Control/">Top 10 2021 Category A1 - Broken Access Control</a></li>
50-
<li>OWASP - <a href="https://owasp.org/www-project-top-ten/2017/A3_2017-Sensitive_Data_Exposure">Top 10 2017 Category A3 - Sensitive Data
50+
<li>OWASP - <a href="https://github.com/OWASP/Top10/blob/master/2017/en/0xa3-sensitive-data-disclosure.md">Top 10 2017 Category A3 - Sensitive Data
5151
Exposure</a></li>
5252
</ul>
5353

‎sonar-java-plugin/src/main/resources/org/sonar/l10n/java/rules/java/S1989.html‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -43,7 +43,7 @@ <h4>Compliant solution</h4>
4343
<h2>Resources</h2>
4444
<h3>Articles &amp; blog posts</h3>
4545
<ul>
46-
<li>OWASP - <a href="https://owasp.org/www-project-top-ten/2017/A3_2017-Sensitive_Data_Exposure">Top 10 2017 Category A3 - Sensitive Data
46+
<li>OWASP - <a href="https://github.com/OWASP/Top10/blob/master/2017/en/0xa3-sensitive-data-disclosure.md">Top 10 2017 Category A3 - Sensitive Data
4747
Exposure</a></li>
4848
<li>CWE - <a href="https://cwe.mitre.org/data/definitions/600">CWE-600 - Uncaught Exception in Servlet</a></li>
4949
<li><a

‎sonar-java-plugin/src/main/resources/org/sonar/l10n/java/rules/java/S2053.html‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -66,7 +66,7 @@ <h2>Resources</h2>
6666
<h3>Standards</h3>
6767
<ul>
6868
<li>OWASP - <a href="https://owasp.org/Top10/A02_2021-Cryptographic_Failures/">Top 10 2021 Category A2 - Cryptographic Failures</a></li>
69-
<li>OWASP - <a href="https://www.owasp.org/www-project-top-ten/2017/A3_2017-Sensitive_Data_Exposure">Top 10 2017 Category A3 - Sensitive Data
69+
<li>OWASP - <a href="https://github.com/OWASP/Top10/blob/master/2017/en/0xa3-sensitive-data-disclosure.md">Top 10 2017 Category A3 - Sensitive Data
7070
Exposure</a></li>
7171
<li>OWASP - <a href="https://owasp.github.io/www-project-mobile-top-10/2023-risks/m10-insufficient-cryptography.html">Mobile Top 10 2024 Category
7272
M10 - Insufficient Cryptography</a></li>

‎sonar-java-plugin/src/main/resources/org/sonar/l10n/java/rules/java/S2068.html‎

Lines changed: 5 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -8,14 +8,17 @@ <h2>Why is this an issue?</h2>
88
<li><a href="https://www.cve.org/CVERecord?id=CVE-2019-13466">CVE-2019-13466</a></li>
99
<li><a href="https://www.cve.org/CVERecord?id=CVE-2018-15389">CVE-2018-15389</a></li>
1010
</ul>
11+
<p>This rule also examines the credential value itself: a value that is recognizable as something other than a real credential is not reported, even
12+
when the variable name or the connection string parameter matches one of the configured words. Placeholders, references to an environment variable or
13+
to a secrets manager, encrypted values, and obvious example or test values are therefore not flagged.</p>
1114
<h2>How to fix it</h2>
1215
<p>Credentials should be stored in a configuration file that is not committed to the code repository, in a database, or managed by your cloud
1316
provider’s secrets management service. If a password is exposed in the source code, it must be changed immediately.</p>
1417
<h3>Code Examples</h3>
1518
<h4>Noncompliant code example</h4>
1619
<pre data-diff-id="1" data-diff-type="noncompliant">
1720
String username = "steve";
18-
String password = "blue";
21+
String password = "Xk9mP2vL8qR4";
1922
Connection conn = DriverManager.getConnection("jdbc:mysql://localhost/test?" +
2023
"user=" + username + "&amp;password=" + password); // Noncompliant
2124
</pre>
@@ -30,7 +33,7 @@ <h2>Resources</h2>
3033
<ul>
3134
<li>OWASP - <a href="https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures/">Top 10 2021 Category A7 - Identification and
3235
Authentication Failures</a></li>
33-
<li>OWASP - <a href="https://owasp.org/www-project-top-ten/2017/A2_2017-Broken_Authentication">Top 10 2017 Category A2 - Broken
36+
<li>OWASP - <a href="https://github.com/OWASP/Top10/blob/master/2017/en/0xa2-broken-authentication.md">Top 10 2017 Category A2 - Broken
3437
Authentication</a></li>
3538
<li>CWE - <a href="https://cwe.mitre.org/data/definitions/798">CWE-798 - Use of Hard-coded Credentials</a></li>
3639
<li>CWE - <a href="https://cwe.mitre.org/data/definitions/259">CWE-259 - Use of Hard-coded Password</a></li>

