Skip to content

Commit 1298c19

Browse files
guillaume-dequennesonartech
authored andcommitted
SONARPY-4149 Update rules metadata (#1101)
GitOrigin-RevId: 0810083f257b39127f369f634a29d48ff04d1575
1 parent 742621c commit 1298c19

80 files changed

Lines changed: 1036 additions & 1004 deletions

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

python-checks/src/main/java/org/sonar/python/checks/OpenSourceCheckList.java

Lines changed: 0 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -60,7 +60,6 @@
6060
import org.sonar.python.checks.hotspots.HttpOnlyCookieCheck;
6161
import org.sonar.python.checks.hotspots.LoggersConfigurationCheck;
6262
import org.sonar.python.checks.hotspots.NonStandardCryptographicAlgorithmCheck;
63-
import org.sonar.python.checks.hotspots.OsExecCheck;
6463
import org.sonar.python.checks.hotspots.ProcessSignallingCheck;
6564
import org.sonar.python.checks.hotspots.PseudoRandomCheck;
6665
import org.sonar.python.checks.hotspots.PubliclyWritableDirectoriesCheck;
@@ -359,7 +358,6 @@ public Stream<Class<?>> getChecks() {
359358
UnusedGroupNamesCheck.class,
360359
OctalEscapeCheck.class,
361360
OneStatementPerLineCheck.class,
362-
OsExecCheck.class,
363361
OverwrittenCollectionEntryCheck.class,
364362
PandasAddMergeParametersCheck.class,
365363
PandasChainInstructionCheck.class,

python-checks/src/main/java/org/sonar/python/checks/hotspots/OsExecCheck.java

Lines changed: 0 additions & 74 deletions
This file was deleted.

python-checks/src/main/resources/org/sonar/l10n/py/rules/python/S1313.html

Lines changed: 35 additions & 40 deletions
Original file line numberDiff line numberDiff line change
@@ -1,44 +1,23 @@
1-
<p>Hardcoding IP addresses is security-sensitive. It has led in the past to the following vulnerabilities:</p>
1+
<p>IP addresses hardcoded in source code couple the application to a specific infrastructure configuration. Today’s services have an ever-changing
2+
architecture due to their scaling and redundancy needs. When an IP address changes, every hardcoded occurrence must be found and updated, which has an
3+
impact on development, delivery, and deployment:</p>
24
<ul>
3-
<li><a href="https://www.cve.org/CVERecord?id=CVE-2006-5901">CVE-2006-5901</a></li>
4-
<li><a href="https://www.cve.org/CVERecord?id=CVE-2005-3725">CVE-2005-3725</a></li>
5+
<li>Developers must fix the code every time the address changes, instead of having an operations team update a configuration file.</li>
6+
<li>It leads to using the same address in every environment (dev, staging, QA, production).</li>
57
</ul>
6-
<p>Today’s services have an ever-changing architecture due to their scaling and redundancy needs. It is a mistake to think that a service will always
7-
have the same IP address. When it does change, the hardcoded IP will have to be modified too. This will have an impact on the product development,
8-
delivery, and deployment:</p>
9-
<ul>
10-
<li>The developers will have to do a rapid fix every time this happens, instead of having an operation team change a configuration file.</li>
11-
<li>It misleads to use the same address in every environment (dev, sys, qa, prod).</li>
12-
</ul>
13-
<p>Last but not least it has an effect on application security. Attackers might be able to decompile the code and thereby discover a potentially
14-
sensitive address. They can perform a Denial of Service attack on the service, try to get access to the system, or try to spoof the IP address to
15-
bypass security checks. Such attacks can always be possible, but in the case of a hardcoded IP address solving the issue will take more time, which
16-
will increase an attack’s impact.</p>
17-
<h2>Ask Yourself Whether</h2>
18-
<p>The disclosed IP address is sensitive, e.g.:</p>
19-
<ul>
20-
<li>Can give information to an attacker about the network topology.</li>
21-
<li>It’s a personal (assigned to an identifiable person) IP address.</li>
22-
</ul>
23-
<p>There is a risk if you answered yes to any of these questions.</p>
24-
<h2>Recommended Secure Coding Practices</h2>
25-
<p>Don’t hard-code the IP address in the source code, instead make it configurable with environment variables, configuration files, or a similar
26-
approach. Alternatively, if confidentially is not required a domain name can be used since it allows to change the destination quickly without having
27-
to rebuild the software.</p>
28-
<h2>Sensitive Code Example</h2>
29-
<pre>
30-
ip = '192.168.12.42'
31-
sock = socket.socket()
32-
sock.bind((ip, 9090))
33-
</pre>
34-
<h2>Compliant Solution</h2>
35-
<pre>
36-
ip = config.get(section, ipAddress)
37-
sock = socket.socket()
38-
sock.bind((ip, 9090))
39-
</pre>
40-
<h2>Exceptions</h2>
41-
<p>No issue is reported for the following cases because they are not considered sensitive:</p>
8+
<h2>Why is this an issue?</h2>
9+
<p>Hardcoding an IP address embeds infrastructure configuration directly into the application. This means any change to the network environment—such
10+
as moving a service to a different host or scaling horizontally—requires a code modification and a full redeployment. Unlike a domain name, a
11+
hardcoded address also makes it harder to use different values across environments such as development, staging, and production.</p>
12+
<h3>What is the potential impact?</h3>
13+
<h4>Environment coupling</h4>
14+
<p>A hardcoded IP address is the same in every environment the application runs in. This makes it difficult to point development, staging, and
15+
production builds at different infrastructure without modifying the source code.</p>
16+
<h4>Increased deployment friction</h4>
17+
<p>Any change to the target host—such as migrating a service, scaling out, or rotating infrastructure—requires a code change and a full redeployment
18+
cycle. This prevents operational teams from making infrastructure adjustments independently and slows down incident response.</p>
19+
<h3>Exceptions</h3>
20+
<p>No issue is reported for the following well-known, special-purpose addresses, as they do not represent configurable infrastructure endpoints:</p>
4221
<ul>
4322
<li>Loopback addresses 127.0.0.0/8 in CIDR notation (from 127.0.0.0 to 127.255.255.255)</li>
4423
<li>Broadcast address 255.255.255.255</li>
@@ -50,7 +29,23 @@ <h2>Exceptions</h2>
5029
<li>Addresses in the range 2001:db8::/32, reserved for documentation purposes by <a href="https://datatracker.ietf.org/doc/html/rfc3849">RFC
5130
3849</a></li>
5231
</ul>
53-
<h2>See</h2>
32+
<h2>How to fix it</h2>
33+
<h3>Code examples</h3>
34+
<p>The following code contains a hardcoded IP address instead of reading it from configuration or environment variables.</p>
35+
<h4>Noncompliant code example</h4>
36+
<pre data-diff-id="1" data-diff-type="noncompliant">
37+
ip = '192.168.12.42' # Noncompliant
38+
sock = socket.socket()
39+
sock.bind((ip, 9090))
40+
</pre>
41+
<h4>Compliant solution</h4>
42+
<pre data-diff-id="1" data-diff-type="compliant">
43+
ip = config.get(section, ipAddress)
44+
sock = socket.socket()
45+
sock.bind((ip, 9090))
46+
</pre>
47+
<h2>Resources</h2>
48+
<h3>Standards</h3>
5449
<ul>
5550
<li>OWASP - <a href="https://owasp.org/Top10/A01_2021-Broken_Access_Control/">Top 10 2021 Category A1 - Broken Access Control</a></li>
5651
<li>OWASP - <a href="https://owasp.org/www-project-top-ten/2017/A3_2017-Sensitive_Data_Exposure">Top 10 2017 Category A3 - Sensitive Data

