69 Commits

Author SHA1 Message Date
Jamie Anderson
d255072981
Modify rules: Rename STIG version in metadata (#4098)
The Security Technical Implementation Guide security standard is being
renamed from its release date (`2023-06-08`) to its official version and
revision number (`V5R3`). This helps to align with the version number
being used internally for reporting purposes.
2024-07-30 16:10:03 +02:00
Jamie Anderson
9ee16daa47
Modify rules: Add STIG AS&D 2023-06-08 mappings (#3914)
* Update JSON schema to include STIG ASD 2023-06-08 mapping

* Update rules to add STIG metadata mappings

---------

Co-authored-by: Loris Sierra <loris.sierra@sonarsource.com>
2024-05-06 08:56:31 +02:00
Egon Okerman
7632676854
Modify rule S5131: Fix Spring example (#3637)
* Fix Spring examples

* Remove unnecessary ResponseBody annotations
2024-02-12 13:33:08 +01:00
Egon Okerman
d1417e82f8
Modify CWE and OWASP Top 10 links to follow standard link format (APPSEC-1134) (#3529)
* Fix all CWE references

* Fix all OWASP references

* Fix missing CWE prefixes
2024-01-15 17:15:56 +01:00
Egon Okerman
6fe3e11073
Modify rule S5131: Add FastAPI (APPSEC-1250) (#3412) 2024-01-04 11:23:05 +01:00
Egon Okerman
6a8c878999
Fix Flask example (#3527) 2024-01-03 16:36:15 +01:00
Egon Okerman
6417c38013
Modify rule S2092, S3330, S4830, S5131, S5144: Revert FastAPI changes (#3408)
The PRs #3365, #3374, #3386, #3391 and #3392 were merged before
implementation. This reverts them, to be merged only once implemented.

## Review

A dedicated reviewer checked the rule description successfully for:

- [ ] logical errors and incorrect information
- [ ] information gaps and missing content
- [ ] text style and tone
- [ ] PR summary and labels follow [the
guidelines](https://github.com/SonarSource/rspec/#to-modify-an-existing-rule)
2023-11-06 15:58:47 +00:00
Egon Okerman
67d91725f0
Modify rule S5131: Add FastAPI (APPSEC-1250) (#3386)
## Review

A dedicated reviewer checked the rule description successfully for:

- [ ] logical errors and incorrect information
- [ ] information gaps and missing content
- [ ] text style and tone
- [ ] PR summary and labels follow [the
guidelines](https://github.com/SonarSource/rspec/#to-modify-an-existing-rule)
2023-11-06 11:04:22 +01:00
Marco Borgeaud
8209548e54
Diff blocks: fix incorrect use for python (#2795)
Improvement identified in #2790.

Add a prefix to the diff-id when it is used multiple times in different
"how to fix it in XYZ" sections to avoid ambiguity and pedantically
follow the spec:

> A single and unique diff-id should be used only once for each type of
code example as shown in the description of a rule.

Obvious typos around `diff-type` were fixed.

An obvious extra use of diff blocks was removed.
2023-08-21 15:22:49 +02:00
Marco Borgeaud
57c303541e
Diff blocks: fix some incorrect use for csharp (#2799) 2023-08-15 14:19:27 +02:00
Marco Borgeaud
7da1e57a15
Diff blocks: fix some incorrect use for java (#2801) 2023-08-10 17:12:37 +02:00
Marco Borgeaud
6550e65756
Diff blocks: fix some incorrect use for php (#2804)
Improvement identified in #2790.

Add a prefix to the diff-id when it is used multiple times in different
"how to fix it in XYZ" sections to avoid ambiguity and pedantically
follow the spec:

> A single and unique diff-id should be used only once for each type of
code example as shown in the description of a rule.

Obvious typos around `diff-type` were fixed.
2023-08-10 15:57:24 +02:00
Antonio Aversa
a02bf814d4
Clean Code Taxonomy: add "code" to all non-obsolete metadata.json (#2793) 2023-08-04 17:19:38 +02:00
Fred Tingaud
51369b610e
Make sure that includes are always surrounded by empty lines (#2270)
When an include is not surrounded by empty lines, its content is inlined
on the same line as the adjacent content. That can lead to broken tags
and other display issues.
This PR fixes all such includes and introduces a validation step that
forbids introducing the same problem again.
2023-06-22 10:38:01 +02:00
John-Clifton-SonarSource
a3fc55943b
Update expressjs.adoc (#2139)
Fixing a typo in the noncompliant code example. I think this is now
right, but please double-check me.

