3203 Commits

Author SHA1 Message Date
Dorian Burihabwa
06c82f57cf
Modify rule S5384: Replace broken GitHub link with webarchive reference (#2965) 2023-08-24 16:44:01 +02:00
Yassin Kammoun
246716be78
Modify rule S6326: Add support for quick fixes (#2962) 2023-08-24 15:56:49 +02:00
Loris S
4fc653c99f
Modify S6497(docker): Remove from SonarWay (#2959)
Related ticket:
[**SONARIAC-1075**](https://sonarsource.atlassian.net/browse/SONARIAC-1075).
2023-08-24 15:20:35 +02:00
Ilia Kebets
25fc761644
Modify rule S2699: add support for sinon.JS library (#2961) 2023-08-24 14:59:15 +02:00
Jonas Wielage
89423ef606
Modify rule S1200 Remove mention of Single Responsibility Principle in title (#2954)
## Review

A dedicated reviewer checked the rule description successfully for:

- [ ] logical errors and incorrect information
- [ ] information gaps and missing content
- [ ] text style and tone
- [ ] PR summary and labels follow [the
guidelines](https://github.com/SonarSource/rspec/#to-modify-an-existing-rule)
2023-08-24 14:58:20 +02:00
Costin Zaharia
9ad140f1ee
Modify rule S3776: use default remediation (#2935) 2023-08-24 14:29:46 +02:00
Loris S
1f304e54ca
Create Shared content: Make impacts consistents across messenger secrets (#2950)
## Review

A dedicated reviewer checked the rule description successfully for:

- [ ] logical errors and incorrect information
- [ ] information gaps and missing content
- [ ] text style and tone
- [ ] PR summary and labels follow [the
guidelines](https://github.com/SonarSource/rspec/#to-modify-an-existing-rule)

---------

Co-authored-by: daniel-teuchert-sonarsource <141642369+daniel-teuchert-sonarsource@users.noreply.github.com>
2023-08-24 14:27:22 +02:00
Philipp Dominik Schubert
5c74fc7ebf
Modify rule S3588: Expand and adjust for LaYC
Removed code example which contains a FN. A corresponding Jira ticket
has been created at https://sonarsource.atlassian.net/browse/CPP-4655


## Review

A dedicated reviewer checked the rule description successfully for:

- [ ] logical errors and incorrect information
- [ ] information gaps and missing content
- [ ] text style and tone
- [ ] PR summary and labels follow [the
guidelines](https://github.com/SonarSource/rspec/#to-modify-an-existing-rule)
2023-08-24 10:47:20 +02:00
Andrea Guarino
88a814b01e
Adjust clean code attributes for DBD rules (#2952) 2023-08-24 10:05:19 +02:00
tomasz-kaminski-sonarsource
be4265a91f
Modify rule S2259: Expand and adjust for LaYC 2023-08-24 09:32:24 +02:00
SonarTech
c87359e2d4 update coverage information 2023-08-24 00:32:30 +00:00
github-actions[bot]
0e4746e235
Create rule S6708(secrets): Discord Webhook URLs should not be disclosed (#2919)
You can preview this rule
[here](https://sonarsource.github.io/rspec/#/rspec/S6708/secrets)
(updated a few minutes after each push).

## Review

A dedicated reviewer checked the rule description successfully for:

- [ ] logical errors and incorrect information
- [ ] information gaps and missing content
- [ ] text style and tone
- [ ] PR summary and labels follow [the
guidelines](https://github.com/SonarSource/rspec/#to-modify-an-existing-rule)

---------

Co-authored-by: daniel-teuchert-sonarsource <daniel-teuchert-sonarsource@users.noreply.github.com>
Co-authored-by: Daniel Teuchert <daniel.teuchert@sonarsource.com>
Co-authored-by: daniel-teuchert-sonarsource <141642369+daniel-teuchert-sonarsource@users.noreply.github.com>
Co-authored-by: Loris S. <91723853+loris-s-sonarsource@users.noreply.github.com>
2023-08-23 15:37:47 +02:00
Philipp Dominik Schubert
1e2bf05e5b
Modify rule S5280: Update quickfix status
## Review

A dedicated reviewer checked the rule description successfully for:

- [ ] logical errors and incorrect information
- [ ] information gaps and missing content
- [ ] text style and tone
- [ ] PR summary and labels follow [the
guidelines](https://github.com/SonarSource/rspec/#to-modify-an-existing-rule)
2023-08-23 15:28:39 +02:00
Philipp Dominik Schubert
00d10a799e
Modify rule S5280: Expand and adjust for LaYC
## Review

A dedicated reviewer checked the rule description successfully for:

- [ ] logical errors and incorrect information
- [ ] information gaps and missing content
- [ ] text style and tone
- [ ] PR summary and labels follow [the
guidelines](https://github.com/SonarSource/rspec/#to-modify-an-existing-rule)
2023-08-23 14:27:08 +02:00
Philipp Dominik Schubert
acaeb943cf
Modify rule S5273: Expand and adjust for LaYC
**Caution:** our analyzer currently does not correctly detect the issue
in the first code example in section `Why is this an issue?`.


