Skip to content

Commit f78aa00

Browse files
leonardo-pilastri-sonarsourceleonardo-pilastri-sonarsource
authored
SONARJAVA-5413 Update rules metadata (#5060)
Includes changes from * APPSEC-2383 * SONARJAVA-5401 * SonarSource/rspec#4777 * SonarSource/rspec#4795
1 parent 45f37f5 commit f78aa00

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

53 files changed

+226
-39
lines changed

‎sonar-java-plugin/src/main/resources/org/sonar/l10n/java/rules/java/S2053.html

+2
Original file line numberDiff line numberDiff line change
@@ -68,6 +68,8 @@ <h3>Standards</h3>
6868
<li> OWASP - <a href="https://owasp.org/Top10/A02_2021-Cryptographic_Failures/">Top 10 2021 Category A2 - Cryptographic Failures</a> </li>
6969
<li> OWASP - <a href="https://www.owasp.org/www-project-top-ten/2017/A3_2017-Sensitive_Data_Exposure">Top 10 2017 Category A3 - Sensitive Data
7070
Exposure</a> </li>
71+
<li> OWASP - <a href="https://owasp.org/www-project-mobile-top-10/2023-risks/m10-insufficient-cryptography">Mobile Top 10 2024 Category M10 -
72+
Insufficient Cryptography</a> </li>
7173
<li> CWE - <a href="https://cwe.mitre.org/data/definitions/759">CWE-759 - Use of a One-Way Hash without a Salt</a> </li>
7274
<li> CWE - <a href="https://cwe.mitre.org/data/definitions/760">CWE-760 - Use of a One-Way Hash with a Predictable Salt</a> </li>
7375
<li> STIG Viewer - <a href="https://stigviewer.com/stig/application_security_and_development/2023-06-08/finding/V-222542">Application Security and

‎sonar-java-plugin/src/main/resources/org/sonar/l10n/java/rules/java/S2053.json

+3
Original file line numberDiff line numberDiff line change
@@ -30,6 +30,9 @@
3030
"OWASP Top 10 2021": [
3131
"A2"
3232
],
33+
"OWASP Mobile Top 10 2024": [
34+
"M10"
35+
],
3336
"PCI DSS 3.2": [
3437
"6.5.10"
3538
],

‎sonar-java-plugin/src/main/resources/org/sonar/l10n/java/rules/java/S2245.html

+5-5
Original file line numberDiff line numberDiff line change
@@ -52,16 +52,16 @@ <h2>See</h2>
5252
<li> OWASP - <a href="https://owasp.org/Top10/A02_2021-Cryptographic_Failures/">Top 10 2021 Category A2 - Cryptographic Failures</a> </li>
5353
<li> OWASP - <a href="https://owasp.org/www-project-top-ten/2017/A3_2017-Sensitive_Data_Exposure">Top 10 2017 Category A3 - Sensitive Data
5454
Exposure</a> </li>
55-
<li> OWASP - <a href="https://mas.owasp.org/checklists/MASVS-CRYPTO/">Mobile AppSec Verification Standard - Cryptography Requirements</a> </li>
56-
<li> OWASP - <a href="https://owasp.org/www-project-mobile-top-10/2016-risks/m5-insufficient-cryptography">Mobile Top 10 2016 Category M5 -
57-
Insufficient Cryptography</a> </li>
5855
<li> CWE - <a href="https://cwe.mitre.org/data/definitions/338">CWE-338 - Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG)</a>
5956
</li>
6057
<li> CWE - <a href="https://cwe.mitre.org/data/definitions/330">CWE-330 - Use of Insufficiently Random Values</a> </li>
6158
<li> CWE - <a href="https://cwe.mitre.org/data/definitions/326">CWE-326 - Inadequate Encryption Strength</a> </li>
6259
<li> CWE - <a href="https://cwe.mitre.org/data/definitions/1241">CWE-1241 - Use of Predictable Algorithm in Random Number Generator</a> </li>
60+
<li> OWASP - <a href="https://mas.owasp.org/checklists/MASVS-CRYPTO/">Mobile AppSec Verification Standard - Cryptography Requirements</a> </li>
61+
<li> OWASP - <a href="https://owasp.org/www-project-mobile-top-10/2016-risks/m5-insufficient-cryptography">Mobile Top 10 2016 Category M5 -
62+
Insufficient Cryptography</a> </li>
63+
<li> OWASP - <a href="https://owasp.org/www-project-mobile-top-10/2023-risks/m10-insufficient-cryptography">Mobile Top 10 2024 Category M10 -
64+
Insufficient Cryptography</a> </li>
6365
<li> <a href="https://wiki.sei.cmu.edu/confluence/x/oTdGBQ">CERT, MSC02-J.</a> - Generate strong random numbers </li>
64-
<li> Derived from FindSecBugs rule <a href="https://h3xstream.github.io/find-sec-bugs/bugs.htm#PREDICTABLE_RANDOM">Predictable Pseudo Random Number
65-
Generator</a> </li>
6666
</ul>
6767

