Skip to content

Commit 099a3c0

Browse files
heliocodacyheliocodacy
committed
Add i18n and exotic rules while bumping to 1.16.2
1 parent c6f0e92 commit 099a3c0

15 files changed

Lines changed: 1511 additions & 11 deletions

‎.tool_version‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1 +1 @@
1-
1.16.1
1+
1.16.2

‎Dockerfile‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
1-
ARG OPENGREP_VERSION=v1.16.1
1+
ARG OPENGREP_VERSION=v1.16.2
22

33
# Build codacy-opengrep wrapper
44
FROM golang:1.23-alpine3.21 as builder

‎docs/codacy-rules-exotic.yaml‎

Lines changed: 28 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,28 @@
1+
rules:
2+
- id: codacy.generic.sql.exotic.hardcoded-sql-values
3+
severity: WARNING
4+
languages:
5+
- generic
6+
patterns:
7+
- pattern-either:
8+
# Complete SQL queries with hardcoded values
9+
- pattern-regex: "(?i)^[^\n]*(?:SELECT|INSERT|UPDATE|DELETE|FROM)[^\n]*\\b(?:85|4322385|86|4323386|1628302)\\b"
10+
- pattern-regex: "(?i)^[^\n]*(?:SELECT|INSERT|UPDATE|DELETE|FROM)[^\n]*['\"](?:IMO|CVO|SMO|US|FRC)['\"]"
11+
# SQL fragments with WHERE/AND/OR and hardcoded values
12+
- pattern-regex: "(?i)^[^\n]*(?:WHERE|AND|OR|SET|VALUES|IN)\\s+[^\n]*\\b(?:85|4322385|86|4323386|1628302)\\b"
13+
- pattern-regex: "(?i)^[^\n]*(?:WHERE|AND|OR|SET|VALUES|IN)\\s+[^\n]*['\"](?:IMO|CVO|SMO|US|FRC)['\"]"
14+
# Column assignments with hardcoded values
15+
- pattern-regex: "(?i)^[^\n]*(?:org_id|organization_id|language|currency|mode)\\s*=\\s*(?:85|4322385|86|4323386|1628302)\\b"
16+
- pattern-regex: "(?i)^[^\n]*(?:org_id|organization_id|language|currency|mode)\\s*=\\s*['\"](?:IMO|CVO|SMO|US|FRC)['\"]"
17+
- pattern-not-regex: '^\s*(?://|--|/\*|\*)'
18+
message: >-
19+
Hardcoded Language, Currency, or Org_Id values detected in SQL. Avoid hardcoding such values; use parameters or configuration instead.
20+
metadata:
21+
category: security
22+
subcategory: sql
23+
description: Flags hardcoded Language, Currency, or Org_Id values in SQL queries that should be parameterized
24+
technology:
25+
- sql
26+
impact: MEDIUM
27+
confidence: LOW
28+
likelihood: HIGH

‎docs/codacy-rules-i18n.yaml‎

Lines changed: 308 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -106,6 +106,242 @@ rules:
106106
confidence: LOW
107107
likelihood: HIGH
108108

