ishangsf/rspec
2
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Modify CWE and OWASP Top 10 links to follow standard link format (APPSEC-1134) (#3529)

Browse Source 
* Fix all CWE references

* Fix all OWASP references

* Fix missing CWE prefixes
This commit is contained in:
Egon Okerman 2024-01-15 17:15:56 +01:00 committed by GitHub
parent 1aafc90f68
commit d1417e82f8
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
503 changed files with 1329 additions and 1328 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
rules/S1041/plsql/rule.adoc
View File

@ -46,7 +46,7 @@ END;
== Resources == Resources
* https://cwe.mitre.org/data/definitions/391[MITRE, CWE-391] - Unchecked Error Condition * CWE - https://cwe.mitre.org/data/definitions/391[CWE-391 - Unchecked Error Condition]
ifdef::env-github,rspecator-view[] ifdef::env-github,rspecator-view[]

2
rules/S1049/cfamily/rule.adoc
View File

@ -44,7 +44,7 @@ void goo ( ) throw ( Exception, int )
== Resources == Resources
* MISRA {cpp}:2008, 15-5-2 * MISRA {cpp}:2008, 15-5-2
* https://cwe.mitre.org/data/definitions/391[MITRE, CWE-391] - Unchecked Error Condition * CWE - https://cwe.mitre.org/data/definitions/391[CWE-391 - Unchecked Error Condition]
* https://www.securecoding.cert.org/confluence/x/EADTAQ[CERT, ERR55-CPP.] - Honor exception specifications * https://www.securecoding.cert.org/confluence/x/EADTAQ[CERT, ERR55-CPP.] - Honor exception specifications

2
rules/S1053/cfamily/rule.adoc
View File

@ -38,7 +38,7 @@ void fn ( std::string str )
== Resources == Resources
* MISRA {cpp}:2008, 18-0-5 * MISRA {cpp}:2008, 18-0-5
* https://cwe.mitre.org/data/definitions/120[MITRE, CWE-120] - Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') * CWE - https://cwe.mitre.org/data/definitions/120[CWE-120 - Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')]
ifdef::env-github,rspecator-view[] ifdef::env-github,rspecator-view[]

6
rules/S1057/plsql/rule.adoc
View File

@ -27,9 +27,9 @@ END;
== Resources == Resources
* https://owasp.org/Top10/A04_2021-Insecure_Design/[OWASP Top 10 2021 Category A4] - Insecure Design * OWASP - https://owasp.org/Top10/A04_2021-Insecure_Design/[Top 10 2021 Category A4 - Insecure Design]
* https://cwe.mitre.org/data/definitions/269[MITRE, CWE-269] - Improper Privilege Management * CWE - https://cwe.mitre.org/data/definitions/269[CWE-269 - Improper Privilege Management]
* https://cwe.mitre.org/data/definitions/270[MITRE, CWE-270] - Privilege Context Switching Error * CWE - https://cwe.mitre.org/data/definitions/270[CWE-270 - Privilege Context Switching Error]
ifdef::env-github,rspecator-view[] ifdef::env-github,rspecator-view[]

4
rules/S106/cfamily/rule.adoc
View File

@ -32,8 +32,8 @@ void doSomething()
== Resources == Resources
* https://owasp.org/Top10/A09_2021-Security_Logging_and_Monitoring_Failures/[OWASP Top 10 2021 Category A9] - Security Logging and Monitoring Failures * OWASP - https://owasp.org/Top10/A09_2021-Security_Logging_and_Monitoring_Failures/[Top 10 2021 Category A9 - Security Logging and Monitoring Failures]
* https://www.owasp.org/www-project-top-ten/2017/A3_2017-Sensitive_Data_Exposure[OWASP Top 10 2017 Category A3] - Sensitive Data Exposure * OWASP - https://owasp.org/www-project-top-ten/2017/A3_2017-Sensitive_Data_Exposure[Top 10 2017 Category A3 - Sensitive Data Exposure]
ifdef::env-github,rspecator-view[] ifdef::env-github,rspecator-view[]

2
rules/S106/csharp/rule.adoc
View File

@ -52,7 +52,7 @@ public class MyClass
== Resources == Resources
* https://owasp.org/Top10/A09_2021-Security_Logging_and_Monitoring_Failures/[OWASP Top 10 2021 Category A9] - Security Logging and Monitoring Failures * OWASP - https://owasp.org/Top10/A09_2021-Security_Logging_and_Monitoring_Failures/[Top 10 2021 Category A9 - Security Logging and Monitoring Failures]
ifdef::env-github,rspecator-view[] ifdef::env-github,rspecator-view[]

4
rules/S106/java/rule.adoc
View File

@ -40,8 +40,8 @@ class MyClass {
=== Documentation === Documentation
* https://docs.oracle.com/javase/7/docs/api/java/util/logging/Logger.html[Java SE 7 API Specification: java.util.logging.Logger] * https://docs.oracle.com/javase/7/docs/api/java/util/logging/Logger.html[Java SE 7 API Specification: java.util.logging.Logger]
* https://owasp.org/Top10/A09_2021-Security_Logging_and_Monitoring_Failures/[OWASP Top 10 2021 Category A9] - Security Logging and Monitoring Failures * OWASP - https://owasp.org/Top10/A09_2021-Security_Logging_and_Monitoring_Failures/[Top 10 2021 Category A9 - Security Logging and Monitoring Failures]
* https://www.owasp.org/www-project-top-ten/2017/A3_2017-Sensitive_Data_Exposure[OWASP Top 10 2017 Category A3] - Sensitive Data Exposure * OWASP - https://owasp.org/www-project-top-ten/2017/A3_2017-Sensitive_Data_Exposure[Top 10 2017 Category A3 - Sensitive Data Exposure]
* https://wiki.sei.cmu.edu/confluence/x/nzdGBQ[CERT, ERR02-J.] - Prevent exceptions while logging data * https://wiki.sei.cmu.edu/confluence/x/nzdGBQ[CERT, ERR02-J.] - Prevent exceptions while logging data
ifdef::env-github,rspecator-view[] ifdef::env-github,rspecator-view[]

4
rules/S106/javascript/rule.adoc
View File

@ -39,8 +39,8 @@ function doSomething() {
== Resources == Resources
* https://owasp.org/Top10/A09_2021-Security_Logging_and_Monitoring_Failures/[OWASP Top 10 2021 Category A9] - Security Logging and Monitoring Failures * OWASP - https://owasp.org/Top10/A09_2021-Security_Logging_and_Monitoring_Failures/[Top 10 2021 Category A9 - Security Logging and Monitoring Failures]
* https://www.owasp.org/www-project-top-ten/2017/A3_2017-Sensitive_Data_Exposure[OWASP Top 10 2017 Category A3] - Sensitive Data Exposure * OWASP - https://owasp.org/www-project-top-ten/2017/A3_2017-Sensitive_Data_Exposure[Top 10 2017 Category A3 - Sensitive Data Exposure]
ifdef::env-github,rspecator-view[] ifdef::env-github,rspecator-view[]

4
rules/S1079/cfamily/rule.adoc
View File

@ -48,8 +48,8 @@ If this code is given the word ``noncompliant`` as an input, ``noncompli␀`` wi
=== Standards === Standards
* OWASP - https://owasp.org/www-project-top-ten/2017/A9_2017-Using_Components_with_Known_Vulnerabilities[Top 10 2017 Category A9 - Using Components with Known Vulnerabilities] * OWASP - https://owasp.org/www-project-top-ten/2017/A9_2017-Using_Components_with_Known_Vulnerabilities[Top 10 2017 Category A9 - Using Components with Known Vulnerabilities]
* MITRE - https://cwe.mitre.org/data/definitions/120[CWE-120 - Buffer Copy without Checking Size of Input] ('Classic Buffer Overflow') * CWE - https://cwe.mitre.org/data/definitions/120[CWE-120 - Buffer Copy without Checking Size of Input] ('Classic Buffer Overflow')
* MITRE - https://cwe.mitre.org/data/definitions/676[CWE-676 - Use of Potentially Dangerous Function] * CWE - https://cwe.mitre.org/data/definitions/676[CWE-676 - Use of Potentially Dangerous Function]
ifdef::env-github,rspecator-view[] ifdef::env-github,rspecator-view[]

2
rules/S1104/see.adoc
View File

@ -1,3 +1,3 @@
== Resources == Resources
* https://cwe.mitre.org/data/definitions/493[MITRE, CWE-493] - Critical Public Variable Without Final Modifier * CWE - https://cwe.mitre.org/data/definitions/493[CWE-493 - Critical Public Variable Without Final Modifier]

2
rules/S1111/java/rule.adoc
View File

@ -26,7 +26,7 @@ public void dispose() throws Throwable {
== Resources == Resources
* https://docs.oracle.com/javase/specs/jls/se17/html/jls-12.html#jls-12.6[docs.oracle.com] - Finalization of Class Instances * https://docs.oracle.com/javase/specs/jls/se17/html/jls-12.html#jls-12.6[docs.oracle.com] - Finalization of Class Instances
* https://cwe.mitre.org/data/definitions/586[MITRE, CWE-586] - Explicit Call to Finalize() * CWE - https://cwe.mitre.org/data/definitions/586[CWE-586 - Explicit Call to Finalize()]
* https://wiki.sei.cmu.edu/confluence/x/4jZGBQ[CERT, MET12-J.] - Do not use finalizers * https://wiki.sei.cmu.edu/confluence/x/4jZGBQ[CERT, MET12-J.] - Do not use finalizers

2
rules/S1114/java/rule.adoc
View File

@ -33,7 +33,7 @@ protected void finalize() {
== Resources == Resources
* https://cwe.mitre.org/data/definitions/568[MITRE, CWE-568] - finalize() Method Without super.finalize() * CWE - https://cwe.mitre.org/data/definitions/568[CWE-568 - finalize() Method Without super.finalize()]
* https://wiki.sei.cmu.edu/confluence/x/4jZGBQ[CERT, MET12-J.] - Do not use finalizers * https://wiki.sei.cmu.edu/confluence/x/4jZGBQ[CERT, MET12-J.] - Do not use finalizers

2
rules/S112/cfamily/rule.adoc
View File

@ -99,7 +99,7 @@ void checkState(S state) {
=== Standards === Standards
* CWE - https://cwe.mitre.org/data/definitions/397[397 Declaration of Throws for Generic Exception] * CWE - https://cwe.mitre.org/data/definitions/397[CWE-397 Declaration of Throws for Generic Exception]
=== External coding guidelines === External coding guidelines

