diff --git a/java-checks/src/main/resources/org/sonar/l10n/java/rules/java/S2095_java.html b/java-checks/src/main/resources/org/sonar/l10n/java/rules/java/S2095_java.html index e47884846a9..5fc41197f66 100644 --- a/java-checks/src/main/resources/org/sonar/l10n/java/rules/java/S2095_java.html +++ b/java-checks/src/main/resources/org/sonar/l10n/java/rules/java/S2095_java.html @@ -2,8 +2,8 @@ AutoCloseable, needs to be closed after use. Further, that close call must be made in a finally block otherwise an exception could keep the call from being made. Preferably, when class implements AutoCloseable, resource should be created using "try-with-resources" pattern and will be closed automatically.

-

Failure to properly close resources will result in a resource leak which could bring first the application and then perhaps the box it's on to -their knees.

+

Failure to properly close resources will result in a resource leak which could bring first the application and then perhaps the box the application +is on to their knees.

Noncompliant Code Example

 private void readTheFile() throws IOException {
diff --git a/java-checks/src/main/resources/org/sonar/l10n/java/rules/java/S2277_java.json b/java-checks/src/main/resources/org/sonar/l10n/java/rules/java/S2277_java.json
index 9b3846af1b7..a0d03f9d0a8 100644
--- a/java-checks/src/main/resources/org/sonar/l10n/java/rules/java/S2277_java.json
+++ b/java-checks/src/main/resources/org/sonar/l10n/java/rules/java/S2277_java.json
@@ -7,10 +7,23 @@
     "constantCost": "20min"
   },
   "tags": [
-    
+    "cwe",
+    "owasp-a6",
+    "sans-top25-porous",
+    "owasp-a3"
   ],
   "defaultSeverity": "Critical",
   "ruleSpecification": "RSPEC-2277",
   "sqKey": "S2277",
-  "scope": "Main"
+  "scope": "Main",
+  "securityStandards": {
+    "CWE": [
+      780,
+      327
+    ],
+    "OWASP": [
+      "A3",
+      "A6"
+    ]
+  }
 }
diff --git a/java-checks/src/main/resources/org/sonar/l10n/java/rules/java/S2278_java.json b/java-checks/src/main/resources/org/sonar/l10n/java/rules/java/S2278_java.json
index 95b5a670ae5..e88538b3008 100644
--- a/java-checks/src/main/resources/org/sonar/l10n/java/rules/java/S2278_java.json
+++ b/java-checks/src/main/resources/org/sonar/l10n/java/rules/java/S2278_java.json
@@ -7,10 +7,22 @@
     "constantCost": "20min"
   },
   "tags": [
-    
+    "cwe",
+    "cert",
+    "owasp-a6",
+    "sans-top25-porous"
   ],
   "defaultSeverity": "Blocker",
   "ruleSpecification": "RSPEC-2278",
   "sqKey": "S2278",
-  "scope": "Main"
+  "scope": "Main",
+  "securityStandards": {
+    "CWE": [
+      326,
+      327
+    ],
+    "OWASP": [
+      "A6"
+    ]
+  }
 }
diff --git a/java-checks/src/main/resources/org/sonar/l10n/java/rules/java/S2647_java.json b/java-checks/src/main/resources/org/sonar/l10n/java/rules/java/S2647_java.json
index e32e482b9f2..f85fe66ea4a 100644
--- a/java-checks/src/main/resources/org/sonar/l10n/java/rules/java/S2647_java.json
+++ b/java-checks/src/main/resources/org/sonar/l10n/java/rules/java/S2647_java.json
@@ -8,7 +8,6 @@
   },
   "tags": [
     "cwe",
-    "owasp-a6",
     "sans-top25-porous",
     "owasp-a3"
   ],
@@ -22,7 +21,6 @@
       311
     ],
     "OWASP": [
-      "A6",
       "A3"
     ]
   }
diff --git a/java-checks/src/main/resources/org/sonar/l10n/java/rules/java/S3011_java.json b/java-checks/src/main/resources/org/sonar/l10n/java/rules/java/S3011_java.json
index f928270f3f6..e9e8a631ade 100644
--- a/java-checks/src/main/resources/org/sonar/l10n/java/rules/java/S3011_java.json
+++ b/java-checks/src/main/resources/org/sonar/l10n/java/rules/java/S3011_java.json
@@ -7,16 +7,10 @@
     "constantCost": "30min"
   },
   "tags": [
-    "cert",
-    "owasp-a3"
+    "cert"
   ],
   "defaultSeverity": "Major",
   "ruleSpecification": "RSPEC-3011",
   "sqKey": "S3011",
-  "scope": "Main",
-  "securityStandards": {
-    "OWASP": [
-      "A3"
-    ]
-  }
+  "scope": "Main"
 }
diff --git a/java-checks/src/main/resources/org/sonar/l10n/java/rules/java/S3400_java.html b/java-checks/src/main/resources/org/sonar/l10n/java/rules/java/S3400_java.html
index e3f46b74fc5..70bb176fc4b 100644
--- a/java-checks/src/main/resources/org/sonar/l10n/java/rules/java/S3400_java.html
+++ b/java-checks/src/main/resources/org/sonar/l10n/java/rules/java/S3400_java.html
@@ -9,7 +9,7 @@ 
Noncompliant Code Example