‎sonar-java-plugin/src/main/resources/org/sonar/l10n/java/rules/java/S2077.html‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -75,7 +75,7 @@ <h3>Articles &amp; blog posts</h3>
7575
<h3>Standards</h3>
7676
<ul>
7777
<li>OWASP - <a href="https://owasp.org/Top10/A03_2021-Injection/">Top 10 2021 Category A3 - Injection</a></li>
78-
<li>OWASP - <a href="https://owasp.org/www-project-top-ten/2017/A1_2017-Injection">Top 10 2017 Category A1 - Injection</a></li>
78+
<li>OWASP - <a href="https://github.com/OWASP/Top10/blob/master/2017/en/0xa1-injection.md">Top 10 2017 Category A1 - Injection</a></li>
7979
<li>CWE - <a href="https://cwe.mitre.org/data/definitions/89">CWE-89 - Improper Neutralization of Special Elements used in an SQL Command</a></li>
8080
<li>CWE - <a href="https://cwe.mitre.org/data/definitions/943">CWE-943 - Improper Neutralization of Special Elements in Data Query Logic</a></li>
8181
<li><a

‎sonar-java-plugin/src/main/resources/org/sonar/l10n/java/rules/java/S2092.html‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -37,7 +37,7 @@ <h3>Standards</h3>
3737
<ul>
3838
<li>OWASP - <a href="https://owasp.org/Top10/A04_2021-Insecure_Design/">Top 10 2021 Category A4 - Insecure Design</a></li>
3939
<li>OWASP - <a href="https://owasp.org/Top10/A05_2021-Security_Misconfiguration/">Top 10 2021 Category A5 - Security Misconfiguration</a></li>
40-
<li>OWASP - <a href="https://owasp.org/www-project-top-ten/2017/A3_2017-Sensitive_Data_Exposure">Top 10 2017 Category A3 - Sensitive Data
40+
<li>OWASP - <a href="https://github.com/OWASP/Top10/blob/master/2017/en/0xa3-sensitive-data-disclosure.md">Top 10 2017 Category A3 - Sensitive Data
4141
Exposure</a></li>
4242
<li>CWE - <a href="https://cwe.mitre.org/data/definitions/311">CWE-311 - Missing Encryption of Sensitive Data</a></li>
4343
<li>CWE - <a href="https://cwe.mitre.org/data/definitions/315">CWE-315 - Cleartext Storage of Sensitive Information in a Cookie</a></li>

‎sonar-java-plugin/src/main/resources/org/sonar/l10n/java/rules/java/S2115.html‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -62,9 +62,9 @@ <h3>Standards</h3>
6262
<ul>
6363
<li>OWASP - <a href="https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures/">Top 10 2021 Category A7 - Identification and
6464
Authentication Failures</a></li>
65-
<li>OWASP - <a href="https://owasp.org/www-project-top-ten/2017/A2_2017-Broken_Authentication">Top 10 2017 Category A2 - Broken
65+
<li>OWASP - <a href="https://github.com/OWASP/Top10/blob/master/2017/en/0xa2-broken-authentication.md">Top 10 2017 Category A2 - Broken
6666
Authentication</a></li>
67-
<li>OWASP - <a href="https://owasp.org/www-project-top-ten/2017/A3_2017-Sensitive_Data_Exposure">Top 10 2017 Category A3 - Sensitive Data
67+
<li>OWASP - <a href="https://github.com/OWASP/Top10/blob/master/2017/en/0xa3-sensitive-data-disclosure.md">Top 10 2017 Category A3 - Sensitive Data
6868
Exposure</a></li>
6969
<li>CWE - <a href="https://cwe.mitre.org/data/definitions/521">CWE-521 - Weak Password Requirements</a></li>
7070
</ul>

‎sonar-java-plugin/src/main/resources/org/sonar/l10n/java/rules/java/S2119.html‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -37,7 +37,7 @@ <h3>Documentation</h3>
3737
</ul>
3838
<h3>Articles &amp; blog posts</h3>
3939
<ul>
40-
<li>OWASP - <a href="https://owasp.org/www-project-top-ten/2017/A6_2017-Security_Misconfiguration">Top 10 2017 Category A6 - Security
40+
<li>OWASP - <a href="https://github.com/OWASP/Top10/blob/master/2017/en/0xa6-security-misconfiguration.md">Top 10 2017 Category A6 - Security
4141
Misconfiguration</a></li>
4242
<li><a href="https://www.baeldung.com/java-generating-random-numbers">Baeldung - generating random number</a></li>
4343
</ul>

0 commit comments

Comments
 (0)