python-checks/src/main/resources/org/sonar/l10n/py/rules/python/S1313.json

Lines changed: 5 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
{
2-
"title": "Using hardcoded IP addresses is security-sensitive",
3-
"type": "SECURITY_HOTSPOT",
2+
"title": "IP addresses should not be hardcoded",
3+
"type": "CODE_SMELL",
44
"code": {
55
"impacts": {
66
"SECURITY": "LOW"
@@ -13,9 +13,11 @@
1313
"constantCost": "30min"
1414
},
1515
"tags": [
16-
"bad-practice"
16+
"bad-practice",
17+
"former-hotspot"
1718
],
1819
"defaultSeverity": "Minor",
20+
"quickfix": "unknown",
1921
"ruleSpecification": "RSPEC-1313",
2022
"sqKey": "S1313",
2123
"scope": "Main",

python-checks/src/main/resources/org/sonar/l10n/py/rules/python/S1523.html

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -20,9 +20,9 @@ <h2>Recommended Secure Coding Practices</h2>
2020
<p>Regarding the execution of unknown code, the best solution is to not run code provided by an untrusted source. If you really need to do it, run the
2121
code in a <a href="https://en.wikipedia.org/wiki/Sandbox_(computer_security)">sandboxed</a> environment. Use jails, firewalls and whatever means your
2222
operating system and programming language provide (example: <a
23-
href="https://wiki.sei.cmu.edu/confluence/display/java/SEC54-J.+Create+a+secure+sandbox+using+a+security+manager">Security Managers</a> in java, <a
24-
href="https://www.w3schools.com/tags/att_iframe_sandbox.asp">iframes</a> and <a href="https://en.wikipedia.org/wiki/Same-origin_policy">same-origin
25-
policy</a> for javascript in a web browser).</p>
23+
href="https://cmu-sei.github.io/secure-coding-standards/sei-cert-oracle-coding-standard-for-java/recommendations/platform-security-sec/sec54-j">Security
24+
Managers</a> in java, <a href="https://www.w3schools.com/tags/att_iframe_sandbox.asp">iframes</a> and <a
25+
href="https://en.wikipedia.org/wiki/Same-origin_policy">same-origin policy</a> for javascript in a web browser).</p>
2626
<p>Do not try to create a blacklist of dangerous code. It is impossible to cover all attacks that way.</p>
2727
<p>Avoid using dynamic code APIs whenever possible. Hard-coded code is always safer.</p>
2828
<h2>Sensitive Code Example</h2>