Compliant Solution

-static int bestNumber = 12;
+static final int BEST_NUMBER = 12;

Exceptions

Methods with annotations, such as @Override and Spring's @RequestMapping, are ignored.

diff --git a/java-checks/src/main/resources/org/sonar/l10n/java/rules/java/S4426_java.html b/java-checks/src/main/resources/org/sonar/l10n/java/rules/java/S4426_java.html index 4acb0ce6f0f..256be4741fd 100644 --- a/java-checks/src/main/resources/org/sonar/l10n/java/rules/java/S4426_java.html +++ b/java-checks/src/main/resources/org/sonar/l10n/java/rules/java/S4426_java.html @@ -12,9 +12,9 @@
  • n ≥ 224 for ECDH and ECMQV (Examples: secp192r1 is a non-compliant curve (n < 224) but secp224k1 is compliant (n >= 224))
    • -

    Encryption and Decryption:

    +

    Symmetric keys:

    This rule will not raise issues for ciphers that are considered weak (no matter the key size) like DES, Blowfish.

    Noncompliant Code Example

    diff --git a/java-checks/src/main/resources/org/sonar/l10n/java/rules/java/S4784_java.json b/java-checks/src/main/resources/org/sonar/l10n/java/rules/java/S4784_java.json index 44001dab7f1..98da3e66c1c 100644 --- a/java-checks/src/main/resources/org/sonar/l10n/java/rules/java/S4784_java.json +++ b/java-checks/src/main/resources/org/sonar/l10n/java/rules/java/S4784_java.json @@ -3,21 +3,10 @@ "type": "SECURITY_HOTSPOT", "status": "ready", "tags": [ - "cwe", - "owasp-a1", - "regex" + ], "defaultSeverity": "Critical", "ruleSpecification": "RSPEC-4784", "sqKey": "S4784", - "scope": "Main", - "securityStandards": { - "CWE": [ - 624, - 185 - ], - "OWASP": [ - "A1" - ] - } + "scope": "Main" } diff --git a/java-checks/src/main/resources/org/sonar/l10n/java/rules/java/S4830_java.json b/java-checks/src/main/resources/org/sonar/l10n/java/rules/java/S4830_java.json index d6c80c7ff8d..a05b2fa6755 100644 --- a/java-checks/src/main/resources/org/sonar/l10n/java/rules/java/S4830_java.json +++ b/java-checks/src/main/resources/org/sonar/l10n/java/rules/java/S4830_java.json @@ -11,7 +11,6 @@ "privacy", "cert", "owasp-a6", - "sans-top25-porous", "ssl", "owasp-a3" ], diff --git a/java-checks/src/main/resources/org/sonar/l10n/java/rules/java/S5344_java.html b/java-checks/src/main/resources/org/sonar/l10n/java/rules/java/S5344_java.html index c4ae8d2e9d5..aa1ddad59eb 100644 --- a/java-checks/src/main/resources/org/sonar/l10n/java/rules/java/S5344_java.html +++ b/java-checks/src/main/resources/org/sonar/l10n/java/rules/java/S5344_java.html @@ -58,6 +58,7 @@