2
rules/S112/java/rule.adoc
View File

@ -67,7 +67,7 @@ void checkValue(int value) {
=== Standards === Standards
* CWE - https://cwe.mitre.org/data/definitions/397[397 Declaration of Throws for Generic Exception] * CWE - https://cwe.mitre.org/data/definitions/397[CWE-397 Declaration of Throws for Generic Exception]
* CERT - https://wiki.sei.cmu.edu/confluence/x/_DdGBQ[ERR07-J. Do not throw RuntimeException, Exception, or Throwable] * CERT - https://wiki.sei.cmu.edu/confluence/x/_DdGBQ[ERR07-J. Do not throw RuntimeException, Exception, or Throwable]
=== Related rules === Related rules

2
rules/S112/see.adoc
View File

@ -2,4 +2,4 @@
=== Standards === Standards
* CWE - https://cwe.mitre.org/data/definitions/397[397 Declaration of Throws for Generic Exception] * CWE - https://cwe.mitre.org/data/definitions/397[CWE-397 Declaration of Throws for Generic Exception]

2
rules/S1121/cfamily/rule.adoc
View File

@ -35,7 +35,7 @@ while ((run = keepRunning())) {
=== Documentation === Documentation
* CWE - https://cwe.mitre.org/data/definitions/481[481: Assigning instead of Comparing] * CWE - https://cwe.mitre.org/data/definitions/481[CWE-481: Assigning instead of Comparing]
=== Standards === Standards

2
rules/S1121/see.adoc
View File

@ -1,3 +1,3 @@
== Resources == Resources
* https://cwe.mitre.org/data/definitions/481[MITRE, CWE-481] - Assigning instead of Comparing * CWE - https://cwe.mitre.org/data/definitions/481[CWE-481 - Assigning instead of Comparing]

2
rules/S1127/rule.adoc
View File

@ -25,7 +25,7 @@ if (!"foo".equals(variable)) { /* ... */ }
== Resources == Resources
* https://cwe.mitre.org/data/definitions/597[MITRE, CWE-597] - Use of Wrong Operator in String Comparison * CWE - https://cwe.mitre.org/data/definitions/597[CWE-597 - Use of Wrong Operator in String Comparison]
ifdef::env-github,rspecator-view[] ifdef::env-github,rspecator-view[]

2
rules/S1134/resources.adoc
View File

@ -2,4 +2,4 @@
=== Documentation === Documentation
* https://cwe.mitre.org/data/definitions/546[MITRE, CWE-546 - Suspicious Comment] * CWE - https://cwe.mitre.org/data/definitions/546[CWE-546 - Suspicious Comment]

2
rules/S1135/see.adoc
View File

@ -1,3 +1,3 @@
== Resources == Resources
* https://cwe.mitre.org/data/definitions/546[MITRE, CWE-546] - Suspicious Comment * CWE - https://cwe.mitre.org/data/definitions/546[CWE-546 - Suspicious Comment]

2
rules/S1143/cfamily/rule.adoc
View File

@ -41,7 +41,7 @@ void fun() {
== Resources == Resources
* https://cwe.mitre.org/data/definitions/584[MITRE, CWE-584] - Return Inside Finally Block * CWE - https://cwe.mitre.org/data/definitions/584[CWE-584 - Return Inside Finally Block]
ifdef::env-github,rspecator-view[] ifdef::env-github,rspecator-view[]

2
rules/S1143/java/rule.adoc
View File

@ -69,7 +69,7 @@ public static void doSomethingWhichThrowsException() {
== Resources == Resources
* https://cwe.mitre.org/data/definitions/584[MITRE, CWE-584] - Return Inside Finally Block * CWE - https://cwe.mitre.org/data/definitions/584[CWE-584 - Return Inside Finally Block]
* https://wiki.sei.cmu.edu/confluence/x/BTdGBQ[CERT, ERR04-J.] - Do not complete abruptly from a finally block * https://wiki.sei.cmu.edu/confluence/x/BTdGBQ[CERT, ERR04-J.] - Do not complete abruptly from a finally block
ifdef::env-github,rspecator-view[] ifdef::env-github,rspecator-view[]

6
rules/S1145/see.adoc
View File

@ -1,5 +1,5 @@
== Resources == Resources
* https://cwe.mitre.org/data/definitions/489[MITRE, CWE-489] - Active Debug Code * CWE - https://cwe.mitre.org/data/definitions/489[CWE-489 - Active Debug Code]
* https://cwe.mitre.org/data/definitions/570[MITRE, CWE-570] - Expression is Always False * CWE - https://cwe.mitre.org/data/definitions/570[CWE-570 - Expression is Always False]
* https://cwe.mitre.org/data/definitions/571[MITRE, CWE-571] - Expression is Always True * CWE - https://cwe.mitre.org/data/definitions/571[CWE-571 - Expression is Always True]

2
rules/S1147/java/rule.adoc
View File

@ -20,7 +20,7 @@ These methods are ignored inside ``++main++``.
== Resources == Resources
* https://cwe.mitre.org/data/definitions/382[MITRE, CWE-382] - Use of System.exit() * CWE - https://cwe.mitre.org/data/definitions/382[CWE-382 - Use of System.exit()]
* https://wiki.sei.cmu.edu/confluence/x/7zZGBQ[CERT, ERR09-J.] - Do not allow untrusted code to terminate the JVM * https://wiki.sei.cmu.edu/confluence/x/7zZGBQ[CERT, ERR09-J.] - Do not allow untrusted code to terminate the JVM
ifdef::env-github,rspecator-view[] ifdef::env-github,rspecator-view[]

4
rules/S1148/java/rule.adoc
View File

@ -37,8 +37,8 @@ try {
== Resources == Resources
* https://www.owasp.org/www-project-top-ten/2017/A3_2017-Sensitive_Data_Exposure[OWASP Top 10 2017 Category A3] - Sensitive Data Exposure * OWASP - https://owasp.org/www-project-top-ten/2017/A3_2017-Sensitive_Data_Exposure[Top 10 2017 Category A3 - Sensitive Data Exposure]
* https://cwe.mitre.org/data/definitions/489[MITRE, CWE-489] - Active Debug Code * CWE - https://cwe.mitre.org/data/definitions/489[CWE-489 - Active Debug Code]
ifdef::env-github,rspecator-view[] ifdef::env-github,rspecator-view[]

6
rules/S1166/java/rule.adoc
View File

@ -10,10 +10,10 @@ include::../exceptions.adoc[]
== Resources == Resources
* https://owasp.org/Top10/A09_2021-Security_Logging_and_Monitoring_Failures/[OWASP Top 10 2021 Category A9] - Security Logging and Monitoring Failures * OWASP - https://owasp.org/Top10/A09_2021-Security_Logging_and_Monitoring_Failures/[Top 10 2021 Category A9 - Security Logging and Monitoring Failures]
* https://owasp.org/www-project-top-ten/2017/A10_2017-Insufficient_Logging%2526Monitoring[OWASP Top 10 2017 Category A10] - Insufficient Logging & Monitoring * OWASP - https://owasp.org/www-project-top-ten/2017/A10_2017-Insufficient_Logging%2526Monitoring[Top 10 2017 Category A10 - Insufficient Logging & Monitoring]
* https://wiki.sei.cmu.edu/confluence/x/xDdGBQ[CERT, ERR00-J.] - Do not suppress or ignore checked exceptions * https://wiki.sei.cmu.edu/confluence/x/xDdGBQ[CERT, ERR00-J.] - Do not suppress or ignore checked exceptions
* https://cwe.mitre.org/data/definitions/778[MITRE, CWE-778] - Insufficient Logging * CWE - https://cwe.mitre.org/data/definitions/778[CWE-778 - Insufficient Logging]
ifdef::env-github,rspecator-view[] ifdef::env-github,rspecator-view[]

6
rules/S1166/see.adoc
View File

@ -1,5 +1,5 @@
== Resources == Resources
* https://owasp.org/Top10/A09_2021-Security_Logging_and_Monitoring_Failures/[OWASP Top 10 2021 Category A9] - Security Logging and Monitoring Failures * OWASP - https://owasp.org/Top10/A09_2021-Security_Logging_and_Monitoring_Failures/[Top 10 2021 Category A9 - Security Logging and Monitoring Failures]
* https://owasp.org/www-project-top-ten/2017/A10_2017-Insufficient_Logging%2526Monitoring[OWASP Top 10 2017 Category A10] - Insufficient Logging & Monitoring * OWASP - https://owasp.org/www-project-top-ten/2017/A10_2017-Insufficient_Logging%2526Monitoring[Top 10 2017 Category A10 - Insufficient Logging & Monitoring]
* https://cwe.mitre.org/data/definitions/778[MITRE, CWE-778] - Insufficient Logging * CWE - https://cwe.mitre.org/data/definitions/778[CWE-778 - Insufficient Logging]

2
rules/S1169/plsql/rule.adoc
View File

@ -54,7 +54,7 @@ END;
== Resources == Resources
* https://cwe.mitre.org/data/definitions/391[MITRE, CWE-391] - Unchecked Error Condition * CWE - https://cwe.mitre.org/data/definitions/391[CWE-391 - Unchecked Error Condition]
ifdef::env-github,rspecator-view[] ifdef::env-github,rspecator-view[]

2
rules/S1174/java/rule.adoc
View File

@ -21,7 +21,7 @@ public class MyClass {
== Resources == Resources
* https://cwe.mitre.org/data/definitions/583[MITRE, CWE-583] - finalize() Method Declared Public * CWE - https://cwe.mitre.org/data/definitions/583[CWE-583 - finalize() Method Declared Public]
* https://wiki.sei.cmu.edu/confluence/x/4jZGBQ[CERT, MET12-J.] - Do not use finalizers * https://wiki.sei.cmu.edu/confluence/x/4jZGBQ[CERT, MET12-J.] - Do not use finalizers

2
rules/S1181/cfamily/rule.adoc
View File

@ -40,7 +40,7 @@ Additionally, if the ``++catch++`` handler is throwing an exception (either the
== Resources == Resources
* https://cwe.mitre.org/data/definitions/396[MITRE, CWE-396] - Declaration of Catch for Generic Exception * CWE - https://cwe.mitre.org/data/definitions/396[CWE-396 - Declaration of Catch for Generic Exception]
* {cpp} Core Guidelines - https://github.com/isocpp/CppCoreGuidelines/blob/e49158a/CppCoreGuidelines.md#e14-use-purpose-designed-user-defined-types-as-exceptions-not-built-in-types[E.14: Use purpose-designed user-defined types as exceptions (not built-in types)] * {cpp} Core Guidelines - https://github.com/isocpp/CppCoreGuidelines/blob/e49158a/CppCoreGuidelines.md#e14-use-purpose-designed-user-defined-types-as-exceptions-not-built-in-types[E.14: Use purpose-designed user-defined types as exceptions (not built-in types)]