## Review

A dedicated reviewer checked the rule description successfully for:

- [x] logical errors and incorrect information
- [x] information gaps and missing content
- [x] text style and tone
2023-06-09 15:45:56 +01:00
Jamie Anderson
2d52a31a16
Modify rules: Remove deprecated sans-top25-* tags (#1694) 2023-03-29 15:31:59 +02:00
Jamie Anderson
2d8892defb
Modify rules: Remove "owasp-aX" tag (#1655) 2023-03-16 15:25:13 +01:00
Ilia Kebets
c80d7f3b4c
Add checks for education format (#1607) 2023-03-07 17:16:47 +01:00
Loris S
e52b9671b2 Education text Fix (#1338) 2023-03-02 18:22:24 +01:00
pedro-oliveira-sonarsource
0340dd7ba1 [Education] Modify Rules: Fix OR operand character escape (#1259) 2023-03-02 18:22:24 +01:00
Loris S
8815e23ae8 Modify All Current Education Rules: Support intuitive view (#1256) 2023-03-02 18:22:24 +01:00
Loris S
cff3fc8804 Modify S5131(Multiple Languages): Add CSPs to 'Going The Extra Mile' (#1239) 2023-03-02 18:22:24 +01:00
Loris S
1253c0a013 Modify Multiple Rules(Education): Standardization of impact files (#1240) 2023-03-02 18:22:24 +01:00
hendrik-buchwald-sonarsource
ef80aeb0bf [Education] Modify rule S5131: Improve language (#1177) 2023-03-02 18:07:54 +01:00
Christophe Zürn
47ba59f3b5 RULEAPI-766 Add documentation and integrity checks for new education rule descriptions format (#1098) 2023-03-02 18:07:54 +01:00
Christophe Zurn
7c36d2a006 SONARSEC-3113 Update code example layouts of S5131 (XSS) rule description 2023-03-02 18:07:54 +01:00
Christophe Zurn
bb64555a09 SONARSEC-3109 Merge all resources together 2023-03-02 18:07:54 +01:00
Christophe Zurn
e7cf1c030e SONARSEC-3109 S5131 XSS rule should contain context-specific patches 2023-03-02 18:07:54 +01:00
Christophe Zürn
e8563c6351 [Education] Update code example layout of S5131 (XSS) (#1018)
* Update code examples of data encoding to use more vertical space

* Compliant / Noncompliant code examples are one after the other
2023-03-02 18:07:54 +01:00
Christophe Zürn
8ee3e9e8c7 Remove headers for empty section (#1017) 2023-03-02 18:07:54 +01:00
Roberto Orlandi
47d95f6802 SONARSEC-3035 Adapt images of educational rule descriptions (#1010) 2023-03-02 18:07:54 +01:00
Roberto Orlandi
83eefb94b5 Education s5131 one file per language (#1002) 2023-03-02 18:07:54 +01:00
Christophe Zürn
db2f440797
SONARSEC-3163 Add education principles to S5131 metadata json file (#1155) 2022-08-09 12:06:31 +02:00
Alexandre Gigleux
01bad1b800
Map rules to OWASP ASVS 4 (#1110)
https://sonarsource.atlassian.net/browse/MMF-2794
2022-07-29 13:35:38 +02:00
pedro-oliveira-sonarsource
082b3ef269
Modify: Fix old/broken embedded links (#1100) 2022-07-08 13:58:56 +02:00
pedro-oliveira-sonarsource
b04b29019c
[APPSEC-3] Security rules are mapped to PCI DSS 4.0 (#1007) 2022-05-24 16:19:27 +02:00
Karim El Ouerghemmi
c34cebc122
Adapt python code example (#1012) 2022-05-24 13:56:11 +02:00
pedro-oliveira-sonarsource
4cd575af12
[APPSEC-2] New security standard - PCI DSS 3.2 (#1005) 2022-05-23 09:00:28 +02:00
jtingsanchali
96d9ddb930
RULEAPI-755 Update CWE URLs by removing .html suffix and update with https protocol (#926)
* Change affects only see.adoc and rule.adoc files, not comments-and-links.adoc files
2022-04-07 08:53:59 -05:00
Fred Tingaud
b4161466e6
RULEAPI-661: Add syntax coloring 2022-02-04 16:28:24 +00:00
Loris S
2d01928240
Modify Rule S5131: Message clarity (#688) 2022-01-12 15:11:54 +00:00
hendrik-buchwald-sonarsource
651157eb2a
Modify rule S5131: Make description more precise (#665) 2021-12-17 13:38:57 +01:00
Loris S
4774e72dc1
Modify Rules: Multiple typo on missing hyphens (#660) 2021-12-13 16:18:55 +01:00
Pierre-Loup
5a2828b558
Modify rule S5131: improve description (#633) 2021-12-09 11:26:12 +00:00
Pierre-Loup
e7ad1012e3
RULEAPI-709: Security rules are mapped to the OWASP Top 10 2021 security-standard (#545) 2021-11-01 15:00:32 +01:00
Pierre-Loup
547094ab3c
Update CWE mapping (#534) 2021-10-28 10:07:16 +02:00
Arseniy Zaostrovnykh
6a0ec99e78
RULEAPI-706: Add quick fixes metadata 2021-10-07 09:23:15 +00:00
Arseniy Zaostrovnykh
2301f5808e
RULEAPI-695: remove extra/coveredLanguages field 2021-09-28 13:36:45 +02:00
Arseniy Zaostrovnykh
ec55b6ead1
RULEAPI-687: Migrate legacy keys from Jira RSPEC (#392) 2021-09-24 09:08:46 +02:00
Arseniy Zaostrovnykh
f7904cebe7
RULEAPI-666: Migrate the "List of parameters", "Highlighting" and "Message" fields from jira RSPEC (#346) 2021-09-20 13:38:42 +00:00