## Review

A dedicated reviewer checked the rule description successfully for:

- [ ] logical errors and incorrect information
- [ ] information gaps and missing content
- [ ] text style and tone
- [ ] PR summary and labels follow [the
guidelines](https://github.com/SonarSource/rspec/#to-modify-an-existing-rule)
2023-08-23 13:59:14 +02:00
Egon Okerman
ee3a611ce2
Modify rule S4347: Update to LayC format (APPSEC-975) (#2903)
## Review

A dedicated reviewer checked the rule description successfully for:

- [x] logical errors and incorrect information
- [x] information gaps and missing content
- [x] text style and tone
- [x] PR summary and labels follow [the
guidelines](https://github.com/SonarSource/rspec/#to-modify-an-existing-rule)
2023-08-23 13:18:37 +02:00
Mary Georgiou
a4b68c982b
Modify S2255: Delete (#2930)
Deleting S2255 as it has been deprecated.
Deprecated since:
-  sonar-dotnet 8.9.0.19135, released on Jun 26, 2020
- SQ 8.4.0.35506 on Jul 3, 2020.
2023-08-23 10:58:18 +02:00
Tibor Blenessy
fa56bf4c9c
Modify rule S3699: Remove duplicated MDN prefix from links (#2932) 2023-08-23 10:25:03 +02:00
Anton Haubner
b5a123e90f
Modify rule S6416: Also check for IllegalStateException (#2826) 2023-08-23 10:10:34 +02:00
Antonio Aversa
f8b02f1be9
Modify rule S2589: fix missing diff-id (#2931)
Related to [this discuss
post](https://discuss.sonarsource.com/t/layc-diff-view-validation/15392/2?u=antonio.aversa).
2023-08-23 08:53:31 +02:00
Philipp Dominik Schubert
74e699cf15
Modify rule S3588: Expand and adjust for LaYC
## Review

A dedicated reviewer checked the rule description successfully for:

- [ ] logical errors and incorrect information
- [ ] information gaps and missing content
- [ ] text style and tone
- [ ] PR summary and labels follow [the
guidelines](https://github.com/SonarSource/rspec/#to-modify-an-existing-rule)
2023-08-22 14:33:47 +02:00
Philipp Dominik Schubert
70be86ab51
Modify rule S5308: Expand and adjust for LaYC (#2916)
## Review

A dedicated reviewer checked the rule description successfully for:

- [x] logical errors and incorrect information
- [x] information gaps and missing content
- [x] text style and tone
- [x] PR summary and labels follow [the
guidelines](https://github.com/SonarSource/rspec/#to-modify-an-existing-rule)

---------

Co-authored-by: tomasz-kaminski-sonarsource <79814193+tomasz-kaminski-sonarsource@users.noreply.github.com>
2023-08-22 08:54:59 +00:00
Philipp Dominik Schubert
fa9676ea16
Modify rule S5488: Expand and adjust for LaYC
## Review

A dedicated reviewer checked the rule description successfully for:

- [ ] logical errors and incorrect information
- [ ] information gaps and missing content
- [ ] text style and tone
- [ ] PR summary and labels follow [the
guidelines](https://github.com/SonarSource/rspec/#to-modify-an-existing-rule)
2023-08-22 10:04:47 +02:00
SonarTech
e2e2f6525a update coverage information 2023-08-22 00:33:10 +00:00
Yassin Kammoun
881f0fd245
Modify rule S6661: Quote the method's name in the title (#2915)
## Review

A dedicated reviewer checked the rule description successfully for:

- [ ] logical errors and incorrect information
- [ ] information gaps and missing content
- [ ] text style and tone
- [ ] PR summary and labels follow [the
guidelines](https://github.com/SonarSource/rspec/#to-modify-an-existing-rule)
2023-08-21 16:33:29 +02:00
Marco Borgeaud
8209548e54
Diff blocks: fix incorrect use for python (#2795)
Improvement identified in #2790.

Add a prefix to the diff-id when it is used multiple times in different
"how to fix it in XYZ" sections to avoid ambiguity and pedantically
follow the spec:

> A single and unique diff-id should be used only once for each type of
code example as shown in the description of a rule.

Obvious typos around `diff-type` were fixed.

An obvious extra use of diff blocks was removed.
2023-08-21 15:22:49 +02:00
Cristian Ambrosini
08247967e0
S2931: fix spacing (#2913)
Fixing tabs on Compliant solution snippet (it was showing `$nbsp;`)

## Review

A dedicated reviewer checked the rule description successfully for:

