Skip to content

Commit

Permalink
Update rule metdata for version 3.19 (#815)
Browse files Browse the repository at this point in the history
  • Loading branch information
nils-werner-sonarsource authored Aug 16, 2021
1 parent 52d0e72 commit 482f7d2
Show file tree
Hide file tree
Showing 152 changed files with 455 additions and 443 deletions.
Original file line number Diff line number Diff line change
@@ -1,4 +1,4 @@
<p>Merging collapsible <code>if</code> statements increases the code's readability.</p>
<p>Merging collapsible <code>if</code> statements increases the codes readability.</p>
<h2>Noncompliant Code Example</h2>
<pre>
if (condition1) {
Expand Down
Original file line number Diff line number Diff line change
@@ -1,6 +1,6 @@
<p>The complexity of an expression is defined by the number of <code>&amp;&amp;</code>, <code>||</code> and <code>condition ? ifTrue : ifFalse</code>
operators it contains.</p>
<p>A single expression's complexity should not become too high to keep the code readable.</p>
<p>A single expressions complexity should not become too high to keep the code readable.</p>
<h2>Noncompliant Code Example</h2>
<p>With the default threshold value of 3</p>
<pre>
Expand Down
Original file line number Diff line number Diff line change
@@ -1,9 +1,9 @@
<p>Hard coding a URI makes it difficult to test a program: path literals are not always portable across operating systems, a given absolute path may
not exist on a specific test environment, a specified Internet URL may not be available when executing the tests, production environment filesystems
usually differ from the development environment, ...etc. For all those reasons, a URI should never be hard coded. Instead, it should be replaced by
usually differ from the development environment, …​etc. For all those reasons, a URI should never be hard coded. Instead, it should be replaced by
customizable parameter.</p>
<p>Further even if the elements of a URI are obtained dynamically, portability can still be limited if the path-delimiters are hard-coded.</p>
<p>This rule raises an issue when URI's or path delimiters are hard coded.</p>
<p>This rule raises an issue when URIs or path delimiters are hard coded.</p>
<h2>See</h2>
<ul>
<li> <a href="https://wiki.sei.cmu.edu/confluence/x/OjdGBQ">CERT, MSC03-J.</a> - Never hard code sensitive information </li>
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -6,9 +6,7 @@
"func": "Constant\/Issue",
"constantCost": "20min"
},
"tags": [

],
"tags": [],
"defaultSeverity": "Minor",
"ruleSpecification": "RSPEC-1075",
"sqKey": "S1075",
Expand Down
Original file line number Diff line number Diff line change
@@ -1,6 +1,6 @@
<p>Inheritance is certainly one of the most valuable concepts in object-oriented programming. It's a way to compartmentalize and reuse code by
<p>Inheritance is certainly one of the most valuable concepts in object-oriented programming. Its a way to compartmentalize and reuse code by
creating collections of attributes and behaviors called classes which can be based on previously created classes. But abusing this concept by creating
a deep inheritance tree can lead to very complex and unmaintainable source code. Most of the time a too deep inheritance tree is due to bad object
oriented design which has led to systematically use 'inheritance' when for instance 'composition' would suit better.</p>
<p>This rule raises an issue when the inheritance tree, starting from <code>Object</code> has a greater depth than is allowed. </p>
<p>This rule raises an issue when the inheritance tree, starting from <code>Object</code> has a greater depth than is allowed.</p>

