5327 Commits

Author SHA1 Message Date
SonarTech
c3d5e7ae01 update coverage information 2025-02-28 02:43:49 +00:00
daniel-teuchert-sonarsource
76ccee7856
Fix multiple broken links (#4712)
* Fix multiple broken links

* Remove postman blog post because the link does not work properly

* Re add postman resource

* Undo postman changes
2025-02-27 16:05:39 +01:00
github-actions[bot]
7cd779c09a
Create rule S7201: Exposing the Android file system to WebViews is security-sensitive (#4680) 2025-02-27 14:46:30 +00:00
Pierre-Loup
d63f01a9b1
Update S4507: Add kotlin code examples (SONARKT-580) (#4708) 2025-02-27 14:09:15 +01:00
Ilia Kebets
8b10fbcbb5
Modify S1135: remove Flex (#4704) 2025-02-27 08:09:10 +00:00
SonarTech
8d2a7efa47 update coverage information 2025-02-27 02:43:30 +00:00
github-actions[bot]
afc4f2638a
SONARJAVA-5163 Create rule S7198: Path.of should be preferred to Paths.get (#4670) 2025-02-26 16:50:20 +01:00
daniel-teuchert-sonarsource
1dc40b1a64
Update S2053: Align recommended salt length (#4711) 2025-02-26 15:09:46 +01:00
Michael Jabbour
99e38a9163
CPP-6162 S1265 Require sized delete since C++14 and definitions in the same file
* CPP-6162 S1265 Require sized delete since C++14 and definitions in the same file

* Remove requirement to be in the same file

---------

Co-authored-by: Mostafa Mohammed <mostafa.mohammed@sonarsource.com>
2025-02-26 11:08:39 +00:00
Jonas Wielage
1060d8a1b4
Modify rule S6953, S7021: Fix MQR inconsistencies (#4705) 2025-02-26 08:40:40 +00:00
Anton Haubner
67416c1eec
Modify rule S6945: Add MAINTAINABILITY quality, increase severity and impact levels (#4707)
* Modify rule S6945: Add MAINTAINABILITY quality.

S6945 does not necessarily indicate a bug since COND might not be set on
purpose.
Hence, keeping the type as `CODE_SMELL` appears correct.

However, as a code smell, we need to qualify its `MAINTAINABILITY` impact.

At the same time, we keep the existing `RELIABILITY` impact:
Not setting COND is a practice that not only leads to harder to debug code but
it may also lead to bugs

* Modify rule S6945: Upgrade severity and impact to Critical and HIGH

Following the documentation, MAINTAINABILITY issues should have at least HIGH
impact, and Critical severity, if they can lead to the introduction of bugs.

RELIABILITY issues should have at least HIGH impact, and Critical severity,
if they can for example cause corrupted data.

Both applies here. Hence, we upgrade the `defaultSeverity` and impact
levels.

These are the documentation link:
https://docs.sonarsource.com/sonarqube-server/2025.1/extension-guide/adding-coding-rules/#setting-severities-in-mqr-mode
https://docs.sonarsource.com/sonarqube-server/2025.1/extension-guide/adding-coding-rules/#setting-severities-in-se-mode
2025-02-26 09:30:10 +01:00
Anton Haubner
3cb75f0c8b
Modify rule S6977: Change type to BUG (#4706)
S6977 definitely impacts RELIABILITY, but it was typed as a
`CODE_SMELL`.
However, if reliability is the main quality of an issue, then it should
be paired with the `BUG` type.

S6977 is not a BUG in the sense that correctness is affected.
At the same time, the previous MAINTAINABILITY quality is not impacted at all.
Also, the issue does negatively affect performance, so it is bug in that sense.

Thus, the decision was made to change the type to `BUG`.
See also
https://sonarsource.slack.com/archives/C026N4DMXNK/p1740474666962219?thread_ts=1740420785.011249&cid=C026N4DMXNK
for an internal discussion.
2025-02-26 09:16:22 +01:00
SonarTech
f191b1e114 update coverage information 2025-02-26 02:43:04 +00:00
Marharyta
66586c5c75
DART-210 Fix discrepancies between MQR and severity for Dart rules
Rules affected: S7058, S7064, S7066, S7083, S7095, S7103, S7104, S7105, S7120
2025-02-25 15:49:31 +00:00
github-actions[bot]
de3124561f
Create rule S5659: JWT should be signed and verified with strong cipher algorithms for Go (#4668)
* Add go to rule S5659

