From 06f0764268997aac3d3f12d233ce6418dce05be6 Mon Sep 17 00:00:00 2001
From: Dorian Burihabwa For all those reasons, a URI should never be hard coded. Instead, it should be replaced by a customizable parameter. Further, even if the elements of a URI are obtained dynamically, portability can still be limited if the path delimiters are hard-coded. This rule raises an issue when URIs or path delimiters are hard-coded. This rule does not raise an issue when: Exceptions examples: The rule applies to fields of primitive types (for example, This rule raises an issue on a non-transient and non-serializable field within a serializable class, if said class does not have
By contract, fields in a By contract, non-static fields in a An object that implements Finally, static fields are out of scope for serialization, so making a field static prevents issues from being raised. Formatted SQL queries can be difficult to maintain, debug and can increase the risk of SQL injection when concatenating untrusted values into the
-query. However, this rule doesn’t detect SQL injections (unlike rule {rule:javasecurity:S3649}), the goal is only to highlight complex/formatted queries.Why is this an issue?
Exceptions
+
+
How to fix it
Code examples
Noncompliant code example
public class Foo {
+ public static final String FRIENDS_ENDPOINT = "/user/friends"; // Compliant path is relative and has only two parts
+
public Collection<User> listUsers() {
File userList = new File("/home/mylogin/Dev/users.txt"); // Noncompliant
Collection<User> users = parse(userList);
@@ -40,4 +49,19 @@
+Compliant solution
}
}
+public class Foo {
+ public static final String FRIENDS_ENDPOINT = "/user/friends"; // Compliant path is relative and has only two parts
+
+ public static final String ACCOUNT = "/account/group/list.html"; // Compliant path is used in an annotation
+
+ @Value("${base.url}" + ACCOUNT)
+ private String groupUrl;
+
+ @MyAnnotation()
+ String path = "/default/url/for/site"; // Compliant path is annotated
+
+}
+
diff --git a/sonar-java-plugin/src/main/resources/org/sonar/l10n/java/rules/java/S115.html b/sonar-java-plugin/src/main/resources/org/sonar/l10n/java/rules/java/S115.html
index 54b462e0446..5b992c1584a 100644
--- a/sonar-java-plugin/src/main/resources/org/sonar/l10n/java/rules/java/S115.html
+++ b/sonar-java-plugin/src/main/resources/org/sonar/l10n/java/rules/java/S115.html
@@ -46,6 +46,19 @@ Compliant solution
OPTION_TWO;
}
+Exceptions
+float
), boxed primitives (Float
), and Strings. We do not
+apply it to other types, which can be mutated, or have methods with side effects.
+public static final Logger log = getLogger(MyClass.class);
+public static final List<Integer> myList = new ArrayList<>();
+
+// call with side-effects
+log.info("message")
+
+// mutating an object
+myList.add(28);
+
Resources
External coding guidelines
diff --git a/sonar-java-plugin/src/main/resources/org/sonar/l10n/java/rules/java/S1190.html b/sonar-java-plugin/src/main/resources/org/sonar/l10n/java/rules/java/S1190.html
index b58a7c7c516..57a76334e02 100644
--- a/sonar-java-plugin/src/main/resources/org/sonar/l10n/java/rules/java/S1190.html
+++ b/sonar-java-plugin/src/main/resources/org/sonar/l10n/java/rules/java/S1190.html
@@ -17,7 +17,7 @@
Noncompliant code example
Compliant solution
public class MyClass {
- String s = ""; // Noncompliant
+ String s = ""; // Compliant
}
Resources
diff --git a/sonar-java-plugin/src/main/resources/org/sonar/l10n/java/rules/java/S1451.json b/sonar-java-plugin/src/main/resources/org/sonar/l10n/java/rules/java/S1451.json
index 5d760dce4d0..f2eb2aac344 100644
--- a/sonar-java-plugin/src/main/resources/org/sonar/l10n/java/rules/java/S1451.json