109+
- id: codacy.js.i18n.no-hardcoded-confirm-prompt
110+
severity: WARNING
111+
languages:
112+
- js
113+
- ts
114+
patterns:
115+
- pattern-either:
116+
- pattern: confirm("...")
117+
- pattern: window.confirm("...")
118+
- pattern: prompt("...")
119+
- pattern: window.prompt("...")
120+
- pattern-not: confirm(t(...))
121+
- pattern-not: prompt(t(...))
122+
message: >-
123+
Avoid hardcoded strings in confirm/prompt dialogs. Use an i18n translation function (e.g., t("key")) with interpolation.
124+
metadata:
125+
category: codestyle
126+
subcategory: i18n
127+
description: Flags hardcoded strings in confirm/prompt dialogs to enforce localization
128+
technology:
129+
- javascript
130+
- typescript
131+
impact: MEDIUM
132+
confidence: LOW
133+
likelihood: HIGH
134+
135+
- id: codacy.js.i18n.no-hardcoded-jsx-user-props
136+
severity: WARNING
137+
languages:
138+
- js
139+
- ts
140+
patterns:
141+
- pattern-either:
142+
- pattern: <$EL placeholder="$STR" ... />
143+
- pattern: <$EL alt="$STR" ... />
144+
- pattern: <$EL aria-label="$STR" ... />
145+
- pattern: <$EL label="$STR" ... />
146+
- pattern: <$EL title="$STR" ... />
147+
- metavariable-regex:
148+
metavariable: $STR
149+
regex: '^(?!SELECT|INSERT|UPDATE|DELETE|FROM|WHERE|ERR)[^.]*\s[^.]*'
150+
message: >-
151+
Avoid hardcoded strings in JSX user-facing props. Use an i18n translation function (e.g., t("key")).
152+
metadata:
153+
category: codestyle
154+
subcategory: i18n
155+
description: Flags hardcoded strings in JSX props like placeholder, alt, aria-label, label, and title
156+
technology:
157+
- javascript
158+
- typescript
159+
impact: MEDIUM
160+
confidence: LOW
161+
likelihood: HIGH
162+
163+
- id: codacy.js.i18n.no-hardcoded-console-error
164+
severity: WARNING
165+
languages:
166+
- js
167+
- ts
168+
patterns:
169+
- pattern: console.error("$MSG")
170+
- metavariable-regex:
171+
metavariable: $MSG
172+
regex: '^(?!SELECT|INSERT|UPDATE|DELETE|FROM|WHERE|ERR)[^.]*\s[^.]*'
173+
message: >-
174+
Avoid hardcoded strings in console.error. Use an i18n translation function (e.g., t("key")).
175+
metadata:
176+
category: codestyle
177+
subcategory: i18n
178+
description: Flags hardcoded natural language strings in console.error calls
179+
technology:
180+
- javascript
181+
- typescript
182+
impact: MEDIUM
183+
confidence: LOW
184+
likelihood: MEDIUM
185+
186+
- id: codacy.js.i18n.no-hardcoded-throw-error
187+
severity: WARNING
188+
languages:
189+
- js
190+
- ts
191+
patterns:
192+
- pattern: throw new Error("$MSG")
193+
- metavariable-regex:
194+
metavariable: $MSG
195+
regex: '^(?!SELECT|INSERT|UPDATE|DELETE|FROM|WHERE|ERR)[^.]*\s[^.]*'
196+
message: >-
197+
Avoid hardcoded strings in Error constructors. Use an i18n translation function (e.g., t("key")).
198+
metadata:
199+
category: codestyle
200+
subcategory: i18n
201+
description: Flags hardcoded natural language strings in Error constructor calls
202+
technology:
203+
- javascript
204+
- typescript
205+
impact: MEDIUM
206+
confidence: LOW
207+
likelihood: MEDIUM
208+
209+
- id: codacy.java.i18n.no-hardcoded-date-format
210+
severity: WARNING
211+
languages:
212+
- java
213+
pattern-either:
214+
- pattern: new SimpleDateFormat("...")
215+
- pattern: DateTimeFormatter.ofPattern("...")
216+
message: >-
217+
Avoid hardcoded date format patterns. Use DateTimeFormatter.ofLocalizedDate() or DateTimeFormatter.ofLocalizedDateTime() for locale-aware formatting.
218+
metadata:
219+
category: codestyle
220+
subcategory: i18n
221+
description: Flags hardcoded date format patterns that are not locale-aware
222+
technology:
223+
- java
224+
impact: MEDIUM
225+
confidence: HIGH
226+
likelihood: HIGH
227+
228+
- id: codacy.java.i18n.no-hardcoded-decimal-format
229+
severity: WARNING
230+
languages:
231+
- java
232+
pattern-either:
233+
- pattern: new DecimalFormat("...")
234+
- patterns:
235+
- pattern: String.format("$FMT", ...)
236+
- metavariable-regex:
237+
metavariable: $FMT
238+
regex: '%[0-9.]*[fd]'
239+
message: >-
240+
Avoid hardcoded number format patterns. Use NumberFormat.getInstance(locale) or locale-aware formatting for user-visible numbers.
241+
metadata:
242+
category: codestyle
243+
subcategory: i18n
244+
description: Flags hardcoded decimal format patterns and String.format with numeric format specifiers
245+
technology:
246+
- java
247+
impact: MEDIUM
248+
confidence: MEDIUM
249+
likelihood: HIGH
250+
251+
- id: codacy.java.i18n.no-hardcoded-exception-message
252+
severity: WARNING
253+
languages:
254+
- java
255+
patterns:
256+
- pattern: throw new $EX("$MSG");
257+
- metavariable-regex:
258+
metavariable: $MSG
259+
regex: '^(?!SELECT|INSERT|UPDATE|DELETE|FROM|WHERE|ERR)[^.]*\s[^.]*'
260+
- pattern-not: throw new $EX($BUNDLE.getString(...));
261+
message: >-
262+
Avoid hardcoded strings in exception messages. Use ResourceBundle.getString() or a localization key.
263+
metadata:
264+
category: codestyle
265+
subcategory: i18n
266+
description: Flags hardcoded natural language strings in exception constructors
267+
technology:
268+
- java
269+
impact: MEDIUM
270+
confidence: LOW
271+
likelihood: HIGH
272+
273+
