Skip to content

Commit c763401

Browse files
rudy-regazzoni-sonarsourcerudy-regazzoni-sonarsource
authored
Update rule api (#1265)
1 parent 6c384ef commit c763401

23 files changed

+59
-30
lines changed

‎php-checks/src/main/resources/org/sonar/l10n/php/rules/php/S100.html

+19-2
Original file line numberDiff line numberDiff line change
@@ -2,17 +2,29 @@ <h2>Why is this an issue?</h2>
22
<p>Shared naming conventions allow teams to collaborate efficiently.</p>
33
<p>This rule raises an issue when a function name does not match a provided regular expression.</p>
44
<p>For example, with the default provided regular expression <code>^[a-z][a-zA-Z0-9]*$</code>, the function:</p>
5-
<pre>
5+
<pre data-diff-id="1" data-diff-type="noncompliant">
66
function DoSomething(){ // Noncompliant
77
// ...
88
}
99
</pre>
1010
<p>should be renamed to</p>
11-
<pre>
11+
<pre data-diff-id="1" data-diff-type="compliant">
1212
function doSomething(){
1313
// ...
1414
}
1515
</pre>
16+
<p>In case the Drupal framework is detected and the default regex is not replaced, it will follow the PHP coding standards for Drupal.</p>
17+
<pre data-diff-id="2" data-diff-type="noncompliant">
18+
function doSomething(){ // Noncompliant
19+
// ...
20+
}
21+
</pre>
22+
<p>should be renamed to</p>
23+
<pre data-diff-id="2" data-diff-type="compliant">
24+
function do_something(){
25+
// ...
26+
}
27+
</pre>
1628
<h3>Exceptions</h3>
1729
<p>Methods with an <code>@inheritdoc</code> annotation, as well as magic methods (<code>__construct()</code>, <code>__destruct()</code>,
1830
<code>__call()</code>, <code>__callStatic()</code>, <code>__get()</code>, <code>__set()</code>, <code>__isset()</code>, <code>__unset()</code>,
@@ -27,4 +39,9 @@ <h3>Exceptions</h3>
2739
*/
2840
function myFunc(){...} // Compliant by exception
2941
</pre>
42+
<h2>References</h2>
43+
<ul>
44+
<li> <a href="https://www.drupal.org/docs/develop/standards/php/php-coding-standards#s-functions-and-variables">Drupal - Naming Conventions -
45+
Functions and variables</a> </li>
46+
</ul>
3047

‎php-checks/src/main/resources/org/sonar/l10n/php/rules/php/S1781.html

+15
Original file line numberDiff line numberDiff line change
@@ -3,17 +3,32 @@ <h2>Why is this an issue?</h2>
33
functionality. This allows for more flexibility and ease of use when writing code.</p>
44
<p>However, it is generally recommended to follow a consistent casing convention for readability and maintainability purposes. Relevant constants are
55
<code>true</code>, <code>false</code> and <code>null</code>.</p>
6+
<p>Note that if the Drupal framework is detected, this rule will enforce Drupal standards instead. Relevant constants are <code>TRUE</code>,
7+
<code>FALSE</code> and <code>NULL</code>.</p>
68
<h3>Noncompliant code example</h3>
79
<pre data-diff-id="1" data-diff-type="noncompliant">
810
&lt;?php ECHO 'Hello World'; ?&gt;
911
</pre>
12+
<pre data-diff-id="2" data-diff-type="noncompliant">
13+
&lt;?php
14+
// In a Drupal context
15+
const CACHE_ENABLED = true;
16+
?&gt;
17+
</pre>
1018
<h3>Compliant solution</h3>
1119
<pre data-diff-id="1" data-diff-type="compliant">
1220
&lt;?php echo 'Hello World'; ?&gt;
1321
</pre>
22+
<pre data-diff-id="2" data-diff-type="compliant">
23+
&lt;?php
24+
// In a Drupal context
25+
const CACHE_ENABLED = TRUE;
26+
?&gt;
27+
</pre>
1428
<h2>Resources</h2>
1529
<h3>Documentation</h3>
1630
<ul>
1731
<li> <a href="https://www.php.net/manual/en/reserved.constants.php">PHP Manual - Predefined Constants</a> </li>
32+
<li> <a href="https://www.drupal.org/docs/develop/standards/php/php-coding-standards#s-constants">Drupal - Naming Conventions - Constants</a> </li>
1833
</ul>
1934

‎php-checks/src/main/resources/org/sonar/l10n/php/rules/php/S2053.html

+1-1
Original file line numberDiff line numberDiff line change
@@ -42,7 +42,7 @@ <h4>Noncompliant code example</h4>
4242
</pre>
4343
<h4>Compliant solution</h4>
4444
<pre data-diff-id="1" data-diff-type="compliant">
45-
$salt = random_bytes(16);
45+
$salt = random_bytes(32);
4646
$hash = hash_pbkdf2('sha256', $password, $salt, 100000);
4747
</pre>
4848
<h3>How does this work?</h3>

