100 Commits

Author SHA1 Message Date
Jonas Wielage
aa7f7e600d
Modify rule S4423 for Go: Add examples for HTTP servers (#4800)
* Revert "SONARGO-393 Modify rule S4423 for Go: remove examples for HTTP server…"

This reverts commit e7c5865c645d1d0268b89a1c9e6ec005c056545e.

* Adjusted text about go version
2025-03-18 15:34:53 +01:00
Eric Morand
7c9aad50bf
RULEAPI-836 - Add compatibleLanguages to javascript rule manifests (#4731) 2025-03-17 09:58:46 +00:00
Quentin Jaquier
e7c5865c64
SONARGO-393 Modify rule S4423 for Go: remove examples for HTTP servers (#4726) 2025-03-07 14:04:22 +01:00
Pierre-Loup
e769e586c9
Update security rules: add OWASP Mobile Top 10 2024 security standard (APPSEC-2383) (#4660) 2025-02-19 17:19:00 +01:00
Egon Okerman
afdfdf77d0
Update URLs to point to mas.owasp.org (#4126) 2024-08-08 09:50:21 +02:00
Arseniy Zaostrovnykh
d1e98e9eb9
Modify Rule S4423[cfamily]: add nullptr check for libcurl examples
Co-authored-by: Arseniy Zaostrovnykh <necto.ne@gmail.com>
2024-05-28 14:46:07 +02:00
Egon Okerman
da58171bf4
Modify rule S4423: Add "How to fix" sections for all Azure resources (APPSEC-383) (#2676)
Co-authored-by: sebastien-andrivet-sonarsource <138577785+sebastien-andrivet-sonarsource@users.noreply.github.com>
Co-authored-by: Peter Trifanov <peter.trifanov@sonarsource.com>
2024-05-22 16:35:51 +02:00
Sebastien Andrivet
078287d9ad
Modify rule S4423: Remove instructions that are not relevant for API Gateway V2 (#2520) 2024-05-21 14:03:34 +02:00
Egon Okerman
054e47fcb7
Modify rule S4423: Adjust Python compliant examples (APPSEC-1556) (#3688)
* Use recommended helper method in compliant solution

* Change minimal version to TLSv1.2 (to match other languages)
2024-02-29 12:36:15 +01:00
Loris S
96811524d7
Modify JVM Crypto rules: Change framework name (#3550)
* Modify JVM Crypto rules: Change title

* changed names

* Apply suggestions from code review

* fixed includes
2024-01-25 15:18:07 +01:00
Pierre-Loup
770348d041
Avoid OWASP Top 10 security-standard mismatch between metadata and description links (RULEAPI-798) (#3537)
* Add check for security standard mismatch

* Fix security standard mismatches

* Fix Resources/Standards links for secrets rules

* Fix check

* Fix links and update security standard mapping

* Fix maintanability issue

* Apply review suggestions

* Apply suggestions from code review

Co-authored-by: Egon Okerman <egon.okerman@sonarsource.com>

* Fix typo

Co-authored-by: Egon Okerman <egon.okerman@sonarsource.com>

---------

Co-authored-by: Egon Okerman <egon.okerman@sonarsource.com>
2024-01-17 17:20:28 +01:00
Egon Okerman
d1417e82f8
Modify CWE and OWASP Top 10 links to follow standard link format (APPSEC-1134) (#3529)
* Fix all CWE references

* Fix all OWASP references

* Fix missing CWE prefixes
2024-01-15 17:15:56 +01:00
Marco Borgeaud
34814f787b
Remove links to SANS Top 25 CWEs (#3322)
These links are no longer relevant since SANS now just link to CWE, and we already have links to CWEs.
2023-10-18 13:16:00 +00:00
Fred Tingaud
6f24cc0632
Clean rule at root
In some cases, the `rule.adoc` at root of a rule is never included
anywhere and thus is dead code.
It's a maintenance cost by itself, but also it misses opportunities to
inline code that seems used by two documents when in fact only one
document is actually rendered. And this missed opportunity, in turn,
stops us from applying the correct language tag on the code samples.
2023-10-16 16:34:38 +02:00
daniel-teuchert-sonarsource
732ed4108f
APPSEC-1090: S4423 Improved RSPEC example (#3096)
## Review