‎sonar-java-plugin/src/main/resources/org/sonar/l10n/java/rules/java/S2245.json

+3
Original file line numberDiff line numberDiff line change
@@ -37,6 +37,9 @@
3737
"OWASP Mobile": [
3838
"M5"
3939
],
40+
"OWASP Mobile Top 10 2024": [
41+
"M10"
42+
],
4043
"MASVS": [
4144
"MSTG-CRYPTO-6"
4245
],

‎sonar-java-plugin/src/main/resources/org/sonar/l10n/java/rules/java/S3329.html

+5-3
Original file line numberDiff line numberDiff line change
@@ -114,12 +114,14 @@ <h3>Standards</h3>
114114
Exposure</a> </li>
115115
<li> OWASP - <a href="https://owasp.org/www-project-top-ten/2017/A6_2017-Security_Misconfiguration">Top 10 2017 Category A6 - Security
116116
Misconfiguration</a> </li>
117+
<li> OWASP - <a href="https://mas.owasp.org/checklists/MASVS-CRYPTO/">Mobile AppSec Verification Standard - Cryptography Requirements</a> </li>
118+
<li> OWASP - <a href="https://owasp.org/www-project-mobile-top-10/2016-risks/m5-insufficient-cryptography">Mobile Top 10 2016 Category M5 -
119+
Insufficient Cryptography</a> </li>
120+
<li> OWASP - <a href="https://owasp.org/www-project-mobile-top-10/2023-risks/m10-insufficient-cryptography">Mobile Top 10 2024 Category M10 -
121+
Insufficient Cryptography</a> </li>
117122
<li> CWE - <a href="https://cwe.mitre.org/data/definitions/329">CWE-329 - Not Using an Unpredictable IV with CBC Mode</a> </li>
118123
<li> CWE - <a href="https://cwe.mitre.org/data/definitions/780">CWE-780 - Use of RSA Algorithm without OAEP</a> </li>
119124
<li> <a href="https://nvlpubs.nist.gov/nistpubs/Legacy/SP/nistspecialpublication800-38a.pdf">NIST, SP-800-38A</a> - Recommendation for Block Cipher
120125
Modes of Operation </li>
121-
<li> OWASP - <a href="https://mas.owasp.org/checklists/MASVS-CRYPTO/">Mobile AppSec Verification Standard - Cryptography Requirements</a> </li>
122-
<li> OWASP - <a href="https://owasp.org/www-project-mobile-top-10/2016-risks/m5-insufficient-cryptography">Mobile Top 10 2016 Category M5 -
123-
Insufficient Cryptography</a> </li>
124126
</ul>
125127

