diff --git a/java-symbolic-execution/java-symbolic-execution-plugin/src/main/resources/org/sonar/l10n/java/rules/javase/S2259.html b/java-symbolic-execution/java-symbolic-execution-plugin/src/main/resources/org/sonar/l10n/java/rules/javase/S2259.html index 25a93c7f4df..23057ec6ca6 100644 --- a/java-symbolic-execution/java-symbolic-execution-plugin/src/main/resources/org/sonar/l10n/java/rules/javase/S2259.html +++ b/java-symbolic-execution/java-symbolic-execution-plugin/src/main/resources/org/sonar/l10n/java/rules/javase/S2259.html @@ -1,3 +1,4 @@ +

This rule is deprecated; use {rule:java:S6555} instead.

Why is this an issue?

A reference to null should never be dereferenced/accessed. Doing so will cause a NullPointerException to be thrown. At best, such an exception will cause abrupt program termination. At worst, it could expose debugging information that would be useful to an attacker, or diff --git a/java-symbolic-execution/java-symbolic-execution-plugin/src/main/resources/org/sonar/l10n/java/rules/javase/S2259.json b/java-symbolic-execution/java-symbolic-execution-plugin/src/main/resources/org/sonar/l10n/java/rules/javase/S2259.json index 996c08831db..8af0ec16035 100644 --- a/java-symbolic-execution/java-symbolic-execution-plugin/src/main/resources/org/sonar/l10n/java/rules/javase/S2259.json +++ b/java-symbolic-execution/java-symbolic-execution-plugin/src/main/resources/org/sonar/l10n/java/rules/javase/S2259.json @@ -7,16 +7,12 @@ }, "attribute": "LOGICAL" }, - "status": "ready", + "status": "deprecated", "remediation": { "func": "Constant\/Issue", "constantCost": "10min" }, - "tags": [ - "cwe", - "cert", - "symbolic-execution" - ], + "tags": [], "defaultSeverity": "Major", "ruleSpecification": "RSPEC-2259", "sqKey": "S2259", diff --git a/java-symbolic-execution/java-symbolic-execution-plugin/src/main/resources/org/sonar/l10n/java/rules/javase/S2583.html b/java-symbolic-execution/java-symbolic-execution-plugin/src/main/resources/org/sonar/l10n/java/rules/javase/S2583.html index 7ed81864ec5..c41c31476bc 100644 --- a/java-symbolic-execution/java-symbolic-execution-plugin/src/main/resources/org/sonar/l10n/java/rules/javase/S2583.html +++ b/java-symbolic-execution/java-symbolic-execution-plugin/src/main/resources/org/sonar/l10n/java/rules/javase/S2583.html @@ -1,3 +1,4 @@ +

This rule is deprecated; use {rule:java:S6651} instead.

Why is this an issue?

Conditional expressions which are always true or false can lead to unreachable code.

diff --git a/java-symbolic-execution/java-symbolic-execution-plugin/src/main/resources/org/sonar/l10n/java/rules/javase/S2583.json b/java-symbolic-execution/java-symbolic-execution-plugin/src/main/resources/org/sonar/l10n/java/rules/javase/S2583.json index 209234d914e..a5e24f5c34f 100644 --- a/java-symbolic-execution/java-symbolic-execution-plugin/src/main/resources/org/sonar/l10n/java/rules/javase/S2583.json +++ b/java-symbolic-execution/java-symbolic-execution-plugin/src/main/resources/org/sonar/l10n/java/rules/javase/S2583.json @@ -7,19 +7,12 @@ }, "attribute": "LOGICAL" }, - "status": "ready", + "status": "deprecated", "remediation": { "func": "Constant\/Issue", "constantCost": "15min" }, - "tags": [ - "cwe", - "cert", - "unused", - "suspicious", - "pitfall", - "symbolic-execution" - ], + "tags": [], "defaultSeverity": "Major", "ruleSpecification": "RSPEC-2583", "sqKey": "S2583", diff --git a/java-symbolic-execution/java-symbolic-execution-plugin/src/main/resources/org/sonar/l10n/java/rules/javase/S2589.html b/java-symbolic-execution/java-symbolic-execution-plugin/src/main/resources/org/sonar/l10n/java/rules/javase/S2589.html index 27c4b357eba..b947b0b0260 100644 --- a/java-symbolic-execution/java-symbolic-execution-plugin/src/main/resources/org/sonar/l10n/java/rules/javase/S2589.html +++ b/java-symbolic-execution/java-symbolic-execution-plugin/src/main/resources/org/sonar/l10n/java/rules/javase/S2589.html @@ -1,3 +1,4 @@ +

This rule is deprecated; use {rule:java:S6646} instead.