‎php-checks/src/main/resources/org/sonar/l10n/php/rules/php/S2053.json

+1-1
Original file line numberDiff line numberDiff line change
@@ -36,7 +36,7 @@
3636
"PCI DSS 4.0": [
3737
"6.2.4"
3838
],
39-
"STIG ASD 2023-06-08": [
39+
"STIG ASD_V5R3": [
4040
"V-222542"
4141
]
4242
},

‎php-checks/src/main/resources/org/sonar/l10n/php/rules/php/S2092.json

+1-1
Original file line numberDiff line numberDiff line change
@@ -45,7 +45,7 @@
4545
"6.1.2",
4646
"6.1.3"
4747
],
48-
"STIG ASD 2023-06-08": [
48+
"STIG ASD_V5R3": [
4949
"V-222576"
5050
]
5151
}

‎php-checks/src/main/resources/org/sonar/l10n/php/rules/php/S2245.html

+1-2
Original file line numberDiff line numberDiff line change
@@ -39,8 +39,7 @@ <h2>See</h2>
3939
<li> OWASP - <a href="https://owasp.org/Top10/A02_2021-Cryptographic_Failures/">Top 10 2021 Category A2 - Cryptographic Failures</a> </li>
4040
<li> OWASP - <a href="https://owasp.org/www-project-top-ten/2017/A3_2017-Sensitive_Data_Exposure">Top 10 2017 Category A3 - Sensitive Data
4141
Exposure</a> </li>
42-
<li> <a href="https://mobile-security.gitbook.io/masvs/security-requirements/0x08-v3-cryptography_verification_requirements">Mobile AppSec
43-
Verification Standard - Cryptography Requirements</a> </li>
42+
<li> <a href="https://mas.owasp.org/checklists/MASVS-CRYPTO/">Mobile AppSec Verification Standard - Cryptography Requirements</a> </li>
4443
<li> OWASP - <a href="https://owasp.org/www-project-mobile-top-10/2016-risks/m5-insufficient-cryptography">Mobile Top 10 2016 Category M5 -
4544
Insufficient Cryptography</a> </li>
4645
<li> CWE - <a href="https://cwe.mitre.org/data/definitions/338">CWE-338 - Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG)</a>

‎php-checks/src/main/resources/org/sonar/l10n/php/rules/php/S2612.json

+1-1
Original file line numberDiff line numberDiff line change
@@ -40,7 +40,7 @@
4040
"ASVS 4.0": [
4141
"4.3.3"
4242
],
43-
"STIG ASD 2023-06-08": [
43+
"STIG ASD_V5R3": [
4444
"V-222430"
4545
]
4646
}

‎php-checks/src/main/resources/org/sonar/l10n/php/rules/php/S2755.json

+1-1
Original file line numberDiff line numberDiff line change
@@ -39,7 +39,7 @@
3939
"ASVS 4.0": [
4040
"5.5.2"
4141
],
42-
"STIG ASD 2023-06-08": [
42+
"STIG ASD_V5R3": [
4343
"V-222608"
4444
]
4545
},

‎php-checks/src/main/resources/org/sonar/l10n/php/rules/php/S3330.json

+1-1
Original file line numberDiff line numberDiff line change
@@ -39,7 +39,7 @@
3939
"ASVS 4.0": [
4040
"3.4.2"
4141
],
42-
"STIG ASD 2023-06-08": [
42+
"STIG ASD_V5R3": [
4343
"V-222575"
4444
]
4545
}

‎php-checks/src/main/resources/org/sonar/l10n/php/rules/php/S4426.html

+1-2
Original file line numberDiff line numberDiff line change
@@ -127,8 +127,7 @@ <h3>Standards</h3>
127127
Exposure</a> </li>
128128
<li> OWASP - <a href="https://owasp.org/www-project-top-ten/2017/A6_2017-Security_Misconfiguration">Top 10 2017 Category A6 - Security
129129
Misconfiguration</a> </li>
130-
<li> OWASP - <a href="https://mobile-security.gitbook.io/masvs/security-requirements/0x08-v3-cryptography_verification_requirements">Mobile AppSec
131-
Verification Standard - Cryptography Requirements</a> </li>
130+
<li> OWASP - <a href="https://mas.owasp.org/checklists/MASVS-CRYPTO/">Mobile AppSec Verification Standard - Cryptography Requirements</a> </li>
132131
<li> OWASP - <a href="https://owasp.org/www-project-mobile-top-10/2016-risks/m5-insufficient-cryptography">Mobile Top 10 2016 Category M5 -
133132
Insufficient Cryptography</a> </li>
134133
<li> <a href="https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-131Ar1.pdf">NIST 800-131A</a> - Recommendation for Transitioning the

