42 Commits

Author SHA1 Message Date
github-actions[bot]
df5229c7be
Create rule S7203: Java Keystore files should not disclose cryptographic private keys (#4685) 2025-02-28 08:05:15 +00:00
daniel-teuchert-sonarsource
76ccee7856
Fix multiple broken links (#4712)
* Fix multiple broken links

* Remove postman blog post because the link does not work properly

* Re add postman resource

* Undo postman changes
2025-02-27 16:05:39 +01:00
Sebastien Marichal
0a7e283d1b
SONARPLSQL-805 S3921: Update RSPEC to mention data dictionary (#4544) 2024-11-27 14:11:29 +01:00
github-actions[bot]
0b279b2bf2
Create rule S7164: Dropbox app credentials should not be disclosed (#4501)
* Create rule S7164

* Initial content

* Additional content

---------

Co-authored-by: jamie-anderson-sonarsource <jamie-anderson-sonarsource@users.noreply.github.com>
Co-authored-by: Jamie Anderson <127742609+jamie-anderson-sonarsource@users.noreply.github.com>
2024-11-15 16:12:02 +00:00
github-actions[bot]
8d1152d450
Create rule S7161: Tableau secrets should not be disclosed (#4497)
* Create rule S7161

* Add text

* Apply suggestions from code review

Co-authored-by: Jamie Anderson <127742609+jamie-anderson-sonarsource@users.noreply.github.com>

---------

Co-authored-by: loris-s-sonarsource <loris-s-sonarsource@users.noreply.github.com>
Co-authored-by: Loris Sierra <loris.sierra@sonarsource.com>
Co-authored-by: Loris S. <91723853+loris-s-sonarsource@users.noreply.github.com>
Co-authored-by: Jamie Anderson <127742609+jamie-anderson-sonarsource@users.noreply.github.com>
2024-11-15 16:56:28 +01:00
Pierre-Loup
a7bff601e5
Remove mention to "pornographic material" in shared phising.adoc (#4480) 2024-11-12 12:27:14 +01:00
Sebastien Marichal
716a7aa85d
Modify S3431: Promote C# rule to SonarWay (#4127) 2024-08-09 10:58:55 +02:00
github-actions[bot]
7e2174bd6f
Create rule S6989: Adafruit IO API keys should not be disclosed (#4009)
* Create rule S6989

* Add content for S6989

* Add documentation link

---------

Co-authored-by: jamie-anderson-sonarsource <jamie-anderson-sonarsource@users.noreply.github.com>
Co-authored-by: Jamie Anderson <127742609+jamie-anderson-sonarsource@users.noreply.github.com>
2024-06-28 11:17:39 +01:00
github-actions[bot]
c61e87ceda
Create rule S6988 (#3991)
* Create rule S6988

* Add initial rule content

* Generalize content and move it to a shared location.

---------

Co-authored-by: jamie-anderson-sonarsource <jamie-anderson-sonarsource@users.noreply.github.com>
Co-authored-by: Jamie Anderson <jamie.anderson@sonarsource.com>
2024-06-28 09:53:36 +01:00
Jamie Anderson
9ee16daa47
Modify rules: Add STIG AS&D 2023-06-08 mappings (#3914)
* Update JSON schema to include STIG ASD 2023-06-08 mapping

* Update rules to add STIG metadata mappings

---------

Co-authored-by: Loris Sierra <loris.sierra@sonarsource.com>
2024-05-06 08:56:31 +02:00
Marco Borgeaud
fa678815a7
Modify rules S946,S2107,S3470,S3490,S5312,S6183: Fix links & minor grammar improvements (#3737) 2024-03-08 13:13:25 +01:00
Tim Pohlmann
6aed7888c4
Move dotnet keywords and concepts to shared_content (#3699) 2024-02-29 09:13:05 +01:00
github-actions[bot]
65ec930f11
Create rule S6910 (#3610)
* Create rule S6910

* Added description and metadata

---------

Co-authored-by: daniel-teuchert-sonarsource <daniel-teuchert-sonarsource@users.noreply.github.com>
Co-authored-by: Daniel Teuchert <daniel.teuchert@sonarsource.com>
Co-authored-by: daniel-teuchert-sonarsource <141642369+daniel-teuchert-sonarsource@users.noreply.github.com>
2024-02-08 11:31:38 +01:00
Pierre-Loup
770348d041
Avoid OWASP Top 10 security-standard mismatch between metadata and description links (RULEAPI-798) (#3537)
* Add check for security standard mismatch