Original file line number Diff line number Diff line change
Expand Up @@ -14,7 +14,7 @@ <h2>Compliant Solution</h2>
}
</pre>
<h2>Exceptions</h2>
<p>When blocks are inlined (left and right curly braces on the same line), no issue is triggered. </p>
<p>When blocks are inlined (left and right curly braces on the same line), no issue is triggered.</p>
<pre>
if(condition) {doSomething();}
</pre>
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -12,7 +12,7 @@ <h2>Compliant Solution</h2>
}
</pre>
<h2>Exceptions</h2>
<p>When blocks are inlined (open and close curly braces on the same line), no issue is triggered. </p>
<p>When blocks are inlined (open and close curly braces on the same line), no issue is triggered.</p>
<pre>
if(condition) {doSomething();}
</pre>
Expand Down
Original file line number Diff line number Diff line change
@@ -1,5 +1,5 @@
<p>The use of parentheses, even those not required to enforce a desired order of operations, can clarify the intent behind a piece of code. But
redundant pairs of parentheses could be misleading, and should be removed. </p>
redundant pairs of parentheses could be misleading, and should be removed.</p>
<h2>Noncompliant Code Example</h2>
<pre>
$x = ($y / 2 + 1); // Compliant even if the parenthesis are ignored by the compiler
Expand Down
Original file line number Diff line number Diff line change
@@ -1,5 +1,5 @@
<p>Overriding or shadowing a variable declared in an outer scope can strongly impact the readability, and therefore the maintainability, of a piece of
code. Further, it could lead maintainers to introduce bugs because they think they're using one variable but are really using another.</p>
code. Further, it could lead maintainers to introduce bugs because they think theyre using one variable but are really using another.</p>
<h2>Noncompliant Code Example</h2>
<pre>
class Foo {
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -11,7 +11,7 @@ <h2>Compliant Solution</h2>
if ($val &amp;&amp; check()) {
}
</pre>
<p>or </p>
<p>or</p>
<pre>
if ($val == value() &amp;&amp; check()) { // Perhaps in fact the equality operator was expected
}
Expand Down
Original file line number Diff line number Diff line change
@@ -1,7 +1,7 @@
<p>Trailing whitespaces are simply useless and should not stay in code. They may generate noise when comparing different versions of the same
file.</p>
<p>If you encounter issues from this rule, this probably means that you are not using an automated code formatter - which you should if you have the
opportunity to do so. </p>
opportunity to do so.</p>
<h2>Exceptions</h2>
<p>Lines containing only whitespaces.</p>

Original file line number Diff line number Diff line change
Expand Up @@ -2,6 +2,10 @@
"title": "Track uses of \"FIXME\" tags",
"type": "CODE_SMELL",
"status": "ready",
"remediation": {
"func": "Constant\/Issue",
"constantCost": "0min"
},
"tags": [
"cwe"
],
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -2,6 +2,10 @@
"title": "Track uses of \"TODO\" tags",
"type": "CODE_SMELL",
"status": "ready",
"remediation": {
"func": "Constant\/Issue",
"constantCost": "0min"
},
"tags": [
"cwe"
],
Expand Down
Original file line number Diff line number Diff line change
@@ -1,4 +1,4 @@
<p>Having too many return statements in a function increases the function's essential complexity because the flow of execution is broken each time a
<p>Having too many return statements in a function increases the functions essential complexity because the flow of execution is broken each time a
return statement is encountered. This makes it harder to read and understand the logic of the function.</p>
<h2>Noncompliant Code Example</h2>
<p>With the default threshold of 3:</p>
Expand Down
Original file line number Diff line number Diff line change
@@ -1,6 +1,6 @@
<p><code>if</code> statements with conditions that are always false have the effect of making blocks of code non-functional. <code>if</code>
statements with conditions that are always true are completely redundant, and make the code less readable.</p>
<p>There are three possible causes for the presence of such code: </p>
<p>There are three possible causes for the presence of such code:</p>
<ul>
<li> An if statement was changed during debugging and that debug code has been committed. </li>
<li> Some value was left unset. </li>
Expand Down
Original file line number Diff line number Diff line change
@@ -1,14 +1,12 @@
{
"title": "Function and method parameters' initial values should not be ignored",
"title": "Function and method parameters\u0027 initial values should not be ignored",
"type": "BUG",
"status": "ready",
"remediation": {
"func": "Constant\/Issue",
"constantCost": "5min"
},
"tags": [