    See

  • MITRE, CWE-328 - Reversible One-Way Hash
  • MITRE, CWE-327 - Use of a Broken or Risky Cryptographic Algorithm
  • SANS Top 25 - Porous Defenses
    • -
  • https://blog.ircmaxell.com/2014/03/why-i-dont-recommend-scrypt.html
    • +
  • https://blog.ircmaxell.com/2014/03/why-i-dont-recommend-scrypt.html
    • diff --git a/java-checks/src/main/resources/org/sonar/l10n/java/rules/java/S5344_java.json b/java-checks/src/main/resources/org/sonar/l10n/java/rules/java/S5344_java.json index 031359f3c30..2e120a9bf1b 100644 --- a/java-checks/src/main/resources/org/sonar/l10n/java/rules/java/S5344_java.json +++ b/java-checks/src/main/resources/org/sonar/l10n/java/rules/java/S5344_java.json @@ -11,8 +11,7 @@ "spring", "owasp-a6", "sans-top25-porous", - "owasp-a2", - "owasp-a3" + "owasp-a2" ], "defaultSeverity": "Critical", "ruleSpecification": "RSPEC-5344", @@ -25,8 +24,7 @@ ], "OWASP": [ "A2", - "A6", - "A3" + "A6" ] } } diff --git a/java-checks/src/main/resources/org/sonar/l10n/java/rules/java/S5527_java.json b/java-checks/src/main/resources/org/sonar/l10n/java/rules/java/S5527_java.json index a1a6d85e31d..81cb79edaac 100644 --- a/java-checks/src/main/resources/org/sonar/l10n/java/rules/java/S5527_java.json +++ b/java-checks/src/main/resources/org/sonar/l10n/java/rules/java/S5527_java.json @@ -10,7 +10,6 @@ "cwe", "privacy", "owasp-a6", - "sans-top25-porous", "ssl", "owasp-a3" ], diff --git a/java-checks/src/main/resources/org/sonar/l10n/java/rules/java/S5542_java.html b/java-checks/src/main/resources/org/sonar/l10n/java/rules/java/S5542_java.html index e55b0224e7c..1be640c2541 100644 --- a/java-checks/src/main/resources/org/sonar/l10n/java/rules/java/S5542_java.html +++ b/java-checks/src/main/resources/org/sonar/l10n/java/rules/java/S5542_java.html @@ -7,7 +7,7 @@
  • RSA encryption algorithm should be used with the recommended padding scheme (OAEP)
    • diff --git a/java-checks/src/main/resources/org/sonar/l10n/java/rules/java/S5547_java.html b/java-checks/src/main/resources/org/sonar/l10n/java/rules/java/S5547_java.html index b87c604eff4..b5a067317ca 100644 --- a/java-checks/src/main/resources/org/sonar/l10n/java/rules/java/S5547_java.html +++ b/java-checks/src/main/resources/org/sonar/l10n/java/rules/java/S5547_java.html @@ -1,6 +1,7 @@

    Strong cipher algorithms are cryptographic systems resistant to cryptanalysis, they are not vulnerable to well-known attacks like brute force attacks for example.

    -

    It is recommended to use only cipher algorithms intensively tested and promoted by the cryptographic community.

    +

    A general recomandation is to only use cipher algorithms intensively tested and promoted by the cryptographic community.

    +

    More specifically for block cipher, it's not recommended to use algorithm with a block size inferior than 128 bits.

    Noncompliant Code Example

     import javax.crypto.Cipher;
diff --git a/java-checks/src/main/resources/org/sonar/l10n/java/rules/java/S5841_java.html b/java-checks/src/main/resources/org/sonar/l10n/java/rules/java/S5841_java.html
index d017b1257a1..280dc2801f1 100644
--- a/java-checks/src/main/resources/org/sonar/l10n/java/rules/java/S5841_java.html
+++ b/java-checks/src/main/resources/org/sonar/l10n/java/rules/java/S5841_java.html
@@ -1,8 +1,9 @@
 
    AssertJ assertions allMatch and doesNotContains on an empty list always returns true whatever the content of the
 predicate. Despite being correct, you should make explicit if you expect an empty list or not, by adding
-isEmpty()/isNotEmpty() before calling the assertion. It will justify the useless predicate to improve clarity or increase
-the reliability of the test.
    
-
    This rule raises an issue when any of the methods listed are used without asserting that the list is empty or not.
    
+isEmpty()/isNotEmpty() in addition to calling the assertion, or by testing the list's content further. It will justify the
+useless predicate to improve clarity or increase the reliability of the test.
    
+
    This rule raises an issue when any of the methods listed are used without asserting that the list is empty or not and without testing the
+content.
    
 
    Targetted methods:
    diff --git a/java-checks/src/main/resources/org/sonar/l10n/java/rules/java/S5852_java.html b/java-checks/src/main/resources/org/sonar/l10n/java/rules/java/S5852_java.html index c63d9303b7c..74e42364f66 100644 --- a/java-checks/src/main/resources/org/sonar/l10n/java/rules/java/S5852_java.html +++ b/java-checks/src/main/resources/org/sonar/l10n/java/rules/java/S5852_java.html @@ -61,6 +61,7 @@

    Compliant Solution

    See