+++ b/sonar-java-plugin/src/main/resources/org/sonar/l10n/java/rules/java/S1451.json
@@ -12,7 +12,9 @@
"func": "Constant\/Issue",
"constantCost": "5min"
},
- "tags": [],
+ "tags": [
+ "convention"
+ ],
"defaultSeverity": "Blocker",
"ruleSpecification": "RSPEC-1451",
"sqKey": "S1451",
diff --git a/sonar-java-plugin/src/main/resources/org/sonar/l10n/java/rules/java/S1751.json b/sonar-java-plugin/src/main/resources/org/sonar/l10n/java/rules/java/S1751.json
index 1340cc14b02..65ed1883782 100644
--- a/sonar-java-plugin/src/main/resources/org/sonar/l10n/java/rules/java/S1751.json
+++ b/sonar-java-plugin/src/main/resources/org/sonar/l10n/java/rules/java/S1751.json
@@ -12,7 +12,10 @@
"func": "Constant\/Issue",
"constantCost": "5min"
},
- "tags": [],
+ "tags": [
+ "confusing",
+ "bad-practice"
+ ],
"defaultSeverity": "Major",
"ruleSpecification": "RSPEC-1751",
"sqKey": "S1751",
diff --git a/sonar-java-plugin/src/main/resources/org/sonar/l10n/java/rules/java/S1948.html b/sonar-java-plugin/src/main/resources/org/sonar/l10n/java/rules/java/S1948.html
index 9dc9caa5127..69e23b74aa6 100644
--- a/sonar-java-plugin/src/main/resources/org/sonar/l10n/java/rules/java/S1948.html
+++ b/sonar-java-plugin/src/main/resources/org/sonar/l10n/java/rules/java/S1948.html
@@ -1,9 +1,9 @@
writeObject
and readObject
methods defined.Why is this an issue?
-Serializable
class must themselves be either Serializable
or transient
. Even if the
-class is never explicitly serialized or deserialized, it is not safe to assume that this cannot happen. For instance, under load, most J2EE
-application frameworks flush objects to disk.Serializable
class must themselves be either Serializable
or transient
.
+Even if the class is never explicitly serialized or deserialized, it is not safe to assume that this cannot happen. For instance, under load, most
+J2EE application frameworks flush objects to disk.Serializable
but contains non-transient, non-serializable data members (and thus violates the contract)
could cause application crashes and open the door to attackers. In general, a Serializable
class is expected to fulfil its contract and
not exhibit unexpected behaviour when an instance is serialized.How to fix it
}
}
+
+public class Person implements Serializable {
+ private static final long serialVersionUID = 1905122041950251207L;
+
+ private String name;
+
+ private static Logger log = getLogger(); // Compliant, static fields are not serialized
+}
+
Resources
org.springframework.beans.factory.annotation.Value
javax.annotation.Inject
javax.annotation.Resource
javax.persistence.PersistenceContext
jakarta.annotation.Resource
jakarta.inject.Inject
jakarta.persistence.PersistenceContext
Add one of these annotations to all non-static
members: @Resource
, @Inject
, @Autowired
or
diff --git a/sonar-java-plugin/src/main/resources/org/sonar/l10n/java/rules/java/S3981.json b/sonar-java-plugin/src/main/resources/org/sonar/l10n/java/rules/java/S3981.json
index b89a6bb842e..bdd9a5c2ba5 100644
--- a/sonar-java-plugin/src/main/resources/org/sonar/l10n/java/rules/java/S3981.json
+++ b/sonar-java-plugin/src/main/resources/org/sonar/l10n/java/rules/java/S3981.json
@@ -12,7 +12,9 @@
"func": "Constant\/Issue",
"constantCost": "2min"
},
- "tags": [],
+ "tags": [
+ "confusing"
+ ],
"defaultSeverity": "Major",
"ruleSpecification": "RSPEC-3981",
"sqKey": "S3981",
diff --git a/sonarpedia.json b/sonarpedia.json
index 1c08bab2e01..51944eee7f9 100644
--- a/sonarpedia.json
+++ b/sonarpedia.json
@@ -3,7 +3,7 @@
"languages": [
"JAVA"
],
- "latest-update": "2024-11-29T11:04:25.911576775Z",
+ "latest-update": "2024-12-17T09:08:48.208626612Z",
"options": {
"no-language-in-filenames": true,
"preserve-filenames": false