2
rules/S1181/java/rule.adoc
View File

@ -26,7 +26,7 @@ try { /* ... */ } catch (MyException e) { /* ... */ }
== Resources == Resources
* https://cwe.mitre.org/data/definitions/396[MITRE, CWE-396] - Declaration of Catch for Generic Exception * CWE - https://cwe.mitre.org/data/definitions/396[CWE-396 - Declaration of Catch for Generic Exception]
* https://wiki.sei.cmu.edu/confluence/display/java/ERR08-J.+Do+not+catch+NullPointerException+or+any+of+its+ancestors[CERT, ERR08-J.] - Do not catch NullPointerException or any of its ancestors * https://wiki.sei.cmu.edu/confluence/display/java/ERR08-J.+Do+not+catch+NullPointerException+or+any+of+its+ancestors[CERT, ERR08-J.] - Do not catch NullPointerException or any of its ancestors

2
rules/S1182/java/rule.adoc
View File

@ -80,7 +80,7 @@ class Application {
== Resources == Resources
* https://cwe.mitre.org/data/definitions/580[MITRE, CWE-580] - clone() Method Without super.clone() * CWE - https://cwe.mitre.org/data/definitions/580[CWE-580 - clone() Method Without super.clone()]
* https://wiki.sei.cmu.edu/confluence/x/FjZGBQ[CERT, MET53-J.] - Ensure that the clone() method calls super.clone() * https://wiki.sei.cmu.edu/confluence/x/FjZGBQ[CERT, MET53-J.] - Ensure that the clone() method calls super.clone()

2
rules/S1206/csharp/rule.adoc
View File

@ -45,7 +45,7 @@ class MyClass
=== Documentation === Documentation
* https://cwe.mitre.org/data/definitions/581[MITRE, CWE-581] - Object Model Violation: Just One of Equals and Hashcode Defined * CWE - https://cwe.mitre.org/data/definitions/581[CWE-581 - Object Model Violation: Just One of Equals and Hashcode Defined]
* https://learn.microsoft.com/en-us/dotnet/api/system.object.equals[Object.Equals Method] * https://learn.microsoft.com/en-us/dotnet/api/system.object.equals[Object.Equals Method]
* https://learn.microsoft.com/en-us/dotnet/api/system.object.gethashcode[Object.GetHashCode Method] * https://learn.microsoft.com/en-us/dotnet/api/system.object.gethashcode[Object.GetHashCode Method]
* https://learn.microsoft.com/en-us/dotnet/api/system.collections.hashtable[Hashtable class] * https://learn.microsoft.com/en-us/dotnet/api/system.collections.hashtable[Hashtable class]

2
rules/S1206/java/rule.adoc
View File

@ -54,7 +54,7 @@ class MyClass { // Compliant
== Resources == Resources
* https://cwe.mitre.org/data/definitions/581[MITRE, CWE-581] - Object Model Violation: Just One of Equals and Hashcode Defined * CWE - https://cwe.mitre.org/data/definitions/581[CWE-581 - Object Model Violation: Just One of Equals and Hashcode Defined]
* https://wiki.sei.cmu.edu/confluence/x/7DVGBQ[CERT, MET09-J.] - Classes that define an equals() method must also define a hashCode() method * https://wiki.sei.cmu.edu/confluence/x/7DVGBQ[CERT, MET09-J.] - Classes that define an equals() method must also define a hashCode() method
ifdef::env-github,rspecator-view[] ifdef::env-github,rspecator-view[]

4
rules/S1279/cobol/rule.adoc
View File

@ -13,8 +13,8 @@ DISPLAY "hello world" *> Noncompliant
== Resources == Resources
* https://www.owasp.org/www-project-top-ten/2017/A3_2017-Sensitive_Data_Exposure[OWASP Top 10 2017 Category A3] - Sensitive Data Exposure * OWASP - https://owasp.org/www-project-top-ten/2017/A3_2017-Sensitive_Data_Exposure[Top 10 2017 Category A3 - Sensitive Data Exposure]
* https://cwe.mitre.org/data/definitions/489[MITRE, CWE-489] - Active Debug Code * CWE - https://cwe.mitre.org/data/definitions/489[CWE-489 - Active Debug Code]
ifdef::env-github,rspecator-view[] ifdef::env-github,rspecator-view[]

2
rules/S128/cfamily/rule.adoc
View File

@ -54,7 +54,7 @@ switch (myVariable) {
* MISRA {cpp}:2008, 6-4-5 - An unconditional throw or break statement shall terminate every non-empty switch-clause * MISRA {cpp}:2008, 6-4-5 - An unconditional throw or break statement shall terminate every non-empty switch-clause
* MISRA C:2012, 16.1 - All switch statements shall be well-formed * MISRA C:2012, 16.1 - All switch statements shall be well-formed
* MISRA C:2012, 16.3 - An unconditional break statement shall terminate every switch-clause * MISRA C:2012, 16.3 - An unconditional break statement shall terminate every switch-clause
* https://cwe.mitre.org/data/definitions/484[MITRE, CWE-484] - Omitted Break Statement in Switch * CWE - https://cwe.mitre.org/data/definitions/484[CWE-484 - Omitted Break Statement in Switch]
* https://wiki.sei.cmu.edu/confluence/x/ldYxBQ[CERT, MSC17-C.] - Finish every set of statements associated with a case label with a break statement * https://wiki.sei.cmu.edu/confluence/x/ldYxBQ[CERT, MSC17-C.] - Finish every set of statements associated with a case label with a break statement
ifdef::env-github,rspecator-view[] ifdef::env-github,rspecator-view[]

2
rules/S128/java/rule.adoc
View File

@ -32,7 +32,7 @@ switch (myVariable) {
== Resources == Resources
* https://cwe.mitre.org/data/definitions/484[MITRE, CWE-484] - Omitted Break Statement in Switch * CWE - https://cwe.mitre.org/data/definitions/484[CWE-484 - Omitted Break Statement in Switch]
* https://wiki.sei.cmu.edu/confluence/x/ldYxBQ[CERT, MSC17-C.] - Finish every set of statements associated with a case label with a break statement * https://wiki.sei.cmu.edu/confluence/x/ldYxBQ[CERT, MSC17-C.] - Finish every set of statements associated with a case label with a break statement
* https://wiki.sei.cmu.edu/confluence/x/1DdGBQ[CERT, MSC52-J.] - Finish every set of statements associated with a case label with a break statement * https://wiki.sei.cmu.edu/confluence/x/1DdGBQ[CERT, MSC52-J.] - Finish every set of statements associated with a case label with a break statement

2
rules/S128/see.adoc
View File

@ -1,3 +1,3 @@
== Resources == Resources
* https://cwe.mitre.org/data/definitions/484[MITRE, CWE-484] - Omitted Break Statement in Switch * CWE - https://cwe.mitre.org/data/definitions/484[CWE-484 - Omitted Break Statement in Switch]

2
rules/S131/cfamily/rule.adoc
View File

@ -47,7 +47,7 @@ switch (param) {
* MISRA C:2012, 16.1 - All switch statements shall be well-formed * MISRA C:2012, 16.1 - All switch statements shall be well-formed
* MISRA C:2012, 16.4 - Every _switch_ statement shall have a _default_ label * MISRA C:2012, 16.4 - Every _switch_ statement shall have a _default_ label
* MISRA C:2012, 16.5 - A _default_ label shall appear as either the first or the last _switch label_ of a _switch_ statement * MISRA C:2012, 16.5 - A _default_ label shall appear as either the first or the last _switch label_ of a _switch_ statement
* https://cwe.mitre.org/data/definitions/478[MITRE, CWE-478] - Missing Default Case in Switch Statement * CWE - https://cwe.mitre.org/data/definitions/478[CWE-478 - Missing Default Case in Switch Statement]
* https://wiki.sei.cmu.edu/confluence/x/RtYxBQ[CERT, MSC01-C.] - Strive for logical completeness * https://wiki.sei.cmu.edu/confluence/x/RtYxBQ[CERT, MSC01-C.] - Strive for logical completeness
=== Related rules === Related rules

2
rules/S131/java/rule.adoc
View File

@ -70,7 +70,7 @@ switch(day) {
== Resources == Resources
* https://cwe.mitre.org/data/definitions/478[MITRE, CWE-478] - Missing Default Case in Switch Statement * CWE - https://cwe.mitre.org/data/definitions/478[CWE-478 - Missing Default Case in Switch Statement]
* https://wiki.sei.cmu.edu/confluence/x/RtYxBQ[CERT, MSC01-C.] - Strive for logical completeness * https://wiki.sei.cmu.edu/confluence/x/RtYxBQ[CERT, MSC01-C.] - Strive for logical completeness
ifdef::env-github,rspecator-view[] ifdef::env-github,rspecator-view[]

2
rules/S131/see.adoc
View File

@ -1,3 +1,3 @@
== Resources == Resources
* https://cwe.mitre.org/data/definitions/478[MITRE, CWE-478] - Missing Default Case in Switch Statement * CWE - https://cwe.mitre.org/data/definitions/478[CWE-478 - Missing Default Case in Switch Statement]

4
rules/S1313/cfamily/rule.adoc
View File

@ -35,8 +35,8 @@ No issue is reported for the following cases because they are not considered sen
== See == See
* https://owasp.org/Top10/A01_2021-Broken_Access_Control/[OWASP Top 10 2021 Category A1] - Broken Access Control * OWASP - https://owasp.org/Top10/A01_2021-Broken_Access_Control/[Top 10 2021 Category A1 - Broken Access Control]
* https://www.owasp.org/www-project-top-ten/2017/A3_2017-Sensitive_Data_Exposure[OWASP Top 10 2017 Category A3] - Sensitive Data Exposure * OWASP - https://owasp.org/www-project-top-ten/2017/A3_2017-Sensitive_Data_Exposure[Top 10 2017 Category A3 - Sensitive Data Exposure]
ifdef::env-github,rspecator-view[] ifdef::env-github,rspecator-view[]

4
rules/S1313/java/rule.adoc
View File

@ -32,8 +32,8 @@ No issue is reported for the following cases because they are not considered sen
== See == See
* https://owasp.org/Top10/A01_2021-Broken_Access_Control/[OWASP Top 10 2021 Category A1] - Broken Access Control * OWASP - https://owasp.org/Top10/A01_2021-Broken_Access_Control/[Top 10 2021 Category A1 - Broken Access Control]
* https://www.owasp.org/www-project-top-ten/2017/A3_2017-Sensitive_Data_Exposure[OWASP Top 10 2017 Category A3] - Sensitive Data Exposure * OWASP - https://owasp.org/www-project-top-ten/2017/A3_2017-Sensitive_Data_Exposure[Top 10 2017 Category A3 - Sensitive Data Exposure]
* https://wiki.sei.cmu.edu/confluence/x/OjdGBQ[CERT, MSC03-J.] - Never hard code sensitive information * https://wiki.sei.cmu.edu/confluence/x/OjdGBQ[CERT, MSC03-J.] - Never hard code sensitive information
ifdef::env-github,rspecator-view[] ifdef::env-github,rspecator-view[]