* SONARGO-211: Add RSPEC for S5659 for Go

* Improve code examples

* Update rules/S5659/go/rule.adoc

Co-authored-by: teemu-rytilahti-sonarsource <teemu.rytilahti@sonarsource.com>

---------

Co-authored-by: daniel-teuchert-sonarsource <daniel-teuchert-sonarsource@users.noreply.github.com>
Co-authored-by: Daniel Teuchert <daniel.teuchert@sonarsource.com>
Co-authored-by: daniel-teuchert-sonarsource <141642369+daniel-teuchert-sonarsource@users.noreply.github.com>
Co-authored-by: teemu-rytilahti-sonarsource <teemu.rytilahti@sonarsource.com>
2025-02-25 16:42:12 +01:00
David Kunzmann
5e6349e3a1
Modify S6660: Fix impacts and default severity (#4703) 2025-02-24 16:40:43 +01:00
SonarTech
410a9972af update coverage information 2025-02-23 02:43:30 +00:00
Fred Tingaud
f16efb2b5c RULEAPI-834 Update remaining rules where defaultSeverity is different from MQR 2025-02-21 17:18:02 +01:00
Fred Tingaud
753b21a566 RULEAPI-834 Update remaining rules where defaultSeverity is different from MQR 2025-02-21 16:19:27 +01:00
Fred Tingaud
d8c3c03e56 RULEAPI-832 Fix missing automatically updatable rules 2025-02-21 15:39:32 +01:00
Nils Werner
656f853238
RULEAPI-834 Update rules where defaultSeverity is different from MQR (#4686) 2025-02-21 15:28:32 +01:00
github-actions[bot]
59fba4deac
Create rule S5445: Insecure temporary file creation methods should not be used (#4671)
* Add go to rule S5445

* Initial draft

* Add examples for temporary directories

---------

Co-authored-by: teemu-rytilahti-sonarsource <teemu-rytilahti-sonarsource@users.noreply.github.com>
Co-authored-by: Teemu Rytilahti <teemu.rytilahti@sonarsource.com>
2025-02-21 12:02:48 +01:00
Fred Tingaud
972b0e39c2 Automatically migrate all rules where defaultSeverity is Blocker and MQR is High 2025-02-20 19:58:25 +01:00
Yassin Kammoun
ea1ac05c78
RULEAPI-833 Add a new langage identifier for Rust (#4675) 2025-02-20 11:45:47 +01:00
github-actions[bot]
ba18ae7f08
Create rule S7187: PySpark Pandas DataFrame columns should not use a reserved name (#4622)
* Create rule S7187: PySpark Pandas DataFrame columns should not use a
reserved name

---------

Co-authored-by: joke1196 <joke1196@users.noreply.github.com>
Co-authored-by: David Kunzmann <david.kunzmann@sonarsource.com>
2025-02-20 11:22:12 +01:00
github-actions[bot]
f26dc7084d
Create rule S7196: Complex logic provided to PySpark withColumn method should be refactored into a separate expression (#4642)
* Create rule S7196: Complex logic provided to PySpark withColumn method should be refactored into a separate expression


---------

Co-authored-by: thomas-serre-sonarsource <thomas-serre-sonarsource@users.noreply.github.com>
Co-authored-by: Thomas Serre <thomas.serre@sonarsource.com>
2025-02-20 11:21:29 +01:00
github-actions[bot]
9d7de6d39d
Create rule S7182: The subset argument should be provided when using PySpark DataFrame dropDuplicates (#4615)
* Create Rule S7182: The `subset` argument should be provided when using PySpark DataFrame `dropDuplicates`



---------

Co-authored-by: joke1196 <joke1196@users.noreply.github.com>
Co-authored-by: David Kunzmann <david.kunzmann@sonarsource.com>
2025-02-20 11:20:42 +01:00
Fred Tingaud
fdf295d151 Update rules/S7119/cfamily/metadata.json
Co-authored-by: Loïc Joly <loic.joly@sonarsource.com>
2025-02-20 10:23:49 +01:00
Fred Tingaud
f78837a2bc Also add S6620 2025-02-20 10:23:49 +01:00
Fred Tingaud
c4ad5da103 Fix two more rules 2025-02-20 10:23:49 +01:00
Fred Tingaud
97ea439a11 Increase severity of S7127 2025-02-20 10:23:49 +01:00
Fred Tingaud
adae29df8e Fix discrepencies between MQR and severity for CFamily rules 2025-02-20 10:23:49 +01:00
SonarTech
60cddc7cc9 update coverage information 2025-02-20 02:42:22 +00:00
github-actions[bot]
ae4e0661ea
Create rule S7191: PySpark "withColumns" should be preferred over "withColumn" when multiple columns are specified (#4633)
* Create rule S7191

* Create rule S7191: PySpark  should be preferred over  when multiple columns are specified

