Skip to content

Commit f9b6e44

Browse files
guillaume-dequenneguillaume-dequenne
authored
Update rules metadata (SonarSource#862)
1 parent 529b9f3 commit f9b6e44

21 files changed

Lines changed: 39 additions & 58 deletions

‎python-checks/src/main/resources/org/sonar/l10n/py/rules/python/S100.html‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
<p>Sharing some naming conventions is a key point to make it possible for a team to efficiently collaborate. This rule allows to check that all method
22
names match a provided regular expression.</p>
33
<h2>Noncompliant Code Example</h2>
4-
<p>With default provided regular expression: ^[a-z_][a-z0-9_]{2,30}$</p>
4+
<p>With default provided regular expression: <code>^[a-z_][a-z0-9_]*$</code></p>
55
<pre>
66
class MyClass:
77
def MyMethod(a,b):

‎python-checks/src/main/resources/org/sonar/l10n/py/rules/python/S107.html‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -11,4 +11,7 @@ <h2>Compliant Solution</h2>
1111
def do_something(param1, param2, param3, param4):
1212
...
1313
</pre>
14+
<h2>Exceptions</h2>
15+
<p>The first argument of non-static methods, i.e. <code>self</code> or <code>cls</code>, is not counted as it is mandatory and it is passed
16+
automatically.</p>
1417

‎python-checks/src/main/resources/org/sonar/l10n/py/rules/python/S1542.html‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
<p>Shared coding conventions allow teams to collaborate efficiently. This rule checks that all function names match a provided regular expression.</p>
22
<h2>Noncompliant Code Example</h2>
3-
<p>With the default provided regular expression: ^[a-z_][a-z0-9_]{2,30}$</p>
3+
<p>With the default provided regular expression: <code>^[a-z_][a-z0-9_]*$</code></p>
44
<pre>
55
def MyFunction(a,b):
66
...

‎python-checks/src/main/resources/org/sonar/l10n/py/rules/python/S2245.html‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -18,8 +18,8 @@ <h2>Ask Yourself Whether</h2>
1818
<h2>Recommended Secure Coding Practices</h2>
1919
<ul>
2020
<li> Only use random number generators which are <a
21-
href="https://www.owasp.org/index.php/Cryptographic_Storage_Cheat_Sheet#Rule_-_Use_strong_random_numbers">recommended by OWASP</a> or any other
22-
trusted organization. </li>
21+
href="https://cheatsheetseries.owasp.org/cheatsheets/Cryptographic_Storage_Cheat_Sheet.html#secure-random-number-generation">recommended by
22+
OWASP</a> or any other trusted organization. </li>
2323
<li> Use the generated random values only once. </li>
2424
<li> You should not expose the generated random value. If you have to store it, make sure that the database or file is secure. </li>
2525
</ul>

‎python-checks/src/main/resources/org/sonar/l10n/py/rules/python/S3827.html‎

Lines changed: 0 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,8 +1,6 @@
11
<p>Variables, Classes and functions should be defined before they are used, otherwise the code will fail.</p>
22
<h2>Noncompliant Code Example</h2>
33
<pre>
4-
unknown_var # Noncompliant (variable is never defined)
5-
64
def noncompliant():
75
foo() # Noncompliant
86
foo = sum

