Skip to content

Update rule metadata to prepare v3.3 #897

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
guillaume-dequenne merged 1 commit into from
Mar 1, 2021
Merged

Update rule metadata to prepare v3.3 #897

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion python-checks/src/main/resources/org/sonar/l10n/py/rules/python/OneStatementPerLine.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -7,7 +7,7 @@
"constantCost": "1min"
},
"tags": [
"style"
"convention"
],
"defaultSeverity": "Major",
"ruleSpecification": "RSPEC-122",
Expand Down
6 changes: 4 additions & 2 deletions python-checks/src/main/resources/org/sonar/l10n/py/rules/python/S1045.html
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -58,6 +58,8 @@ <h2>Compliant Solution</h2>
print(e)
</pre>
<h2>See</h2>
<p> * Python Documentation - <a href="https://docs.python.org/3/reference/compound_stmts.html#the-try-statement">The <code>try</code>
statement</a></p>
<ul>
<li> Python Documentation - <a href="https://docs.python.org/3/reference/compound_stmts.html#the-try-statement">The <code>try</code> statement</a>
</li>
</ul>

3 changes: 1 addition & 2 deletions python-checks/src/main/resources/org/sonar/l10n/py/rules/python/S112.html
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -84,8 +84,7 @@ <h2>Compliant Solution</h2>
</pre>
<h2>See</h2>
<ul>
<li> PEP 352 <del></del> <a href="https://www.python.org/dev/peps/pep-0352/#exception-hierarchy-changes">Required Superclass for Exceptions</a>
</li>
<li> PEP 352 - <a href="https://www.python.org/dev/peps/pep-0352/#exception-hierarchy-changes">Required Superclass for Exceptions</a> </li>
<li> Python Documentation - <a href="https://docs.python.org/3/library/exceptions.html#BaseException">Built-in exceptions</a> </li>
<li> <a href="http://cwe.mitre.org/data/definitions/397.html">MITRE, CWE-397</a> - Declaration of Throws for Generic Exception </li>
<li> <a href="https://wiki.sei.cmu.edu/confluence/x/_DdGBQ">CERT, ERR07-J.</a> - Do not throw RuntimeException, Exception, or Throwable </li>
Expand Down
10 changes: 5 additions & 5 deletions python-checks/src/main/resources/org/sonar/l10n/py/rules/python/S113.html
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,8 +1,8 @@
<p>Some tools such as Git work better when files end with an empty line. This rule simply generates an issue if it is missing.</p>
<p>For example, a Git diff looks like this if the empty line is missing at the end of the file:</p>
<p>&lt;pre&gt;</p>
<p>+class Test:</p>
<p>+ pass</p>
<p> \ No newline at end of file</p>
<p>&lt;/pre&gt;</p>
<pre>
+class Test:
+ pass
\ No newline at end of file
</pre>

1 change: 0 additions & 1 deletion python-checks/src/main/resources/org/sonar/l10n/py/rules/python/S1143.html
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -55,7 +55,6 @@ <h2>Noncompliant Code Example</h2>
raise ValueError()
finally:
continue # Noncompliant

</pre>
<h2>Compliant Solution</h2>
<pre>
Expand Down
4 changes: 2 additions & 2 deletions python-checks/src/main/resources/org/sonar/l10n/py/rules/python/S1144.html
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -51,7 +51,7 @@ <h2>Compliant Solution</h2>
</pre>
<h2>See</h2>
<ul>
<li> <a href="https://docs.python.org/3.8/tutorial/classes.html#private-variables">Python documentation <del></del> Private Variables</a> </li>
<li> <a href="https://www.python.org/dev/peps/pep-0008/#designing-for-inheritance">PEP8 <del></del> Designing for Inheritance</a> </li>
<li> <a href="https://docs.python.org/3.8/tutorial/classes.html#private-variables">Python documentation – Private Variables</a> </li>
<li> <a href="https://www.python.org/dev/peps/pep-0008/#designing-for-inheritance">PEP8 – Designing for Inheritance</a> </li>
</ul>

1 change: 0 additions & 1 deletion python-checks/src/main/resources/org/sonar/l10n/py/rules/python/S1186.html
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -12,7 +12,6 @@ <h2>Noncompliant Code Example</h2>
class MyClass:
def mymethod1(self, foo="Noncompliant"):
pass