Gratuitous boolean expressions are conditions that do not change the evaluation of a program. This issue can indicate logical errors and affect the correctness of an application, as well as its maintainability.

Why is this an issue?

diff --git a/java-symbolic-execution/java-symbolic-execution-plugin/src/main/resources/org/sonar/l10n/java/rules/javase/S2589.json b/java-symbolic-execution/java-symbolic-execution-plugin/src/main/resources/org/sonar/l10n/java/rules/javase/S2589.json index 7d4f2978b40..0d5000de732 100644 --- a/java-symbolic-execution/java-symbolic-execution-plugin/src/main/resources/org/sonar/l10n/java/rules/javase/S2589.json +++ b/java-symbolic-execution/java-symbolic-execution-plugin/src/main/resources/org/sonar/l10n/java/rules/javase/S2589.json @@ -7,17 +7,12 @@ }, "attribute": "LOGICAL" }, - "status": "ready", + "status": "deprecated", "remediation": { "func": "Constant\/Issue", "constantCost": "10min" }, - "tags": [ - "cwe", - "suspicious", - "redundant", - "symbolic-execution" - ], + "tags": [], "defaultSeverity": "Major", "ruleSpecification": "RSPEC-2589", "sqKey": "S2589", diff --git a/java-symbolic-execution/java-symbolic-execution-plugin/src/main/resources/org/sonar/l10n/java/rules/javase/S2755.json b/java-symbolic-execution/java-symbolic-execution-plugin/src/main/resources/org/sonar/l10n/java/rules/javase/S2755.json index 30d28d2f879..7889348b8f1 100644 --- a/java-symbolic-execution/java-symbolic-execution-plugin/src/main/resources/org/sonar/l10n/java/rules/javase/S2755.json +++ b/java-symbolic-execution/java-symbolic-execution-plugin/src/main/resources/org/sonar/l10n/java/rules/javase/S2755.json @@ -40,7 +40,7 @@ "ASVS 4.0": [ "5.5.2" ], - "STIG ASD 2023-06-08": [ + "STIG ASD_V5R3": [ "V-222608" ] }, diff --git a/java-symbolic-execution/java-symbolic-execution-plugin/src/main/resources/org/sonar/l10n/java/rules/javase/S3518.html b/java-symbolic-execution/java-symbolic-execution-plugin/src/main/resources/org/sonar/l10n/java/rules/javase/S3518.html index 4606b5c6e94..704cc9b2b19 100644 --- a/java-symbolic-execution/java-symbolic-execution-plugin/src/main/resources/org/sonar/l10n/java/rules/javase/S3518.html +++ b/java-symbolic-execution/java-symbolic-execution-plugin/src/main/resources/org/sonar/l10n/java/rules/javase/S3518.html @@ -1,3 +1,4 @@ +

This rule is deprecated; use {rule:java:S6649} instead.

If the denominator to an integer division or remainder operation is zero, a ArithmeticException is thrown.

This error will crash your program in most cases. To fix it, you need to ensure that the denominator value in all division operations is always non-zero, or check the value against zero before performing the division.

diff --git a/java-symbolic-execution/java-symbolic-execution-plugin/src/main/resources/org/sonar/l10n/java/rules/javase/S3518.json b/java-symbolic-execution/java-symbolic-execution-plugin/src/main/resources/org/sonar/l10n/java/rules/javase/S3518.json index bafd784f171..3a87d8bf167 100644 --- a/java-symbolic-execution/java-symbolic-execution-plugin/src/main/resources/org/sonar/l10n/java/rules/javase/S3518.json +++ b/java-symbolic-execution/java-symbolic-execution-plugin/src/main/resources/org/sonar/l10n/java/rules/javase/S3518.json @@ -7,17 +7,12 @@ }, "attribute": "LOGICAL" }, - "status": "ready", + "status": "deprecated", "remediation": { "func": "Constant\/Issue", "constantCost": "5 min" }, - "tags": [ - "cwe", - "denial-of-service", - "cert", - "symbolic-execution" - ], + "tags": [], "defaultSeverity": "Critical", "ruleSpecification": "RSPEC-3518", "sqKey": "S3518", @@ -30,7 +25,7 @@ "CWE": [ 369 ], - "STIG ASD 2023-06-08": [ + "STIG ASD_V5R3": [ "V-222612" ] }, diff --git a/java-symbolic-execution/java-symbolic-execution-plugin/src/main/resources/org/sonar/l10n/java/rules/javase/S3655.html b/java-symbolic-execution/java-symbolic-execution-plugin/src/main/resources/org/sonar/l10n/java/rules/javase/S3655.html index 65425e88561..3a0cb0f354c 100644 --- a/java-symbolic-execution/java-symbolic-execution-plugin/src/main/resources/org/sonar/l10n/java/rules/javase/S3655.html +++ b/java-symbolic-execution/java-symbolic-execution-plugin/src/main/resources/org/sonar/l10n/java/rules/javase/S3655.html @@ -1,3 +1,4 @@ +

This rule is deprecated; use {rule:java:S6707} instead.