‎sonar-java-plugin/src/main/resources/org/sonar/l10n/java/rules/java/S3329.json

+3
Original file line numberDiff line numberDiff line change
@@ -51,6 +51,9 @@
5151
"OWASP Mobile": [
5252
"M5"
5353
],
54+
"OWASP Mobile Top 10 2024": [
55+
"M10"
56+
],
5457
"MASVS": [
5558
"MSTG-CRYPTO-3"
5659
]

‎sonar-java-plugin/src/main/resources/org/sonar/l10n/java/rules/java/S4347.html

+2
Original file line numberDiff line numberDiff line change
@@ -66,6 +66,8 @@ <h3>Standards</h3>
6666
<li> OWASP - <a href="https://owasp.org/Top10/A02_2021-Cryptographic_Failures/">Top 10 2021 Category A2 - Cryptographic Failures</a> </li>
6767
<li> OWASP - <a href="https://owasp.org/www-project-top-ten/2017/A6_2017-Security_Misconfiguration">Top 10 2017 Category A6 - Security
6868
Misconfiguration</a> </li>
69+
<li> OWASP - <a href="https://owasp.org/www-project-mobile-top-10/2023-risks/m10-insufficient-cryptography">Mobile Top 10 2024 Category M10 -
70+
Insufficient Cryptography</a> </li>
6971
<li> CWE - <a href="https://cwe.mitre.org/data/definitions/330">CWE-330 - Use of Insufficiently Random Values</a> </li>
7072
<li> CWE - <a href="https://cwe.mitre.org/data/definitions/332">CWE-332 - Insufficient Entropy in PRNG</a> </li>
7173
<li> CWE - <a href="https://cwe.mitre.org/data/definitions/336">CWE-336 - Same Seed in Pseudo-Random Number Generator (PRNG)</a> </li>

‎sonar-java-plugin/src/main/resources/org/sonar/l10n/java/rules/java/S4347.json

+3
Original file line numberDiff line numberDiff line change
@@ -34,6 +34,9 @@
3434
"OWASP Top 10 2021": [
3535
"A2"
3636
],
37+
"OWASP Mobile Top 10 2024": [
38+
"M10"
39+
],
3740
"ASVS 4.0": [
3841
"2.3.1",
3942
"2.6.2",

‎sonar-java-plugin/src/main/resources/org/sonar/l10n/java/rules/java/S4423.html

+2-1
Original file line numberDiff line numberDiff line change
@@ -135,10 +135,11 @@ <h3>Standards</h3>
135135
Exposure</a> </li>
136136
<li> OWASP - <a href="https://owasp.org/www-project-top-ten/2017/A6_2017-Security_Misconfiguration">Top 10 2017 Category A6 - Security
137137
Misconfiguration</a> </li>
138-
<li> CWE - <a href="https://cwe.mitre.org/data/definitions/327">CWE-327 - Use of a Broken or Risky Cryptographic Algorithm</a> </li>
139138
<li> OWASP - <a href="https://mas.owasp.org/checklists/MASVS-CRYPTO/">Mobile AppSec Verification Standard - Cryptography Requirements</a> </li>
140139
<li> OWASP - <a href="https://owasp.org/www-project-mobile-top-10/2016-risks/m5-insufficient-cryptography">Mobile Top 10 2016 Category M5 -
141140
Insufficient Cryptography</a> </li>
141+
<li> OWASP - <a href="https://owasp.org/www-project-mobile-top-10/2023-risks/m5-insecure-communication">Mobile Top 10 2024 Category M5 - Insecure
142+
Communication</a> </li>
142143
<li> CWE - <a href="https://cwe.mitre.org/data/definitions/327">CWE-327 - Use of a Broken or Risky Cryptographic Algorithm</a> </li>
143144
<li> <a href="https://wiki.sei.cmu.edu/confluence/x/hDdGBQ">CERT, MSC61-J.</a> - Do not use insecure or weak cryptographic algorithms </li>
144145
</ul>

