SONAR-26691 Add OWASP MASVS standard

Author: cody-simms-sonarsource

gradle.properties

@@ -6,7 +6,7 @@ version=26.1
 # No change required for patch versions
 versionEOL=2026-06-08
 pdfreportVersion=3.0.0.83
-complianceReportsVersion=1.0.1.191
+complianceReportsVersion=1.0.1.199
 pluginApiVersion=13.4.3.4290
 description=Open source platform for continuous inspection of code quality
 projectTitle=SonarQube

server/sonar-server-common/src/main/java/org/sonar/server/security/SecurityStandards.java

@@ -336,6 +336,34 @@ public String category() {
   private static final Ordering<SQCategory> SQ_CATEGORY_ORDERING = Ordering.explicit(stream(SQCategory.values()).toList());
   public static final Ordering<String> SQ_CATEGORY_KEYS_ORDERING = Ordering.explicit(stream(SQCategory.values()).map(SQCategory::getKey).toList());
 
+  public static final List<String> OWASP_MASVS_CATEGORIES = List.of(
+    "MASVS-STORAGE-1",
+    "MASVS-STORAGE-2",
+    "MASVS-CRYPTO-1",
+    "MASVS-CRYPTO-2",
+    "MASVS-AUTH-1",
+    "MASVS-AUTH-2",
+    "MASVS-AUTH-3",
+    "MASVS-NETWORK-1",
+    "MASVS-NETWORK-2",
+    "MASVS-PLATFORM-1",
+    "MASVS-PLATFORM-2",
+    "MASVS-PLATFORM-3",
+    "MASVS-CODE-1",
+    "MASVS-CODE-2",
+    "MASVS-CODE-3",
+    "MASVS-CODE-4",
+    "MASVS-RESILIENCE-1",
+    "MASVS-RESILIENCE-2",
+    "MASVS-RESILIENCE-3",
+    "MASVS-RESILIENCE-4",
+    "MASVS-PRIVACY-1",
+    "MASVS-PRIVACY-2",
+    "MASVS-PRIVACY-3",
+    "MASVS-PRIVACY-4"
+  );
+  public static final Ordering<String> OWASP_MASVS_CATEGORY_KEYS_ORDERING = Ordering.explicit(OWASP_MASVS_CATEGORIES);
+
   public static final Map<String, String> CWES_BY_CASA_CATEGORY;
 
   static {

sonar-ws/src/main/java/org/sonarqube/ws/client/issue/IssuesWsParameters.java

@@ -95,6 +95,7 @@ public class IssuesWsParameters {
   public static final String PARAM_PCI_DSS_40 = "pciDss-4.0";
   public static final String PARAM_OWASP_ASVS = "owaspAsvs";
   public static final String PARAM_OWASP_ASVS_40 = "owaspAsvs-4.0";
+  public static final String PARAM_OWASP_MASVS = "owaspMasvs-v2";
   public static final String PARAM_OWASP_LLM_TOP_10 = "owaspLlmTop10";
   public static final String PARAM_OWASP_MOBILE_TOP_10 = "owaspMobileTop10";
   public static final String PARAM_OWASP_MOBILE_TOP_10_2024 = "owaspMobileTop10-2024";