- [ ] logical errors and incorrect information
- [ ] information gaps and missing content
- [ ] text style and tone
- [ ] PR summary and labels follow [the
guidelines](https://github.com/SonarSource/rspec/#to-modify-an-existing-rule)
2023-08-21 11:22:22 +02:00
dependabot[bot]
a905672e30
[dependabot] Bump gitpython from 3.1.30 to 3.1.32 in /rspec-tools (#2870)
Bumps [gitpython](https://github.com/gitpython-developers/GitPython)
from 3.1.30 to 3.1.32.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/gitpython-developers/GitPython/releases">gitpython's
releases</a>.</em></p>
<blockquote>
<h2>v3.1.32 - with another security update</h2>
<h2>What's Changed</h2>
<ul>
<li>Bump cygwin/cygwin-install-action from 3 to 4 by <a
href="https://github.com/dependabot"><code>@​dependabot</code></a> in <a
href="https://redirect.github.com/gitpython-developers/GitPython/pull/1572">gitpython-developers/GitPython#1572</a></li>
<li>Fix up the commit trailers functionality by <a
href="https://github.com/itsluketwist"><code>@​itsluketwist</code></a>
in <a
href="https://redirect.github.com/gitpython-developers/GitPython/pull/1576">gitpython-developers/GitPython#1576</a></li>
<li>Name top-level exceptions as private variables by <a
href="https://github.com/Hawk777"><code>@​Hawk777</code></a> in <a
href="https://redirect.github.com/gitpython-developers/GitPython/pull/1590">gitpython-developers/GitPython#1590</a></li>
<li>fix pypi long description by <a
href="https://github.com/eUgEntOptIc44"><code>@​eUgEntOptIc44</code></a>
in <a
href="https://redirect.github.com/gitpython-developers/GitPython/pull/1603">gitpython-developers/GitPython#1603</a></li>
<li>Don't rely on <strong>del</strong> by <a
href="https://github.com/r-darwish"><code>@​r-darwish</code></a> in <a
href="https://redirect.github.com/gitpython-developers/GitPython/pull/1606">gitpython-developers/GitPython#1606</a></li>
<li>Block insecure non-multi options in clone/clone_from by <a
href="https://github.com/Beuc"><code>@​Beuc</code></a> in <a
href="https://redirect.github.com/gitpython-developers/GitPython/pull/1609">gitpython-developers/GitPython#1609</a></li>
</ul>
<h2>New Contributors</h2>
<ul>
<li><a href="https://github.com/Hawk777"><code>@​Hawk777</code></a> made
their first contribution in <a
href="https://redirect.github.com/gitpython-developers/GitPython/pull/1590">gitpython-developers/GitPython#1590</a></li>
<li><a
href="https://github.com/eUgEntOptIc44"><code>@​eUgEntOptIc44</code></a>
made their first contribution in <a
href="https://redirect.github.com/gitpython-developers/GitPython/pull/1603">gitpython-developers/GitPython#1603</a></li>
<li><a href="https://github.com/r-darwish"><code>@​r-darwish</code></a>
made their first contribution in <a
href="https://redirect.github.com/gitpython-developers/GitPython/pull/1606">gitpython-developers/GitPython#1606</a></li>
<li><a href="https://github.com/Beuc"><code>@​Beuc</code></a> made their
first contribution in <a
href="https://redirect.github.com/gitpython-developers/GitPython/pull/1609">gitpython-developers/GitPython#1609</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/gitpython-developers/GitPython/compare/3.1.31...3.1.32">https://github.com/gitpython-developers/GitPython/compare/3.1.31...3.1.32</a></p>
<h2>3.1.31</h2>
<h2>What's Changed</h2>
<ul>
<li>Fix Sphinx rendering errors by <a
href="https://github.com/stephan-cr"><code>@​stephan-cr</code></a> in <a
href="https://redirect.github.com/gitpython-developers/GitPython/pull/1524">gitpython-developers/GitPython#1524</a></li>
<li>tests: Use <code>command -v</code> instead of third-party
<code>which</code> program by <a
href="https://github.com/mgorny"><code>@​mgorny</code></a> in <a
href="https://redirect.github.com/gitpython-developers/GitPython/pull/1525">gitpython-developers/GitPython#1525</a></li>
<li>fix/add allow_unsafe_* params in docstrings + fix typo by <a
href="https://github.com/obfusk"><code>@​obfusk</code></a> in <a
href="https://redirect.github.com/gitpython-developers/GitPython/pull/1530">gitpython-developers/GitPython#1530</a></li>
<li>use tempfile.TemporaryDirectory &amp; fix clone_from_unsafe_protocol
tests by <a href="https://github.com/obfusk"><code>@​obfusk</code></a>
in <a
href="https://redirect.github.com/gitpython-developers/GitPython/pull/1531">gitpython-developers/GitPython#1531</a></li>
<li>Fix some resource leaks by open file handles by <a
href="https://github.com/marlamb"><code>@​marlamb</code></a> in <a
href="https://redirect.github.com/gitpython-developers/GitPython/pull/1532">gitpython-developers/GitPython#1532</a></li>
<li>fix files list on file rename by <a
href="https://github.com/teknoraver"><code>@​teknoraver</code></a> in <a
href="https://redirect.github.com/gitpython-developers/GitPython/pull/1537">gitpython-developers/GitPython#1537</a></li>
<li>Declare support for Python 3.11 by <a
href="https://github.com/hugovk"><code>@​hugovk</code></a> in <a
href="https://redirect.github.com/gitpython-developers/GitPython/pull/1541">gitpython-developers/GitPython#1541</a></li>
<li>Fix ignored by <a
href="https://github.com/Lightborne"><code>@​Lightborne</code></a> in <a
href="https://redirect.github.com/gitpython-developers/GitPython/pull/1545">gitpython-developers/GitPython#1545</a></li>
<li>Fix timezone parsing functions for non-hour timezones by <a
href="https://github.com/jcowgill"><code>@​jcowgill</code></a> in <a
href="https://redirect.github.com/gitpython-developers/GitPython/pull/1547">gitpython-developers/GitPython#1547</a></li>