‎sonar-java-plugin/src/main/resources/org/sonar/l10n/java/rules/java/S4423.json

+3
Original file line numberDiff line numberDiff line change
@@ -33,6 +33,9 @@
3333
"OWASP Mobile": [
3434
"M3"
3535
],
36+
"OWASP Mobile Top 10 2024": [
37+
"M5"
38+
],
3639
"MASVS": [
3740
"MSTG-NETWORK-2"
3841
],

‎sonar-java-plugin/src/main/resources/org/sonar/l10n/java/rules/java/S4426.html

+2
Original file line numberDiff line numberDiff line change
@@ -209,6 +209,8 @@ <h3>Standards</h3>
209209
<li> OWASP - <a href="https://mas.owasp.org/checklists/MASVS-CRYPTO/">Mobile AppSec Verification Standard - Cryptography Requirements</a> </li>
210210
<li> OWASP - <a href="https://owasp.org/www-project-mobile-top-10/2016-risks/m5-insufficient-cryptography">Mobile Top 10 2016 Category M5 -
211211
Insufficient Cryptography</a> </li>
212+
<li> OWASP - <a href="https://owasp.org/www-project-mobile-top-10/2023-risks/m10-insufficient-cryptography">Mobile Top 10 2024 Category M10 -
213+
Insufficient Cryptography</a> </li>
212214
<li> <a href="https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-131Ar1.pdf">NIST 800-131A</a> - Recommendation for Transitioning the
213215
Use of Cryptographic Algorithms and Key Lengths </li>
214216
<li> CWE - <a href="https://cwe.mitre.org/data/definitions/326">CWE-326 - Inadequate Encryption Strength</a> </li>

‎sonar-java-plugin/src/main/resources/org/sonar/l10n/java/rules/java/S4426.json

+3
Original file line numberDiff line numberDiff line change
@@ -32,6 +32,9 @@
3232
"OWASP Mobile": [
3333
"M5"
3434
],
35+
"OWASP Mobile Top 10 2024": [
36+
"M10"
37+
],
3538
"MASVS": [
3639
"MSTG-CRYPTO-3"
3740
],

‎sonar-java-plugin/src/main/resources/org/sonar/l10n/java/rules/java/S4790.html

+2
Original file line numberDiff line numberDiff line change
@@ -33,6 +33,8 @@ <h2>See</h2>
3333
<li> OWASP - <a href="https://mas.owasp.org/checklists/MASVS-CRYPTO/">Mobile AppSec Verification Standard - Cryptography Requirements</a> </li>
3434
<li> OWASP - <a href="https://owasp.org/www-project-mobile-top-10/2016-risks/m5-insufficient-cryptography">Mobile Top 10 2016 Category M5 -
3535
Insufficient Cryptography</a> </li>
36+
<li> OWASP - <a href="https://owasp.org/www-project-mobile-top-10/2023-risks/m10-insufficient-cryptography">Mobile Top 10 2024 Category M10 -
37+
Insufficient Cryptography</a> </li>
3638
<li> CWE - <a href="https://cwe.mitre.org/data/definitions/1240">CWE-1240 - Use of a Risky Cryptographic Primitive</a> </li>
3739
</ul>
3840

‎sonar-java-plugin/src/main/resources/org/sonar/l10n/java/rules/java/S4790.json

+3
Original file line numberDiff line numberDiff line change
@@ -26,6 +26,9 @@
2626
"OWASP Mobile": [
2727
"M5"
2828
],
29+
"OWASP Mobile Top 10 2024": [
30+
"M10"
31+
],
2932
"MASVS": [
3033
"MSTG-CRYPTO-4"
3134
],