A dedicated reviewer checked the rule description successfully for:

- [ ] logical errors and incorrect information
- [ ] information gaps and missing content
- [ ] text style and tone
- [ ] PR summary and labels follow [the
guidelines](https://github.com/SonarSource/rspec/#to-modify-an-existing-rule)
2023-09-20 14:46:42 +02:00
Egon Okerman
a9c9fb99ff
Modify rule S4423, S6378, S6387, S6656: Fix diff view errors in ARM examples (#3067)
## Review

A dedicated reviewer checked the rule description successfully for:

- [x] logical errors and incorrect information
- [x] information gaps and missing content
- [x] text style and tone
- [x] PR summary and labels follow [the
guidelines](https://github.com/SonarSource/rspec/#to-modify-an-existing-rule)
2023-09-13 17:48:09 +02:00
Egon Okerman
897bb45fbf
Modify rule S4423: Add language AzureResourceManager (Bicep) (#1879) 2023-09-13 10:25:04 +02:00
Egon Okerman
e0b8bea72f
Modify rule S2612, S4423 (Go): fix diff-view errors (#3005)
## Review

A dedicated reviewer checked the rule description successfully for:

- [ ] logical errors and incorrect information
- [ ] information gaps and missing content
- [ ] text style and tone
- [ ] PR summary and labels follow [the
guidelines](https://github.com/SonarSource/rspec/#to-modify-an-existing-rule)
2023-09-04 14:23:47 +02:00
Marco Borgeaud
8209548e54
Diff blocks: fix incorrect use for python (#2795)
Improvement identified in #2790.

Add a prefix to the diff-id when it is used multiple times in different
"how to fix it in XYZ" sections to avoid ambiguity and pedantically
follow the spec:

> A single and unique diff-id should be used only once for each type of
code example as shown in the description of a rule.

Obvious typos around `diff-type` were fixed.

An obvious extra use of diff blocks was removed.
2023-08-21 15:22:49 +02:00
github-actions[bot]
10cb45778a
Create rule S4423: add Go (APPSEC-905) (#2830)
Research ticket:
[APPSEC-905](https://sonarsource.atlassian.net/browse/APPSEC-905)

You can preview this rule
[here](https://sonarsource.github.io/rspec/#/rspec/S4423/go) (updated a
few minutes after each push).

## Review

A dedicated reviewer checked the rule description successfully for:

- [ ] logical errors and incorrect information
- [ ] information gaps and missing content
- [ ] text style and tone
- [ ] PR summary and labels follow [the
guidelines](https://github.com/SonarSource/rspec/#to-modify-an-existing-rule)



[APPSEC-905]:
https://sonarsource.atlassian.net/browse/APPSEC-905?atlOrigin=eyJpIjoiNWRkNTljNzYxNjVmNDY3MDlhMDU5Y2ZhYzA5YTRkZjUiLCJwIjoiZ2l0aHViLWNvbS1KU1cifQ

---------

Co-authored-by: egon-okerman-sonarsource <egon-okerman-sonarsource@users.noreply.github.com>
Co-authored-by: Egon Okerman <egon.okerman@sonarsource.com>
2023-08-16 13:53:27 +02:00
Marco Borgeaud
ffde1ebd9a
Diff blocks: fix some incorrect use for kotlin (#2803)
Improvement identified in #2790.

Add a prefix to the diff-id when it is used multiple times in different
"how to fix it in XYZ" sections to avoid ambiguity and pedantically
follow the spec:

> A single and unique diff-id should be used only once for each type of
code example as shown in the description of a rule.