* Fix after review

---------

Co-authored-by: thomas-serre-sonarsource <thomas-serre-sonarsource@users.noreply.github.com>
Co-authored-by: Thomas Serre <thomas.serre@sonarsource.com>
Co-authored-by: Guillaume Dequenne <guillaume.dequenne@sonarsource.com>
2025-02-19 17:06:04 +00:00
Pierre-Loup
e769e586c9
Update security rules: add OWASP Mobile Top 10 2024 security standard (APPSEC-2383) (#4660) 2025-02-19 17:19:00 +01:00
github-actions[bot]
c046fc94c4
Create rule S7195: PySpark lit(None) should be used when populating empty columns (#4638) 2025-02-19 10:58:21 +00:00
SonarTech
9966f12d52 update coverage information 2025-02-19 02:41:59 +00:00
github-actions[bot]
13111e20e7
SONARPY-2489 Create rule S7189 PySpark DataFrames used multiple times should be cached or persisted (#4627)
* SONARPY-2489 Create rule S7189 PySpark DataFrames used multiple times should be cached or persisted

* Fix after review

* Add information on when the rule actually triggers

---------

Co-authored-by: guillaume-dequenne-sonarsource <guillaume-dequenne-sonarsource@users.noreply.github.com>
Co-authored-by: Guillaume Dequenne <guillaume.dequenne@sonarsource.com>
2025-02-18 09:28:22 +01:00
SonarTech
3049db59e8 update coverage information 2025-02-18 02:41:07 +00:00
github-actions[bot]
e2133270e7
Create rule S6437: Credentials should not be hard-coded (#4641)
* Add go to rule S6437

* Add description for S6437 for Go

---------

Co-authored-by: daniel-teuchert-sonarsource <daniel-teuchert-sonarsource@users.noreply.github.com>
Co-authored-by: Daniel Teuchert <daniel.teuchert@sonarsource.com>
2025-02-17 15:53:59 +01:00
github-actions[bot]
a2320f1b8d
Create rule S4830: Server certificates should be verified during SSL/TLS connections (#4662)
* Add go to rule S4830

* Add examples

* Improve examples

* Update rules/S4830/go/rule.adoc

Co-authored-by: daniel-teuchert-sonarsource <141642369+daniel-teuchert-sonarsource@users.noreply.github.com>

---------

Co-authored-by: teemu-rytilahti-sonarsource <teemu-rytilahti-sonarsource@users.noreply.github.com>
Co-authored-by: Teemu Rytilahti <teemu.rytilahti@sonarsource.com>
Co-authored-by: daniel-teuchert-sonarsource <141642369+daniel-teuchert-sonarsource@users.noreply.github.com>
2025-02-17 15:53:21 +01:00
leonardo-pilastri-sonarsource
d22236c056 Modify S7190: change tags to target tests 2025-02-17 10:49:40 +01:00
zglicz
818f168bf5
Delete rules/S5742/javascript/metadata.json (#4667)
* Delete rules/S5742/javascript/metadata.json

* empty metadata.json
2025-02-17 10:43:29 +01:00
teemu-rytilahti-sonarsource
601aff6915
S6418/php: fix typo in variable name (#4665)
`description.adoc` is using `detections` and not `detectons` as a variable:
```
This rule detects {detections} having a name matching a list of words (secret, token, credential, auth, api[_.-]?key) being assigned a pseudorandom hard-coded value.
```

This PR makes the value rendered correctly on https://sonarsource.github.io/rspec/#/rspec/S6418/php
2025-02-17 09:52:55 +01:00
github-actions[bot]
29db082484
Create rule S6418: Hard-coded secrets are security-sensitive (#4661)
* Add go to rule S6418

* SONARGO-215: Add description for S6418 for Go

* Lower default entropy

* Simplify code examples

---------

Co-authored-by: daniel-teuchert-sonarsource <daniel-teuchert-sonarsource@users.noreply.github.com>
Co-authored-by: Daniel Teuchert <daniel.teuchert@sonarsource.com>
Co-authored-by: daniel-teuchert-sonarsource <141642369+daniel-teuchert-sonarsource@users.noreply.github.com>
2025-02-17 09:24:39 +01:00
SonarTech
00213b7c50 update coverage information 2025-02-15 02:40:26 +00:00
Fred Tingaud
4a2fe22a72 Fix Secrets template rule 2025-02-14 16:12:09 +01:00
github-actions[bot]
7475e42c29
Create rule S7192: The "how" parameter should be specified when joining two PySpark DataFrames (#4634) 2025-02-13 17:25:01 +01:00
github-actions[bot]
a16475c830
SONARPY-2501 Create rule S7181 PySpark Window functions should always specify a frame (#4614) 2025-02-13 15:27:23 +01:00
github-actions[bot]
e3a3a43170
Create rule S4426: Cryptographic keys should be robust (#4659)
* Add go to rule S4426

* Add description for S4426 for Go

---------

Co-authored-by: daniel-teuchert-sonarsource <daniel-teuchert-sonarsource@users.noreply.github.com>
Co-authored-by: Daniel Teuchert <daniel.teuchert@sonarsource.com>
Co-authored-by: daniel-teuchert-sonarsource <141642369+daniel-teuchert-sonarsource@users.noreply.github.com>
2025-02-13 14:25:30 +01:00