4
rules/S1313/see.adoc
View File

@ -1,4 +1,4 @@
== See == See
* https://owasp.org/Top10/A01_2021-Broken_Access_Control/[OWASP Top 10 2021 Category A1] - Broken Access Control * OWASP - https://owasp.org/Top10/A01_2021-Broken_Access_Control/[Top 10 2021 Category A1 - Broken Access Control]
* https://www.owasp.org/www-project-top-ten/2017/A3_2017-Sensitive_Data_Exposure[OWASP Top 10 2017 Category A3] - Sensitive Data Exposure * OWASP - https://owasp.org/www-project-top-ten/2017/A3_2017-Sensitive_Data_Exposure[Top 10 2017 Category A3 - Sensitive Data Exposure]

4
rules/S1442/see.adoc
View File

@ -1,4 +1,4 @@
== Resources == Resources
* https://www.owasp.org/www-project-top-ten/2017/A3_2017-Sensitive_Data_Exposure[OWASP Top 10 2017 Category A3] - Sensitive Data Exposure * OWASP - https://owasp.org/www-project-top-ten/2017/A3_2017-Sensitive_Data_Exposure[Top 10 2017 Category A3 - Sensitive Data Exposure]
* https://cwe.mitre.org/data/definitions/489[MITRE, CWE-489] - Active Debug Code * CWE - https://cwe.mitre.org/data/definitions/489[CWE-489 - Active Debug Code]

2
rules/S1444/flex/rule.adoc
View File

@ -25,7 +25,7 @@ public class Greeter {
== Resources == Resources
* https://cwe.mitre.org/data/definitions/500[MITRE, CWE-500] - Public Static Field Not Marked Final * CWE - https://cwe.mitre.org/data/definitions/500[CWE-500 - Public Static Field Not Marked Final]
ifdef::env-github,rspecator-view[] ifdef::env-github,rspecator-view[]

2
rules/S1444/java/rule.adoc
View File

@ -24,7 +24,7 @@ public class Greeter {
== Resources == Resources
* https://cwe.mitre.org/data/definitions/500[MITRE, CWE-500] - Public Static Field Not Marked Final * CWE - https://cwe.mitre.org/data/definitions/500[CWE-500 - Public Static Field Not Marked Final]
* https://wiki.sei.cmu.edu/confluence/x/WjdGBQ[CERT OBJ10-J.] - Do not use public static nonfinal fields * https://wiki.sei.cmu.edu/confluence/x/WjdGBQ[CERT OBJ10-J.] - Do not use public static nonfinal fields
ifdef::env-github,rspecator-view[] ifdef::env-github,rspecator-view[]

2
rules/S1480/plsql/rule.adoc
View File

@ -5,4 +5,4 @@ TODO
== Resources == Resources
* https://cwe.mitre.org/data/definitions/459[MITRE, CWE-459] - Incomplete Cleanup * CWE - https://cwe.mitre.org/data/definitions/459[CWE-459 - Incomplete Cleanup]

4
rules/S1486/abap/rule.adoc
View File

@ -26,8 +26,8 @@ ENDIF.
== Resources == Resources
* https://www.owasp.org/www-project-top-ten/2017/A3_2017-Sensitive_Data_Exposure[OWASP Top 10 2017 Category A3] - Sensitive Data Exposure * OWASP - https://owasp.org/www-project-top-ten/2017/A3_2017-Sensitive_Data_Exposure[Top 10 2017 Category A3 - Sensitive Data Exposure]
* https://cwe.mitre.org/data/definitions/489[MITRE, CWE-489] - Active Debug Code * CWE - https://cwe.mitre.org/data/definitions/489[CWE-489 - Active Debug Code]
ifdef::env-github,rspecator-view[] ifdef::env-github,rspecator-view[]

6
rules/S1493/see.adoc
View File

@ -1,5 +1,5 @@
== See == See
* https://owasp.org/Top10/A03_2021-Injection/[OWASP Top 10 2021 Category A3] - Injection * OWASP - https://owasp.org/Top10/A03_2021-Injection/[Top 10 2021 Category A3 - Injection]
* https://owasp.org/www-project-top-ten/2017/A1_2017-Injection[OWASP Top 10 2017 Category A1] - Injection * OWASP - https://owasp.org/www-project-top-ten/2017/A1_2017-Injection[Top 10 2017 Category A1 - Injection]
* https://cwe.mitre.org/data/definitions/89[MITRE, CWE-89] - SQL Injection * CWE - https://cwe.mitre.org/data/definitions/89[CWE-89 - SQL Injection]

6
rules/S1523/see.adoc
View File

@ -1,5 +1,5 @@
== See == See
* https://owasp.org/Top10/A03_2021-Injection/[OWASP Top 10 2021 Category A3] - Injection * OWASP - https://owasp.org/Top10/A03_2021-Injection/[Top 10 2021 Category A3 - Injection]
* https://owasp.org/www-project-top-ten/2017/A1_2017-Injection[OWASP Top 10 2017 Category A1] - Injection * OWASP - https://owasp.org/www-project-top-ten/2017/A1_2017-Injection[Top 10 2017 Category A1 - Injection]
* https://cwe.mitre.org/data/definitions/95[MITRE, CWE-95] - Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection') * CWE - https://cwe.mitre.org/data/definitions/95[CWE-95 - Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection')]

4
rules/S1525/javascript/rule.adoc
View File

@ -29,8 +29,8 @@ for (i = 1; i<5; i++) {
== Resources == Resources
* https://www.owasp.org/www-project-top-ten/2017/A3_2017-Sensitive_Data_Exposure[OWASP Top 10 2017 Category A3] - Sensitive Data Exposure * OWASP - https://owasp.org/www-project-top-ten/2017/A3_2017-Sensitive_Data_Exposure[Top 10 2017 Category A3 - Sensitive Data Exposure]
* https://cwe.mitre.org/data/definitions/489[MITRE, CWE-489] - Active Debug Code * CWE - https://cwe.mitre.org/data/definitions/489[CWE-489 - Active Debug Code]
ifdef::env-github,rspecator-view[] ifdef::env-github,rspecator-view[]

2
rules/S1573/rule.adoc
View File

@ -5,5 +5,5 @@ If you do not explicitly close a cursor, it will be closed at the end of the tas
== Resources == Resources
* https://cwe.mitre.org/data/definitions/459[MITRE, CWE-459] - Incomplete Cleanup * CWE - https://cwe.mitre.org/data/definitions/459[CWE-459 - Incomplete Cleanup]

4
rules/S1628/rpg/rule.adoc
View File

@ -32,8 +32,8 @@ The ``++DEBUG(*YES)++`` and ``++DUMP++`` statements are useful during developmen
== Resources == Resources
* https://www.owasp.org/www-project-top-ten/2017/A3_2017-Sensitive_Data_Exposure[OWASP Top 10 2017 Category A3] - Sensitive Data Exposure * OWASP - https://owasp.org/www-project-top-ten/2017/A3_2017-Sensitive_Data_Exposure[Top 10 2017 Category A3 - Sensitive Data Exposure]
* https://cwe.mitre.org/data/definitions/489[MITRE, CWE-489] - Active Debug Code * CWE - https://cwe.mitre.org/data/definitions/489[CWE-489 - Active Debug Code]
ifdef::env-github,rspecator-view[] ifdef::env-github,rspecator-view[]

2
rules/S1630/rpg/rule.adoc
View File

@ -57,7 +57,7 @@ F INFSR(*PSSR)
== Resources == Resources
* https://cwe.mitre.org/data/definitions/459[MITRE, CWE-459] - Incomplete Cleanup * CWE - https://cwe.mitre.org/data/definitions/459[CWE-459 - Incomplete Cleanup]

4
rules/S1674/abap/rule.adoc
View File

@ -37,8 +37,8 @@ When a block contains a comment, it is not considered to be empty.
== Resources == Resources
* https://cwe.mitre.org/data/definitions/391[MITRE, CWE-391] - Unchecked Error Condition * CWE - https://cwe.mitre.org/data/definitions/391[CWE-391 - Unchecked Error Condition]
* OWASP Top 10 2017 Category A10 - Insufficient Logging & Monitoring * OWASP - https://owasp.org/www-project-top-ten/2017/A10_2017-Insufficient_Logging%2526Monitoring[Top 10 2017 Category A10 - Insufficient Logging & Monitoring]
ifdef::env-github,rspecator-view[] ifdef::env-github,rspecator-view[]

4
rules/S1685/cobol/rule.adoc
View File

@ -21,8 +21,8 @@ SOURCE-COMPUTER. IBM-370.
== Resources == Resources
* https://www.owasp.org/www-project-top-ten/2017/A3_2017-Sensitive_Data_Exposure[OWASP Top 10 2017 Category A3] - Sensitive Data Exposure * OWASP - https://owasp.org/www-project-top-ten/2017/A3_2017-Sensitive_Data_Exposure[Top 10 2017 Category A3 - Sensitive Data Exposure]
* https://cwe.mitre.org/data/definitions/489[MITRE, CWE-489] - Active Debug Code * CWE - https://cwe.mitre.org/data/definitions/489[CWE-489 - Active Debug Code]
ifdef::env-github,rspecator-view[] ifdef::env-github,rspecator-view[]

2
rules/S1696/csharp/rule.adoc
View File

@ -43,7 +43,7 @@ public int GetLengthPlusTwo(string str)
== Resources == Resources
* https://cwe.mitre.org/data/definitions/395[MITRE, CWE-395] - Use of NullPointerException Catch to Detect NULL Pointer Dereference * CWE - https://cwe.mitre.org/data/definitions/395[CWE-395 - Use of NullPointerException Catch to Detect NULL Pointer Dereference]
ifdef::env-github,rspecator-view[] ifdef::env-github,rspecator-view[]

2
rules/S1696/java/rule.adoc
View File

@ -40,7 +40,7 @@ public int lengthPlus(String str) {
== Resources == Resources
* https://cwe.mitre.org/data/definitions/395[MITRE, CWE-395] - Use of NullPointerException Catch to Detect NULL Pointer Dereference * CWE - https://cwe.mitre.org/data/definitions/395[CWE-395 - Use of NullPointerException Catch to Detect NULL Pointer Dereference]
* https://tinyurl.com/y6r4amg3[CERT, ERR08-J.] - Do not catch NullPointerException or any of its ancestors * https://tinyurl.com/y6r4amg3[CERT, ERR08-J.] - Do not catch NullPointerException or any of its ancestors
ifdef::env-github,rspecator-view[] ifdef::env-github,rspecator-view[]

