Skip to content

Commit f78aa00

Browse files
leonardo-pilastri-sonarsourceleonardo-pilastri-sonarsource
authored
SONARJAVA-5413 Update rules metadata (#5060)
Includes changes from * APPSEC-2383 * SONARJAVA-5401 * SonarSource/rspec#4777 * SonarSource/rspec#4795
1 parent 45f37f5 commit f78aa00

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

53 files changed

+226
-39
lines changed

‎sonar-java-plugin/src/main/resources/org/sonar/l10n/java/rules/java/S2053.html‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -68,6 +68,8 @@ <h3>Standards</h3>
6868
<li> OWASP - <a href="https://owasp.org/Top10/A02_2021-Cryptographic_Failures/">Top 10 2021 Category A2 - Cryptographic Failures</a> </li>
6969
<li> OWASP - <a href="https://www.owasp.org/www-project-top-ten/2017/A3_2017-Sensitive_Data_Exposure">Top 10 2017 Category A3 - Sensitive Data
7070
Exposure</a> </li>
71+
<li> OWASP - <a href="https://owasp.org/www-project-mobile-top-10/2023-risks/m10-insufficient-cryptography">Mobile Top 10 2024 Category M10 -
72+
Insufficient Cryptography</a> </li>
7173
<li> CWE - <a href="https://cwe.mitre.org/data/definitions/759">CWE-759 - Use of a One-Way Hash without a Salt</a> </li>
7274
<li> CWE - <a href="https://cwe.mitre.org/data/definitions/760">CWE-760 - Use of a One-Way Hash with a Predictable Salt</a> </li>
7375
<li> STIG Viewer - <a href="https://stigviewer.com/stig/application_security_and_development/2023-06-08/finding/V-222542">Application Security and

‎sonar-java-plugin/src/main/resources/org/sonar/l10n/java/rules/java/S2053.json‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -30,6 +30,9 @@
3030
"OWASP Top 10 2021": [
3131
"A2"
3232
],
33+
"OWASP Mobile Top 10 2024": [
34+
"M10"
35+
],
3336
"PCI DSS 3.2": [
3437
"6.5.10"
3538
],

‎sonar-java-plugin/src/main/resources/org/sonar/l10n/java/rules/java/S2245.html‎

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -52,16 +52,16 @@ <h2>See</h2>
5252
<li> OWASP - <a href="https://owasp.org/Top10/A02_2021-Cryptographic_Failures/">Top 10 2021 Category A2 - Cryptographic Failures</a> </li>
5353
<li> OWASP - <a href="https://owasp.org/www-project-top-ten/2017/A3_2017-Sensitive_Data_Exposure">Top 10 2017 Category A3 - Sensitive Data
5454
Exposure</a> </li>
55-
<li> OWASP - <a href="https://mas.owasp.org/checklists/MASVS-CRYPTO/">Mobile AppSec Verification Standard - Cryptography Requirements</a> </li>
56-
<li> OWASP - <a href="https://owasp.org/www-project-mobile-top-10/2016-risks/m5-insufficient-cryptography">Mobile Top 10 2016 Category M5 -
57-
Insufficient Cryptography</a> </li>
5855
<li> CWE - <a href="https://cwe.mitre.org/data/definitions/338">CWE-338 - Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG)</a>
5956
</li>
6057
<li> CWE - <a href="https://cwe.mitre.org/data/definitions/330">CWE-330 - Use of Insufficiently Random Values</a> </li>
6158
<li> CWE - <a href="https://cwe.mitre.org/data/definitions/326">CWE-326 - Inadequate Encryption Strength</a> </li>
6259
<li> CWE - <a href="https://cwe.mitre.org/data/definitions/1241">CWE-1241 - Use of Predictable Algorithm in Random Number Generator</a> </li>
60+
<li> OWASP - <a href="https://mas.owasp.org/checklists/MASVS-CRYPTO/">Mobile AppSec Verification Standard - Cryptography Requirements</a> </li>
61+
<li> OWASP - <a href="https://owasp.org/www-project-mobile-top-10/2016-risks/m5-insufficient-cryptography">Mobile Top 10 2016 Category M5 -
62+
Insufficient Cryptography</a> </li>
63+
<li> OWASP - <a href="https://owasp.org/www-project-mobile-top-10/2023-risks/m10-insufficient-cryptography">Mobile Top 10 2024 Category M10 -
64+
Insufficient Cryptography</a> </li>
6365
<li> <a href="https://wiki.sei.cmu.edu/confluence/x/oTdGBQ">CERT, MSC02-J.</a> - Generate strong random numbers </li>
64-
<li> Derived from FindSecBugs rule <a href="https://h3xstream.github.io/find-sec-bugs/bugs.htm#PREDICTABLE_RANDOM">Predictable Pseudo Random Number
65-
Generator</a> </li>
6666
</ul>
6767

‎sonar-java-plugin/src/main/resources/org/sonar/l10n/java/rules/java/S2245.json‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -37,6 +37,9 @@
3737
"OWASP Mobile": [
3838
"M5"
3939
],
40+
"OWASP Mobile Top 10 2024": [
41+
"M10"
42+
],
4043
"MASVS": [
4144
"MSTG-CRYPTO-6"
4245
],