* Fix security standard mismatches

* Fix Resources/Standards links for secrets rules

* Fix check

* Fix links and update security standard mapping

* Fix maintanability issue

* Apply review suggestions

* Apply suggestions from code review

Co-authored-by: Egon Okerman <egon.okerman@sonarsource.com>

* Fix typo

Co-authored-by: Egon Okerman <egon.okerman@sonarsource.com>

---------

Co-authored-by: Egon Okerman <egon.okerman@sonarsource.com>
2024-01-17 17:20:28 +01:00
Egon Okerman
d1417e82f8
Modify CWE and OWASP Top 10 links to follow standard link format (APPSEC-1134) (#3529)
* Fix all CWE references

* Fix all OWASP references

* Fix missing CWE prefixes
2024-01-15 17:15:56 +01:00
Fred Tingaud
22b4470f2a
Modify CFamily rules: CPP-4080 Refresh and standardize CppCoreGuidelines references (#3514)
Update all links to C++ Core Guidelines to `e49158a`.

Refresh done using the following script and some manual edits:
db76e34e74/personal/fred-tingaud/rspec/refresh-cppcoreguidelines.py

When re-using this script, be mindful that:
 - it does not cover `shared_content`
 - it does not properly escape inline code in links (e.g., "[=]" or "`mutex`es")
 - it does not change `C++` to `{cpp}` in link titles.

Co-authored-by: Marco Borgeaud <marco.borgeaud@sonarsource.com>
2023-12-20 10:08:18 +01:00
Marco Borgeaud
34814f787b
Remove links to SANS Top 25 CWEs (#3322)
These links are no longer relevant since SANS now just link to CWE, and we already have links to CWEs.
2023-10-18 13:16:00 +00:00
github-actions[bot]
a422950ed5
Create rule S6793: ARIA properties in DOM elements should have valid values (#3200)
You can preview this rule
[here](https://sonarsource.github.io/rspec/#/rspec/S6793/javascript)
(updated a few minutes after each push).
2023-10-12 14:12:47 +02:00
Philipp Dominik Schubert
f45132d5aa
Modify rule S2637: Expand and adjust for LaYC
## Review

A dedicated reviewer checked the rule description successfully for:

- [x] logical errors and incorrect information
- [x] information gaps and missing content
- [x] text style and tone
- [x] PR summary and labels follow [the
guidelines](https://github.com/SonarSource/rspec/#to-modify-an-existing-rule)

---------

Co-authored-by: Arseniy Zaostrovnykh <arseniy.zaostrovnykh@sonarsource.com>
2023-10-04 13:02:47 +02:00
Anton Haubner
9b3b79f51c
Modify rule S3518: More LaYC Content for Python and Java (#3167) 2023-09-28 11:35:02 +02:00
Loris S
cf35afd3dd
Modify S6698&S6703&S6697: Add a warning against default values (#3121)
## Review

A dedicated reviewer checked the rule description successfully for:

- [ ] logical errors and incorrect information
- [ ] information gaps and missing content
- [ ] text style and tone
- [ ] PR summary and labels follow [the
guidelines](https://github.com/SonarSource/rspec/#to-modify-an-existing-rule)

---------

Co-authored-by: daniel-teuchert-sonarsource <141642369+daniel-teuchert-sonarsource@users.noreply.github.com>
2023-09-22 10:48:47 +00:00
github-actions[bot]
168f231de8
Create rule S6769: Shopify tokens should not be disclosed (APPSEC-1076) (#3068)
You can preview this rule
[here](https://sonarsource.github.io/rspec/#/rspec/S6769/secrets)
(updated a few minutes after each push).

## Review

A dedicated reviewer checked the rule description successfully for:

- [ ] logical errors and incorrect information
- [ ] information gaps and missing content
- [ ] text style and tone
- [ ] PR summary and labels follow [the
guidelines](https://github.com/SonarSource/rspec/#to-modify-an-existing-rule)

---------

Co-authored-by: egon-okerman-sonarsource <egon-okerman-sonarsource@users.noreply.github.com>
Co-authored-by: Egon Okerman <egon.okerman@sonarsource.com>
2023-09-20 10:12:37 +02:00
github-actions[bot]
95d7e2c516
Create rule S6755: DigitalOcean tokens should not be disclosed (APPSEC-1063) (#3029)
You can preview this rule
[here](https://sonarsource.github.io/rspec/#/rspec/S6755/secrets)
(updated a few minutes after each push).

