Pierre-Loup
e769e586c9
Update security rules: add OWASP Mobile Top 10 2024 security standard (APPSEC-2383) ( #4660 )
2025-02-19 17:19:00 +01:00
github-actions[bot]
2742dcd14d
Create rule S6549: Accessing files should not lead to filesystem oracle attacks ( #4156 )
...
* Add csharp to rule S6549
* Add RSPEC for S6549 for C#
* Update rules/S6549/csharp/how-to-fix-it/asp.net.adoc
Co-authored-by: Hendrik Buchwald <64110887+hendrik-buchwald-sonarsource@users.noreply.github.com>
* Update rules/S6549/csharp/how-to-fix-it/asp.net.adoc
Co-authored-by: Hendrik Buchwald <64110887+hendrik-buchwald-sonarsource@users.noreply.github.com>
* Update rules/S6549/csharp/how-to-fix-it/asp.net.adoc
Co-authored-by: Hendrik Buchwald <64110887+hendrik-buchwald-sonarsource@users.noreply.github.com>
* Correct function name
---------
Co-authored-by: daniel-teuchert-sonarsource <daniel-teuchert-sonarsource@users.noreply.github.com>
Co-authored-by: Daniel Teuchert <daniel.teuchert@sonarsource.com>
Co-authored-by: daniel-teuchert-sonarsource <141642369+daniel-teuchert-sonarsource@users.noreply.github.com>
Co-authored-by: Hendrik Buchwald <64110887+hendrik-buchwald-sonarsource@users.noreply.github.com>
2024-08-20 17:57:41 +02:00
Jamie Anderson
d255072981
Modify rules: Rename STIG version in metadata ( #4098 )
...
The Security Technical Implementation Guide security standard is being
renamed from its release date (`2023-06-08`) to its official version and
revision number (`V5R3`). This helps to align with the version number
being used internally for reporting purposes.
2024-07-30 16:10:03 +02:00
Jamie Anderson
9ee16daa47
Modify rules: Add STIG AS&D 2023-06-08 mappings ( #3914 )
...
* Update JSON schema to include STIG ASD 2023-06-08 mapping
* Update rules to add STIG metadata mappings
---------
Co-authored-by: Loris Sierra <loris.sierra@sonarsource.com>
2024-05-06 08:56:31 +02:00
Pierre-Loup
770348d041
Avoid OWASP Top 10 security-standard mismatch between metadata and description links (RULEAPI-798) ( #3537 )
...
* Add check for security standard mismatch
* Fix security standard mismatches
* Fix Resources/Standards links for secrets rules
* Fix check
* Fix links and update security standard mapping
* Fix maintanability issue
* Apply review suggestions
* Apply suggestions from code review
Co-authored-by: Egon Okerman <egon.okerman@sonarsource.com>
* Fix typo
Co-authored-by: Egon Okerman <egon.okerman@sonarsource.com>
---------
Co-authored-by: Egon Okerman <egon.okerman@sonarsource.com>
2024-01-17 17:20:28 +01:00
Egon Okerman
d1417e82f8
Modify CWE and OWASP Top 10 links to follow standard link format (APPSEC-1134) ( #3529 )
...
* Fix all CWE references
* Fix all OWASP references
* Fix missing CWE prefixes
2024-01-15 17:15:56 +01:00
Antonio Aversa
a02bf814d4
Clean Code Taxonomy: add "code" to all non-obsolete metadata.json ( #2793 )
2023-08-04 17:19:38 +02:00
Fred Tingaud
51369b610e
Make sure that includes are always surrounded by empty lines ( #2270 )
...
When an include is not surrounded by empty lines, its content is inlined
on the same line as the adjacent content. That can lead to broken tags
and other display issues.
This PR fixes all such includes and introduces a validation step that
forbids introducing the same problem again.
2023-06-22 10:38:01 +02:00
Fred Tingaud
16f6c0aecf
Inline adoc when include has no additional value ( #1940 )
...
Inline adoc files when they are included exactly once.
Also fix language tags because this inlining gives us better information
on what language the code is written in.
2023-05-25 14:18:12 +02:00
github-actions[bot]
f5ae5e4917
Create rule S6549: Accessing files should not lead to filesystem oracle attacks (APPSEC-540) ( #1695 )
2023-04-05 16:08:56 +02:00