<li>Enable user to override default diff -M arg by <a
href="https://github.com/mellowed100"><code>@​mellowed100</code></a> in
<a
href="https://redirect.github.com/gitpython-developers/GitPython/pull/1551">gitpython-developers/GitPython#1551</a></li>
<li>Remove optional from two member variables by <a
href="https://github.com/Sineaggi"><code>@​Sineaggi</code></a> in <a
href="https://redirect.github.com/gitpython-developers/GitPython/pull/1550">gitpython-developers/GitPython#1550</a></li>
<li>Fix RecursionError when iterating streams by <a
href="https://github.com/eric-wieser"><code>@​eric-wieser</code></a> in
<a
href="https://redirect.github.com/gitpython-developers/GitPython/pull/1554">gitpython-developers/GitPython#1554</a></li>
<li>Fix get_values() so it correctly loads section names by <a
href="https://github.com/Codym48"><code>@​Codym48</code></a> in <a
href="https://redirect.github.com/gitpython-developers/GitPython/pull/1555">gitpython-developers/GitPython#1555</a></li>
</ul>
<h2>New Contributors</h2>
<ul>
<li><a
href="https://github.com/stephan-cr"><code>@​stephan-cr</code></a> made
their first contribution in <a
href="https://redirect.github.com/gitpython-developers/GitPython/pull/1524">gitpython-developers/GitPython#1524</a></li>
<li><a href="https://github.com/obfusk"><code>@​obfusk</code></a> made
their first contribution in <a
href="https://redirect.github.com/gitpython-developers/GitPython/pull/1530">gitpython-developers/GitPython#1530</a></li>
<li><a href="https://github.com/marlamb"><code>@​marlamb</code></a> made
their first contribution in <a
href="https://redirect.github.com/gitpython-developers/GitPython/pull/1532">gitpython-developers/GitPython#1532</a></li>
<li><a
href="https://github.com/teknoraver"><code>@​teknoraver</code></a> made
their first contribution in <a
href="https://redirect.github.com/gitpython-developers/GitPython/pull/1537">gitpython-developers/GitPython#1537</a></li>
<li><a
href="https://github.com/Lightborne"><code>@​Lightborne</code></a> made
their first contribution in <a
href="https://redirect.github.com/gitpython-developers/GitPython/pull/1545">gitpython-developers/GitPython#1545</a></li>
<li><a href="https://github.com/jcowgill"><code>@​jcowgill</code></a>
made their first contribution in <a
href="https://redirect.github.com/gitpython-developers/GitPython/pull/1547">gitpython-developers/GitPython#1547</a></li>
<li><a
href="https://github.com/mellowed100"><code>@​mellowed100</code></a>
made their first contribution in <a
href="https://redirect.github.com/gitpython-developers/GitPython/pull/1551">gitpython-developers/GitPython#1551</a></li>
<li><a href="https://github.com/Sineaggi"><code>@​Sineaggi</code></a>
made their first contribution in <a
href="https://redirect.github.com/gitpython-developers/GitPython/pull/1550">gitpython-developers/GitPython#1550</a></li>
<li><a href="https://github.com/Codym48"><code>@​Codym48</code></a> made
their first contribution in <a
href="https://redirect.github.com/gitpython-developers/GitPython/pull/1555">gitpython-developers/GitPython#1555</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/gitpython-developers/GitPython/compare/3.1.30...3.1.31">https://github.com/gitpython-developers/GitPython/compare/3.1.30...3.1.31</a></p>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="5d45ce243a"><code>5d45ce2</code></a>
prepare 3.1.32 release</li>
<li><a
href="ca965ecc81"><code>ca965ec</code></a>
Merge pull request <a
href="https://redirect.github.com/gitpython-developers/GitPython/issues/1609">#1609</a>
from Beuc/block-insecure-options-clone-non-multi</li>
<li><a
href="5c59e0d63d"><code>5c59e0d</code></a>
Block insecure non-multi options in clone/clone_from</li>
<li><a
href="c09a71e2ca"><code>c09a71e</code></a>
Merge pull request <a
href="https://redirect.github.com/gitpython-developers/GitPython/issues/1606">#1606</a>
from r-darwish/no-del</li>
<li><a
href="a3859ee6f7"><code>a3859ee</code></a>
fixes</li>
<li><a
href="8186159af1"><code>8186159</code></a>
Don't rely on <strong>del</strong></li>
<li><a
href="741edb5430"><code>741edb5</code></a>
Merge pull request <a
href="https://redirect.github.com/gitpython-developers/GitPython/issues/1603">#1603</a>
from eUgEntOptIc44/eugenoptic44-fix-pypi-long-descri...</li>
<li><a
href="0c543cd0dd"><code>0c543cd</code></a>
Improve readability of README.md</li>
<li><a
href="9cd7ddb960"><code>9cd7ddb</code></a>
Improve the 'long_description' displayed on pypi</li>
<li><a
href="6fc11e6e36"><code>6fc11e6</code></a>
update README to reflect the status quo on <code>git</code> command
usage</li>
<li>Additional commits viewable in <a
href="https://github.com/gitpython-developers/GitPython/compare/3.1.30...3.1.32">compare
view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=gitpython&package-manager=pip&previous-version=3.1.30&new-version=3.1.32)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot merge` will merge this PR after your CI passes on it
- `@dependabot squash and merge` will squash and merge this PR after
your CI passes on it
- `@dependabot cancel merge` will cancel a previously requested merge
and block automerging
- `@dependabot reopen` will reopen this PR if it is closed
- `@dependabot close` will close this PR and stop Dependabot recreating
it. You can achieve the same result by closing it manually
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
You can disable automated security fix PRs for this repo from the
[Security Alerts
page](https://github.com/SonarSource/rspec/network/alerts).