‎php-checks/src/main/resources/org/sonar/l10n/php/rules/php/S4502.json

+1-1
Original file line numberDiff line numberDiff line change
@@ -39,7 +39,7 @@
3939
"13.2.3",
4040
"4.2.2"
4141
],
42-
"STIG ASD 2023-06-08": [
42+
"STIG ASD_V5R3": [
4343
"V-222603"
4444
]
4545
}

‎php-checks/src/main/resources/org/sonar/l10n/php/rules/php/S4784.html

+2-2
Original file line numberDiff line numberDiff line change
@@ -66,8 +66,8 @@ <h2>Exceptions</h2>
6666
$pattern = "/(a+)+/";
6767
$result = eregi($pattern, $input); // No issue will be raised even if it is Sensitive
6868
</pre>
69-
<p>Some corner-case regular expressions will not raise an issue even though they might be vulnerable. For example: <code>(a|aa)+</code>,
70-
<code>(a|a?)+</code>.</p>
69+
<p>Some corner-case regular expressions will not raise an issue even though they might be vulnerable. For example: <code>(a|aa)``,
70+
``(a|a?)</code>.</p>
7171
<p>It is a good idea to test your regular expression if it has the same pattern on both side of a "<code>|</code>".</p>
7272
<h2>See</h2>
7373
<ul>

‎php-checks/src/main/resources/org/sonar/l10n/php/rules/php/S4790.html

+1-2
Original file line numberDiff line numberDiff line change
@@ -34,8 +34,7 @@ <h2>See</h2>
3434
Exposure</a> </li>
3535
<li> OWASP - <a href="https://owasp.org/www-project-top-ten/2017/A6_2017-Security_Misconfiguration">Top 10 2017 Category A6 - Security
3636
Misconfiguration</a> </li>
37-
<li> OWASP - <a href="https://mobile-security.gitbook.io/masvs/security-requirements/0x08-v3-cryptography_verification_requirements">Mobile AppSec
38-
Verification Standard - Cryptography Requirements</a> </li>
37+
<li> OWASP - <a href="https://mas.owasp.org/checklists/MASVS-CRYPTO/">Mobile AppSec Verification Standard - Cryptography Requirements</a> </li>
3938
<li> OWASP - <a href="https://owasp.org/www-project-mobile-top-10/2016-risks/m5-insufficient-cryptography">Mobile Top 10 2016 Category M5 -
4039
Insufficient Cryptography</a> </li>
4140
<li> CWE - <a href="https://cwe.mitre.org/data/definitions/1240">CWE-1240 - Use of a Risky Cryptographic Primitive</a> </li>

‎php-checks/src/main/resources/org/sonar/l10n/php/rules/php/S4830.html

+2-2
Original file line numberDiff line numberDiff line change
@@ -60,8 +60,8 @@ <h3>Standards</h3>
6060
Misconfiguration</a> </li>
6161
<li> OWASP - <a href="https://owasp.org/www-project-mobile-top-10/2016-risks/m3-insecure-communication">Mobile Top 10 2016 Category M3 - Insecure
6262
Communication</a> </li>
63-
<li> OWASP - <a href="https://mobile-security.gitbook.io/masvs/security-requirements/0x10-v5-network_communication_requirements">Mobile AppSec
64-
Verification Standard - Network Communication Requirements</a> </li>
63+
<li> OWASP - <a href="https://mas.owasp.org/checklists/MASVS-NETWORK/">Mobile AppSec Verification Standard - Network Communication Requirements</a>
64+
</li>
6565
<li> CWE - <a href="https://cwe.mitre.org/data/definitions/295">CWE-295 - Improper Certificate Validation</a> </li>
6666
<li> STIG Viewer - <a href="https://stigviewer.com/stig/application_security_and_development/2023-06-08/finding/V-222550">Application Security and
6767
Development: V-222550</a> - The application must validate certificates by constructing a certification path to an accepted trust anchor. </li>

‎php-checks/src/main/resources/org/sonar/l10n/php/rules/php/S4830.json

+1-1
Original file line numberDiff line numberDiff line change
@@ -53,7 +53,7 @@
5353
"1.9.2",
5454
"9.2.1"
5555
],
56-
"STIG ASD 2023-06-08": [
56+
"STIG ASD_V5R3": [
5757
"V-222550"
5858
]
5959
},

‎php-checks/src/main/resources/org/sonar/l10n/php/rules/php/S5328.json

+1-1
Original file line numberDiff line numberDiff line change
@@ -42,7 +42,7 @@
4242
"2.6.2",
4343
"2.9.2"
4444
],
45-
"STIG ASD 2023-06-08": [
45+
"STIG ASD_V5R3": [
4646
"V-222579",
4747
"V-222582"
4848
]