Obvious typos around `diff-id` were fixed.
2023-08-15 13:34:10 +02:00
Marco Borgeaud
210246f5d8
Diff blocks: fix incorrect use for CFamily
Improvement identified in #2790.

Add a prefix to the diff-id when it is used multiple times in different
"how to fix it in XYZ" sections to avoid ambiguity and pedantically
follow the spec:

> A single and unique diff-id should be used only once for each type of
code example as shown in the description of a rule.

Obvious typos around `diff-type` were fixed.
2023-08-15 10:14:59 +02:00
Marco Borgeaud
95ce8c6119
Diff blocks: fix some incorrect use for javascript (#2802)
Improvement identified in #2790.

Add a prefix to the diff-id when it is used multiple times in different
"how to fix it in XYZ" sections to avoid ambiguity and pedantically
follow the spec:

> A single and unique diff-id should be used only once for each type of
code example as shown in the description of a rule.

Obvious typos around `diff-type` were fixed.
2023-08-15 09:43:48 +02:00
Marco Borgeaud
7da1e57a15
Diff blocks: fix some incorrect use for java (#2801) 2023-08-10 17:12:37 +02:00
Marco Borgeaud
ce07d261a4
Diff blocks: fix some incorrect use for terraform (#2806)
Improvement identified in #2790.

Add a prefix to the diff-id when it is used multiple times in different
"how to fix it in XYZ" sections to avoid ambiguity and pedantically
follow the spec:

> A single and unique diff-id should be used only once for each type of
code example as shown in the description of a rule.
2023-08-10 15:57:41 +02:00
Marco Borgeaud
8729d7a38c
Diff blocks: fix some incorrect use for docker (#2800)
Improvement identified in #2790.

Add a prefix to the diff-id when it is used multiple times in different
"how to fix it in XYZ" sections to avoid ambiguity and pedantically
follow the spec:

> A single and unique diff-id should be used only once for each type of
code example as shown in the description of a rule.

Obvious typos around `diff-id` were fixed.
2023-08-10 15:57:01 +02:00
Marco Borgeaud
ecf191e992
Diff blocks: fix incorrect use for cloudformation (#2798)
Improvement identified in #2790.

Add a prefix to the diff-id when it is used multiple times in different
"how to fix it in XYZ" sections to avoid ambiguity and pedantically
follow the spec:

> A single and unique diff-id should be used only once for each type of
code example as shown in the description of a rule.
2023-08-10 15:56:42 +02:00
Marco Borgeaud
fe06d23670
Diff blocks: fix some incorrect use for azureresourcemanager (#2796)
Improvement identified in #2790.

Add a prefix to the diff-id when it is used multiple times in different
"how to fix it in XYZ" sections to avoid ambiguity and pedantically
follow the spec:

> A single and unique diff-id should be used only once for each type of
code example as shown in the description of a rule.

Obvious typos around `diff-type` and `diff-id` were fixed.
2023-08-10 15:56:15 +02:00
Antonio Aversa
a02bf814d4
Clean Code Taxonomy: add "code" to all non-obsolete metadata.json (#2793) 2023-08-04 17:19:38 +02:00
Loris S
bef49d6a16
Modify S4423(Azure): Add MSSQL sample (#2532)
## Review

A dedicated reviewer checked the rule description successfully for:

- [x] logical errors and incorrect information
- [x] information gaps and missing content
- [x] text style and tone
- [x] PR summary and labels follow [the
guidelines](https://github.com/SonarSource/rspec/#to-modify-an-existing-rule)
2023-07-20 16:09:48 +02:00
Fred Tingaud
51369b610e
Make sure that includes are always surrounded by empty lines (#2270)
When an include is not surrounded by empty lines, its content is inlined
on the same line as the adjacent content. That can lead to broken tags
and other display issues.
This PR fixes all such includes and introduces a validation step that
forbids introducing the same problem again.
2023-06-22 10:38:01 +02:00
Loris S
1a84c758e1
Modify S4423: Learn-As-You-Code Migration (#2097)
Co-authored-by: hendrik-buchwald-sonarsource <64110887+hendrik-buchwald-sonarsource@users.noreply.github.com>
2023-06-20 15:36:01 +00:00
Fred Tingaud
16f6c0aecf
Inline adoc when include has no additional value (#1940)
Inline adoc files when they are included exactly once.