## Review

A dedicated reviewer checked the rule description successfully for:

- [ ] logical errors and incorrect information
- [ ] information gaps and missing content
- [ ] text style and tone
- [ ] PR summary and labels follow [the
guidelines](https://github.com/SonarSource/rspec/#to-modify-an-existing-rule)

---------

Co-authored-by: egon-okerman-sonarsource <egon-okerman-sonarsource@users.noreply.github.com>
Co-authored-by: Egon Okerman <egon.okerman@sonarsource.com>
Co-authored-by: gaetan-ferry-sonarsource <112399173+gaetan-ferry-sonarsource@users.noreply.github.com>
2023-09-19 17:40:09 +02:00
Marco Borgeaud
ebe334e961
Modify rule S4999,S5000: LaYC format (#2712) 2023-09-19 08:14:39 +02:00
github-actions[bot]
054bdfb71c
Create rule S6751: PyPI tokens should not be disclosed (APPSEC-1073) (#3021)
You can preview this rule
[here](https://sonarsource.github.io/rspec/#/rspec/S6751/secrets)
(updated a few minutes after each push).

## Review

A dedicated reviewer checked the rule description successfully for:

- [ ] logical errors and incorrect information
- [ ] information gaps and missing content
- [ ] text style and tone
- [ ] PR summary and labels follow [the
guidelines](https://github.com/SonarSource/rspec/#to-modify-an-existing-rule)

---------

Co-authored-by: egon-okerman-sonarsource <egon-okerman-sonarsource@users.noreply.github.com>
Co-authored-by: Egon Okerman <egon.okerman@sonarsource.com>
2023-09-15 15:25:35 +02:00
github-actions[bot]
06e4b6313d
Create rule S6758: NPM access tokens should not be disclosed (APPSEC-1064) (#3041)
You can preview this rule
[here](https://sonarsource.github.io/rspec/#/rspec/S6758/secrets)
(updated a few minutes after each push).

## Review

A dedicated reviewer checked the rule description successfully for:

- [ ] logical errors and incorrect information
- [ ] information gaps and missing content
- [ ] text style and tone
- [ ] PR summary and labels follow [the
guidelines](https://github.com/SonarSource/rspec/#to-modify-an-existing-rule)

---------

Co-authored-by: egon-okerman-sonarsource <egon-okerman-sonarsource@users.noreply.github.com>
Co-authored-by: Egon Okerman <egon.okerman@sonarsource.com>
2023-09-15 14:20:15 +02:00
Loris S
80179dd99b
Modify S6290(secrets): Validation (#3079)
## Review

A dedicated reviewer checked the rule description successfully for:

- [ ] logical errors and incorrect information
- [ ] information gaps and missing content
- [ ] text style and tone
- [ ] PR summary and labels follow [the
guidelines](https://github.com/SonarSource/rspec/#to-modify-an-existing-rule)

---------

Co-authored-by: daniel-teuchert-sonarsource <141642369+daniel-teuchert-sonarsource@users.noreply.github.com>
2023-09-14 15:10:18 +00:00
github-actions[bot]
392e33a6f7 Create rule S6718(secrets): Stripe Keys should not be disclosed (#2943)
You can preview this rule
[here](https://sonarsource.github.io/rspec/#/rspec/S6718/secrets)
(updated a few minutes after each push).

## Review

A dedicated reviewer checked the rule description successfully for:

- [ ] logical errors and incorrect information
- [ ] information gaps and missing content
- [ ] text style and tone
- [ ] PR summary and labels follow [the
guidelines](https://github.com/SonarSource/rspec/#to-modify-an-existing-rule)

---------

Co-authored-by: loris-s-sonarsource <loris-s-sonarsource@users.noreply.github.com>
Co-authored-by: Loris Sierra <loris.sierra@sonarsource.com>
Co-authored-by: Loris S <91723853+loris-s-sonarsource@users.noreply.github.com>
2023-08-29 16:01:09 +02:00
github-actions[bot]
f283b8c276 Create rule S6731(secrets): Slack Bot Tokens should not be disclosed (#2973)
You can preview this rule
[here](https://sonarsource.github.io/rspec/#/rspec/S6731/secrets)
(updated a few minutes after each push).