4
rules/S1698/java/rule.adoc
View File

@ -78,8 +78,8 @@ Comparing with ``++java.lang.String++`` and boxed types ``++java.lang.Integer++`
== Resources == Resources
* S4973 - Strings and Boxed types should be compared using "equals()" * S4973 - Strings and Boxed types should be compared using "equals()"
* https://cwe.mitre.org/data/definitions/595[MITRE, CWE-595] - Comparison of Object References Instead of Object Contents * CWE - https://cwe.mitre.org/data/definitions/595[CWE-595 - Comparison of Object References Instead of Object Contents]
* https://cwe.mitre.org/data/definitions/597[MITRE, CWE-597] - Use of Wrong Operator in String Comparison * CWE - https://cwe.mitre.org/data/definitions/597[CWE-597 - Use of Wrong Operator in String Comparison]
* https://wiki.sei.cmu.edu/confluence/x/UjdGBQ[CERT, EXP03-J.] - Do not use the equality operators when comparing values of boxed primitives * https://wiki.sei.cmu.edu/confluence/x/UjdGBQ[CERT, EXP03-J.] - Do not use the equality operators when comparing values of boxed primitives
* https://wiki.sei.cmu.edu/confluence/x/yDdGBQ[CERT, EXP50-J.] - Do not confuse abstract object equality with reference equality * https://wiki.sei.cmu.edu/confluence/x/yDdGBQ[CERT, EXP50-J.] - Do not confuse abstract object equality with reference equality

4
rules/S1698/see.adoc
View File

@ -1,4 +1,4 @@
== Resources == Resources
* https://cwe.mitre.org/data/definitions/595[MITRE, CWE-595] - Comparison of Object References Instead of Object Contents * CWE - https://cwe.mitre.org/data/definitions/595[CWE-595 - Comparison of Object References Instead of Object Contents]
* https://cwe.mitre.org/data/definitions/597[MITRE, CWE-597] - Use of Wrong Operator in String Comparison * CWE - https://cwe.mitre.org/data/definitions/597[CWE-597 - Use of Wrong Operator in String Comparison]

2
rules/S1724/rule.adoc
View File

@ -37,7 +37,7 @@ class Bar extends Foo { ... } // compliant Bar is deprecated.
== Resources == Resources
* https://cwe.mitre.org/data/definitions/477[MITRE, CWE-477] - Use of Obsolete Functions * CWE - https://cwe.mitre.org/data/definitions/477[CWE-477 - Use of Obsolete Functions]
ifdef::env-github,rspecator-view[] ifdef::env-github,rspecator-view[]

2
rules/S1725/cobol/rule.adoc
View File

@ -23,7 +23,7 @@ CLOSE my-file
== Resources == Resources
* https://cwe.mitre.org/data/definitions/459[MITRE, CWE-459] - Incomplete Cleanup * CWE - https://cwe.mitre.org/data/definitions/459[CWE-459 - Incomplete Cleanup]
ifdef::env-github,rspecator-view[] ifdef::env-github,rspecator-view[]

2
rules/S1763/cfamily/rule.adoc
View File

@ -80,7 +80,7 @@ int divide(int a, int b) {
* MISRA C:2004, 14.1 - There shall be no unreachable code * MISRA C:2004, 14.1 - There shall be no unreachable code
* MISRA {cpp}:2008, 0-1-1 - A project shall not contain unreachable code * MISRA {cpp}:2008, 0-1-1 - A project shall not contain unreachable code
* MISRA C:2012, 2.1 - A project shall not contain unreachable code * MISRA C:2012, 2.1 - A project shall not contain unreachable code
* https://cwe.mitre.org/data/definitions/561[MITRE, CWE-561] - Dead Code * CWE - https://cwe.mitre.org/data/definitions/561[CWE-561 - Dead Code]
* https://wiki.sei.cmu.edu/confluence/x/5dUxBQ[CERT, MSC12-C.] - Detect and remove code that has no effect or is never executed * https://wiki.sei.cmu.edu/confluence/x/5dUxBQ[CERT, MSC12-C.] - Detect and remove code that has no effect or is never executed
ifdef::env-github,rspecator-view[] ifdef::env-github,rspecator-view[]

2
rules/S1763/see.adoc
View File

@ -1,3 +1,3 @@
== Resources == Resources
* https://cwe.mitre.org/data/definitions/561[MITRE, CWE-561] - Dead Code * CWE - https://cwe.mitre.org/data/definitions/561[CWE-561 - Dead Code]

2
rules/S1854/cfamily/rule.adoc
View File

@ -176,7 +176,7 @@ void caller() {
=== Standards === Standards
* CERT - https://wiki.sei.cmu.edu/confluence/x/39UxBQ[MSC13-C. Detect and remove unused values] * CERT - https://wiki.sei.cmu.edu/confluence/x/39UxBQ[MSC13-C. Detect and remove unused values]
* CWE - https://cwe.mitre.org/data/definitions/563[563 - Assignment to Variable without Use ('Unused Variable')] * CWE - https://cwe.mitre.org/data/definitions/563[CWE-563 - Assignment to Variable without Use ('Unused Variable')]
=== Related rules === Related rules

2
rules/S1854/see.adoc
View File

@ -2,4 +2,4 @@
=== Standards === Standards
* CWE - https://cwe.mitre.org/data/definitions/563[563 - Assignment to Variable without Use ('Unused Variable')] * CWE - https://cwe.mitre.org/data/definitions/563[CWE-563 - Assignment to Variable without Use ('Unused Variable')]

2
rules/S1872/java/rule.adoc
View File

@ -56,7 +56,7 @@ class Store {
== Resources == Resources
* https://cwe.mitre.org/data/definitions/486[MITRE, CWE-486] - Comparison of Classes by Name * CWE - https://cwe.mitre.org/data/definitions/486[CWE-486 - Comparison of Classes by Name]
* https://wiki.sei.cmu.edu/confluence/x/eDdGBQ[CERT, OBJ09-J.] - Compare classes and not class names * https://wiki.sei.cmu.edu/confluence/x/eDdGBQ[CERT, OBJ09-J.] - Compare classes and not class names
ifdef::env-github,rspecator-view[] ifdef::env-github,rspecator-view[]

4
rules/S1873/rule.adoc
View File

@ -46,8 +46,8 @@ public class Estate {
== Resources == Resources
* https://cwe.mitre.org/data/definitions/582[MITRE, CWE-582] - Array Declared Public, Final, and Static * CWE - https://cwe.mitre.org/data/definitions/582[CWE-582 - Array Declared Public, Final, and Static]
* https://cwe.mitre.org/data/definitions/607[MITRE, CWE-607] - Public Static Final Field References Mutable Object * CWE - https://cwe.mitre.org/data/definitions/607[CWE-607 - Public Static Final Field References Mutable Object]
* https://wiki.sei.cmu.edu/confluence/x/LjdGBQ[CERT, OBJ01-J.] - Limit accessibility of fields * https://wiki.sei.cmu.edu/confluence/x/LjdGBQ[CERT, OBJ01-J.] - Limit accessibility of fields
* https://wiki.sei.cmu.edu/confluence/x/VzZGBQ[CERT, OBJ13-J.] - Ensure that references to mutable objects are not exposed * https://wiki.sei.cmu.edu/confluence/x/VzZGBQ[CERT, OBJ13-J.] - Ensure that references to mutable objects are not exposed

2
rules/S1874/see.adoc
View File

@ -1,3 +1,3 @@
== Resources == Resources
=== Documentation === Documentation
* https://cwe.mitre.org/data/definitions/477[MITRE, CWE-477] - Use of Obsolete Functions * CWE - https://cwe.mitre.org/data/definitions/477[CWE-477 - Use of Obsolete Functions]

2
rules/S1875/see.adoc
View File

@ -1,3 +1,3 @@
== Resources == Resources
* https://cwe.mitre.org/data/definitions/482[MITRE, CWE-482] - Comparing instead of Assigning * CWE - https://cwe.mitre.org/data/definitions/482[CWE-482 - Comparing instead of Assigning]

4
rules/S1876/html/rule.adoc
View File

@ -45,8 +45,8 @@ It is recommended to remove the comment or change its style so that it is not ou
== See == See
* https://www.owasp.org/www-project-top-ten/2017/A3_2017-Sensitive_Data_Exposure[OWASP Top 10 2017 Category A3] - Sensitive Data Exposure * OWASP - https://owasp.org/www-project-top-ten/2017/A3_2017-Sensitive_Data_Exposure[Top 10 2017 Category A3 - Sensitive Data Exposure]
* https://cwe.mitre.org/data/definitions/615[MITRE, CWE-615] - Information Exposure Through Comments * CWE - https://cwe.mitre.org/data/definitions/615[CWE-615 - Information Exposure Through Comments]

4
rules/S1944/csharp/rule.adoc
View File

@ -86,7 +86,7 @@ public static class Program
** https://learn.microsoft.com/en-us/dotnet/csharp/language-reference/operators/type-testing-and-cast#as-operator[`as` operator] ** https://learn.microsoft.com/en-us/dotnet/csharp/language-reference/operators/type-testing-and-cast#as-operator[`as` operator]
* https://learn.microsoft.com/en-us/dotnet/csharp/language-reference/language-specification/conversions#103-explicit-conversions[Conversions - Explicit conversions in C#] * https://learn.microsoft.com/en-us/dotnet/csharp/language-reference/language-specification/conversions#103-explicit-conversions[Conversions - Explicit conversions in C#]
** https://learn.microsoft.com/en-us/dotnet/csharp/language-reference/language-specification/conversions#1035-explicit-reference-conversions[Conversions - Explicit reference conversions in C#] ** https://learn.microsoft.com/en-us/dotnet/csharp/language-reference/language-specification/conversions#1035-explicit-reference-conversions[Conversions - Explicit reference conversions in C#]
* https://cwe.mitre.org/data/definitions/588[MITRE, CWE-588 - Attempt to Access Child of a Non-structure Pointer] * CWE - https://cwe.mitre.org/data/definitions/588[CWE-588 - Attempt to Access Child of a Non-structure Pointer]
* https://cwe.mitre.org/data/definitions/704[MITRE, CWE-704 - Incorrect Type Conversion or Cast] * CWE - https://cwe.mitre.org/data/definitions/704[CWE-704 - Incorrect Type Conversion or Cast]
include::../rspecator-dotnet.adoc[] include::../rspecator-dotnet.adoc[]

