5184 Commits

Author SHA1 Message Date
teemu-rytilahti-sonarsource
8586551b59
Add newlines around includes in secrets template (#4718)
* Add newlines around includes in secrets template

* Mention that new lines are needed around includes

---------

Co-authored-by: Daniel Teuchert <daniel.teuchert@sonarsource.com>
Co-authored-by: daniel-teuchert-sonarsource <141642369+daniel-teuchert-sonarsource@users.noreply.github.com>
2025-03-04 09:50:45 +01:00
SonarTech
91feb0da97 update coverage information 2025-03-04 02:43:53 +00:00
github-actions[bot]
909d3d025a
Create rule S7199 (#4676)
* Create rule S7199

* Add initial draft

* Mark rule as beta

* Generalize the contents, add commented out include directives for all available commons

* Move variables on top of the file for easy editing, add descriptions to impacts, fix ordering of common fixes

* Add generic impact text from S6652

* Fix unwanted whitespace change

* Add missing mandatory newlines between comments and includes

---------

Co-authored-by: teemu-rytilahti-sonarsource <teemu-rytilahti-sonarsource@users.noreply.github.com>
Co-authored-by: Teemu Rytilahti <teemu.rytilahti@sonarsource.com>
2025-03-03 13:44:04 +01:00
teemu-rytilahti-sonarsource
d76bab68bd
SONARTEXT-328 Improve generic secret template (#4714)
* Revise the secret rspec template

* Set status=beta for new secrets

* Revert back to old values for example_{secret,name,env} vars
2025-03-03 10:25:53 +00:00
SonarTech
3077f8ce6e update coverage information 2025-03-01 02:44:45 +00:00
zglicz
f0986b7056
Update S6426 to scope Tests (#4716)
Noticed this through the new configs realignment
2025-02-28 16:48:16 +01:00
github-actions[bot]
df5229c7be
Create rule S7203: Java Keystore files should not disclose cryptographic private keys (#4685) 2025-02-28 08:05:15 +00:00
SonarTech
c3d5e7ae01 update coverage information 2025-02-28 02:43:49 +00:00
daniel-teuchert-sonarsource
76ccee7856
Fix multiple broken links (#4712)
* Fix multiple broken links

* Remove postman blog post because the link does not work properly

* Re add postman resource

* Undo postman changes
2025-02-27 16:05:39 +01:00
github-actions[bot]
7cd779c09a
Create rule S7201: Exposing the Android file system to WebViews is security-sensitive (#4680) 2025-02-27 14:46:30 +00:00
Pierre-Loup
d63f01a9b1
Update S4507: Add kotlin code examples (SONARKT-580) (#4708) 2025-02-27 14:09:15 +01:00
Ilia Kebets
8b10fbcbb5
Modify S1135: remove Flex (#4704) 2025-02-27 08:09:10 +00:00
SonarTech
8d2a7efa47 update coverage information 2025-02-27 02:43:30 +00:00
github-actions[bot]
afc4f2638a
SONARJAVA-5163 Create rule S7198: Path.of should be preferred to Paths.get (#4670) 2025-02-26 16:50:20 +01:00
daniel-teuchert-sonarsource
1dc40b1a64
Update S2053: Align recommended salt length (#4711) 2025-02-26 15:09:46 +01:00
Michael Jabbour
99e38a9163
CPP-6162 S1265 Require sized delete since C++14 and definitions in the same file
* CPP-6162 S1265 Require sized delete since C++14 and definitions in the same file

* Remove requirement to be in the same file

---------

Co-authored-by: Mostafa Mohammed <mostafa.mohammed@sonarsource.com>
2025-02-26 11:08:39 +00:00
Jonas Wielage
1060d8a1b4
Modify rule S6953, S7021: Fix MQR inconsistencies (#4705) 2025-02-26 08:40:40 +00:00
Anton Haubner
67416c1eec
Modify rule S6945: Add MAINTAINABILITY quality, increase severity and impact levels (#4707)
* Modify rule S6945: Add MAINTAINABILITY quality.

S6945 does not necessarily indicate a bug since COND might not be set on
purpose.
Hence, keeping the type as `CODE_SMELL` appears correct.

However, as a code smell, we need to qualify its `MAINTAINABILITY` impact.

At the same time, we keep the existing `RELIABILITY` impact:
Not setting COND is a practice that not only leads to harder to debug code but
it may also lead to bugs

* Modify rule S6945: Upgrade severity and impact to Critical and HIGH

Following the documentation, MAINTAINABILITY issues should have at least HIGH
impact, and Critical severity, if they can lead to the introduction of bugs.

RELIABILITY issues should have at least HIGH impact, and Critical severity,
if they can for example cause corrupted data.

Both applies here. Hence, we upgrade the `defaultSeverity` and impact
levels.