</pre>
<h2>Compliant Solution</h2>
<pre>
Expand Down
4 changes: 2 additions & 2 deletions python-checks/src/main/resources/org/sonar/l10n/py/rules/python/S1523.html
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4,8 +4,8 @@
<li> <a href="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-9802">CVE-2017-9802</a> </li>
</ul>
<p>Some APIs enable the execution of dynamic code by providing it as strings at runtime. These APIs might be useful in some very specific
meta-programming use-cases. However most of the time their use is frowned upon as they also increase the risk of <a
href="https://www.owasp.org/index.php/Code_Injection">Injected Code</a>. Such attacks can either run on the server or in the client (exemple: XSS
meta-programming use-cases. However most of the time their use is frowned upon because they also increase the risk of maliciously <a
href="https://www.owasp.org/index.php/Code_Injection">Injected Code</a>. Such attacks can either run on the server or in the client (example: XSS
attack) and have a huge impact on an application's security.</p>
<p>This rule marks for review each occurrence of such dynamic code execution. This rule does not detect code injections. It only highlights the use of
APIs which should be used sparingly and very carefully.</p>
Expand Down
14 changes: 12 additions & 2 deletions python-checks/src/main/resources/org/sonar/l10n/py/rules/python/S1523.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -7,10 +7,20 @@
"constantCost": "30min"
},
"tags": [

