SonarSource · andrea-guarino-sonarsource · Sep 27, 2019 · Sep 27, 2019
diff --git a/python-checks/src/main/resources/org/sonar/l10n/py/rules/python/S2245.html b/python-checks/src/main/resources/org/sonar/l10n/py/rules/python/S2245.html
@@ -23,18 +23,18 @@ <h2>Recommended Secure Coding Practices</h2>
   <li> Use the generated random values only once. </li>
   <li> You should not expose the generated random value. If you have to store it, make sure that the database or file is secure. </li>
 </ul>
-<h2>Questionable Code Example</h2>
+<h2>Sensitive Code Example</h2>
 <pre>
 import random
 
-random.getrandbits(1) # Questionable
-random.randint(0,9) # Questionable
-random.random()  # Questionable
+random.getrandbits(1) # Sensitive
+random.randint(0,9) # Sensitive
+random.random()  # Sensitive
 
 # the following functions are sadly used to generate salt by selecting characters in a string ex: "abcdefghijk"...
-random.sample(['a', 'b'], 1)  # Questionable
-random.choice(['a', 'b'])  # Questionable
-random.choices(['a', 'b'])  # Questionable
+random.sample(['a', 'b'], 1)  # Sensitive
+random.choice(['a', 'b'])  # Sensitive
+random.choices(['a', 'b'])  # Sensitive
 </pre>
 <h2>See</h2>
 <ul>

diff --git a/python-checks/src/main/resources/org/sonar/l10n/py/rules/python/S4507.html b/python-checks/src/main/resources/org/sonar/l10n/py/rules/python/S4507.html
@@ -30,9 +30,9 @@ <h2>Sensitive Code Example</h2>
 def custom_config(config):
     settings.configure(default_settings=config, DEBUG=True)  # Sensitive
 </pre>
-<p>Django's "global_settings.py" configuration file</p>
+<p>Django's "settings.py" or "global_settings.py" configuration file</p>
 <pre>
-# NOTE: The following code raises issues only if the file is named "global_settings.py". This is the default
+# NOTE: The following code raises issues only if the file is named "settings.py" or "global_settings.py". This is the default
 # name of Django configuration file
 
 DEBUG = True  # Sensitive

diff --git a/python-checks/src/main/resources/org/sonar/l10n/py/rules/python/S4787.html b/python-checks/src/main/resources/org/sonar/l10n/py/rules/python/S4787.html
@@ -7,7 +7,7 @@
 <p>Proper encryption requires both the encryption algorithm and the key to be strong. Obviously the private key needs to remain secret and be renewed
 regularly. However these are not the only means to defeat or weaken an encryption.</p>
 <p> </p>
-<p>This rule flags function calls that initiate encryption/decryption. The goal is to guide security code reviews.</p>
+<p>This rule flags function calls that initiate encryption/decryption.</p>
 <h2>Ask Yourself Whether</h2>
 <ul>
   <li> the private key might not be random, strong enough or the same key is reused for a long long time. </li>
@@ -51,7 +51,7 @@ <h2>Recommended Secure Coding Practices</h2>
       <li> Cipher Block Chaining (CBC) with PKCS#5 padding (or PKCS#7) is susceptible to padding oracle attacks. </li>
     </ul> </li>
 </ul>
-<h2>Questionable Code Example</h2>
+<h2>Sensitive Code Example</h2>
 <p><code>cryptography</code> module</p>
 <pre>
 from cryptography.fernet import Fernet
@@ -61,17 +61,17 @@ <h2>Questionable Code Example</h2>
 
 
 def encrypt(key):
-    Fernet(key)  # Questionable
-    ChaCha20Poly1305(key)  # Questionable
-    AESGCM(key)  # Questionable
-    AESCCM(key)  # Questionable
+    Fernet(key)  # Sensitive
+    ChaCha20Poly1305(key)  # Sensitive
+    AESGCM(key)  # Sensitive
+    AESCCM(key)  # Sensitive
 
 
-private_key = rsa.generate_private_key()  # Questionable
+private_key = rsa.generate_private_key()  # Sensitive
 
 
 def encrypt2(algorithm, mode, backend):
-    Cipher(algorithm, mode, backend)  # Questionable
+    Cipher(algorithm, mode, backend)  # Sensitive
 </pre>
 <p><code>pynacl</code> library</p>
 <pre>
@@ -80,11 +80,11 @@ <h2>Questionable Code Example</h2>
 
 
 def public_encrypt(secret_key, public_key):
-    Box(secret_key, public_key)  # Questionable
+    Box(secret_key, public_key)  # Sensitive
 
 
 def secret_encrypt(key):
-    SecretBox(key)  # Questionable
+    SecretBox(key)  # Sensitive
 </pre>
 <h2>See</h2>
 <ul>

diff --git a/python-checks/src/main/resources/org/sonar/l10n/py/rules/python/S4792.html b/python-checks/src/main/resources/org/sonar/l10n/py/rules/python/S4792.html
@@ -51,40 +51,40 @@ <h2>Recommended Secure Coding Practices</h2>
   failed logins, successful logins, server side input validation failures, access denials and any important transaction. </li>
   <li> Monitor the logs for any suspicious activity. </li>
 </ul>
-<h2>Questionable Code Example</h2>
+<h2>Sensitive Code Example</h2>
 <pre>
 import logging
 from logging import Logger, Handler, Filter
 from logging.config import fileConfig, dictConfig
 