‎php-checks/src/main/resources/org/sonar/l10n/php/rules/php/S5332.html

+2-2
Original file line numberDiff line numberDiff line change
@@ -109,8 +109,8 @@ <h3>Standards</h3>
109109
<li> OWASP - <a href="https://owasp.org/www-project-top-ten/2017/A3_2017-Sensitive_Data_Exposure">Top 10 2017 Category A3 - Sensitive Data
110110
Exposure</a> </li>
111111
<li> OWASP - <a href="https://owasp.org/Top10/A02_2021-Cryptographic_Failures/">Top 10 2021 Category A2 - Cryptographic Failures</a> </li>
112-
<li> OWASP - <a href="https://mobile-security.gitbook.io/masvs/security-requirements/0x10-v5-network_communication_requirements">Mobile AppSec
113-
Verification Standard - Network Communication Requirements</a> </li>
112+
<li> OWASP - <a href="https://mas.owasp.org/checklists/MASVS-NETWORK/">Mobile AppSec Verification Standard - Network Communication Requirements</a>
113+
</li>
114114
<li> OWASP - <a href="https://owasp.org/www-project-mobile-top-10/2016-risks/m3-insecure-communication">Mobile Top 10 2016 Category M3 - Insecure
115115
Communication</a> </li>
116116
<li> CWE - <a href="https://cwe.mitre.org/data/definitions/200">CWE-200 - Exposure of Sensitive Information to an Unauthorized Actor</a> </li>

‎php-checks/src/main/resources/org/sonar/l10n/php/rules/php/S5332.json

+1-1
Original file line numberDiff line numberDiff line change
@@ -45,7 +45,7 @@
4545
"9.1.1",
4646
"9.2.2"
4747
],
48-
"STIG ASD 2023-06-08": [
48+
"STIG ASD_V5R3": [
4949
"V-222397",
5050
"V-222534",
5151
"V-222562",

‎php-checks/src/main/resources/org/sonar/l10n/php/rules/php/S5527.html

+2-2
Original file line numberDiff line numberDiff line change
@@ -61,8 +61,8 @@ <h3>Standards</h3>
6161
Exposure</a> </li>
6262
<li> OWASP - <a href="https://owasp.org/www-project-top-ten/2017/A6_2017-Security_Misconfiguration">Top 10 2017 Category A6 - Security
6363
Misconfiguration</a> </li>
64-
<li> OWASP - <a href="https://mobile-security.gitbook.io/masvs/security-requirements/0x10-v5-network_communication_requirements">Mobile AppSec
65-
Verification Standard - Network Communication Requirements</a> </li>
64+
<li> OWASP - <a href="https://mas.owasp.org/checklists/MASVS-NETWORK/">Mobile AppSec Verification Standard - Network Communication Requirements</a>
65+
</li>
6666
<li> OWASP - <a href="https://owasp.org/www-project-mobile-top-10/2016-risks/m3-insecure-communication">Mobile Top 10 2016 Category M3 - Insecure
6767
Communication</a> </li>
6868
<li> CWE - <a href="https://cwe.mitre.org/data/definitions/297">CWE-297 - Improper Validation of Certificate with Host Mismatch</a> </li>

‎php-checks/src/main/resources/org/sonar/l10n/php/rules/php/S5527.json

+1-1
Original file line numberDiff line numberDiff line change
@@ -49,7 +49,7 @@
4949
"4.2.1",
5050
"6.2.4"
5151
],
52-
"STIG ASD 2023-06-08": [
52+
"STIG ASD_V5R3": [
5353
"V-222550"
5454
]
5555
},

‎php-checks/src/main/resources/org/sonar/l10n/php/rules/php/S5547.json

+1-1
Original file line numberDiff line numberDiff line change
@@ -53,7 +53,7 @@
5353
"6.2.5",
5454
"8.3.7"
5555
],
56-
"STIG ASD 2023-06-08": [
56+
"STIG ASD_V5R3": [
5757
"V-222396"
5858
]
5959
},

‎php-checks/src/main/resources/org/sonar/l10n/php/rules/php/S5876.json

+1-1
Original file line numberDiff line numberDiff line change
@@ -38,7 +38,7 @@
3838
"ASVS 4.0": [
3939
"3.2.1"
4040
],
41-
"STIG ASD 2023-06-08": [
41+
"STIG ASD_V5R3": [
4242
"V-222579",
4343
"V-222582"
4444
]

‎sonarpedia.json

+1-1
Original file line numberDiff line numberDiff line change
@@ -3,7 +3,7 @@
33
"languages": [
44
"PHP"
55
],
6-
"latest-update": "2024-06-17T07:58:30.080972500Z",
6+
"latest-update": "2024-08-13T08:39:04.772066700Z",
77
"options": {
88
"no-language-in-filenames": true,
99
"preserve-filenames": true

0 commit comments

Comments
 (0)