</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2023-08-21 11:07:47 +02:00
Loris S
cd03a1dd3d
Modify S5144&S6547: Improve fixes (#2912)
## Review

A dedicated reviewer checked the rule description successfully for:

- [ ] logical errors and incorrect information
- [ ] information gaps and missing content
- [ ] text style and tone
- [ ] PR summary and labels follow [the
guidelines](https://github.com/SonarSource/rspec/#to-modify-an-existing-rule)
2023-08-21 10:51:21 +02:00
Ilia Kebets
4db020b283
Modify rule S1488: add code example when returning awaited promise (#2909)
Fixes https://github.com/SonarSource/eslint-plugin-sonarjs/issues/413
2023-08-21 10:28:17 +02:00
dependabot[bot]
c841e81ad5
[dependabot] Bump certifi from 2023.5.7 to 2023.7.22 in /rspec-tools (#2646)
Bumps [certifi](https://github.com/certifi/python-certifi) from 2023.5.7
to 2023.7.22.
<details>
<summary>Commits</summary>
<ul>
<li><a
href="8fb96ed81f"><code>8fb96ed</code></a>
2023.07.22</li>
<li><a
href="afe77220e0"><code>afe7722</code></a>
Bump actions/setup-python from 4.6.1 to 4.7.0 (<a
href="https://redirect.github.com/certifi/python-certifi/issues/230">#230</a>)</li>
<li><a
href="2038739ad5"><code>2038739</code></a>
Bump dessant/lock-threads from 3.0.0 to 4.0.1 (<a
href="https://redirect.github.com/certifi/python-certifi/issues/229">#229</a>)</li>
<li><a
href="44df761f4c"><code>44df761</code></a>
Hash pin Actions and enable dependabot (<a
href="https://redirect.github.com/certifi/python-certifi/issues/228">#228</a>)</li>
<li>See full diff in <a
href="https://github.com/certifi/python-certifi/compare/2023.05.07...2023.07.22">compare
view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=certifi&package-manager=pip&previous-version=2023.5.7&new-version=2023.7.22)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot merge` will merge this PR after your CI passes on it
- `@dependabot squash and merge` will squash and merge this PR after
your CI passes on it
- `@dependabot cancel merge` will cancel a previously requested merge
and block automerging
- `@dependabot reopen` will reopen this PR if it is closed
- `@dependabot close` will close this PR and stop Dependabot recreating
it. You can achieve the same result by closing it manually
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
You can disable automated security fix PRs for this repo from the
[Security Alerts
page](https://github.com/SonarSource/rspec/network/alerts).

</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2023-08-21 10:00:59 +02:00
Loris S
5a15b560fd
APPSEC-843 Modify S3329: Mention FIPS-compliant PRNG (#2904)
## Review

A dedicated reviewer checked the rule description successfully for:

- [ ] logical errors and incorrect information
- [ ] information gaps and missing content
- [ ] text style and tone
- [ ] PR summary and labels follow [the
guidelines](https://github.com/SonarSource/rspec/#to-modify-an-existing-rule)