"cwe",
"owasp-a1"
],
"defaultSeverity": "Critical",
"ruleSpecification": "RSPEC-1523",
"sqKey": "S1523",
"scope": "Main"
"scope": "Main",
"securityStandards": {
"CWE": [
95,
470
],
"OWASP": [
"A1"
]
}
}
20 changes: 8 additions & 12 deletions python-checks/src/main/resources/org/sonar/l10n/py/rules/python/S2053.html
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,17 +1,13 @@
<p>In cryptography, "salt" is extra piece of data which is included in a hashing algorithm. It makes dictionary attacks more difficult. Using a
cryptographic hash function without an unpredictable salt increases the likelihood that an attacker will be able to successfully guess a hashed value
such as a password with a dictionary attack.</p>
<p>This rule raises an issue when a hashing function which has been specifically designed for hashing sensitive data, such as PBKDF2, is used with a
non-random, reused or too short salt value. It does not raise an issue on base hashing algorithms such as sha1 or md5 as these are often used for
other purposes.</p>
<p>In cryptography, a "salt" is an extra piece of data which is included when hashing a password. This makes <code>rainbow-table attacks</code> more
difficult. Using a cryptographic hash function without an unpredictable salt increases the likelihood that an attacker could successfully find the
hash value in databases of precomputed hashes (called <code>rainbow-tables</code>).</p>
<p>This rule raises an issue when a hashing function which has been specifically designed for hashing passwords, such as <code>PBKDF2</code>, is used
with a non-random, reused or too short salt value. It does not raise an issue on base hashing algorithms such as <code>sha1</code> or <code>md5</code>
as they should not be used to hash passwords.</p>
<h2>Recommended Secure Coding Practices</h2>
<ul>
<li> Use hashing functions generating their own salt or generate a long random salt of at least 32 bytes. </li>
<li> The salt is at least as long as the resulting hash value. </li>
<li> Provide the salt to a safe hashing function such as PBKDF2. </li>
<li> Save both the salt and the hashed value in the relevant database record; during future validation operations, the salt and hash can then be
retrieved from the database. The hash is recalculated with the stored salt and the value being validated, and the result compared to the stored
hash. </li>
<li> Use hashing functions generating their own secure salt or generate a secure random value of at least 16 bytes. </li>
<li> The salt should be unique by user password. </li>
</ul>
<h2>Noncompliant Code Example</h2>
<p>hashlib</p>
Expand Down
35 changes: 7 additions & 28 deletions python-checks/src/main/resources/org/sonar/l10n/py/rules/python/S2077.html
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,39 +1,18 @@
<p>Formatting strings used as SQL queries is security-sensitive. It has led in the past to the following vulnerabilities:</p>
<ul>
<li> <a href="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-9019">CVE-2018-9019</a> </li>
<li> <a href="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-7318">CVE-2018-7318</a> </li>
<li> <a href="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-5611">CVE-2017-5611</a> </li>
</ul>
<p>SQL queries often need to use a hardcoded SQL string with a dynamic parameter coming from a user request. Formatting a string to add those
parameters to the request is a bad practice as it can result in an <a href="https://www.owasp.org/index.php/SQL_Injection">SQL injection</a>. The safe
way to add parameters to a SQL query is to use SQL binding mechanisms.</p>
<p>Note that this rule does not detect SQL injections.</p>
<p>This rule flags the execution of formatted SQL via Django APIs. The goal is to guide security code reviews and to prevent a common bad
practice.</p>
<p>A string is considered formatted if it uses one of the following operations:</p>
<ul>
<li> <code>str.format(...)</code> </li>
<li> <code>str % str</code> </li>
<li> <code>str + str</code> </li>
<li> <code>f"SELECT * FROM mytable WHERE name = '{value}'"</code> </li>
<li> <code>F"SELECT * FROM mytable WHERE name = '{value}'"</code> </li>
</ul>
<p>Formatted SQL queries can be difficult to maintain, debug and can increase the risk of SQL injection when concatenating untrusted values into the
query. However, this rule doesn't detect SQL injections (unlike rule s3649), the goal is only to highlight complex/formatted queries.</p>
<h2>Ask Yourself Whether</h2>
<ul>
<li> the SQL query is built using string formatting technics, such as concatenating variables. </li>
<li> some of the values are coming from an untrusted source and are not sanitized. </li>
<li> Some parts of the query come from untrusted values (like user inputs). </li>
<li> The query is repeated/duplicated in other parts of the code. </li>
<li> The application must support different types of relational databases. </li>
</ul>
<p>There is a risk if you answered yes to any of those questions.</p>
<h2>Recommended Secure Coding Practices</h2>
<ul>
<li> Avoid building queries manually using formatting. If you do it anyway, do not include user input in this building process. </li>
<li> Use <a href="https://www.owasp.org/index.php/Query_Parameterization_Cheat_Sheet">parameterized queries, prepared statements, or stored
procedures</a> whenever possible. </li>
<li> Avoid executing SQL queries containing unsafe input in stored procedures or functions. </li>
<li> <a href="https://www.owasp.org/index.php/Input_Validation_Cheat_Sheet">Sanitize</a> every unsafe input. </li>
<li> Follow <a href="https://docs.djangoproject.com/en/3.0/topics/security/#sql-injection-protection">Django best practices</a>. </li>
procedures</a> and bind variables to SQL query parameters. </li>
<li> Consider using ORM frameworks if there is a need to have an abstract layer to access data. </li>
</ul>
<p>You can also reduce the impact of an attack by using a database account with low privileges.</p>
<h2>Sensitive Code Example</h2>
<pre>
from django.db import models
Expand Down
2 changes: 1 addition & 1 deletion python-checks/src/main/resources/org/sonar/l10n/py/rules/python/S2077.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -13,7 +13,7 @@
"bad-practice",
"sql"
],
"defaultSeverity": "Critical",
"defaultSeverity": "Major",
"ruleSpecification": "RSPEC-2077",
"sqKey": "S2077",
"scope": "Main",
Expand Down
11 changes: 6 additions & 5 deletions python-checks/src/main/resources/org/sonar/l10n/py/rules/python/S2115.html
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,6 +1,5 @@
<p>Databases should always be password protected. The use of a database connection with an empty password is a clear indication of a database that is
not protected.</p>
<p>This rule flags database connections with empty passwords.</p>
<p>When relying on the password authentication mode for the database connection, a secure password should be chosen.</p>
<p>This rule raises an issue when an empty password is used.</p>
<h2>Noncompliant Code Example</h2>
<p>Flask-SQLAlchemy</p>
<pre>
Expand Down Expand Up @@ -60,8 +59,10 @@ <h2>Compliant Solution</h2>
</pre>
<h2>See</h2>
<ul>
<li> <a href="https://www.owasp.org/index.php/Top_10-2017_A3-Sensitive_Data_Exposure">OWASP Top 10 2017 Category A3</a> - Sensitive Data Exposure
</li>
<li> <a href="https://owasp.org/www-project-top-ten/2017/A2_2017-Broken_Authentication.html">OWASP Top 10 2017 Category A2</a> - Broken
Authentication </li>
<li> <a href="https://owasp.org/www-project-top-ten/2017/A3_2017-Sensitive_Data_Exposure">OWASP Top 10 2017 Category A3</a> - Sensitive Data
Exposure </li>
<li> <a href="https://cwe.mitre.org/data/definitions/521.html">MITRE, CWE-521</a> - Weak Password Requirements </li>
</ul>

4 changes: 3 additions & 1 deletion python-checks/src/main/resources/org/sonar/l10n/py/rules/python/S2115.json
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,5 +1,5 @@
{
"title": "Databases should be password-protected",
"title": "A secure password should be used when connecting to a database",
"type": "VULNERABILITY",
"status": "ready",
"remediation": {
Expand All @@ -8,6 +8,7 @@
},
"tags": [
"cwe",
"owasp-a2",
"owasp-a3"
],
"defaultSeverity": "Blocker",
Expand All @@ -19,6 +20,7 @@
521
],
"OWASP": [
"A2",
"A3"
]
}
Expand Down
1 change: 0 additions & 1 deletion python-checks/src/main/resources/org/sonar/l10n/py/rules/python/S2159.html
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -16,7 +16,6 @@ <h2>Noncompliant Code Example</h2>

myvar = A() == 1 # Noncompliant. Always False.
myvar = A() != 1 # Noncompliant. Always True.