],
"tags": [],
"defaultSeverity": "Minor",
"ruleSpecification": "RSPEC-1226",
"sqKey": "S1226",
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -6,9 +6,7 @@
"func": "Constant\/Issue",
"constantCost": "5min"
},
"tags": [

],
"tags": [],
"defaultSeverity": "Critical",
"ruleSpecification": "RSPEC-126",
"sqKey": "S126",
Expand Down
Original file line number Diff line number Diff line change
@@ -1,5 +1,5 @@
<p>When only the condition expression is defined in a <code>for</code> loop, and the initialization and increment expressions are missing, a
<code>while</code> loop should be used instead to increase readability. </p>
<code>while</code> loop should be used instead to increase readability.</p>
<h2>Noncompliant Code Example</h2>
<pre>
for (;condition;) { /*...*/ }
Expand Down
Original file line number Diff line number Diff line change
@@ -1,5 +1,5 @@
<p>A <code>for</code> loop stop condition should test the loop counter against an invariant value (i.e. one that is true at both the beginning and
ending of every loop iteration). Ideally, this means that the stop condition is set to a local variable just before the loop begins. </p>
ending of every loop iteration). Ideally, this means that the stop condition is set to a local variable just before the loop begins.</p>
<p>Stop conditions that are not invariant are slightly less efficient, as well as being difficult to understand and maintain, and likely lead to the
introduction of errors in the future.</p>
<p>This rule tracks three types of non-invariant stop conditions:</p>
Expand Down
Original file line number Diff line number Diff line change
@@ -1,5 +1,5 @@
<p>When the execution is not explicitly terminated at the end of a switch case, it continues to execute the statements of the following case. While
this is sometimes intentional, it often is a mistake which leads to unexpected behavior. </p>
this is sometimes intentional, it often is a mistake which leads to unexpected behavior.</p>
<h2>Noncompliant Code Example</h2>
<pre>
switch ($myVariable) {
Expand Down
Original file line number Diff line number Diff line change
@@ -1,6 +1,6 @@
<p>The requirement for a final <code>case default</code> clause is defensive programming. The clause should either take appropriate action, or contain
a suitable comment as to why no action is taken. Even when the <code>switch</code> covers all current values of an <code>enum</code>, a default case
should still be used because there is no guarantee that the <code>enum</code> won't be extended.</p>
should still be used because there is no guarantee that the <code>enum</code> wont be extended.</p>
<h2>Noncompliant Code Example</h2>
<pre>
switch ($param) { //missing default clause
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -8,9 +8,7 @@
"linearOffset": "10min",
"linearFactor": "1min"
},
"tags": [