---------

Co-authored-by: daniel-teuchert-sonarsource <141642369+daniel-teuchert-sonarsource@users.noreply.github.com>
2023-08-21 07:55:20 +00:00
dependabot[bot]
b17cbdd8d3
[dependabot] Bump aiohttp from 3.8.4 to 3.8.5 in /rspec-tools (#2593)
Bumps [aiohttp](https://github.com/aio-libs/aiohttp) from 3.8.4 to
3.8.5.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/aio-libs/aiohttp/releases">aiohttp's
releases</a>.</em></p>
<blockquote>
<h2>3.8.5</h2>
<h2>Security bugfixes</h2>
<ul>
<li>
<p>Upgraded the vendored copy of llhttp_ to v8.1.1 -- by
:user:<code>webknjaz</code>
and :user:<code>Dreamsorcerer</code>.</p>
<p>Thanks to :user:<code>sethmlarson</code> for reporting this and
providing us with
comprehensive reproducer, workarounds and fixing details! For more
information, see
<a
href="https://github.com/aio-libs/aiohttp/security/advisories/GHSA-45c4-8wx5-qw6w">https://github.com/aio-libs/aiohttp/security/advisories/GHSA-45c4-8wx5-qw6w</a>.</p>
<p>.. _llhttp: <a href="https://llhttp.org">https://llhttp.org</a></p>
<p>(<a
href="https://redirect.github.com/aio-libs/aiohttp/issues/7346">#7346</a>)</p>
</li>
</ul>
<h2>Features</h2>
<ul>
<li>
<p>Added information to C parser exceptions to show which character
caused the error. -- by :user:<code>Dreamsorcerer</code></p>
<p>(<a
href="https://redirect.github.com/aio-libs/aiohttp/issues/7366">#7366</a>)</p>
</li>
</ul>
<h2>Bugfixes</h2>
<ul>
<li>
<p>Fixed a transport is :data:<code>None</code> error -- by
:user:<code>Dreamsorcerer</code>.</p>
<p>(<a
href="https://redirect.github.com/aio-libs/aiohttp/issues/3355">#3355</a>)</p>
</li>
</ul>
<hr />
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/aio-libs/aiohttp/blob/v3.8.5/CHANGES.rst">aiohttp's
changelog</a>.</em></p>
<blockquote>
<h1>3.8.5 (2023-07-19)</h1>
<h2>Security bugfixes</h2>
<ul>
<li>
<p>Upgraded the vendored copy of llhttp_ to v8.1.1 -- by
:user:<code>webknjaz</code>
and :user:<code>Dreamsorcerer</code>.</p>
<p>Thanks to :user:<code>sethmlarson</code> for reporting this and
providing us with
comprehensive reproducer, workarounds and fixing details! For more
information, see
<a
href="https://github.com/aio-libs/aiohttp/security/advisories/GHSA-45c4-8wx5-qw6w">https://github.com/aio-libs/aiohttp/security/advisories/GHSA-45c4-8wx5-qw6w</a>.</p>
<p>.. _llhttp: <a href="https://llhttp.org">https://llhttp.org</a></p>
<p><code>[#7346](https://github.com/aio-libs/aiohttp/issues/7346)
&lt;https://github.com/aio-libs/aiohttp/issues/7346&gt;</code>_</p>
</li>
</ul>
<h2>Features</h2>
<ul>
<li>
<p>Added information to C parser exceptions to show which character
caused the error. -- by :user:<code>Dreamsorcerer</code></p>
<p><code>[#7366](https://github.com/aio-libs/aiohttp/issues/7366)
&lt;https://github.com/aio-libs/aiohttp/issues/7366&gt;</code>_</p>
</li>
</ul>
<h2>Bugfixes</h2>
<ul>
<li>
<p>Fixed a transport is :data:<code>None</code> error -- by
:user:<code>Dreamsorcerer</code>.</p>
<p><code>[#3355](https://github.com/aio-libs/aiohttp/issues/3355)
&lt;https://github.com/aio-libs/aiohttp/issues/3355&gt;</code>_</p>
</li>
</ul>
<hr />
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="9c13a52c21"><code>9c13a52</code></a>
Bump aiohttp to v3.8.5 a security release</li>
<li><a
href="7c02129567"><code>7c02129</code></a>
 Bump pypa/cibuildwheel to v2.14.1</li>
<li><a
href="135a45e9d6"><code>135a45e</code></a>
Improve error messages from C parser (<a
href="https://redirect.github.com/aio-libs/aiohttp/issues/7366">#7366</a>)
(<a
href="https://redirect.github.com/aio-libs/aiohttp/issues/7380">#7380</a>)</li>
<li><a
href="9337fb3f2a"><code>9337fb3</code></a>
Fix bump llhttp to v8.1.1 (<a
href="https://redirect.github.com/aio-libs/aiohttp/issues/7367">#7367</a>)
(<a
href="https://redirect.github.com/aio-libs/aiohttp/issues/7377">#7377</a>)</li>
<li><a
href="f07e9b44b5"><code>f07e9b4</code></a>
[PR <a
href="https://redirect.github.com/aio-libs/aiohttp/issues/7373">#7373</a>/66e261a5
backport][3.8] Drop azure mention (<a
href="https://redirect.github.com/aio-libs/aiohttp/issues/7374">#7374</a>)</li>
<li><a
href="01d9b70e54"><code>01d9b70</code></a>
[PR <a
href="https://redirect.github.com/aio-libs/aiohttp/issues/7370">#7370</a>/22c264ce
backport][3.8] fix: Spelling error fixed (<a
href="https://redirect.github.com/aio-libs/aiohttp/issues/7371">#7371</a>)</li>
<li><a
href="3577b1e371"><code>3577b1e</code></a>
[PR <a
href="https://redirect.github.com/aio-libs/aiohttp/issues/7359">#7359</a>/7911f1e9
backport][3.8]  Set up secretless publishing to PyPI (<a
href="https://redirect.github.com/aio-libs/aiohttp/issues/7360">#7360</a>)</li>
<li><a
href="8d45f9c995"><code>8d45f9c</code></a>
[PR <a
href="https://redirect.github.com/aio-libs/aiohttp/issues/7333">#7333</a>/3a54d378
backport][3.8] Fix TLS transport is <code>None</code> error (<a
href="https://redirect.github.com/aio-libs/aiohttp/issues/7357">#7357</a>)</li>
<li><a
href="dd8e24e773"><code>dd8e24e</code></a>
[PR <a
href="https://redirect.github.com/aio-libs/aiohttp/issues/7343">#7343</a>/18057581
backport][3.8] Mention encoding in <code>yarl.URL</code> (<a
href="https://redirect.github.com/aio-libs/aiohttp/issues/7355">#7355</a>)</li>
<li><a
href="40874103eb"><code>4087410</code></a>
[PR <a
href="https://redirect.github.com/aio-libs/aiohttp/issues/7346">#7346</a>/346fd202
backport][3.8]  Bump vendored llhttp to v8.1.1 (<a
href="https://redirect.github.com/aio-libs/aiohttp/issues/7352">#7352</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/aio-libs/aiohttp/compare/v3.8.4...v3.8.5">compare
view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=aiohttp&package-manager=pip&previous-version=3.8.4&new-version=3.8.5)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot merge` will merge this PR after your CI passes on it
- `@dependabot squash and merge` will squash and merge this PR after
your CI passes on it
- `@dependabot cancel merge` will cancel a previously requested merge
and block automerging
- `@dependabot reopen` will reopen this PR if it is closed
- `@dependabot close` will close this PR and stop Dependabot recreating
it. You can achieve the same result by closing it manually
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
You can disable automated security fix PRs for this repo from the
[Security Alerts
page](https://github.com/SonarSource/rspec/network/alerts).