## Review

A dedicated reviewer checked the rule description successfully for:

- [ ] logical errors and incorrect information
- [ ] information gaps and missing content
- [ ] text style and tone
- [ ] PR summary and labels follow [the
guidelines](https://github.com/SonarSource/rspec/#to-modify-an-existing-rule)

---------

Co-authored-by: loris-s-sonarsource <loris-s-sonarsource@users.noreply.github.com>
Co-authored-by: Loris Sierra <loris.sierra@sonarsource.com>
Co-authored-by: Loris S <91723853+loris-s-sonarsource@users.noreply.github.com>
2023-08-29 16:01:09 +02:00
github-actions[bot]
990ffb5be5 Create rule S6723(secrets): Mailgun API keys should not be disclosed (#2948)
You can preview this rule
[here](https://sonarsource.github.io/rspec/#/rspec/S6723/secrets)
(updated a few minutes after each push).

## Review

A dedicated reviewer checked the rule description successfully for:

- [ ] logical errors and incorrect information
- [ ] information gaps and missing content
- [ ] text style and tone
- [ ] PR summary and labels follow [the
guidelines](https://github.com/SonarSource/rspec/#to-modify-an-existing-rule)

---------

Co-authored-by: loris-s-sonarsource <loris-s-sonarsource@users.noreply.github.com>
Co-authored-by: Loris Sierra <loris.sierra@sonarsource.com>
2023-08-29 16:01:09 +02:00
github-actions[bot]
ec4643680c Create rule S6720(secrets): Zapier keys should not be disclosed (#2945)
You can preview this rule
[here](https://sonarsource.github.io/rspec/#/rspec/S6720/secrets)
(updated a few minutes after each push).

## Review

A dedicated reviewer checked the rule description successfully for:

- [ ] logical errors and incorrect information
- [ ] information gaps and missing content
- [ ] text style and tone
- [ ] PR summary and labels follow [the
guidelines](https://github.com/SonarSource/rspec/#to-modify-an-existing-rule)

---------

Co-authored-by: loris-s-sonarsource <loris-s-sonarsource@users.noreply.github.com>
Co-authored-by: Loris Sierra <loris.sierra@sonarsource.com>
2023-08-28 14:53:45 +02:00
Philipp Dominik Schubert
1595dcd062
Modify rule S2095: Expand and adjust for LaYC
## Review

A dedicated reviewer checked the rule description successfully for:

- [ ] logical errors and incorrect information
- [ ] information gaps and missing content
- [ ] text style and tone
- [ ] PR summary and labels follow [the
guidelines](https://github.com/SonarSource/rspec/#to-modify-an-existing-rule)
2023-08-25 11:40:35 +02:00
Loris S
1f304e54ca
Create Shared content: Make impacts consistents across messenger secrets (#2950)
## Review

A dedicated reviewer checked the rule description successfully for:

- [ ] logical errors and incorrect information
- [ ] information gaps and missing content
- [ ] text style and tone
- [ ] PR summary and labels follow [the
guidelines](https://github.com/SonarSource/rspec/#to-modify-an-existing-rule)

---------

Co-authored-by: daniel-teuchert-sonarsource <141642369+daniel-teuchert-sonarsource@users.noreply.github.com>
2023-08-24 14:27:22 +02:00
hendrik-buchwald-sonarsource
55da3e8734
Use new link format for secret resources (#2845) 2023-08-10 11:26:56 +02:00
github-actions[bot]
91b004957f
Create rule S6686: Clarifai API keys should not be disclosed (#2819) 2023-08-09 14:26:46 +02:00
hendrik-buchwald-sonarsource
93479de5a1
Modify rule S6652: Separate resources in multiple files (#2828) 2023-08-08 12:26:10 +00:00
hendrik-buchwald-sonarsource
32bbe863a4
Modify rule S6652: Move content to shared directory (#2810) 2023-08-07 15:49:00 +02:00
Marco Borgeaud
c8cb1f6fb0
Modify rule S1048,S3654: LaYC format 2023-08-04 09:38:26 +02:00
tomasz-kaminski-sonarsource
c5cf32fc30
Modify rule S3529: Adapt to LaYC 2023-08-03 14:20:30 +00:00
Arseniy Zaostrovnykh
46a58e80ca
Modify rule S2107: Expand and adjust for LaYC
I moved and closed the Java rule description because they do not plan to
implement it, but it is nice to preserve the description for posterity.
2023-08-02 14:52:06 +00:00
Marco Borgeaud
6cae06f38c
Modify rule S1916: LaYC format (#2711)
Share content with S2323.
2023-08-02 09:47:38 +00:00
Fred Tingaud
dc89dd499c
Create a shared_content folder at root 2023-07-20 12:17:32 +02:00