From 88cb1dff7f2688bff297c2e94b2ebb4a26707f16 Mon Sep 17 00:00:00 2001 From: Johann Beleites Date: Fri, 30 Aug 2024 10:48:37 +0200 Subject: [PATCH] SONARJAVA-5102 Update SE rules metadata (#4853) --- .../resources/org/sonar/l10n/java/rules/javase/S2259.html | 4 +++- .../resources/org/sonar/l10n/java/rules/javase/S2583.html | 4 +++- .../resources/org/sonar/l10n/java/rules/javase/S2589.html | 4 +++- .../resources/org/sonar/l10n/java/rules/javase/S3518.html | 4 +++- .../resources/org/sonar/l10n/java/rules/javase/S3655.html | 4 +++- .../resources/org/sonar/l10n/java/rules/javase/S3959.html | 3 ++- .../resources/org/sonar/l10n/java/rules/javase/S6376.html | 2 +- java-symbolic-execution/sonarpedia.json | 2 +- 8 files changed, 19 insertions(+), 8 deletions(-) diff --git a/java-symbolic-execution/java-symbolic-execution-plugin/src/main/resources/org/sonar/l10n/java/rules/javase/S2259.html b/java-symbolic-execution/java-symbolic-execution-plugin/src/main/resources/org/sonar/l10n/java/rules/javase/S2259.html index 23057ec6ca6..281a98b839f 100644 --- a/java-symbolic-execution/java-symbolic-execution-plugin/src/main/resources/org/sonar/l10n/java/rules/javase/S2259.html +++ b/java-symbolic-execution/java-symbolic-execution-plugin/src/main/resources/org/sonar/l10n/java/rules/javase/S2259.html @@ -1,4 +1,6 @@ -

This rule is deprecated; use {rule:java:S6555} instead.

+

This rule is deprecated, and will eventually be removed.

+

We are deprecating our legacy symbolic execution engine in favor of our more advanced commercial engine. The legacy engine will remain Open +Source for the community as a separate plugin and will receive no further updates by SonarSource.

Why is this an issue?

A reference to null should never be dereferenced/accessed. Doing so will cause a NullPointerException to be thrown. At best, such an exception will cause abrupt program termination. At worst, it could expose debugging information that would be useful to an attacker, or diff --git a/java-symbolic-execution/java-symbolic-execution-plugin/src/main/resources/org/sonar/l10n/java/rules/javase/S2583.html b/java-symbolic-execution/java-symbolic-execution-plugin/src/main/resources/org/sonar/l10n/java/rules/javase/S2583.html index c41c31476bc..64a067ce286 100644 --- a/java-symbolic-execution/java-symbolic-execution-plugin/src/main/resources/org/sonar/l10n/java/rules/javase/S2583.html +++ b/java-symbolic-execution/java-symbolic-execution-plugin/src/main/resources/org/sonar/l10n/java/rules/javase/S2583.html @@ -1,4 +1,6 @@ -

This rule is deprecated; use {rule:java:S6651} instead.

+

This rule is deprecated, and will eventually be removed.

+

We are deprecating our legacy symbolic execution engine in favor of our more advanced commercial engine. The legacy engine will remain Open +Source for the community as a separate plugin and will receive no further updates by SonarSource.

Why is this an issue?

Conditional expressions which are always true or false can lead to unreachable code.

diff --git a/java-symbolic-execution/java-symbolic-execution-plugin/src/main/resources/org/sonar/l10n/java/rules/javase/S2589.html b/java-symbolic-execution/java-symbolic-execution-plugin/src/main/resources/org/sonar/l10n/java/rules/javase/S2589.html index b947b0b0260..d41184cde24 100644 --- a/java-symbolic-execution/java-symbolic-execution-plugin/src/main/resources/org/sonar/l10n/java/rules/javase/S2589.html +++ b/java-symbolic-execution/java-symbolic-execution-plugin/src/main/resources/org/sonar/l10n/java/rules/javase/S2589.html @@ -1,4 +1,6 @@ -

This rule is deprecated; use {rule:java:S6646} instead.

+

This rule is deprecated, and will eventually be removed.

+

We are deprecating our legacy symbolic execution engine in favor of our more advanced commercial engine. The legacy engine will remain Open +Source for the community as a separate plugin and will receive no further updates by SonarSource.

Gratuitous boolean expressions are conditions that do not change the evaluation of a program. This issue can indicate logical errors and affect the correctness of an application, as well as its maintainability.

