diff --git a/java-checks/src/main/resources/org/sonar/l10n/java/rules/java/S2326.json b/java-checks/src/main/resources/org/sonar/l10n/java/rules/java/S2326.json index 961dc57ce3d..f4c411cdc1c 100644 --- a/java-checks/src/main/resources/org/sonar/l10n/java/rules/java/S2326.json +++ b/java-checks/src/main/resources/org/sonar/l10n/java/rules/java/S2326.json @@ -7,17 +7,11 @@ "constantCost": "5min" }, "tags": [ - "cert", "unused" ], "defaultSeverity": "Major", "ruleSpecification": "RSPEC-2326", "sqKey": "S2326", "scope": "All", - "quickfix": "unknown", - "securityStandards": { - "CERT": [ - "MSC12-CPP." - ] - } + "quickfix": "unknown" } diff --git a/java-checks/src/main/resources/org/sonar/l10n/java/rules/java/S2589.json b/java-checks/src/main/resources/org/sonar/l10n/java/rules/java/S2589.json index ed052219603..bedce7af566 100644 --- a/java-checks/src/main/resources/org/sonar/l10n/java/rules/java/S2589.json +++ b/java-checks/src/main/resources/org/sonar/l10n/java/rules/java/S2589.json @@ -8,7 +8,6 @@ }, "tags": [ "cwe", - "cert", "suspicious", "redundant" ], @@ -17,9 +16,6 @@ "sqKey": "S2589", "scope": "All", "securityStandards": { - "CERT": [ - "MSC12-C." - ], "CWE": [ 489, 571, diff --git a/java-checks/src/main/resources/org/sonar/l10n/java/rules/java/S5659.json b/java-checks/src/main/resources/org/sonar/l10n/java/rules/java/S5659.json index 2b5bd2e6015..04dff708467 100644 --- a/java-checks/src/main/resources/org/sonar/l10n/java/rules/java/S5659.json +++ b/java-checks/src/main/resources/org/sonar/l10n/java/rules/java/S5659.json @@ -8,8 +8,7 @@ }, "tags": [ "cwe", - "privacy", - "cert" + "privacy" ], "defaultSeverity": "Critical", "ruleSpecification": "RSPEC-5659", diff --git a/java-checks/src/main/resources/org/sonar/l10n/java/rules/java/S5693.json b/java-checks/src/main/resources/org/sonar/l10n/java/rules/java/S5693.json index db0e928e190..95e3dea8e94 100644 --- a/java-checks/src/main/resources/org/sonar/l10n/java/rules/java/S5693.json +++ b/java-checks/src/main/resources/org/sonar/l10n/java/rules/java/S5693.json @@ -7,8 +7,7 @@ "constantCost": "5min" }, "tags": [ - "cwe", - "cert" + "cwe" ], "defaultSeverity": "Major", "ruleSpecification": "RSPEC-5693", diff --git a/java-checks/src/main/resources/org/sonar/l10n/java/rules/java/S6418.html b/java-checks/src/main/resources/org/sonar/l10n/java/rules/java/S6418.html index 32360ef0271..8d64a9934f3 100644 --- a/java-checks/src/main/resources/org/sonar/l10n/java/rules/java/S6418.html +++ b/java-checks/src/main/resources/org/sonar/l10n/java/rules/java/S6418.html @@ -1,3 +1,12 @@ +

Secrets should not be hard-coded in source code, instead be stored outside of the source code in a configuration file or a management service for +secrets.

+

There would be a risk, if any of the following apply to you:

+ +

Why is this an issue?

Because it is easy to extract strings from an application source code or binary, secrets should not be hard-coded. This is particularly true for applications that are distributed or that are open-source.

In the past, it has led to the following vulnerabilities:

@@ -5,24 +14,17 @@
  • CVE-2022-25510
  • CVE-2021-42635
    • -

    Secrets should be stored outside of the source code in a configuration file or a management service for secrets.

    This rule detects variables/fields having a name matching a list of words (secret, token, credential, auth, api[_.-]?key) being assigned a pseudorandom hard-coded value. The pseudorandomness of the hard-coded value is based on its entropy and the probability to be human-readable. The randomness sensibility can be adjusted if needed. Lower values will detect less random values, raising potentially more false positives.

    -

    Ask Yourself Whether

    - -

    There would be a risk if you answered yes to any of those questions.

    -

    Recommended Secure Coding Practices

    +

    How to fix it

    -

    Sensitive Code Example

    +

    Code examples

    +

    Noncompliant code example

     private static final String MY_SECRET = "47828a8dd77ee1eb9dde2d5e93cb221ce8c32b37";
 
@@ -30,7 +32,7 @@ 
    Sensitive Code Example
    
   MyClass.callMyService(MY_SECRET);
 }
    -

    Compliant Solution

    +

    Compliant solution

    Using AWS Secrets Manager:

     import software.amazon.awssdk.services.secretsmanager.model.GetSecretValueRequest;
@@ -80,7 +82,12 @@ 
    Compliant Solution
    
   MyClass.callMyService(secret);
 }
    -

    See

    +

    How does this work?

    +

    This rule detects variables/fields having a name matching a list of words (secret, token, credential, auth, api[_.-]?key) being assigned a +pseudorandom hard-coded value. The pseudorandomness of the hard-coded value is based on its entropy and the probability to be human-readable. The +randomness sensibility can be adjusted if needed. Lower values will detect less random values, raising potentially more false positives.

    +

    Resources

    +

    Documentation