‎sonar-java-plugin/src/main/resources/org/sonar/l10n/java/rules/java/S4830.html

+2
Original file line numberDiff line numberDiff line change
@@ -67,6 +67,8 @@ <h3>Standards</h3>
6767
Misconfiguration</a> </li>
6868
<li> OWASP - <a href="https://owasp.org/www-project-mobile-top-10/2016-risks/m3-insecure-communication">Mobile Top 10 2016 Category M3 - Insecure
6969
Communication</a> </li>
70+
<li> OWASP - <a href="https://owasp.org/www-project-mobile-top-10/2023-risks/m5-insecure-communication">Mobile Top 10 2024 Category M5 - Insecure
71+
Communication</a> </li>
7072
<li> OWASP - <a href="https://mas.owasp.org/checklists/MASVS-NETWORK/">Mobile AppSec Verification Standard - Network Communication Requirements</a>
7173
</li>
7274
<li> CWE - <a href="https://cwe.mitre.org/data/definitions/295">CWE-295 - Improper Certificate Validation</a> </li>

‎sonar-java-plugin/src/main/resources/org/sonar/l10n/java/rules/java/S4830.json

+3
Original file line numberDiff line numberDiff line change
@@ -36,6 +36,9 @@
3636
"OWASP Mobile": [
3737
"M3"
3838
],
39+
"OWASP Mobile Top 10 2024": [
40+
"M5"
41+
],
3942
"MASVS": [
4043
"MSTG-NETWORK-3"
4144
],

‎sonar-java-plugin/src/main/resources/org/sonar/l10n/java/rules/java/S5320.html

+4
Original file line numberDiff line numberDiff line change
@@ -76,6 +76,10 @@ <h2>See</h2>
7676
</li>
7777
<li> OWASP - <a href="https://owasp.org/www-project-mobile-top-10/2016-risks/m1-improper-platform-usage">Mobile Top 10 2016 Category M1 - Improper
7878
Platform Usage</a> </li>
79+
<li> OWASP - <a href="https://owasp.org/www-project-mobile-top-10/2023-risks/m3-insecure-authentication-authorization">Mobile Top 10 2024 Category
80+
M3 - Insecure Authentication/Authorization</a> </li>
81+
<li> OWASP - <a href="https://owasp.org/www-project-mobile-top-10/2023-risks/m8-security-misconfiguration">Mobile Top 10 2024 Category M8 - Security
82+
Misconfiguration</a> </li>
7983
<li> CWE - <a href="https://cwe.mitre.org/data/definitions/927">CWE-927 - Use of Implicit Intent for Sensitive Communication</a> </li>
8084
<li> <a href="https://developer.android.com/guide/components/broadcasts.html#restricting_broadcasts_with_permissions">Android documentation</a> -
8185
Broadcast Overview - Security considerations and best practices </li>

‎sonar-java-plugin/src/main/resources/org/sonar/l10n/java/rules/java/S5320.json

+4
Original file line numberDiff line numberDiff line change
@@ -23,6 +23,10 @@
2323
"OWASP Mobile": [
2424
"M1"
2525
],
26+
"OWASP Mobile Top 10 2024": [
27+
"M3",
28+
"M8"
29+
],
2630
"MASVS": [
2731
"MSTG-PLATFORM-4"
2832
],

‎sonar-java-plugin/src/main/resources/org/sonar/l10n/java/rules/java/S5322.html

+4
Original file line numberDiff line numberDiff line change
@@ -77,6 +77,10 @@ <h2>See</h2>
7777
</li>
7878
<li> OWASP - <a href="https://owasp.org/www-project-mobile-top-10/2016-risks/m1-improper-platform-usage">Mobile Top 10 2016 Category M1 - Improper
7979
Platform Usage</a> </li>
80+
<li> OWASP - <a href="https://owasp.org/www-project-mobile-top-10/2023-risks/m3-insecure-authentication-authorization">Mobile Top 10 2024 Category
81+
M3 - Insecure Authentication/Authorization</a> </li>
82+
<li> OWASP - <a href="https://owasp.org/www-project-mobile-top-10/2023-risks/m4-insufficient-input-output-validation">Mobile Top 10 2024 Category M4
83+
- Insufficient Input/Output Validation</a> </li>
8084
<li> CWE - <a href="https://cwe.mitre.org/data/definitions/925">CWE-925 - Improper Verification of Intent by Broadcast Receiver</a> </li>
8185
<li> CWE - <a href="https://cwe.mitre.org/data/definitions/926">CWE-926 - Improper Export of Android Application Components</a> </li>
8286
<li> <a href="https://developer.android.com/guide/components/broadcasts.html#restricting_broadcasts_with_permissions">Android documentation</a> -