-logging.basicConfig()  # Questionable
+logging.basicConfig()  # Sensitive
 
-logging.disable()  # Questionable
+logging.disable()  # Sensitive
 
 
 def update_logging(logger_class):
-    logging.setLoggerClass(logger_class)  # Questionable
+    logging.setLoggerClass(logger_class)  # Sensitive
 
 
 def set_last_resort(last_resort):
-    logging.lastResort = last_resort  # Questionable
+    logging.lastResort = last_resort  # Sensitive
 
 
-class CustomLogger(Logger):  # Questionable
+class CustomLogger(Logger):  # Sensitive
     pass
 
 
-class CustomHandler(Handler):  # Questionable
+class CustomHandler(Handler):  # Sensitive
     pass
 
 
-class CustomFilter(Filter):  # Questionable
+class CustomFilter(Filter):  # Sensitive
     pass
 
 
 def update_config(path, config):
-    fileConfig(path)  # Questionable
-    dictConfig(config)  # Questionable
+    fileConfig(path)  # Sensitive
+    dictConfig(config)  # Sensitive
 </pre>
 <h2>See</h2>
 <ul>

diff --git a/python-checks/src/main/resources/org/sonar/l10n/py/rules/python/S5332.html b/python-checks/src/main/resources/org/sonar/l10n/py/rules/python/S5332.html
@@ -32,19 +32,19 @@ <h2>Recommended Secure Coding Practices</h2>
 application or system. </p>
 <h2>Exceptions</h2>
 <p>Exception: the url domain component is a loopback address.</p>
-<h3>Noncompliant Code Example</h3>
+<h3>Sensitive Code Example</h3>
 <pre>
-url = "http://exemple.com" # Noncompliant
-url = "ftp://anonymous@exemple.com" # Noncompliant
-url = "telnet://anonymous@exemple.com" # Noncompliant
+url = "http://exemple.com" # Sensitive
+url = "ftp://anonymous@exemple.com" # Sensitive
+url = "telnet://anonymous@exemple.com" # Sensitive
 
 
 import telnetlib
-cnx = telnetlib.Telnet("towel.blinkenlights.nl") # Noncompliant
+cnx = telnetlib.Telnet("towel.blinkenlights.nl") # Sensitive
 
 
 import ftplib
-cnx = ftplib.FTP("194.244.111.175") # Noncompliant
+cnx = ftplib.FTP("194.244.111.175") # Sensitive
 </pre>
 <h3>Compliant Solution</h3>
 <pre>

diff --git a/python-checks/src/main/resources/org/sonar/l10n/py/rules/python/S5332.json b/python-checks/src/main/resources/org/sonar/l10n/py/rules/python/S5332.json
@@ -6,7 +6,7 @@
     "cwe",
     "owasp-a3"
   ],
-  "defaultSeverity": "Blocker",
+  "defaultSeverity": "Critical",
   "ruleSpecification": "RSPEC-5332",
   "sqKey": "S5332",
   "scope": "Main",

diff --git a/python-checks/src/main/resources/org/sonar/l10n/py/rules/python/S5443.html b/python-checks/src/main/resources/org/sonar/l10n/py/rules/python/S5443.html
@@ -42,12 +42,12 @@ <h2>Recommended Secure Coding Practices</h2>
       <li> The file will be destroyed as soon as it is closed </li>
     </ul> </li>
 </ul>
-<h2>Sensitive Code Examples</h2>
+<h2>Sensitive Code Example</h2>
 <pre>
-file = open("/tmp/temporary_file","w+") # Questionable
+file = open("/tmp/temporary_file","w+") # Sensitive
 </pre>
 <pre>
-tmp_dir = os.environ.get('TMPDIR') # Questionable
+tmp_dir = os.environ.get('TMPDIR') # Sensitive
 file = open(tmp_dir+"/temporary_file","w+")
 </pre>
 <h2>Compliant Solution</h2>

diff --git a/sonarpedia.json b/sonarpedia.json
@@ -3,7 +3,7 @@
   "languages": [
     "PY"
   ],
-  "latest-update": "2019-09-12T12:14:07.869218Z",
+  "latest-update": "2019-09-27T09:04:56.450672Z",
   "options": {
     "no-language-in-filenames": true,
     "preserve-filenames": true