],
"tags": [],
"defaultSeverity": "Critical",
"ruleSpecification": "RSPEC-1311",
"sqKey": "S1311",
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -3,7 +3,7 @@
<li> <a href="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-5901">CVE-2006-5901</a> </li>
<li> <a href="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-3725">CVE-2005-3725</a> </li>
</ul>
<p>Today's services have an ever-changing architecture due to their scaling and redundancy needs. It is a mistake to think that a service will always
<p>Todays services have an ever-changing architecture due to their scaling and redundancy needs. It is a mistake to think that a service will always
have the same IP address. When it does change, the hardcoded IP will have to be modified too. This will have an impact on the product development,
delivery, and deployment:</p>
<ul>
Expand All @@ -13,16 +13,16 @@
<p>Last but not least it has an effect on application security. Attackers might be able to decompile the code and thereby discover a potentially
sensitive address. They can perform a Denial of Service attack on the service, try to get access to the system, or try to spoof the IP address to
bypass security checks. Such attacks can always be possible, but in the case of a hardcoded IP address solving the issue will take more time, which
will increase an attack's impact.</p>
will increase an attacks impact.</p>
<h2>Ask Yourself Whether</h2>
<p>The disclosed IP address is sensitive, e.g.:</p>
<ul>
<li> Can give information to an attacker about the network topology. </li>
<li> It's a personal (assigned to an identifiable person) IP address. </li>
<li> Its a personal (assigned to an identifiable person) IP address. </li>
</ul>
<p>There is a risk if you answered yes to any of these questions.</p>
<h2>Recommended Secure Coding Practices</h2>
<p>Don't hard-code the IP address in the source code, instead make it configurable with environment variables, configuration files, or a similar
<p>Dont hard-code the IP address in the source code, instead make it configurable with environment variables, configuration files, or a similar
approach. Alternatively, if confidentially is not required a domain name can be used since it allows to change the destination quickly without having
to rebuild the software.</p>
<h2>Sensitive Code Example</h2>
Expand Down
Original file line number Diff line number Diff line change
@@ -1,5 +1,5 @@
<p>Nested <code>if</code>, <code>for</code>, <code>while</code>, <code>switch</code>, and <code>try</code> statements are key ingredients for making
what's known as "Spaghetti code".</p>
whats known as "Spaghetti code".</p>
<p>Such code is hard to read, refactor and therefore maintain.</p>
<h2>Noncompliant Code Example</h2>
<p>With the default threshold of 3:</p>
Expand Down
Original file line number Diff line number Diff line change
@@ -1,5 +1,5 @@
<p>A function that grows too large tends to aggregate too many responsibilities.</p>
<p>Such functions inevitably become harder to understand and therefore harder to maintain. </p>
<p>Such functions inevitably become harder to understand and therefore harder to maintain.</p>
<p>Above a specific threshold, it is strongly advised to refactor into smaller functions which focus on well-defined tasks.</p>
<p>Those smaller functions will not only be easier to understand, but also probably easier to test.</p>

Original file line number Diff line number Diff line change
@@ -1,4 +1,4 @@
<p>Each source file should start with a header stating file ownership and the license which must be used to distribute the application. </p>
<p>Each source file should start with a header stating file ownership and the license which must be used to distribute the application.</p>
<p>This rule must be fed with the header text that is expected at the beginning of every file.</p>
<h2>Compliant Solution</h2>
<pre>
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -6,9 +6,7 @@
"func": "Constant\/Issue",
"constantCost": "5min"
},
"tags": [