Why is this an issue?

Optional value can hold either a value or not. The value held in the Optional can be accessed using the get() method, but it will throw a

diff --git a/java-symbolic-execution/java-symbolic-execution-plugin/src/main/resources/org/sonar/l10n/java/rules/javase/S3655.json b/java-symbolic-execution/java-symbolic-execution-plugin/src/main/resources/org/sonar/l10n/java/rules/javase/S3655.json index 3df00f4ec4d..18f019bcdfb 100644 --- a/java-symbolic-execution/java-symbolic-execution-plugin/src/main/resources/org/sonar/l10n/java/rules/javase/S3655.json +++ b/java-symbolic-execution/java-symbolic-execution-plugin/src/main/resources/org/sonar/l10n/java/rules/javase/S3655.json @@ -7,15 +7,12 @@ }, "attribute": "COMPLETE" }, - "status": "ready", + "status": "deprecated", "remediation": { "func": "Constant\/Issue", "constantCost": "10min" }, - "tags": [ - "cwe", - "symbolic-execution" - ], + "tags": [], "defaultSeverity": "Major", "ruleSpecification": "RSPEC-3655", "sqKey": "S3655", diff --git a/java-symbolic-execution/java-symbolic-execution-plugin/src/main/resources/org/sonar/l10n/java/rules/javase/S3959.html b/java-symbolic-execution/java-symbolic-execution-plugin/src/main/resources/org/sonar/l10n/java/rules/javase/S3959.html index ca7ea71c547..7b249eb5e9f 100644 --- a/java-symbolic-execution/java-symbolic-execution-plugin/src/main/resources/org/sonar/l10n/java/rules/javase/S3959.html +++ b/java-symbolic-execution/java-symbolic-execution-plugin/src/main/resources/org/sonar/l10n/java/rules/javase/S3959.html @@ -1,3 +1,4 @@ +

This rule is deprecated; use {rule:java:S6976} instead.

Why is this an issue?

Stream operations are divided into intermediate and terminal operations, and are combined to form stream pipelines. After the terminal operation is performed, the stream pipeline is considered consumed, and cannot be used again. Such a reuse will yield unexpected results.