‎sonar-java-plugin/src/main/resources/org/sonar/l10n/java/rules/java/S5322.json

+4
Original file line numberDiff line numberDiff line change
@@ -24,6 +24,10 @@
2424
"OWASP Mobile": [
2525
"M1"
2626
],
27+
"OWASP Mobile Top 10 2024": [
28+
"M3",
29+
"M4"
30+
],
2731
"MASVS": [
2832
"MSTG-PLATFORM-2"
2933
]

‎sonar-java-plugin/src/main/resources/org/sonar/l10n/java/rules/java/S5324.html

+2
Original file line numberDiff line numberDiff line change
@@ -52,6 +52,8 @@ <h2>See</h2>
5252
Requirements</a> </li>
5353
<li> OWASP - <a href="https://owasp.org/www-project-mobile-top-10/2016-risks/m2-insecure-data-storage">Mobile Top 10 2016 Category M2 - Insecure
5454
Data Storage</a> </li>
55+
<li> OWASP - <a href="https://owasp.org/www-project-mobile-top-10/2023-risks/m9-insecure-data-storage">Mobile Top 10 2024 Category M9 - Insecure
56+
Data Storage</a> </li>
5557
<li> CWE - <a href="https://cwe.mitre.org/data/definitions/312">CWE-312 - Cleartext Storage of Sensitive Information</a> </li>
5658
</ul>
5759

‎sonar-java-plugin/src/main/resources/org/sonar/l10n/java/rules/java/S5324.json

+3
Original file line numberDiff line numberDiff line change
@@ -23,6 +23,9 @@
2323
"OWASP Mobile": [
2424
"M2"
2525
],
26+
"OWASP Mobile Top 10 2024": [
27+
"M9"
28+
],
2629
"MASVS": [
2730
"MSTG-STORAGE-1"
2831
],

‎sonar-java-plugin/src/main/resources/org/sonar/l10n/java/rules/java/S5332.html

+2
Original file line numberDiff line numberDiff line change
@@ -141,6 +141,8 @@ <h3>Standards</h3>
141141
</li>
142142
<li> OWASP - <a href="https://owasp.org/www-project-mobile-top-10/2016-risks/m3-insecure-communication">Mobile Top 10 2016 Category M3 - Insecure
143143
Communication</a> </li>
144+
<li> OWASP - <a href="https://owasp.org/www-project-mobile-top-10/2023-risks/m5-insecure-communication">Mobile Top 10 2024 Category M5 - Insecure
145+
Communication</a> </li>
144146
<li> CWE - <a href="https://cwe.mitre.org/data/definitions/200">CWE-200 - Exposure of Sensitive Information to an Unauthorized Actor</a> </li>
145147
<li> CWE - <a href="https://cwe.mitre.org/data/definitions/319">CWE-319 - Cleartext Transmission of Sensitive Information</a> </li>
146148
<li> STIG Viewer - <a href="https://stigviewer.com/stig/application_security_and_development/2023-06-08/finding/V-222397">Application Security and

‎sonar-java-plugin/src/main/resources/org/sonar/l10n/java/rules/java/S5332.json

+3
Original file line numberDiff line numberDiff line change
@@ -27,6 +27,9 @@
2727
"OWASP Mobile": [
2828
"M3"
2929
],
30+
"OWASP Mobile Top 10 2024": [
31+
"M5"
32+
],
3033
"MASVS": [
3134
"MSTG-NETWORK-1"
3235
],