- id: codacy.java.i18n.no-hardcoded-return-string
274+
severity: WARNING
275+
languages:
276+
- java
277+
patterns:
278+
- pattern: return "$STR";
279+
- metavariable-regex:
280+
metavariable: $STR
281+
regex: '^(?!SELECT|INSERT|UPDATE|DELETE|FROM|WHERE|ERR)[^.]*\s[^.]*'
282+
- pattern-not: return $BUNDLE.getString(...);
283+
message: >-
284+
Avoid returning hardcoded natural language strings. Use ResourceBundle.getString() or a localization key.
285+
metadata:
286+
category: codestyle
287+
subcategory: i18n
288+
description: Flags hardcoded natural language strings returned from methods
289+
technology:
290+
- java
291+
impact: MEDIUM
292+
confidence: LOW
293+
likelihood: HIGH
294+
295+
- id: codacy.java.i18n.no-hardcoded-string-concat
296+
severity: WARNING
297+
languages:
298+
- java
299+
patterns:
300+
- pattern-either:
301+
- patterns:
302+
- pattern: return "$LIT" + ...;
303+
- metavariable-regex:
304+
metavariable: $LIT
305+
regex: '^[A-Z](?![a-z]+\[)[a-z].*'
306+
- patterns:
307+
- pattern: return ... + "$LIT";
308+
- metavariable-regex:
309+
metavariable: $LIT
310+
regex: '^\s(?!.*\b(?:SELECT|INSERT|UPDATE|DELETE|FROM|WHERE|JOIN)\b).*[a-z]{2}'
311+
- pattern-not: return $BUNDLE.getString(...) + ...;
312+
message: >-
313+
Avoid hardcoded strings in string concatenation for user-facing output. Use ResourceBundle.getString() with MessageFormat.
314+
metadata:
315+
category: codestyle
316+
subcategory: i18n
317+
description: Flags hardcoded natural language strings in return concatenation
318+
technology:
319+
- java
320+
impact: MEDIUM
321+
confidence: LOW
322+
likelihood: HIGH
323+
324+
- id: codacy.java.i18n.no-hardcoded-stringbuilder-append
325+
severity: WARNING
326+
languages:
327+
- java
328+
patterns:
329+
- pattern: $SB.append("$STR");
330+
- metavariable-regex:
331+
metavariable: $STR
332+
regex: '^(?!SELECT|INSERT|UPDATE|DELETE|FROM|WHERE|JOIN|ORDER)[^.]*\s[^.]*'
333+
message: >-
334+
Avoid hardcoded natural language strings in StringBuilder.append. Use ResourceBundle.getString() or MessageFormat.
335+
metadata:
336+
category: codestyle
337+
subcategory: i18n
338+
description: Flags hardcoded natural language strings in StringBuilder.append calls
339+
technology:
340+
- java
341+
impact: MEDIUM
342+
confidence: LOW
343+
likelihood: HIGH
344+
109345
- id: codacy.js.i18n.no-raw-jsx-text
110346
severity: WARNING
111347
languages:
@@ -124,4 +360,75 @@ rules:
124360
impact: MEDIUM
125361
confidence: LOW
126362
likelihood: MEDIUM
127-
363+
364+
- id: codacy.java.i18n.no-hardcoded-map-put
365+
severity: WARNING
366+
languages:
367+
- java
368+
patterns:
369+
- pattern: $MAP.put("$KEY", "$VALUE");
370+
- metavariable-regex:
371+
metavariable: $VALUE
372+
regex: '^(?!SELECT|INSERT|UPDATE|DELETE|FROM|WHERE|ERR)[^.]*\s[^.]*'
373+
- pattern-not: $MAP.put("$KEY", $BUNDLE.getString(...));
374+
message: >-
375+
Avoid hardcoded strings in Map.put(). Use ResourceBundle.getString() or a localization key for user-facing messages.
376+
metadata:
377+
category: codestyle
378+
subcategory: i18n
379+
description: Flags hardcoded natural language strings in Map.put() calls that should be localized
380+
technology:
381+
- java
382+
impact: MEDIUM
383+
confidence: LOW
384+
likelihood: HIGH
385+
386+
- id: codacy.java.i18n.no-hardcoded-map-of
387+
severity: WARNING
388+
languages:
389+
- java
390+
patterns:
391+
- pattern-either:
392+
- pattern: Map.of(..., "$VALUE", ...)
393+
- pattern: Map.of("$KEY", "$VALUE")
394+
- metavariable-regex:
395+
metavariable: $VALUE
396+
regex: '^(?!SELECT|INSERT|UPDATE|DELETE|FROM|WHERE|ERR)[^.]*\s[^.]*'
397+
- pattern-not: Map.of(..., $BUNDLE.getString(...), ...)
398+
message: >-
399+
Avoid hardcoded strings in Map.of(). Use ResourceBundle.getString() or a localization key for user-facing messages.
400+
metadata:
401+
category: codestyle
402+
subcategory: i18n
403+
description: Flags hardcoded natural language strings in Map.of() calls that should be localized
404+
technology:
405+
- java
406+
impact: MEDIUM
407+
confidence: LOW
408+
likelihood: HIGH
409+
410+
- id: codacy.java.i18n.no-hardcoded-response-body
411+
severity: WARNING
412+
languages:
413+
- java
414+
patterns:
415+
- pattern-either:
416+
- pattern: ResponseEntity.ok(Map.of(..., "$VALUE", ...))
417+
- pattern: ResponseEntity.status(...).body(Map.of(..., "$VALUE", ...))
418+
- pattern: ResponseEntity.$METHOD(Map.of(..., "$VALUE", ...))
419+
- metavariable-regex:
420+
metavariable: $VALUE
421+
regex: '^(?!SELECT|INSERT|UPDATE|DELETE|FROM|WHERE|ERR)[^.]*\s[^.]*'
422+
- pattern-not: ResponseEntity.ok(Map.of(..., $BUNDLE.getString(...), ...))
423+
- pattern-not: ResponseEntity.status(...).body(Map.of(..., $BUNDLE.getString(...), ...))
424+
message: >-
425+
Avoid hardcoded strings in ResponseEntity body maps. Use ResourceBundle.getString() or a localization key for user-facing messages.
426+
metadata:
427+
category: codestyle
428+
subcategory: i18n
429+
description: Flags hardcoded natural language strings in Spring ResponseEntity responses that should be localized
430+
technology:
431+
- java
432+
impact: MEDIUM
433+
confidence: LOW
434+
likelihood: HIGH