],
"tags": [],
"defaultSeverity": "Blocker",
"ruleSpecification": "RSPEC-1451",
"sqKey": "S1451",
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -6,13 +6,13 @@
<p>Some APIs enable the execution of dynamic code by providing it as strings at runtime. These APIs might be useful in some very specific
meta-programming use-cases. However most of the time their use is frowned upon as they also increase the risk of <a
href="https://www.owasp.org/index.php/Code_Injection">Injected Code</a>. Such attacks can either run on the server or in the client (exemple: XSS
attack) and have a huge impact on an application's security.</p>
attack) and have a huge impact on an applications security.</p>
<p>This rule marks for review each occurrence of the <a href="https://www.php.net/manual/en/function.eval.php"><code>eval</code> function</a>. This
rule does not detect code injections. It only highlights the use of APIs which should be used sparingly and very carefully. The goal is to guide
security code reviews.</p>
<h2>Ask Yourself Whether</h2>
<ul>
<li> the executed code may come from an untrusted source and hasn't been sanitized. </li>
<li> the executed code may come from an untrusted source and hasnt been sanitized. </li>
<li> you really need to run code dynamically. </li>
</ul>
<p>There is a risk if you answered yes to any of those questions.</p>
Expand Down
Original file line number Diff line number Diff line change
@@ -1,5 +1,5 @@
<p>Shared coding conventions allow teams to collaborate effectively. For that reason, file names should conform to a defined standard. This rule
raises an issue when the names of analyzed files don't match the provided regular expression.</p>
raises an issue when the names of analyzed files dont match the provided regular expression.</p>
<h2>See</h2>
<ul>
<li> <a href="https://wiki.sei.cmu.edu/confluence/x/GtYxBQ">CERT, MSC09-C.</a> - Character encoding: Use subset of ASCII for safety </li>
Expand Down
Original file line number Diff line number Diff line change
@@ -1,4 +1,4 @@
<p>PHP's "variable variables" feature (dynamically-named variables) is temptingly powerful, but can lead to unmaintainable code. </p>
<p>PHPs "variable variables" feature (dynamically-named variables) is temptingly powerful, but can lead to unmaintainable code.</p>
<h2>Noncompliant Code Example</h2>
<pre>
$var = 'foo';
Expand Down
Original file line number Diff line number Diff line change
@@ -1,41 +1,47 @@
<p>The following predefined variables are deprecated and should be replaced by the new versions:</p>
<table>
<tbody>
<colgroup>
<col style="width: 50%;">
<col style="width: 50%;">
</colgroup>
<thead>
<tr>
<th>Replace</th>
<th>With</th>
</tr>
</thead>
<tbody>
<tr>
<td>$HTTP_SERVER_VARS</td>
<td>$_SERVER</td>
<td><p>$HTTP_SERVER_VARS</p></td>
<td><p>$_SERVER</p></td>
</tr>
<tr>
<td>$HTTP_GET_VARS</td>
<td>$_GET</td>
<td><p>$HTTP_GET_VARS</p></td>
<td><p>$_GET</p></td>
</tr>
<tr>
<td>$HTTP_POST_VARS</td>
<td>$_POST</td>
<td><p>$HTTP_POST_VARS</p></td>
<td><p>$_POST</p></td>
</tr>
<tr>
<td>$HTTP_POST_FILES</td>
<td>$_FILES</td>
<td><p>$HTTP_POST_FILES</p></td>
<td><p>$_FILES</p></td>
</tr>
<tr>
<td>$HTTP_SESSION_VARS</td>
<td>$_SESSION</td>
<td><p>$HTTP_SESSION_VARS</p></td>
<td><p>$_SESSION</p></td>
</tr>
<tr>
<td>$HTTP_ENV_VARS</td>
<td>$_ENV</td>
<td><p>$HTTP_ENV_VARS</p></td>
<td><p>$_ENV</p></td>
</tr>
<tr>
<td>$HTTP_COOKIE_VARS</td>
<td>$_COOKIE</td>
<td><p>$HTTP_COOKIE_VARS</p></td>
<td><p>$_COOKIE</p></td>
</tr>
<tr>
<td>$php_errormsg</td>
<td>error_get_last()</td>
<td><p>$php_errormsg</p></td>
<td><p>error_get_last()</p></td>
</tr>
</tbody>
</table>
Expand Down
Original file line number Diff line number Diff line change
@@ -1,6 +1,6 @@
<p>In PHP 4, any function with the same name as the nesting class was considered a class constructor. In PHP 5, this mechanism has been deprecated and
the <code>__construct</code> method name should be used instead. If both styles are present in the same class, PHP 5 will treat the function named
<code>__construct</code> as the class constructor. </p>
<code>__construct</code> as the class constructor.</p>
<p>This rule rule raises an issue for each method with the same name as the enclosing class.</p>
<h2>Noncompliant Code Example</h2>
<pre>
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -6,9 +6,7 @@
"func": "Constant\/Issue",
"constantCost": "3min"
},
"tags": [

],
"tags": [],
"defaultSeverity": "Major",
"ruleSpecification": "RSPEC-1656",
"sqKey": "S1656",
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -6,9 +6,7 @@
"func": "Constant\/Issue",
"constantCost": "2min"
},
"tags": [

],
"tags": [],
"defaultSeverity": "Major",
"ruleSpecification": "RSPEC-1697",
"sqKey": "S1697",
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -6,9 +6,7 @@
"func": "Constant\/Issue",
"constantCost": "5min"
},
"tags": [

],
"tags": [],
"defaultSeverity": "Major",
"ruleSpecification": "RSPEC-1751",
"sqKey": "S1751",
Expand Down
Loading

0 comments on commit 482f7d2

Please sign in to comment.