4
rules/S1944/java/rule.adoc
View File

@ -45,8 +45,8 @@ public class S1944 {
== Resources == Resources
* https://wiki.sei.cmu.edu/confluence/x/u9UxBQ[CERT, EXP36-C.] - Do not cast pointers into more strictly aligned pointer types * https://wiki.sei.cmu.edu/confluence/x/u9UxBQ[CERT, EXP36-C.] - Do not cast pointers into more strictly aligned pointer types
* https://cwe.mitre.org/data/definitions/588[MITRE, CWE-588] - Attempt to Access Child of a Non-structure Pointer * CWE - https://cwe.mitre.org/data/definitions/588[CWE-588 - Attempt to Access Child of a Non-structure Pointer]
* https://cwe.mitre.org/data/definitions/704[MITRE, CWE-704] - Incorrect Type Conversion or Cast * CWE - https://cwe.mitre.org/data/definitions/704[CWE-704 - Incorrect Type Conversion or Cast]
ifdef::env-github,rspecator-view[] ifdef::env-github,rspecator-view[]

4
rules/S1944/vbnet/rule.adoc
View File

@ -85,7 +85,7 @@ End Module
* https://learn.microsoft.com/en-us/dotnet/visual-basic/language-reference/operators/directcast-operator[`DirectCast` operator] * https://learn.microsoft.com/en-us/dotnet/visual-basic/language-reference/operators/directcast-operator[`DirectCast` operator]
* https://learn.microsoft.com/en-us/dotnet/visual-basic/language-reference/functions/ctype-function[`CType` function] * https://learn.microsoft.com/en-us/dotnet/visual-basic/language-reference/functions/ctype-function[`CType` function]
* https://learn.microsoft.com/en-us/dotnet/visual-basic/language-reference/operators/trycast-operator[`TryCast` operator] * https://learn.microsoft.com/en-us/dotnet/visual-basic/language-reference/operators/trycast-operator[`TryCast` operator]
* https://cwe.mitre.org/data/definitions/588[MITRE, CWE-588 - Attempt to Access Child of a Non-structure Pointer] * CWE - https://cwe.mitre.org/data/definitions/588[CWE-588 - Attempt to Access Child of a Non-structure Pointer]
* https://cwe.mitre.org/data/definitions/704[MITRE, CWE-704 - Incorrect Type Conversion or Cast] * CWE - https://cwe.mitre.org/data/definitions/704[CWE-704 - Incorrect Type Conversion or Cast]
include::../rspecator-dotnet.adoc[] include::../rspecator-dotnet.adoc[]

2
rules/S1948/java/rule.adoc
View File

@ -94,7 +94,7 @@ public class Person implements Serializable {
== Resources == Resources
* https://cwe.mitre.org/data/definitions/594[Saving Unserializable Objects to Disk - MITRE, CWE-594] * CWE - https://cwe.mitre.org/data/definitions/594[CWE-594 - Saving Unserializable Objects to Disk]
* https://docs.oracle.com/en/java/javase/11/docs/api/java.base/java/io/Serializable.html[Interface Serializable - Java SE 11 API Documentation] * https://docs.oracle.com/en/java/javase/11/docs/api/java.base/java/io/Serializable.html[Interface Serializable - Java SE 11 API Documentation]
* https://docs.oracle.com/en/java/javase/11/docs/api/java.base/java/io/Serializable.html[Interface Serializable - Java SE 17 API Documentation] * https://docs.oracle.com/en/java/javase/11/docs/api/java.base/java/io/Serializable.html[Interface Serializable - Java SE 17 API Documentation]

4
rules/S1951/flex/rule.adoc
View File

@ -22,8 +22,8 @@ The ``++trace()++`` function outputs debug statements, which can be read by anyo
== Resources == Resources
* https://www.owasp.org/www-project-top-ten/2017/A3_2017-Sensitive_Data_Exposure[OWASP Top 10 2017 Category A3] - Sensitive Data Exposure * OWASP - https://owasp.org/www-project-top-ten/2017/A3_2017-Sensitive_Data_Exposure[Top 10 2017 Category A3 - Sensitive Data Exposure]
* https://cwe.mitre.org/data/definitions/489[MITRE, CWE-489] - Active Debug Code * CWE - https://cwe.mitre.org/data/definitions/489[CWE-489 - Active Debug Code]
ifdef::env-github,rspecator-view[] ifdef::env-github,rspecator-view[]

2
rules/S1966/cobol/rule.adoc
View File

@ -46,7 +46,7 @@ END-IF
== Resources == Resources
* https://cwe.mitre.org/data/definitions/704[MITRE, CWE-704] - Incorrect Type Conversion or Cast * CWE - https://cwe.mitre.org/data/definitions/704[CWE-704 - Incorrect Type Conversion or Cast]
ifdef::env-github,rspecator-view[] ifdef::env-github,rspecator-view[]

2
rules/S1967/cobol/rule.adoc
View File

@ -34,7 +34,7 @@ In any case, data loss is always the result when too-large values are moved to t
== Resources == Resources
* https://cwe.mitre.org/data/definitions/704[MITRE, CWE-704] - Incorrect Type Conversion or Cast * CWE - https://cwe.mitre.org/data/definitions/704[CWE-704 - Incorrect Type Conversion or Cast]
=== Related rules === Related rules

4
rules/S1989/java/rule.adoc
View File

@ -64,8 +64,8 @@ public void doGet(HttpServletRequest request, HttpServletResponse response) thro
=== Articles & blog posts === Articles & blog posts
* https://www.owasp.org/www-project-top-ten/2017/A3_2017-Sensitive_Data_Exposure[OWASP Top 10 2017 Category A3] - Sensitive Data Exposure * OWASP - https://owasp.org/www-project-top-ten/2017/A3_2017-Sensitive_Data_Exposure[Top 10 2017 Category A3 - Sensitive Data Exposure]
* https://cwe.mitre.org/data/definitions/600[MITRE, CWE-600] - Uncaught Exception in Servlet * CWE - https://cwe.mitre.org/data/definitions/600[CWE-600 - Uncaught Exception in Servlet]
* https://wiki.sei.cmu.edu/confluence/x/-zZGBQ[CERT, ERR01-J.] - Do not allow exceptions to expose sensitive information * https://wiki.sei.cmu.edu/confluence/x/-zZGBQ[CERT, ERR01-J.] - Do not allow exceptions to expose sensitive information
ifdef::env-github,rspecator-view[] ifdef::env-github,rspecator-view[]

2
rules/S1998/php/rule.adoc
View File

@ -39,7 +39,7 @@ myfun($name);
=== Standards === Standards
* https://cwe.mitre.org/data/definitions/374[MITRE, CWE-374] - Weakness Base Passing Mutable Objects to an Untrusted Method * CWE - https://cwe.mitre.org/data/definitions/374[CWE-374 - Weakness Base Passing Mutable Objects to an Untrusted Method]
ifdef::env-github,rspecator-view[] ifdef::env-github,rspecator-view[]

2
rules/S2015/php/rule.adoc
View File

@ -31,7 +31,7 @@ if (authenticated($user)) {
== Resources == Resources
* https://cwe.mitre.org/data/definitions/457[MITRE, CWE-457] - Use of Uninitialized Variable * CWE - https://cwe.mitre.org/data/definitions/457[CWE-457 - Use of Uninitialized Variable]
ifdef::env-github,rspecator-view[] ifdef::env-github,rspecator-view[]

8
rules/S2053/common/resources/standards.adoc
View File

@ -1,7 +1,7 @@
=== Standards === Standards
* https://owasp.org/Top10/A02_2021-Cryptographic_Failures/[OWASP] Top 10:2021 A02:2021 - Cryptographic Failures * OWASP - https://owasp.org/Top10/A02_2021-Cryptographic_Failures/[Top 10 2021 Category A2 - Cryptographic Failures]
* https://www.owasp.org/www-project-top-ten/2017/A3_2017-Sensitive_Data_Exposure[OWASP] - Top 10 2017 - A03:2017 - Sensitive Data Exposure * OWASP - https://www.owasp.org/www-project-top-ten/2017/A3_2017-Sensitive_Data_Exposure[Top 10 2017 Category A3 - Sensitive Data Exposure]
* https://cwe.mitre.org/data/definitions/759[CWE] - CWE-759: Use of a One-Way Hash without a Salt * CWE - https://cwe.mitre.org/data/definitions/759[CWE-759 - Use of a One-Way Hash without a Salt]
* https://cwe.mitre.org/data/definitions/760[CWE] - CWE-760: Use of a One-Way Hash with a Predictable Salt * CWE - https://cwe.mitre.org/data/definitions/760[CWE-760 - Use of a One-Way Hash with a Predictable Salt]

8
rules/S2068/cfamily/rule.adoc
View File

@ -34,10 +34,10 @@ dbi_conn_set_option(conn, "password", password.c_str()); // Compliant
== See == See
* https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures/[OWASP Top 10 2021 Category A7] - Identification and Authentication Failures * OWASP - https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures/[Top 10 2021 Category A7 - Identification and Authentication Failures]
* https://owasp.org/www-project-top-ten/2017/A2_2017-Broken_Authentication[OWASP Top 10 2017 Category A2] - Broken Authentication * OWASP - https://owasp.org/www-project-top-ten/2017/A2_2017-Broken_Authentication[Top 10 2017 Category A2 - Broken Authentication]
* https://cwe.mitre.org/data/definitions/798[MITRE, CWE-798] - Use of Hard-coded Credentials * CWE - https://cwe.mitre.org/data/definitions/798[CWE-798 - Use of Hard-coded Credentials]
* https://cwe.mitre.org/data/definitions/259[MITRE, CWE-259] - Use of Hard-coded Password * CWE - https://cwe.mitre.org/data/definitions/259[CWE-259 - Use of Hard-coded Password]
* Derived from FindSecBugs rule https://h3xstream.github.io/find-sec-bugs/bugs.htm#HARD_CODE_PASSWORD[Hard Coded Password] * Derived from FindSecBugs rule https://h3xstream.github.io/find-sec-bugs/bugs.htm#HARD_CODE_PASSWORD[Hard Coded Password]
ifdef::env-github,rspecator-view[] ifdef::env-github,rspecator-view[]

8
rules/S2068/java/rule.adoc
View File

@ -45,10 +45,10 @@ Connection conn = DriverManager.getConnection("jdbc:mysql://localhost/test?" +
== See == See
* https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures/[OWASP Top 10 2021 Category A7] - Identification and Authentication Failures * OWASP - https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures/[Top 10 2021 Category A7 - Identification and Authentication Failures]
* https://owasp.org/www-project-top-ten/2017/A2_2017-Broken_Authentication[OWASP Top 10 2017 Category A2] - Broken Authentication * OWASP - https://owasp.org/www-project-top-ten/2017/A2_2017-Broken_Authentication[Top 10 2017 Category A2 - Broken Authentication]
* https://cwe.mitre.org/data/definitions/798[MITRE, CWE-798] - Use of Hard-coded Credentials * CWE - https://cwe.mitre.org/data/definitions/798[CWE-798 - Use of Hard-coded Credentials]
* https://cwe.mitre.org/data/definitions/259[MITRE, CWE-259] - Use of Hard-coded Password * CWE - https://cwe.mitre.org/data/definitions/259[CWE-259 - Use of Hard-coded Password]
* https://wiki.sei.cmu.edu/confluence/x/OjdGBQ[CERT, MSC03-J.] - Never hard code sensitive information * https://wiki.sei.cmu.edu/confluence/x/OjdGBQ[CERT, MSC03-J.] - Never hard code sensitive information
* Derived from FindSecBugs rule https://h3xstream.github.io/find-sec-bugs/bugs.htm#HARD_CODE_PASSWORD[Hard Coded Password] * Derived from FindSecBugs rule https://h3xstream.github.io/find-sec-bugs/bugs.htm#HARD_CODE_PASSWORD[Hard Coded Password]