These are the documentation link:
https://docs.sonarsource.com/sonarqube-server/2025.1/extension-guide/adding-coding-rules/#setting-severities-in-mqr-mode
https://docs.sonarsource.com/sonarqube-server/2025.1/extension-guide/adding-coding-rules/#setting-severities-in-se-mode
2025-02-26 09:30:10 +01:00
Anton Haubner
3cb75f0c8b
Modify rule S6977: Change type to BUG (#4706)
S6977 definitely impacts RELIABILITY, but it was typed as a
`CODE_SMELL`.
However, if reliability is the main quality of an issue, then it should
be paired with the `BUG` type.

S6977 is not a BUG in the sense that correctness is affected.
At the same time, the previous MAINTAINABILITY quality is not impacted at all.
Also, the issue does negatively affect performance, so it is bug in that sense.

Thus, the decision was made to change the type to `BUG`.
See also
https://sonarsource.slack.com/archives/C026N4DMXNK/p1740474666962219?thread_ts=1740420785.011249&cid=C026N4DMXNK
for an internal discussion.
2025-02-26 09:16:22 +01:00
SonarTech
f191b1e114 update coverage information 2025-02-26 02:43:04 +00:00
Marharyta
66586c5c75
DART-210 Fix discrepancies between MQR and severity for Dart rules
Rules affected: S7058, S7064, S7066, S7083, S7095, S7103, S7104, S7105, S7120
2025-02-25 15:49:31 +00:00
github-actions[bot]
de3124561f
Create rule S5659: JWT should be signed and verified with strong cipher algorithms for Go (#4668)
* Add go to rule S5659

* SONARGO-211: Add RSPEC for S5659 for Go

* Improve code examples

* Update rules/S5659/go/rule.adoc

Co-authored-by: teemu-rytilahti-sonarsource <teemu.rytilahti@sonarsource.com>

---------

Co-authored-by: daniel-teuchert-sonarsource <daniel-teuchert-sonarsource@users.noreply.github.com>
Co-authored-by: Daniel Teuchert <daniel.teuchert@sonarsource.com>
Co-authored-by: daniel-teuchert-sonarsource <141642369+daniel-teuchert-sonarsource@users.noreply.github.com>
Co-authored-by: teemu-rytilahti-sonarsource <teemu.rytilahti@sonarsource.com>
2025-02-25 16:42:12 +01:00
David Kunzmann
5e6349e3a1
Modify S6660: Fix impacts and default severity (#4703) 2025-02-24 16:40:43 +01:00
SonarTech
410a9972af update coverage information 2025-02-23 02:43:30 +00:00
Fred Tingaud
f16efb2b5c RULEAPI-834 Update remaining rules where defaultSeverity is different from MQR 2025-02-21 17:18:02 +01:00
Fred Tingaud
753b21a566 RULEAPI-834 Update remaining rules where defaultSeverity is different from MQR 2025-02-21 16:19:27 +01:00
Fred Tingaud
d8c3c03e56 RULEAPI-832 Fix missing automatically updatable rules 2025-02-21 15:39:32 +01:00
Nils Werner
656f853238
RULEAPI-834 Update rules where defaultSeverity is different from MQR (#4686) 2025-02-21 15:28:32 +01:00
github-actions[bot]
59fba4deac
Create rule S5445: Insecure temporary file creation methods should not be used (#4671)
* Add go to rule S5445

* Initial draft

* Add examples for temporary directories

---------

Co-authored-by: teemu-rytilahti-sonarsource <teemu-rytilahti-sonarsource@users.noreply.github.com>
Co-authored-by: Teemu Rytilahti <teemu.rytilahti@sonarsource.com>
2025-02-21 12:02:48 +01:00
Fred Tingaud
972b0e39c2 Automatically migrate all rules where defaultSeverity is Blocker and MQR is High 2025-02-20 19:58:25 +01:00
Yassin Kammoun
ea1ac05c78
RULEAPI-833 Add a new langage identifier for Rust (#4675) 2025-02-20 11:45:47 +01:00
github-actions[bot]
ba18ae7f08
Create rule S7187: PySpark Pandas DataFrame columns should not use a reserved name (#4622)
* Create rule S7187: PySpark Pandas DataFrame columns should not use a
reserved name

---------

Co-authored-by: joke1196 <joke1196@users.noreply.github.com>
Co-authored-by: David Kunzmann <david.kunzmann@sonarsource.com>
2025-02-20 11:22:12 +01:00
github-actions[bot]
f26dc7084d
Create rule S7196: Complex logic provided to PySpark withColumn method should be refactored into a separate expression (#4642)
* Create rule S7196: Complex logic provided to PySpark withColumn method should be refactored into a separate expression