</pre>
<h2>Compliant Solution</h2>
<pre>
Expand Down
48 changes: 27 additions & 21 deletions python-checks/src/main/resources/org/sonar/l10n/py/rules/python/S2638.html
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,24 +2,28 @@
that relate to the Liskov Substitution Principle. Specifically, an overriding method should be callable with the same parameters as the overriden
one.</p>
<p>The following modifications are ok:</p>
<p> * Adding an optional parameter, i.e. with a default value, as long as they don't change the order of positional parameters.</p>
<p> * Renaming a positional-only parameter.</p>
<p> * Reordering keyword-only parameters.</p>
<p> * Adding a default value to an existing parameter.</p>
<p> * Changing the default value of an existing parameter.</p>
<p> * Extend the ways a parameter can be provided, i.e. change a keyword-only or positional-only parameter to a keyword-or-positional parameter. This
is only true if the order of positional parameters doesn't change. New positional parameters should be placed at the end.</p>
<p> * Adding a vararg parameter (<code>*args</code>).</p>
<p> * Adding a keywords parameter (<code>**kwargs</code>).</p>
<ul>
<li> Adding an optional parameter, i.e. with a default value, as long as they don't change the order of positional parameters. </li>
<li> Renaming a positional-only parameter. </li>
<li> Reordering keyword-only parameters. </li>
<li> Adding a default value to an existing parameter. </li>
<li> Changing the default value of an existing parameter. </li>
<li> Extend the ways a parameter can be provided, i.e. change a keyword-only or positional-only parameter to a keyword-or-positional parameter. This
is only true if the order of positional parameters doesn't change. New positional parameters should be placed at the end. </li>
<li> Adding a vararg parameter (<code>*args</code>). </li>
<li> Adding a keywords parameter (<code>**kwargs</code>). </li>
</ul>
<p>The following modifications are not ok:</p>
<p> * Removing parameters, even when they have default values.</p>
<p> * Adding mandatory parameters, i.e. without a default value.</p>
<p> * Removing the default value of a parameter.</p>
<p> * Reordering parameters, except when they are keyword-only parameters.</p>
<p> * Removing some ways of providing a parameter. If a parameter could be passed as keyword it should still be possible to pass it as keyword, and
the same is true for positional parameters.</p>
<p> * Removing a vararg parameter (<code>*args</code>).</p>
<p> * Removing a keywords parameter (<code>**kwargs</code>).</p>
<ul>
<li> Removing parameters, even when they have default values. </li>
<li> Adding mandatory parameters, i.e. without a default value. </li>
<li> Removing the default value of a parameter. </li>
<li> Reordering parameters, except when they are keyword-only parameters. </li>
<li> Removing some ways of providing a parameter. If a parameter could be passed as keyword it should still be possible to pass it as keyword, and
the same is true for positional parameters. </li>
<li> Removing a vararg parameter (<code>*args</code>). </li>
<li> Removing a keywords parameter (<code>**kwargs</code>). </li>
</ul>
<p>This rule raises an issue when the signature of an overriding method does not accept the same parameters as the overriden one. Only instance
methods are considered, class methods and static methods are ignored.</p>
<h2>Noncompliant Code Example:</h2>
Expand Down Expand Up @@ -65,7 +69,7 @@ <h2>Exceptions</h2>
<p>In theory renaming parameters also breaks Liskov Substitution Principle. Arguments can't be passed via keyword arguments anymore. However, <a
href="https://www.python.org/dev/peps/pep-0570/#consistency-in-subclasses">as PEP-570 says</a>, it is common to rename parameters when it improves
code readability and when arguments are always passed by position.</p>
<p> "Positional-Only Parameters" were introduced in python 3.8 to solve this problem. As most programs will need to support older versions of python,
<p>"Positional-Only Parameters" were introduced in python 3.8 to solve this problem. As most programs will need to support older versions of python,
this rule won't raise an issue on renamed parameters.</p>
<pre>
class ParentClass(object):
Expand All @@ -77,7 +81,9 @@ <h2>Exceptions</h2>
pass
</pre>
<h2>See</h2>
<p> * <a href="https://en.wikipedia.org/wiki/Liskov_substitution_principle">Wikipedia - Liskov substitution principle</a></p>
<p> * Python Enhancement Proposal (PEP) 3102 - <a href="https://www.python.org/dev/peps/pep-3102/">Keyword-Only Arguments</a></p>
<p> * Python Enhancement Proposal (PEP) 570 - <a href="https://www.python.org/dev/peps/pep-0570/">Python Positional-Only Parameters</a></p>
<ul>
<li> <a href="https://en.wikipedia.org/wiki/Liskov_substitution_principle">Wikipedia - Liskov substitution principle</a> </li>
<li> Python Enhancement Proposal (PEP) 3102 - <a href="https://www.python.org/dev/peps/pep-3102/">Keyword-Only Arguments</a> </li>
<li> Python Enhancement Proposal (PEP) 570 - <a href="https://www.python.org/dev/peps/pep-0570/">Python Positional-Only Parameters</a> </li>
</ul>