</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2023-08-21 09:49:51 +02:00
dependabot[bot]
28eb6865eb
Bump word-wrap from 1.2.3 to 1.2.4 in /frontend (#2541)
Bumps [word-wrap](https://github.com/jonschlinkert/word-wrap) from 1.2.3
to 1.2.4.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/jonschlinkert/word-wrap/releases">word-wrap's
releases</a>.</em></p>
<blockquote>
<h2>1.2.4</h2>
<h2>What's Changed</h2>
<ul>
<li>Remove default indent by <a
href="https://github.com/mohd-akram"><code>@​mohd-akram</code></a> in <a
href="https://redirect.github.com/jonschlinkert/word-wrap/pull/24">jonschlinkert/word-wrap#24</a></li>
<li>🔒fix: CVE 2023 26115 (2) by <a
href="https://github.com/OlafConijn"><code>@​OlafConijn</code></a> in <a
href="https://redirect.github.com/jonschlinkert/word-wrap/pull/41">jonschlinkert/word-wrap#41</a></li>
<li>🔒 fix: CVE-2023-26115 by <a
href="https://github.com/aashutoshrathi"><code>@​aashutoshrathi</code></a>
in <a
href="https://redirect.github.com/jonschlinkert/word-wrap/pull/33">jonschlinkert/word-wrap#33</a></li>
<li>chore: publish workflow by <a
href="https://github.com/OlafConijn"><code>@​OlafConijn</code></a> in <a
href="https://redirect.github.com/jonschlinkert/word-wrap/pull/42">jonschlinkert/word-wrap#42</a></li>
</ul>
<h2>New Contributors</h2>
<ul>
<li><a
href="https://github.com/mohd-akram"><code>@​mohd-akram</code></a> made
their first contribution in <a
href="https://redirect.github.com/jonschlinkert/word-wrap/pull/24">jonschlinkert/word-wrap#24</a></li>
<li><a
href="https://github.com/OlafConijn"><code>@​OlafConijn</code></a> made
their first contribution in <a
href="https://redirect.github.com/jonschlinkert/word-wrap/pull/41">jonschlinkert/word-wrap#41</a></li>
<li><a
href="https://github.com/aashutoshrathi"><code>@​aashutoshrathi</code></a>
made their first contribution in <a
href="https://redirect.github.com/jonschlinkert/word-wrap/pull/33">jonschlinkert/word-wrap#33</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/jonschlinkert/word-wrap/compare/1.2.3...1.2.4">https://github.com/jonschlinkert/word-wrap/compare/1.2.3...1.2.4</a></p>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="f64b188c72"><code>f64b188</code></a>
run verb to generate README</li>
<li><a
href="03ea08256b"><code>03ea082</code></a>
Merge pull request <a
href="https://redirect.github.com/jonschlinkert/word-wrap/issues/42">#42</a>
from jonschlinkert/chore/publish-workflow</li>
<li><a
href="420dce9a24"><code>420dce9</code></a>
Merge pull request <a
href="https://redirect.github.com/jonschlinkert/word-wrap/issues/41">#41</a>
from jonschlinkert/fix/CVE-2023-26115-2</li>
<li><a
href="bfa694edf5"><code>bfa694e</code></a>
Update .github/workflows/publish.yml</li>
<li><a
href="ace0b3c78f"><code>ace0b3c</code></a>
chore: bump version to 1.2.4</li>
<li><a
href="6fd7275946"><code>6fd7275</code></a>
chore: add publish workflow</li>
<li><a
href="30d6daf60f"><code>30d6daf</code></a>
chore: fix test</li>
<li><a
href="655929cabe"><code>655929c</code></a>
chore: remove package-lock</li>
<li><a
href="49e08bbc32"><code>49e08bb</code></a>
chore: added an additional testcase</li>
<li><a
href="9f626935f3"><code>9f62693</code></a>
fix: cve 2023-26115</li>
<li>Additional commits viewable in <a
href="https://github.com/jonschlinkert/word-wrap/compare/1.2.3...1.2.4">compare
view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=word-wrap&package-manager=npm_and_yarn&previous-version=1.2.3&new-version=1.2.4)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot merge` will merge this PR after your CI passes on it
- `@dependabot squash and merge` will squash and merge this PR after
your CI passes on it
- `@dependabot cancel merge` will cancel a previously requested merge
and block automerging
- `@dependabot reopen` will reopen this PR if it is closed
- `@dependabot close` will close this PR and stop Dependabot recreating
it. You can achieve the same result by closing it manually
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
You can disable automated security fix PRs for this repo from the
[Security Alerts
page](https://github.com/SonarSource/rspec/network/alerts).