‎python-checks/src/main/resources/org/sonar/l10n/py/rules/python/S4721.html‎

Lines changed: 4 additions & 19 deletions
Original file line numberDiff line numberDiff line change
@@ -1,28 +1,13 @@
1-
<p>Arbitrary OS commands can be executed by an attacker when:</p>
2-
<ul>
3-
<li> The OS command name to execute is user-controlled. </li>
4-
<li> A shell is spawn rather than a new process, in this case shell meta-chars can be used (when parameters are user-controlled for instance) to
5-
inject OS commands. </li>
6-
<li> The executable is searched in the directories specified by the PATH variable (which can contain user-controlled or malicious directories).
7-
</li>
8-
</ul>
1+
<p>Arbitrary OS command injection vulnerabilities are more likely when a shell is spawned rather than a new process, indeed shell meta-chars can be
2+
used (when parameters are user-controlled for instance) to inject OS commands.</p>
93
<h2>Ask Yourself Whether</h2>
104
<ul>
115
<li> OS command name or parameters are user-controlled. </li>
12-
<li> The relative path of the OS command is specified. </li>
13-
<li> OS commands are not executed in an isolated/sandboxed environment. </li>
14-
<li> OS command are executed with high privileges. </li>
156
</ul>
16-
<p>There is a risk if you answered yes to any of those questions.</p>
7+
<p>There is a risk if you answered yes to this question.</p>
178
<p> </p>
189
<h2>Recommended Secure Coding Practices</h2>
19-
<ul>
20-
<li> User-controlled inputs should not be used, for any reasons, to build a dynamically OS command (command name or even parameters when shell is
21-
used). </li>
22-
<li> Fully qualified/absolute path should be used to specify the OS command to execute. </li>
23-
<li> If possible, set the lowest privileges to the new process/shell in which commands are executed. </li>
24-
<li> If possible, execute the OS commands in an isolated environment. </li>
25-
</ul>
10+
<p>Use functions that don't spawn a shell.</p>
2611
<h2>Sensitive Code Example</h2>
2712
<p>Python 3</p>
2813
<pre>

‎python-checks/src/main/resources/org/sonar/l10n/py/rules/python/S4784.json‎

Lines changed: 2 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -3,21 +3,10 @@
33
"type": "SECURITY_HOTSPOT",
44
"status": "ready",
55
"tags": [
6-
"cwe",
7-
"owasp-a1",
8-
"regex"
6+
97
],
108
"defaultSeverity": "Critical",
119
"ruleSpecification": "RSPEC-4784",
1210
"sqKey": "S4784",
13-
"scope": "Main",
14-
"securityStandards": {
15-
"CWE": [
16-
624,
17-
185
18-
],
19-
"OWASP": [
20-
"A1"
21-
]
22-
}
11+
"scope": "Main"
2312
}

‎python-checks/src/main/resources/org/sonar/l10n/py/rules/python/S5247.json‎

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -4,7 +4,6 @@
44
"status": "ready",
55
"tags": [
66
"cwe",
7-
"sans-top25-insecure",
87
"owasp-a7"
98
],
109
"defaultSeverity": "Major",

‎python-checks/src/main/resources/org/sonar/l10n/py/rules/python/S5332.html‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -70,7 +70,7 @@ <h2>See</h2>
7070
<ul>
7171
<li> <a href="https://www.owasp.org/index.php/Top_10-2017_A3-Sensitive_Data_Exposure">OWASP Top 10 2017 Category A3</a> - Sensitive Data Exposure
7272
</li>
73-
<li> <a href="https://cwe.mitre.org/data/definitions/200.html">MITRE, CWE-200</a> - Information Exposure </li>
73+
<li> <a href="https://cwe.mitre.org/data/definitions/200.html">MITRE, CWE-200</a> - Exposure of Sensitive Information to an Unauthorized Actor </li>
7474
<li> <a href="http://cwe.mitre.org/data/definitions/319">MITRE, CWE-319</a> - Cleartext Transmission of Sensitive Information </li>
7575
<li> <a href="https://security.googleblog.com/2016/09/moving-towards-more-secure-web.html">Google, Moving towards more secure web</a> </li>
7676
<li> <a href="https://blog.mozilla.org/security/2015/04/30/deprecating-non-secure-http/">Mozilla, Deprecating non secure http</a> </li>

‎python-checks/src/main/resources/org/sonar/l10n/py/rules/python/S5542.html‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -7,7 +7,7 @@
77
<ul>
88
<li> Electronic Codebook (ECB) mode is vulnerable because it doesn't provide serious message confidentiality: under a given key any given
99
plaintext block always gets encrypted to the same ciphertext block. </li>
10-
<li> Cipher Block Chaining (CBC) with PKCS#5 padding (or PKCS#7) is susceptible to padding oracle attacks. </li>
10+
<li> Cipher Block Chaining (CBC) with PKCS#5 padding (or PKCS#7) is vulnerable to padding oracle attacks. </li>
1111
</ul> </li>
1212
<li> RSA encryption algorithm should be used with the recommended padding scheme (OAEP) </li>
1313
</ul>

0 commit comments

Comments
 (0)