Why is this an issue?

diff --git a/java-symbolic-execution/java-symbolic-execution-plugin/src/main/resources/org/sonar/l10n/java/rules/javase/S3518.html b/java-symbolic-execution/java-symbolic-execution-plugin/src/main/resources/org/sonar/l10n/java/rules/javase/S3518.html index 704cc9b2b19..70c5efefa77 100644 --- a/java-symbolic-execution/java-symbolic-execution-plugin/src/main/resources/org/sonar/l10n/java/rules/javase/S3518.html +++ b/java-symbolic-execution/java-symbolic-execution-plugin/src/main/resources/org/sonar/l10n/java/rules/javase/S3518.html @@ -1,4 +1,6 @@ -

This rule is deprecated; use {rule:java:S6649} instead.

+

This rule is deprecated, and will eventually be removed.

+

We are deprecating our legacy symbolic execution engine in favor of our more advanced commercial engine. The legacy engine will remain Open +Source for the community as a separate plugin and will receive no further updates by SonarSource.

If the denominator to an integer division or remainder operation is zero, a ArithmeticException is thrown.

This error will crash your program in most cases. To fix it, you need to ensure that the denominator value in all division operations is always non-zero, or check the value against zero before performing the division.

diff --git a/java-symbolic-execution/java-symbolic-execution-plugin/src/main/resources/org/sonar/l10n/java/rules/javase/S3655.html b/java-symbolic-execution/java-symbolic-execution-plugin/src/main/resources/org/sonar/l10n/java/rules/javase/S3655.html index 3a0cb0f354c..1fe428a716e 100644 --- a/java-symbolic-execution/java-symbolic-execution-plugin/src/main/resources/org/sonar/l10n/java/rules/javase/S3655.html +++ b/java-symbolic-execution/java-symbolic-execution-plugin/src/main/resources/org/sonar/l10n/java/rules/javase/S3655.html @@ -1,4 +1,6 @@ -

This rule is deprecated; use {rule:java:S6707} instead.

+

This rule is deprecated, and will eventually be removed.

+

We are deprecating our legacy symbolic execution engine in favor of our more advanced commercial engine. The legacy engine will remain Open +Source for the community as a separate plugin and will receive no further updates by SonarSource.

Why is this an issue?

Optional value can hold either a value or not. The value held in the Optional can be accessed using the get() method, but it will throw a

diff --git a/java-symbolic-execution/java-symbolic-execution-plugin/src/main/resources/org/sonar/l10n/java/rules/javase/S3959.html b/java-symbolic-execution/java-symbolic-execution-plugin/src/main/resources/org/sonar/l10n/java/rules/javase/S3959.html index 7b249eb5e9f..560fec93157 100644 --- a/java-symbolic-execution/java-symbolic-execution-plugin/src/main/resources/org/sonar/l10n/java/rules/javase/S3959.html +++ b/java-symbolic-execution/java-symbolic-execution-plugin/src/main/resources/org/sonar/l10n/java/rules/javase/S3959.html @@ -1,4 +1,5 @@ -

This rule is deprecated; use {rule:java:S6976} instead.

+

We are deprecating our legacy symbolic execution engine in favor of our more advanced commercial engine. The legacy engine will remain Open +Source for the community as a separate plugin and will receive no further updates by SonarSource.

Why is this an issue?

Stream operations are divided into intermediate and terminal operations, and are combined to form stream pipelines. After the terminal operation is performed, the stream pipeline is considered consumed, and cannot be used again. Such a reuse will yield unexpected results.

diff --git a/java-symbolic-execution/java-symbolic-execution-plugin/src/main/resources/org/sonar/l10n/java/rules/javase/S6376.html b/java-symbolic-execution/java-symbolic-execution-plugin/src/main/resources/org/sonar/l10n/java/rules/javase/S6376.html index fedac9b9425..8ba9ad734ed 100644 --- a/java-symbolic-execution/java-symbolic-execution-plugin/src/main/resources/org/sonar/l10n/java/rules/javase/S6376.html +++ b/java-symbolic-execution/java-symbolic-execution-plugin/src/main/resources/org/sonar/l10n/java/rules/javase/S6376.html @@ -75,7 +75,7 @@

Documentation

  • Java Documentation - Java API for XML Processing (JAXP) Security Guide
  • Dom4j Documentation - SAXReader Class
    • -
  • Jdom2 Documentation - SAXBuilder class
    • +
  • Jdom2 Documentation - SAXBuilder class
  • OWASP - XXE Prevention Cheat Sheet
    • diff --git a/java-symbolic-execution/sonarpedia.json b/java-symbolic-execution/sonarpedia.json index 350b57a16f3..946a3fec84a 100644 --- a/java-symbolic-execution/sonarpedia.json +++ b/java-symbolic-execution/sonarpedia.json @@ -3,7 +3,7 @@ "languages": [ "JAVA" ], - "latest-update": "2024-08-29T10:04:42.887568058Z", + "latest-update": "2024-08-30T06:58:12.220861855Z", "options": { "no-language-in-filenames": true, "preserve-filenames": false