‎docs/codacy-rules.yaml‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -182,7 +182,7 @@ rules:
182182
GRANT SELECT privileges should only be given to role-based accounts
183183
(ending in '_role'). Direct grants to users or non-role accounts violate
184184
security best practices.
185-
pattern-regex: GRANT\s+(DELETE|INSERT|SELECT|UPDATE)(\s*,\s*(DELETE|INSERT|SELECT|UPDATE))*\s+ON\s+[a-zA-Z0-9_]+(\.[a-zA-Z0-9_*]+)?\s+TO\s+(?![a-zA-Z0-9_]*_role\b)[a-zA-Z0-9_]+
185+
pattern-regex: GRANT\s+(?:DELETE|INSERT|SELECT|UPDATE)(?:\s*,\s*(?:DELETE|INSERT|SELECT|UPDATE))*\s+ON\s+[\w.*]+\s+TO\s+(?!\w*_[Rr][Oo][Ll][Ee]\b)\b\w+
186186
paths:
187187
include:
188188
- "*.sql"
@@ -303,9 +303,9 @@ rules:
303303
- generic
304304
patterns:
305305
- pattern-either:
306-
- pattern-regex: "(?i)\\b\\w*language\\w*\\b\\s*(=|:=)\\s*'?\\b[A-Z]{2}\\b'?"
307-
- pattern-regex: "(?i)\\b\\w*currency\\w*\\b\\s*(=|:=)\\s*'?\\b[A-Z]{3}\\b'?"
308-
- pattern-regex: "(?i)\\b(\\w*\\.)?org_id\\b\\s*(=|:=|IN|!=|<>)\\s*(\\(?\\s*'?\\d+'?(,\\s*'?\\d+'?)*\\s*\\)?)?"
306+
- pattern-regex: "(?i)^(?:(?!--).)*\\b\\w*language\\w*\\b\\s*(=|:=)\\s*'?\\b[A-Z]{2}\\b'?"
307+
- pattern-regex: "(?i)^(?:(?!--).)*\\b\\w*currency\\w*\\b\\s*(=|:=)\\s*'?\\b[A-Z]{3}\\b'?"
308+
- pattern-regex: "(?i)^(?:(?!--).)*\\b(\\w*\\.)?org_id\\b\\s*(=|:=|IN|!=|<>)\\s*(\\(?\\s*'?\\d+'?(,\\s*'?\\d+'?)*\\s*\\)?)?"
309309
paths:
310310
include:
311311
- "*.sql"

‎docs/multiple-tests/exotic/patterns.xml‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,4 @@
1+
<?xml version="1.0" encoding="UTF-8"?>
2+
<module name="root">
3+
<module name="codacy.generic.sql.exotic.hardcoded-sql-values" />
4+
</module>

0 commit comments

Comments
 (0)