Also fix language tags because this inlining gives us better information
on what language the code is written in.
2023-05-25 14:18:12 +02:00
Egon Okerman
42f4fbdd5a
Create rule S4423: add language AzureResourceManager (#1835)
[Specification
ticket](https://sonarsource.atlassian.net/browse/SONARIAC-755)
[Implementation
ticket](https://sonarsource.atlassian.net/browse/SONARIAC-781)
[RSPEC
Preview](https://sonarsource.github.io/rspec/#/rspec/S4423/azureresourcemanager)

Bicep PR for S4423: #1879
2023-05-11 17:14:01 +02:00
Victor
fe961619f9 migrate rule descriptions to new education format 2023-05-05 16:29:04 +02:00
Rudy Regazzoni
d6a6439e46
Add bicep and json for language support in code example (#1830) 2023-05-05 11:12:16 +02:00
Jamie Anderson
2d52a31a16
Modify rules: Remove deprecated sans-top25-* tags (#1694) 2023-03-29 15:31:59 +02:00
Jamie Anderson
664d3c5a0f
Modify rules: Remove deprecated owasp-mX tags (#1692) 2023-03-28 11:14:25 +02:00
Jamie Anderson
2d8892defb
Modify rules: Remove "owasp-aX" tag (#1655) 2023-03-16 15:25:13 +01:00
Egon Okerman
38b0750ac6
Modify rule S4423: Add Docker (APPSEC-460) (#1585)
* Add Docker rule

* Remove irrelevant metadata tag

* Update message
2023-02-23 14:27:11 +01:00
Yassin Kammoun
8656528c00
Modify rule S4423: Update issue message (#1558) 2023-02-09 11:34:23 +01:00
gaetan-ferry-sonarsource
be544bb597
Modify rule S4423: Update the detection logic to match the current deprecation state [PYTHON][APPSEC-12] (#1429) 2022-12-06 13:55:06 +01:00
Loris S
0b49b91f58
Modify S4423[JS]: Support of AWS CDK code (APPSEC-158) (#1315) 2022-10-10 18:04:24 +02:00
Pierre-Loup
afcae498a5
Modify S4423[Python]: Support of AWS CDK code (APPSEC-103) (#1273) (#1278) 2022-09-26 14:04:15 +02:00
Pierre-Loup
e6ead4ded2
Revert "Modify S4423[Python]: Support of AWS CDK code (APPSEC-103) (#1273)" (#1277)
This reverts commit 7aa3adc6bfbaf80456d85c27f858ce20b7200811.
2022-09-20 13:48:06 +00:00
Pierre-Loup
7aa3adc6bf
Modify S4423[Python]: Support of AWS CDK code (APPSEC-103) (#1273) 2022-09-20 15:44:27 +02:00
pedro-oliveira-sonarsource
8fc7e3e3d8
[APPSEC-63] Modify Rules: Fix ASVS assignments (#1251) 2022-09-14 14:00:38 +02:00
Loris S
9d8b209353
Modify Multiple Rules(IAC): Remove Non-IAC-Based Standards in Metadata (APPSEC-5) (#1238) 2022-09-14 10:29:18 +02:00
Pierre-Loup
7194184e3a
Modify S4423: Fix See section for CF and TF (#1250) 2022-09-13 16:56:07 +02:00
Alexandre Gigleux
01bad1b800
Map rules to OWASP ASVS 4 (#1110)
https://sonarsource.atlassian.net/browse/MMF-2794
2022-07-29 13:35:38 +02:00