diff --git a/java-symbolic-execution/java-symbolic-execution-plugin/src/main/resources/org/sonar/l10n/java/rules/javase/S3959.json b/java-symbolic-execution/java-symbolic-execution-plugin/src/main/resources/org/sonar/l10n/java/rules/javase/S3959.json index 9f52687f34e..f4cd2d0cf42 100644 --- a/java-symbolic-execution/java-symbolic-execution-plugin/src/main/resources/org/sonar/l10n/java/rules/javase/S3959.json +++ b/java-symbolic-execution/java-symbolic-execution-plugin/src/main/resources/org/sonar/l10n/java/rules/javase/S3959.json @@ -7,15 +7,12 @@ }, "attribute": "LOGICAL" }, - "status": "ready", + "status": "deprecated", "remediation": { "func": "Constant\/Issue", "constantCost": "10min" }, - "tags": [ - "java8", - "symbolic-execution" - ], + "tags": [], "defaultSeverity": "Major", "ruleSpecification": "RSPEC-3959", "sqKey": "S3959", diff --git a/java-symbolic-execution/java-symbolic-execution-plugin/src/main/resources/org/sonar/l10n/java/rules/javase/S6373.json b/java-symbolic-execution/java-symbolic-execution-plugin/src/main/resources/org/sonar/l10n/java/rules/javase/S6373.json index 1574a93f442..7d65194f8a0 100644 --- a/java-symbolic-execution/java-symbolic-execution-plugin/src/main/resources/org/sonar/l10n/java/rules/javase/S6373.json +++ b/java-symbolic-execution/java-symbolic-execution-plugin/src/main/resources/org/sonar/l10n/java/rules/javase/S6373.json @@ -39,7 +39,7 @@ "ASVS 4.0": [ "5.5.2" ], - "STIG ASD 2023-06-08": [ + "STIG ASD_V5R3": [ "V-222608" ] }, diff --git a/java-symbolic-execution/java-symbolic-execution-plugin/src/main/resources/org/sonar/l10n/java/rules/javase/S6376.json b/java-symbolic-execution/java-symbolic-execution-plugin/src/main/resources/org/sonar/l10n/java/rules/javase/S6376.json index 71c531bc225..b25526ee024 100644 --- a/java-symbolic-execution/java-symbolic-execution-plugin/src/main/resources/org/sonar/l10n/java/rules/javase/S6376.json +++ b/java-symbolic-execution/java-symbolic-execution-plugin/src/main/resources/org/sonar/l10n/java/rules/javase/S6376.json @@ -29,7 +29,7 @@ "OWASP Top 10 2021": [ "A5" ], - "STIG ASD 2023-06-08": [ + "STIG ASD_V5R3": [ "V-222593", "V-222608", "V-222667" diff --git a/java-symbolic-execution/java-symbolic-execution-plugin/src/main/resources/org/sonar/l10n/java/rules/javase/S6377.json b/java-symbolic-execution/java-symbolic-execution-plugin/src/main/resources/org/sonar/l10n/java/rules/javase/S6377.json index 48e9387c884..32e1b26692a 100644 --- a/java-symbolic-execution/java-symbolic-execution-plugin/src/main/resources/org/sonar/l10n/java/rules/javase/S6377.json +++ b/java-symbolic-execution/java-symbolic-execution-plugin/src/main/resources/org/sonar/l10n/java/rules/javase/S6377.json @@ -29,7 +29,7 @@ "OWASP Top 10 2021": [ "A2" ], - "STIG ASD 2023-06-08": [ + "STIG ASD_V5R3": [ "V-222608" ] }, diff --git a/java-symbolic-execution/java-symbolic-execution-plugin/src/main/resources/org/sonar/l10n/java/rules/javase/Sonar_way_profile.json b/java-symbolic-execution/java-symbolic-execution-plugin/src/main/resources/org/sonar/l10n/java/rules/javase/Sonar_way_profile.json index bf73889643a..aa8d52dff25 100644 --- a/java-symbolic-execution/java-symbolic-execution-plugin/src/main/resources/org/sonar/l10n/java/rules/javase/Sonar_way_profile.json +++ b/java-symbolic-execution/java-symbolic-execution-plugin/src/main/resources/org/sonar/l10n/java/rules/javase/Sonar_way_profile.json @@ -4,19 +4,13 @@ "S2095", "S2189", "S2222", - "S2259", - "S2583", - "S2589", "S2637", "S2689", "S2755", "S3065", "S3516", - "S3518", - "S3655", "S3824", "S3958", - "S3959", "S4165", "S4449", "S6373", diff --git a/java-symbolic-execution/java-symbolic-execution-plugin/src/test/java/org/sonar/java/se/plugin/JavaSECheckRegistrarTest.java b/java-symbolic-execution/java-symbolic-execution-plugin/src/test/java/org/sonar/java/se/plugin/JavaSECheckRegistrarTest.java index a91e1dd26bc..9142008496d 100644 --- a/java-symbolic-execution/java-symbolic-execution-plugin/src/test/java/org/sonar/java/se/plugin/JavaSECheckRegistrarTest.java +++ b/java-symbolic-execution/java-symbolic-execution-plugin/src/test/java/org/sonar/java/se/plugin/JavaSECheckRegistrarTest.java @@ -46,6 +46,17 @@ class JavaSECheckRegistrarTest { private static final ActiveRules activeRules = activeRules(getRuleKeysWithRepo()); + private static final List rulesNotActiveByDefault = List.of( + "S2259", + "S2583", + "S2589", + "S3518", + "S3546", + "S3655", + "S3959", + "S6374" + ); + @Test void register_rules() { CheckRegistrar registrar = new JavaSECheckRegistrar(null); @@ -80,7 +91,7 @@ void rules_definition() { assertThat(rules).hasSize(23); var activeByDefault = rules.stream() - .filter(k -> !"S6374".equals(k.key()) && !"S3546".equals(k.key())) + .filter(k -> !rulesNotActiveByDefault.contains(k.key())) .toList(); var allRules = rules.stream().map(RulesDefinition.Rule::key).toList(); diff --git a/java-symbolic-execution/sonarpedia.json b/java-symbolic-execution/sonarpedia.json index a88c7187742..350b57a16f3 100644 --- a/java-symbolic-execution/sonarpedia.json +++ b/java-symbolic-execution/sonarpedia.json @@ -3,7 +3,7 @@ "languages": [ "JAVA" ], - "latest-update": "2024-06-04T16:13:16.680708700Z", + "latest-update": "2024-08-29T10:04:42.887568058Z", "options": { "no-language-in-filenames": true, "preserve-filenames": false