8
rules/S2068/see.adoc
View File

@ -1,7 +1,7 @@
== See == See
* https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures/[OWASP Top 10 2021 Category A7] - Identification and Authentication Failures * OWASP - https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures/[Top 10 2021 Category A7 - Identification and Authentication Failures]
* https://owasp.org/www-project-top-ten/2017/A2_2017-Broken_Authentication[OWASP Top 10 2017 Category A2] - Broken Authentication * OWASP - https://owasp.org/www-project-top-ten/2017/A2_2017-Broken_Authentication[Top 10 2017 Category A2 - Broken Authentication]
* https://cwe.mitre.org/data/definitions/798[MITRE, CWE-798] - Use of Hard-coded Credentials * CWE - https://cwe.mitre.org/data/definitions/798[CWE-798 - Use of Hard-coded Credentials]
* https://cwe.mitre.org/data/definitions/259[MITRE, CWE-259] - Use of Hard-coded Password * CWE - https://cwe.mitre.org/data/definitions/259[CWE-259 - Use of Hard-coded Password]
* Derived from FindSecBugs rule https://h3xstream.github.io/find-sec-bugs/bugs.htm#HARD_CODE_PASSWORD[Hard Coded Password] * Derived from FindSecBugs rule https://h3xstream.github.io/find-sec-bugs/bugs.htm#HARD_CODE_PASSWORD[Hard Coded Password]

6
rules/S2070/see.adoc
View File

@ -1,6 +1,6 @@
== Resources == Resources
* https://owasp.org/www-project-top-ten/2017/A6_2017-Security_Misconfiguration[OWASP Top 10 2017 Category A6] - Security Misconfiguration * OWASP - https://owasp.org/www-project-top-ten/2017/A6_2017-Security_Misconfiguration[Top 10 2017 Category A6 - Security Misconfiguration]
* https://cwe.mitre.org/data/definitions/328[MITRE, CWE-328] - Reversible One-Way Hash * CWE - https://cwe.mitre.org/data/definitions/328[CWE-328 - Reversible One-Way Hash]
* https://cwe.mitre.org/data/definitions/327[MITRE, CWE-327] - Use of a Broken or Risky Cryptographic Algorithm * CWE - https://cwe.mitre.org/data/definitions/327[CWE-327 - Use of a Broken or Risky Cryptographic Algorithm]
* https://shattered.io/[SHAttered] - The first concrete collision attack against SHA-1. * https://shattered.io/[SHAttered] - The first concrete collision attack against SHA-1.

6
rules/S2073/rule.adoc
View File

@ -21,7 +21,7 @@ Cipher cipher = Cipher.getInstance("RSA/ECB/OAEPWITHSHA-256ANDMGF1PADDING");
== Resources == Resources
* https://owasp.org/Top10/A02_2021-Cryptographic_Failures/[OWASP Top 10 2021 Category A2] - Cryptographic Failures * OWASP - https://owasp.org/Top10/A02_2021-Cryptographic_Failures/[Top 10 2021 Category A2 - Cryptographic Failures]
* https://cwe.mitre.org/data/definitions/780[MITRE, CWE-780] - Use of RSA Algorithm without OAEP * CWE - https://cwe.mitre.org/data/definitions/780[CWE-780 - Use of RSA Algorithm without OAEP]
* https://www.owasp.org/index.php/Top_10_2013-A5-Security_Misconfiguration[OWASP Top Ten 2013 Category A5] - Security Misconfiguration * OWASP - https://owasp.org/www-pdf-archive/OWASP_Top_10_-_2013.pdf[Top 10 2013 Category A5 - Security Misconfiguration]

8
rules/S2076/common/resources/standards.adoc
View File

@ -1,6 +1,6 @@
=== Standards === Standards
* https://owasp.org/Top10/A03_2021-Injection/[OWASP Top 10 2021 Category A3] - Injection * OWASP - https://owasp.org/Top10/A03_2021-Injection/[Top 10 2021 Category A3 - Injection]
* https://www.owasp.org/index.php/Top_10-2017_A1-Injection[OWASP Top 10 2017 Category A1] - Injection * OWASP - https://owasp.org/www-project-top-ten/2017/A1_2017-Injection[Top 10 2017 Category A1 - Injection]
* https://cwe.mitre.org/data/definitions/20[MITRE, CWE-20] - Improper Input Validation * CWE - https://cwe.mitre.org/data/definitions/20[CWE-20 - Improper Input Validation]
* https://cwe.mitre.org/data/definitions/78[MITRE, CWE-78] - Improper Neutralization of Special Elements used in an OS Command * CWE - https://cwe.mitre.org/data/definitions/78[CWE-78 - Improper Neutralization of Special Elements used in an OS Command]

12
rules/S2077/java/rule.adoc
View File

@ -68,12 +68,12 @@ public User getUserHibernate(org.hibernate.Session session, String data) {
== See == See
* https://owasp.org/Top10/A03_2021-Injection/[OWASP Top 10 2021 Category A3] - Injection * OWASP - https://owasp.org/Top10/A03_2021-Injection/[Top 10 2021 Category A3 - Injection]
* https://owasp.org/www-project-top-ten/2017/A1_2017-Injection[OWASP Top 10 2017 Category A1] - Injection * OWASP - https://owasp.org/www-project-top-ten/2017/A1_2017-Injection[Top 10 2017 Category A1 - Injection]
* https://cwe.mitre.org/data/definitions/89[MITRE, CWE-89] - Improper Neutralization of Special Elements used in an SQL Command * CWE - https://cwe.mitre.org/data/definitions/89[CWE-89 - Improper Neutralization of Special Elements used in an SQL Command]
* https://cwe.mitre.org/data/definitions/564[MITRE, CWE-564] - SQL Injection: Hibernate * CWE - https://cwe.mitre.org/data/definitions/564[CWE-564 - SQL Injection: Hibernate]
* https://cwe.mitre.org/data/definitions/20[MITRE, CWE-20] - Improper Input Validation * CWE - https://cwe.mitre.org/data/definitions/20[CWE-20 - Improper Input Validation]
* https://cwe.mitre.org/data/definitions/943[MITRE, CWE-943] - Improper Neutralization of Special Elements in Data Query Logic * CWE - https://cwe.mitre.org/data/definitions/943[CWE-943 - Improper Neutralization of Special Elements in Data Query Logic]
* https://wiki.sei.cmu.edu/confluence/x/ITdGBQ[CERT, IDS00-J.] - Prevent SQL injection * https://wiki.sei.cmu.edu/confluence/x/ITdGBQ[CERT, IDS00-J.] - Prevent SQL injection
* Derived from FindSecBugs rules https://h3xstream.github.io/find-sec-bugs/bugs.htm#SQL_INJECTION_JPA[Potential SQL/JPQL Injection (JPA)], https://h3xstream.github.io/find-sec-bugs/bugs.htm#SQL_INJECTION_JDO[Potential SQL/JDOQL Injection (JDO)], https://h3xstream.github.io/find-sec-bugs/bugs.htm#SQL_INJECTION_HIBERNATE[Potential SQL/HQL Injection (Hibernate)] * Derived from FindSecBugs rules https://h3xstream.github.io/find-sec-bugs/bugs.htm#SQL_INJECTION_JPA[Potential SQL/JPQL Injection (JPA)], https://h3xstream.github.io/find-sec-bugs/bugs.htm#SQL_INJECTION_JDO[Potential SQL/JDOQL Injection (JDO)], https://h3xstream.github.io/find-sec-bugs/bugs.htm#SQL_INJECTION_HIBERNATE[Potential SQL/HQL Injection (Hibernate)]

8
rules/S2077/see.adoc
View File

@ -1,7 +1,7 @@
== See == See
* https://owasp.org/Top10/A03_2021-Injection/[OWASP Top 10 2021 Category A3] - Injection * OWASP - https://owasp.org/Top10/A03_2021-Injection/[Top 10 2021 Category A3 - Injection]
* https://owasp.org/www-project-top-ten/2017/A1_2017-Injection[OWASP Top 10 2017 Category A1] - Injection * OWASP - https://owasp.org/www-project-top-ten/2017/A1_2017-Injection[Top 10 2017 Category A1 - Injection]
* https://cwe.mitre.org/data/definitions/20[MITRE, CWE-20] - Improper Input Validation * CWE - https://cwe.mitre.org/data/definitions/20[CWE-20 - Improper Input Validation]
* https://cwe.mitre.org/data/definitions/89[MITRE, CWE-89] - Improper Neutralization of Special Elements used in an SQL Command * CWE - https://cwe.mitre.org/data/definitions/89[CWE-89 - Improper Neutralization of Special Elements used in an SQL Command]
* Derived from FindSecBugs rules https://h3xstream.github.io/find-sec-bugs/bugs.htm#SQL_INJECTION_JPA[Potential SQL/JPQL Injection (JPA)], https://h3xstream.github.io/find-sec-bugs/bugs.htm#SQL_INJECTION_JDO[Potential SQL/JDOQL Injection (JDO)], https://h3xstream.github.io/find-sec-bugs/bugs.htm#SQL_INJECTION_HIBERNATE[Potential SQL/HQL Injection (Hibernate)] * Derived from FindSecBugs rules https://h3xstream.github.io/find-sec-bugs/bugs.htm#SQL_INJECTION_JPA[Potential SQL/JPQL Injection (JPA)], https://h3xstream.github.io/find-sec-bugs/bugs.htm#SQL_INJECTION_JDO[Potential SQL/JDOQL Injection (JDO)], https://h3xstream.github.io/find-sec-bugs/bugs.htm#SQL_INJECTION_HIBERNATE[Potential SQL/HQL Injection (Hibernate)]