‎sonar-java-plugin/src/main/resources/org/sonar/l10n/java/rules/java/S5344.html

+2
Original file line numberDiff line numberDiff line change
@@ -89,6 +89,8 @@ <h3>Standards</h3>
8989
<li> OWASP - <a href="https://owasp.org/Top10/A04_2021-Insecure_Design/">Top 10 2021 Category A4 - Insecure Design</a> </li>
9090
<li> OWASP - <a href="https://owasp.org/www-project-top-ten/2017/A3_2017-Sensitive_Data_Exposure">Top 10 2017 Category A3 - Sensitive Data
9191
Exposure</a> </li>
92+
<li> OWASP - <a href="https://owasp.org/www-project-mobile-top-10/2023-risks/m10-insufficient-cryptography">Mobile Top 10 2024 Category M10 -
93+
Insufficient Cryptography</a> </li>
9294
<li> CWE - <a href="https://cwe.mitre.org/data/definitions/256">CWE-256 - Plaintext Storage of a Password</a> </li>
9395
<li> CWE - <a href="https://cwe.mitre.org/data/definitions/916">CWE-916 - Use of Password Hash With Insufficient Computational Effort</a> </li>
9496
<li> STIG Viewer - <a href="https://stigviewer.com/stig/application_security_and_development/2023-06-08/finding/V-222542">Application Security and

‎sonar-java-plugin/src/main/resources/org/sonar/l10n/java/rules/java/S5344.json

+3
Original file line numberDiff line numberDiff line change
@@ -32,6 +32,9 @@
3232
"A2",
3333
"A4"
3434
],
35+
"OWASP Mobile Top 10 2024": [
36+
"M10"
37+
],
3538
"PCI DSS 3.2": [
3639
"6.5.3"
3740
],

‎sonar-java-plugin/src/main/resources/org/sonar/l10n/java/rules/java/S5527.html

+2
Original file line numberDiff line numberDiff line change
@@ -203,6 +203,8 @@ <h3>Standards</h3>
203203
</li>
204204
<li> OWASP - <a href="https://owasp.org/www-project-mobile-top-10/2016-risks/m3-insecure-communication">Mobile Top 10 2016 Category M3 - Insecure
205205
Communication</a> </li>
206+
<li> OWASP - <a href="https://owasp.org/www-project-mobile-top-10/2023-risks/m5-insecure-communication">Mobile Top 10 2024 Category M5 - Insecure
207+
Communication</a> </li>
206208
<li> CWE - <a href="https://cwe.mitre.org/data/definitions/297">CWE-297 - Improper Validation of Certificate with Host Mismatch</a> </li>
207209
<li> STIG Viewer - <a href="https://stigviewer.com/stig/application_security_and_development/2023-06-08/finding/V-222550">Application Security and
208210
Development: V-222550</a> - The application must validate certificates by constructing a certification path to an accepted trust anchor. </li>

‎sonar-java-plugin/src/main/resources/org/sonar/l10n/java/rules/java/S5527.json

+3
Original file line numberDiff line numberDiff line change
@@ -32,6 +32,9 @@
3232
"OWASP Mobile": [
3333
"M3"
3434
],
35+
"OWASP Mobile Top 10 2024": [
36+
"M5"
37+
],
3538
"MASVS": [
3639
"MSTG-NETWORK-3"
3740
],