2 changes: 1 addition & 1 deletion python-checks/src/main/resources/org/sonar/l10n/py/rules/python/S2755.html
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -69,7 +69,7 @@ <h2>Noncompliant Code Example</h2>
<h2>Compliant Solution</h2>
<p><a href="https://lxml.de/">lxml</a> module:</p>
<ul>
<li> When parsing XML, disable <em>resolve</em>entities_ and <em>network access</em>: </li>
<li> When parsing XML, disable <code>resolve_entities</code> and <em>network access</em>: </li>
</ul>
<pre>
parser = etree.XMLParser(resolve_entities=False, no_network=True) # Compliant
Expand Down
1 change: 0 additions & 1 deletion python-checks/src/main/resources/org/sonar/l10n/py/rules/python/S3923.html
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -10,7 +10,6 @@ <h2>Noncompliant Code Example</h2>
doOneMoreThing()

b = 4 if a &gt; 12 else 4 # Noncompliant

</pre>
<h2>Exceptions</h2>
<p>This rule does not apply to <code>if</code> chains without <code>else</code>-s.</p>
Expand Down
4 changes: 2 additions & 2 deletions python-checks/src/main/resources/org/sonar/l10n/py/rules/python/S3985.html
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -39,7 +39,7 @@ <h2>Compliant Solution</h2>
</pre>
<h2>See</h2>
<ul>
<li> <a href="https://docs.python.org/3.8/tutorial/classes.html#private-variables">Python documentation <del></del> Private Variables</a> </li>
<li> <a href="https://www.python.org/dev/peps/pep-0008/#designing-for-inheritance">PEP 8 <del></del> Style Guide for Python Code</a> </li>
<li> <a href="https://docs.python.org/3.8/tutorial/classes.html#private-variables">Python documentation – Private Variables</a> </li>
<li> <a href="https://www.python.org/dev/peps/pep-0008/#designing-for-inheritance">PEP 8 – Style Guide for Python Code</a> </li>
</ul>

5 changes: 2 additions & 3 deletions python-checks/src/main/resources/org/sonar/l10n/py/rules/python/S4423.html
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -34,10 +34,9 @@ <h2>See</h2>
</li>
<li> <a href="https://www.owasp.org/index.php/Top_10-2017_A6-Security_Misconfiguration">OWASP Top 10 2017 Category A6</a> - Security
Misconfiguration </li>
<li> <a href="http://cwe.mitre.org/data/definitions/326.html">MITRE, CWE-327</a> - Inadequate Encryption Strength </li>
<li> <a href="http://cwe.mitre.org/data/definitions/327.html">MITRE, CWE-326</a> - Use of a Broken or Risky Cryptographic Algorithm </li>
<li> <a href="https://cwe.mitre.org/data/definitions/326.html">MITRE, CWE-327</a> - Inadequate Encryption Strength </li>
<li> <a href="https://cwe.mitre.org/data/definitions/327.html">MITRE, CWE-326</a> - Use of a Broken or Risky Cryptographic Algorithm </li>
<li> <a href="https://www.sans.org/top25-software-errors/#cat3">SANS Top 25</a> - Porous Defenses </li>
<li> <a href="https://blogs.oracle.com/java-platform-group/diagnosing-tls,-ssl,-and-https">Diagnosing TLS, SSL, and HTTPS</a> </li>
<li> <a href="https://github.com/ssllabs/research/wiki/SSL-and-TLS-Deployment-Best-Practices#22-use-secure-protocols">SSL and TLS Deployment Best
Practices - Use secure protocols</a> </li>
</ul>
Expand Down
Loading