8
rules/S2078/common/resources/standards.adoc
View File

@ -1,8 +1,8 @@
=== Standards === Standards
* https://owasp.org/Top10/A03_2021-Injection/[OWASP Top 10 2021 Category A3] - Injection * OWASP - https://owasp.org/Top10/A03_2021-Injection/[Top 10 2021 Category A3 - Injection]
* https://www.owasp.org/index.php/Top_10-2017_A1-Injection[OWASP Top 10 2017 Category A1] - Injection * OWASP - https://owasp.org/www-project-top-ten/2017/A1_2017-Injection[Top 10 2017 Category A1 - Injection]
* https://www.ietf.org/rfc/rfc4514.txt[RFC 4514] - LDAP: String Representation of Distinguished Names * https://www.ietf.org/rfc/rfc4514.txt[RFC 4514] - LDAP: String Representation of Distinguished Names
* https://www.ietf.org/rfc/rfc4515.txt[RFC 4515] - LDAP: String Representation of Search Filters * https://www.ietf.org/rfc/rfc4515.txt[RFC 4515] - LDAP: String Representation of Search Filters
* https://cwe.mitre.org/data/definitions/20[MITRE, CWE-20] - Improper Input Validation * CWE - https://cwe.mitre.org/data/definitions/20[CWE-20 - Improper Input Validation]
* https://cwe.mitre.org/data/definitions/90[MITRE, CWE-90] - Improper Neutralization of Special Elements used in an LDAP Query ('LDAP Injection') * CWE - https://cwe.mitre.org/data/definitions/90[CWE-90 - Improper Neutralization of Special Elements used in an LDAP Query ('LDAP Injection')]

12
rules/S2083/common/resources/standards.adoc
View File

@ -1,8 +1,8 @@
=== Standards === Standards
* https://owasp.org/Top10/A01_2021-Broken_Access_Control/[OWASP Top 10 2021 Category A1] - Broken Access Control * OWASP - https://owasp.org/Top10/A01_2021-Broken_Access_Control/[Top 10 2021 Category A1 - Broken Access Control]
* https://owasp.org/Top10/A03_2021-Injection/[OWASP Top 10 2021 Category A3] - Injection * OWASP - https://owasp.org/Top10/A03_2021-Injection/[Top 10 2021 Category A3 - Injection]
* https://www.owasp.org/index.php/Top_10-2017_A1-Injection[OWASP Top 10 2017 Category A1] - Injection * OWASP - https://owasp.org/www-project-top-ten/2017/A1_2017-Injection[Top 10 2017 Category A1 - Injection]
* https://www.owasp.org/index.php/Top_10-2017_A5-Broken_Access_Control[OWASP Top 10 2017 Category A5] - Broken Access Control * OWASP - https://owasp.org/www-project-top-ten/2017/A5_2017-Broken_Access_Control[Top 10 2017 Category A5 - Broken Access Control]
* https://cwe.mitre.org/data/definitions/20[MITRE, CWE-20] - Improper Input Validation * CWE - https://cwe.mitre.org/data/definitions/20[CWE-20 - Improper Input Validation]
* https://cwe.mitre.org/data/definitions/22[MITRE, CWE-22] - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') * CWE - https://cwe.mitre.org/data/definitions/22[CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')]

4
rules/S2084/java/rule.adoc
View File

@ -57,8 +57,8 @@ public class MyServlet extends HttpServlet {
== Resources == Resources
* https://www.owasp.org/www-project-top-ten/2017/A3_2017-Sensitive_Data_Exposure[OWASP Top 10 2017 Category A3] - Sensitive Data Exposure * OWASP - https://owasp.org/www-project-top-ten/2017/A3_2017-Sensitive_Data_Exposure[Top 10 2017 Category A3 - Sensitive Data Exposure]
* https://cwe.mitre.org/data/definitions/537[MITRE, CWE-537] - Information Exposure Through Java Runtime Error Message * CWE - https://cwe.mitre.org/data/definitions/537[CWE-537 - Information Exposure Through Java Runtime Error Message]

6
rules/S2087/see.adoc
View File

@ -1,5 +1,5 @@
== Resources == Resources
* https://owasp.org/Top10/A02_2021-Cryptographic_Failures/[OWASP Top 10 2021 Category A2] - Cryptographic Failures * OWASP - https://owasp.org/Top10/A02_2021-Cryptographic_Failures/[Top 10 2021 Category A2 - Cryptographic Failures]
* https://www.owasp.org/www-project-top-ten/2017/A3_2017-Sensitive_Data_Exposure[OWASP Top 10 2017 Category A3] - Sensitive Data Exposure * OWASP - https://owasp.org/www-project-top-ten/2017/A3_2017-Sensitive_Data_Exposure[Top 10 2017 Category A3 - Sensitive Data Exposure]
* https://cwe.mitre.org/data/definitions/261[MITRE, CWE-261] - Weak Cryptography for Passwords * CWE - https://cwe.mitre.org/data/definitions/261[CWE-261 - Weak Cryptography for Passwords]

6
rules/S2089/java/rule.adoc
View File

@ -24,9 +24,9 @@ public class MyServlet extends HttpServlet {
== Resources == Resources
* https://owasp.org/www-project-top-ten/2017/A2_2017-Broken_Authentication[OWASP Top 10 2017 Category A2] - Broken Authentication * OWASP - https://owasp.org/www-project-top-ten/2017/A2_2017-Broken_Authentication[Top 10 2017 Category A2 - Broken Authentication]
* https://cwe.mitre.org/data/definitions/807[MITRE, CWE-807] - Reliance on Untrusted Inputs in a Security Decision * CWE - https://cwe.mitre.org/data/definitions/807[CWE-807 - Reliance on Untrusted Inputs in a Security Decision]
* https://cwe.mitre.org/data/definitions/293[MITRE, CWE-293] - Using Referer Field for Authentication * CWE - https://cwe.mitre.org/data/definitions/293[CWE-293 - Using Referer Field for Authentication]
ifdef::env-github,rspecator-view[] ifdef::env-github,rspecator-view[]

8
rules/S2091/common/resources/standards.adoc
View File

@ -1,6 +1,6 @@
=== Standards === Standards
* https://owasp.org/Top10/A03_2021-Injection/[OWASP Top 10 2021 Category A3] - Injection * OWASP - https://owasp.org/Top10/A03_2021-Injection/[Top 10 2021 Category A3 - Injection]
* https://www.owasp.org/index.php/Top_10-2017_A1-Injection[OWASP Top 10 2017 Category A1] - Injection * OWASP - https://owasp.org/www-project-top-ten/2017/A1_2017-Injection[Top 10 2017 Category A1 - Injection]
* https://cwe.mitre.org/data/definitions/20[MITRE, CWE-20] - Improper Input Validation * CWE - https://cwe.mitre.org/data/definitions/20[CWE-20 - Improper Input Validation]
* https://cwe.mitre.org/data/definitions/643[MITRE, CWE-643] - Improper Neutralization of Data within XPath Expressions * CWE - https://cwe.mitre.org/data/definitions/643[CWE-643 - Improper Neutralization of Data within XPath Expressions]

12
rules/S2092/see.adoc
View File

@ -1,8 +1,8 @@
== See == See
* https://owasp.org/Top10/A04_2021-Insecure_Design/[OWASP Top 10 2021 Category A4] - Insecure Design * OWASP - https://owasp.org/Top10/A04_2021-Insecure_Design/[Top 10 2021 Category A4 - Insecure Design]
* https://owasp.org/Top10/A05_2021-Security_Misconfiguration/[OWASP Top 10 2021 Category A5] - Security Misconfiguration * OWASP - https://owasp.org/Top10/A05_2021-Security_Misconfiguration/[Top 10 2021 Category A5 - Security Misconfiguration]
* https://www.owasp.org/www-project-top-ten/2017/A3_2017-Sensitive_Data_Exposure[OWASP Top 10 2017 Category A3] - Sensitive Data Exposure * OWASP - https://owasp.org/www-project-top-ten/2017/A3_2017-Sensitive_Data_Exposure[Top 10 2017 Category A3 - Sensitive Data Exposure]
* https://cwe.mitre.org/data/definitions/311[MITRE, CWE-311] - Missing Encryption of Sensitive Data * CWE - https://cwe.mitre.org/data/definitions/311[CWE-311 - Missing Encryption of Sensitive Data]
* https://cwe.mitre.org/data/definitions/315[MITRE, CWE-315] - Cleartext Storage of Sensitive Information in a Cookie * CWE - https://cwe.mitre.org/data/definitions/315[CWE-315 - Cleartext Storage of Sensitive Information in a Cookie]
* https://cwe.mitre.org/data/definitions/614[MITRE, CWE-614] - Sensitive Cookie in HTTPS Session Without 'Secure' Attribute * CWE - https://cwe.mitre.org/data/definitions/614[CWE-614 - Sensitive Cookie in HTTPS Session Without 'Secure' Attribute]

4
rules/S2095/cfamily/rule.adoc
View File

@ -98,8 +98,8 @@ If falling back to low-level file operations is not necessary, one should prefer
=== Standards === Standards
* CERT - https://wiki.sei.cmu.edu/confluence/x/QtUxBQ[FIO42-C. Close files when they are no longer needed] * CERT - https://wiki.sei.cmu.edu/confluence/x/QtUxBQ[FIO42-C. Close files when they are no longer needed]
* CWE - https://cwe.mitre.org/data/definitions/459[459 Incomplete Cleanup] * CWE - https://cwe.mitre.org/data/definitions/459[CWE-459 Incomplete Cleanup]
* CWE - https://cwe.mitre.org/data/definitions/772[772 Missing Release of Resource after Effective Lifetime] * CWE - https://cwe.mitre.org/data/definitions/772[CWE-772 Missing Release of Resource after Effective Lifetime]
=== Related rules === Related rules

4
rules/S2095/java/rule.adoc
View File

@ -92,8 +92,8 @@ catch ( ... ) {
== Resources == Resources
* https://cwe.mitre.org/data/definitions/459[MITRE, CWE-459] - Incomplete Cleanup * CWE - https://cwe.mitre.org/data/definitions/459[CWE-459 - Incomplete Cleanup]
* https://cwe.mitre.org/data/definitions/772[MITRE, CWE-772] - Missing Release of Resource after Effective Lifetime * CWE - https://cwe.mitre.org/data/definitions/772[CWE-772 - Missing Release of Resource after Effective Lifetime]
* https://wiki.sei.cmu.edu/confluence/x/vjdGBQ[CERT, FIO04-J.] - Release resources when they are no longer needed * https://wiki.sei.cmu.edu/confluence/x/vjdGBQ[CERT, FIO04-J.] - Release resources when they are no longer needed
* https://wiki.sei.cmu.edu/confluence/x/QtUxBQ[CERT, FIO42-C.] - Close files when they are no longer needed * https://wiki.sei.cmu.edu/confluence/x/QtUxBQ[CERT, FIO42-C.] - Close files when they are no longer needed
* https://docs.oracle.com/javase/tutorial/essential/exceptions/tryResourceClose.html[Try With Resources] * https://docs.oracle.com/javase/tutorial/essential/exceptions/tryResourceClose.html[Try With Resources]

Some files were not shown because too many files have changed in this diff Show More