‎sonar-java-plugin/src/main/resources/org/sonar/l10n/java/rules/java/S5542.html

+2-1
Original file line numberDiff line numberDiff line change
@@ -127,10 +127,11 @@ <h3>Standards</h3>
127127
Exposure</a> </li>
128128
<li> OWASP - <a href="https://owasp.org/www-project-top-ten/2017/A6_2017-Security_Misconfiguration">Top 10 2017 Category A6 - Security
129129
Misconfiguration</a> </li>
130-
<li> CWE - <a href="https://cwe.mitre.org/data/definitions/327">CWE-327 - Use of a Broken or Risky Cryptographic Algorithm</a> </li>
131130
<li> OWASP - <a href="https://mas.owasp.org/checklists/MASVS-CRYPTO/">Mobile AppSec Verification Standard - Cryptography Requirements</a> </li>
132131
<li> OWASP - <a href="https://owasp.org/www-project-mobile-top-10/2016-risks/m5-insufficient-cryptography">Mobile Top 10 2016 Category M5 -
133132
Insufficient Cryptography</a> </li>
133+
<li> OWASP - <a href="https://owasp.org/www-project-mobile-top-10/2023-risks/m10-insufficient-cryptography">Mobile Top 10 2024 Category M10 -
134+
Insufficient Cryptography</a> </li>
134135
<li> CWE - <a href="https://cwe.mitre.org/data/definitions/327">CWE-327 - Use of a Broken or Risky Cryptographic Algorithm</a> </li>
135136
<li> <a href="https://wiki.sei.cmu.edu/confluence/x/hDdGBQ">CERT, MSC61-J.</a> - Do not use insecure or weak cryptographic algorithms </li>
136137
</ul>

‎sonar-java-plugin/src/main/resources/org/sonar/l10n/java/rules/java/S5542.json

+3
Original file line numberDiff line numberDiff line change
@@ -35,6 +35,9 @@
3535
"OWASP Mobile": [
3636
"M5"
3737
],
38+
"OWASP Mobile Top 10 2024": [
39+
"M10"
40+
],
3841
"MASVS": [
3942
"MSTG-CRYPTO-3"
4043
],

‎sonar-java-plugin/src/main/resources/org/sonar/l10n/java/rules/java/S5547.html

+5
Original file line numberDiff line numberDiff line change
@@ -67,6 +67,11 @@ <h3>Standards</h3>
6767
Exposure</a> </li>
6868
<li> OWASP - <a href="https://owasp.org/www-project-top-ten/2017/A6_2017-Security_Misconfiguration">Top 10 2017 Category A6 - Security
6969
Misconfiguration</a> </li>
70+
<li> OWASP - <a href="https://mas.owasp.org/checklists/MASVS-CRYPTO/">Mobile AppSec Verification Standard - Cryptography Requirements</a> </li>
71+
<li> OWASP - <a href="https://owasp.org/www-project-mobile-top-10/2016-risks/m5-insufficient-cryptography">Mobile Top 10 2016 Category M5 -
72+
Insufficient Cryptography</a> </li>
73+
<li> OWASP - <a href="https://owasp.org/www-project-mobile-top-10/2023-risks/m10-insufficient-cryptography">Mobile Top 10 2024 Category M10 -
74+
Insufficient Cryptography</a> </li>
7075
<li> CWE - <a href="https://cwe.mitre.org/data/definitions/327">CWE-327 - Use of a Broken or Risky Cryptographic Algorithm</a> </li>
7176
<li> STIG Viewer - <a href="https://stigviewer.com/stig/application_security_and_development/2023-06-08/finding/V-222396">Application Security and
7277
Development: V-222396</a> - The application must implement DoD-approved encryption to protect the confidentiality of remote access sessions. </li>

‎sonar-java-plugin/src/main/resources/org/sonar/l10n/java/rules/java/S5547.json

+3
Original file line numberDiff line numberDiff line change
@@ -35,6 +35,9 @@
3535
"OWASP Mobile": [
3636
"M5"
3737
],
38+
"OWASP Mobile Top 10 2024": [
39+
"M10"
40+
],
3841
"MASVS": [
3942
"MSTG-CRYPTO-3"
4043
],

0 commit comments

Comments
 (0)