python-checks/src/main/resources/org/sonar/l10n/py/rules/python/S2068.json

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -14,7 +14,8 @@
1414
},
1515
"quickfix": "infeasible",
1616
"tags": [
17-
"cwe"
17+
"cwe",
18+
"former-hotspot"
1819
],
1920
"defaultSeverity": "Major",
2021
"ruleSpecification": "RSPEC-2068",

python-checks/src/main/resources/org/sonar/l10n/py/rules/python/S2092.json

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -18,7 +18,8 @@
1818
"privacy",
1919
"fastapi",
2020
"django",
21-
"flask"
21+
"flask",
22+
"former-hotspot"
2223
],
2324
"defaultSeverity": "Minor",
2425
"ruleSpecification": "RSPEC-2092",

python-checks/src/main/resources/org/sonar/l10n/py/rules/python/S2257.html

Lines changed: 22 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -1,16 +1,27 @@
1-
<p>The use of a non-standard algorithm is dangerous because a determined attacker may be able to break the algorithm and compromise whatever data has
2-
been protected. Standard algorithms like <code>Argon2PasswordHasher</code>, <code>BCryptPasswordHasher</code>, …​ should be used instead.</p>
3-
<p>This rule tracks creation of <code>BasePasswordHasher</code> subclasses for Django applications.</p>
4-
<h2>Recommended Secure Coding Practices</h2>
5-
<ul>
6-
<li>Use a standard algorithm instead of creating a custom one.</li>
7-
</ul>
8-
<h2>Sensitive Code Example</h2>
9-
<pre>
10-
class CustomPasswordHasher(BasePasswordHasher): # Sensitive
1+
<p>Cryptographic operations should use proven, standard algorithms rather than custom implementations.</p>
2+
<h2>Why is this an issue?</h2>
3+
<p>Non-standard cryptographic algorithms are those that have not been publicly vetted by the security community or that implement cryptographic
4+
primitives in a custom way. Creating a custom cryptographic algorithm by subclassing standard cryptographic base classes bypasses the rigorous testing
5+
and peer review that established algorithms undergo. Custom implementations are likely to contain subtle flaws that could be exploited to break the
6+
protection the algorithm is supposed to provide.</p>
7+
<h3>What is the potential impact?</h3>
8+
<h4>Data compromise</h4>
9+
<p>When an attacker discovers a flaw in a custom cryptographic algorithm, they may be able to decrypt any data protected by it. Depending on the
10+
application, this could expose passwords, personal data, financial records, or other sensitive information.</p>
11+
<h2>How to fix it</h2>
12+
<p>This rule detects custom implementations of <code>BasePasswordHasher</code> subclasses for Django applications.</p>
13+
<h3>Code examples</h3>
14+
<h4>Noncompliant code example</h4>
15+
<pre data-diff-id="1" data-diff-type="noncompliant">
16+
class CustomPasswordHasher(BasePasswordHasher): # Noncompliant
1117
# ...
1218
</pre>
13-
<h2>See</h2>
19+
<h4>Compliant solution</h4>
20+
<pre data-diff-id="1" data-diff-type="compliant">
21+
from django.contrib.auth.hashers import Argon2PasswordHasher
22+
</pre>
23+
<h2>Resources</h2>
24+
<h3>Standards</h3>
1425
<ul>
1526
<li>OWASP - <a href="https://owasp.org/Top10/A02_2021-Cryptographic_Failures/">Top 10 2021 Category A2 - Cryptographic Failures</a></li>
1627
<li>OWASP - <a href="https://owasp.org/www-project-top-ten/2017/A3_2017-Sensitive_Data_Exposure">Top 10 2017 Category A3 - Sensitive Data

python-checks/src/main/resources/org/sonar/l10n/py/rules/python/S2257.json

Lines changed: 5 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
{
2-
"title": "Using non-standard cryptographic algorithms is security-sensitive",
3-
"type": "SECURITY_HOTSPOT",
2+
"title": "Custom cryptographic algorithms should not be used",
3+
"type": "VULNERABILITY",
44
"code": {
55
"impacts": {
66
"SECURITY": "HIGH"
@@ -12,9 +12,11 @@
1212
"func": "Constant\/Issue",
1313
"constantCost": "1d"
1414
},
15+
"quickfix": "unknown",
1516
"tags": [
1617
"cwe",
17-
"bad-practice"
18+
"bad-practice",
19+
"former-hotspot"
1820
],
1921
"defaultSeverity": "Critical",
2022
"ruleSpecification": "RSPEC-2257",

python-checks/src/main/resources/org/sonar/l10n/py/rules/python/S2612.html

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -25,7 +25,7 @@ <h2>How to fix it</h2>
2525
<h3>Code examples</h3>
2626
<h4>Noncompliant code example</h4>
2727
<pre data-diff-id="1" data-diff-type="noncompliant">
28-
os.umask(0) # Sensitive
28+
os.umask(0) # Noncompliant
2929
</pre>
3030
<h4>Compliant solution</h4>
3131
<pre data-diff-id="1" data-diff-type="compliant">

0 commit comments

Comments
 (0)