</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2023-08-21 09:49:30 +02:00
Arseniy Zaostrovnykh
55720d6cda
Fix rule coverage on a rule page: include all rule keys to metadata
For some rules, rule-specific metadata.json overridden the `sqKey` for
all languages, so when the predeployment script collected all keys, it
did not list the actual, most canonical key "S****".
This leads to the incorrect display of coverage information on a rule
page that relies on the `allKeys` precomputed property to retrieve the
version of the analyzer that implements the rule.

The fix includes the generic rule metadata.json file into the aggregator
that computes `allKeys`, thus propagating it to every language-specific
metadata.
2023-08-21 07:45:14 +00:00
SonarTech
db2433195f update coverage information 2023-08-21 00:32:40 +00:00
SonarTech
c60968571e update coverage information 2023-08-19 00:33:14 +00:00
cynthiabethea
33d408cbfd
cyn/modify-S2696-layc-ltypo (#2910)
## Review

A dedicated reviewer checked the rule description successfully for:

- [ ] logical errors and incorrect information
- [ ] information gaps and missing content
- [ ] text style and tone
- [ ] PR summary and labels follow [the
guidelines](https://github.com/SonarSource/rspec/#to-modify-an-existing-rule)
2023-08-18 16:52:42 +01:00
Marco Kaufmann
52a0ee1b41
Modify rule S106: reworked rule description for LaYC format, SONARJAVA-4570 (#2907) 2023-08-18 16:39:19 +02:00
Alban Auzeill
f57852ffb7
Modify rule S2189: Fix diff-id (#2908) 2023-08-18 16:01:09 +02:00
github-actions[bot]
de5d7d9043
Create rule S6485: Hash-based collections should be initlizialized with the related static method for better performance (#1441) 2023-08-18 16:00:26 +02:00
Alban Auzeill
a25eaee927
Modify rule S4838: Fix typos (#2906) 2023-08-18 13:55:15 +00:00
leonardo-pilastri-sonarsource
2808713f12
Modify rule S3020: better rule title (#2852) 2023-08-18 15:12:42 +02:00
Marco Kaufmann
92b3f17c07
Modify rule S5413: reworked rule description for LaYC format (#2905) 2023-08-18 14:16:29 +02:00
Yassin Kammoun
289a124d78
Modify rule S107: Do not count TypeScript parameter properties (#2898)
## Review

A dedicated reviewer checked the rule description successfully for:

- [ ] logical errors and incorrect information
- [ ] information gaps and missing content
- [ ] text style and tone
- [ ] PR summary and labels follow [the
guidelines](https://github.com/SonarSource/rspec/#to-modify-an-existing-rule)
2023-08-18 14:01:14 +02:00
Dorian Burihabwa
9ce1a8de8e
Modify rule S2589: Fix typo and formatting in code examples [SONARJAVA-4463] (#2902) 2023-08-18 12:09:07 +02:00
github-actions[bot]
64f9977e49
Create rule S6399(C#): XML operations should not be vulnerable to injection attacks (#2860)
You can preview this rule
[here](https://sonarsource.github.io/rspec/#/rspec/S6399/csharp)
(updated a few minutes after each push).

## Review

A dedicated reviewer checked the rule description successfully for:

- [ ] logical errors and incorrect information
- [ ] information gaps and missing content
- [ ] text style and tone
- [ ] PR summary and labels follow [the
guidelines](https://github.com/SonarSource/rspec/#to-modify-an-existing-rule)

---------

Co-authored-by: daniel-teuchert-sonarsource <daniel-teuchert-sonarsource@users.noreply.github.com>
Co-authored-by: Daniel Teuchert <daniel.teuchert@sonarsource.com>
Co-authored-by: daniel-teuchert-sonarsource <141642369+daniel-teuchert-sonarsource@users.noreply.github.com>
Co-authored-by: Loris S. <91723853+loris-s-sonarsource@users.noreply.github.com>
2023-08-18 11:31:42 +02:00
Loris S
a0abb99f76
Modify S2596(javascript): Convert to LayC (#2901)
This PR also removes the java folder because it is not implemented and
has no implementation plan. This PR was made spontaneously during
Daniel's onboarding.

---------

Co-authored-by: daniel-teuchert-sonarsource <141642369+daniel-teuchert-sonarsource@users.noreply.github.com>
2023-08-18 09:31:06 +00:00
SonarTech
0d571ab062 update coverage information 2023-08-18 00:34:02 +00:00
Irina Batinic
61b3938fc0
Modify rule S6073: reworked rule description for LaYC format (#2892) 2023-08-17 16:53:46 +02:00