‎sonar-java-plugin/src/main/resources/org/sonar/l10n/java/rules/java/S3329.html‎

Lines changed: 5 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -114,12 +114,14 @@ <h3>Standards</h3>
114114
Exposure</a> </li>
115115
<li> OWASP - <a href="https://owasp.org/www-project-top-ten/2017/A6_2017-Security_Misconfiguration">Top 10 2017 Category A6 - Security
116116
Misconfiguration</a> </li>
117+
<li> OWASP - <a href="https://mas.owasp.org/checklists/MASVS-CRYPTO/">Mobile AppSec Verification Standard - Cryptography Requirements</a> </li>
118+
<li> OWASP - <a href="https://owasp.org/www-project-mobile-top-10/2016-risks/m5-insufficient-cryptography">Mobile Top 10 2016 Category M5 -
119+
Insufficient Cryptography</a> </li>
120+
<li> OWASP - <a href="https://owasp.org/www-project-mobile-top-10/2023-risks/m10-insufficient-cryptography">Mobile Top 10 2024 Category M10 -
121+
Insufficient Cryptography</a> </li>
117122
<li> CWE - <a href="https://cwe.mitre.org/data/definitions/329">CWE-329 - Not Using an Unpredictable IV with CBC Mode</a> </li>
118123
<li> CWE - <a href="https://cwe.mitre.org/data/definitions/780">CWE-780 - Use of RSA Algorithm without OAEP</a> </li>
119124
<li> <a href="https://nvlpubs.nist.gov/nistpubs/Legacy/SP/nistspecialpublication800-38a.pdf">NIST, SP-800-38A</a> - Recommendation for Block Cipher
120125
Modes of Operation </li>
121-
<li> OWASP - <a href="https://mas.owasp.org/checklists/MASVS-CRYPTO/">Mobile AppSec Verification Standard - Cryptography Requirements</a> </li>
122-
<li> OWASP - <a href="https://owasp.org/www-project-mobile-top-10/2016-risks/m5-insufficient-cryptography">Mobile Top 10 2016 Category M5 -
123-
Insufficient Cryptography</a> </li>
124126
</ul>
125127

‎sonar-java-plugin/src/main/resources/org/sonar/l10n/java/rules/java/S3329.json‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -51,6 +51,9 @@
5151
"OWASP Mobile": [
5252
"M5"
5353
],
54+
"OWASP Mobile Top 10 2024": [
55+
"M10"
56+
],
5457
"MASVS": [
5558
"MSTG-CRYPTO-3"
5659
]

‎sonar-java-plugin/src/main/resources/org/sonar/l10n/java/rules/java/S4347.html‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -66,6 +66,8 @@ <h3>Standards</h3>
6666
<li> OWASP - <a href="https://owasp.org/Top10/A02_2021-Cryptographic_Failures/">Top 10 2021 Category A2 - Cryptographic Failures</a> </li>
6767
<li> OWASP - <a href="https://owasp.org/www-project-top-ten/2017/A6_2017-Security_Misconfiguration">Top 10 2017 Category A6 - Security
6868
Misconfiguration</a> </li>
69+
<li> OWASP - <a href="https://owasp.org/www-project-mobile-top-10/2023-risks/m10-insufficient-cryptography">Mobile Top 10 2024 Category M10 -
70+
Insufficient Cryptography</a> </li>
6971
<li> CWE - <a href="https://cwe.mitre.org/data/definitions/330">CWE-330 - Use of Insufficiently Random Values</a> </li>
7072
<li> CWE - <a href="https://cwe.mitre.org/data/definitions/332">CWE-332 - Insufficient Entropy in PRNG</a> </li>
7173
<li> CWE - <a href="https://cwe.mitre.org/data/definitions/336">CWE-336 - Same Seed in Pseudo-Random Number Generator (PRNG)</a> </li>

‎sonar-java-plugin/src/main/resources/org/sonar/l10n/java/rules/java/S4347.json‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -34,6 +34,9 @@
3434
"OWASP Top 10 2021": [
3535
"A2"
3636
],
37+
"OWASP Mobile Top 10 2024": [
38+
"M10"
39+
],
3740
"ASVS 4.0": [
3841
"2.3.1",
3942
"2.6.2",

‎sonar-java-plugin/src/main/resources/org/sonar/l10n/java/rules/java/S4423.html‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -135,10 +135,11 @@ <h3>Standards</h3>
135135
Exposure</a> </li>
136136
<li> OWASP - <a href="https://owasp.org/www-project-top-ten/2017/A6_2017-Security_Misconfiguration">Top 10 2017 Category A6 - Security
137137
Misconfiguration</a> </li>
138-
<li> CWE - <a href="https://cwe.mitre.org/data/definitions/327">CWE-327 - Use of a Broken or Risky Cryptographic Algorithm</a> </li>
139138
<li> OWASP - <a href="https://mas.owasp.org/checklists/MASVS-CRYPTO/">Mobile AppSec Verification Standard - Cryptography Requirements</a> </li>
140139
<li> OWASP - <a href="https://owasp.org/www-project-mobile-top-10/2016-risks/m5-insufficient-cryptography">Mobile Top 10 2016 Category M5 -
141140
Insufficient Cryptography</a> </li>
141+
<li> OWASP - <a href="https://owasp.org/www-project-mobile-top-10/2023-risks/m5-insecure-communication">Mobile Top 10 2024 Category M5 - Insecure
142+
Communication</a> </li>
142143
<li> CWE - <a href="https://cwe.mitre.org/data/definitions/327">CWE-327 - Use of a Broken or Risky Cryptographic Algorithm</a> </li>
143144
<li> <a href="https://wiki.sei.cmu.edu/confluence/x/hDdGBQ">CERT, MSC61-J.</a> - Do not use insecure or weak cryptographic algorithms </li>
144145
</ul>

‎sonar-java-plugin/src/main/resources/org/sonar/l10n/java/rules/java/S4423.json‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -33,6 +33,9 @@
3333
"OWASP Mobile": [
3434
"M3"
3535
],
36+
"OWASP Mobile Top 10 2024": [
37+
"M5"
38+
],
3639
"MASVS": [
3740
"MSTG-NETWORK-2"
3841
],

0 commit comments

Comments
 (0)