---------

Co-authored-by: thomas-serre-sonarsource <thomas-serre-sonarsource@users.noreply.github.com>
Co-authored-by: Thomas Serre <thomas.serre@sonarsource.com>
2025-02-20 11:21:29 +01:00
github-actions[bot]
9d7de6d39d
Create rule S7182: The subset argument should be provided when using PySpark DataFrame dropDuplicates (#4615)
* Create Rule S7182: The `subset` argument should be provided when using PySpark DataFrame `dropDuplicates`



---------

Co-authored-by: joke1196 <joke1196@users.noreply.github.com>
Co-authored-by: David Kunzmann <david.kunzmann@sonarsource.com>
2025-02-20 11:20:42 +01:00
Fred Tingaud
fdf295d151 Update rules/S7119/cfamily/metadata.json
Co-authored-by: Loïc Joly <loic.joly@sonarsource.com>
2025-02-20 10:23:49 +01:00
Fred Tingaud
f78837a2bc Also add S6620 2025-02-20 10:23:49 +01:00
Fred Tingaud
c4ad5da103 Fix two more rules 2025-02-20 10:23:49 +01:00
Fred Tingaud
97ea439a11 Increase severity of S7127 2025-02-20 10:23:49 +01:00
Fred Tingaud
adae29df8e Fix discrepencies between MQR and severity for CFamily rules 2025-02-20 10:23:49 +01:00
SonarTech
60cddc7cc9 update coverage information 2025-02-20 02:42:22 +00:00
github-actions[bot]
ae4e0661ea
Create rule S7191: PySpark "withColumns" should be preferred over "withColumn" when multiple columns are specified (#4633)
* Create rule S7191

* Create rule S7191: PySpark  should be preferred over  when multiple columns are specified

* Fix after review

---------

Co-authored-by: thomas-serre-sonarsource <thomas-serre-sonarsource@users.noreply.github.com>
Co-authored-by: Thomas Serre <thomas.serre@sonarsource.com>
Co-authored-by: Guillaume Dequenne <guillaume.dequenne@sonarsource.com>
2025-02-19 17:06:04 +00:00
Pierre-Loup
e769e586c9
Update security rules: add OWASP Mobile Top 10 2024 security standard (APPSEC-2383) (#4660) 2025-02-19 17:19:00 +01:00
github-actions[bot]
c046fc94c4
Create rule S7195: PySpark lit(None) should be used when populating empty columns (#4638) 2025-02-19 10:58:21 +00:00
SonarTech
9966f12d52 update coverage information 2025-02-19 02:41:59 +00:00
github-actions[bot]
13111e20e7
SONARPY-2489 Create rule S7189 PySpark DataFrames used multiple times should be cached or persisted (#4627)
* SONARPY-2489 Create rule S7189 PySpark DataFrames used multiple times should be cached or persisted

* Fix after review

* Add information on when the rule actually triggers

---------

Co-authored-by: guillaume-dequenne-sonarsource <guillaume-dequenne-sonarsource@users.noreply.github.com>
Co-authored-by: Guillaume Dequenne <guillaume.dequenne@sonarsource.com>
2025-02-18 09:28:22 +01:00
SonarTech
3049db59e8 update coverage information 2025-02-18 02:41:07 +00:00
github-actions[bot]
e2133270e7
Create rule S6437: Credentials should not be hard-coded (#4641)
* Add go to rule S6437

* Add description for S6437 for Go

---------

Co-authored-by: daniel-teuchert-sonarsource <daniel-teuchert-sonarsource@users.noreply.github.com>
Co-authored-by: Daniel Teuchert <daniel.teuchert@sonarsource.com>
2025-02-17 15:53:59 +01:00
github-actions[bot]
a2320f1b8d
Create rule S4830: Server certificates should be verified during SSL/TLS connections (#4662)
* Add go to rule S4830

* Add examples

* Improve examples

* Update rules/S4830/go/rule.adoc

Co-authored-by: daniel-teuchert-sonarsource <141642369+daniel-teuchert-sonarsource@users.noreply.github.com>

---------

Co-authored-by: teemu-rytilahti-sonarsource <teemu-rytilahti-sonarsource@users.noreply.github.com>
Co-authored-by: Teemu Rytilahti <teemu.rytilahti@sonarsource.com>
Co-authored-by: daniel-teuchert-sonarsource <141642369+daniel-teuchert-sonarsource@users.noreply.github.com>
2025-02-17 15:53:21 +01:00
leonardo-pilastri-sonarsource
d22236c056 Modify S7190: change tags to target tests 2025-02-17 10:49:40 +01:00
zglicz
818f168bf5
Delete rules/S5742/javascript/metadata.json (#4667)
* Delete rules/S5742/javascript/metadata.json

* empty metadata.json
2025-02-17 10:43:29 +01:00