Skip to content

Commit 7daeeca

Browse files
hashicorp-vault-sonar-prod[bot]aurelien-coet-sonarsource
hashicorp-vault-sonar-prod[bot]
and
aurelien-coet-sonarsource
authored
SONARJAVA-6194 Update rule metadata (#5526)
Co-authored-by: aurelien-coet-sonarsource <aurelien-coet-sonarsource@users.noreply.github.com>
1 parent 9d666d2 commit 7daeeca

File tree

11 files changed

+119
-89
lines changed

11 files changed

+119
-89
lines changed

‎sonar-java-plugin/src/main/resources/org/sonar/l10n/java/rules/java/S2068.json‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -3,7 +3,7 @@
33
"type": "VULNERABILITY",
44
"code": {
55
"impacts": {
6-
"SECURITY": "BLOCKER"
6+
"SECURITY": "MEDIUM"
77
},
88
"attribute": "TRUSTWORTHY"
99
},
@@ -17,7 +17,7 @@
1717
"cwe",
1818
"cert"
1919
],
20-
"defaultSeverity": "Blocker",
20+
"defaultSeverity": "Major",
2121
"ruleSpecification": "RSPEC-2068",
2222
"sqKey": "S2068",
2323
"scope": "Main",

‎sonar-java-plugin/src/main/resources/org/sonar/l10n/java/rules/java/S2612.html‎

Lines changed: 40 additions & 37 deletions
Original file line numberDiff line numberDiff line change
@@ -1,16 +1,28 @@
1+
<h2>Why is this an issue?</h2>
12
<p>In Unix file system permissions, the "<code>others</code>" category refers to all users except the owner of the file system resource and the
23
members of the group assigned to this resource.</p>
34
<p>Granting permissions to this category can lead to unintended access to files or directories that could allow attackers to obtain sensitive
45
information, disrupt services or elevate privileges.</p>
5-
<h2>Ask Yourself Whether</h2>
6-
<ul>
7-
<li>The application is designed to be run on a multi-user environment.</li>
8-
<li>Corresponding files and directories may contain confidential information.</li>
9-
</ul>
10-
<p>There is a risk if you answered yes to any of those questions.</p>
11-
<h2>Recommended Secure Coding Practices</h2>
12-
<p>The most restrictive possible permissions should be assigned to files and directories.</p>
13-
<h2>Sensitive Code Example</h2>
6+
<h3>What is the potential impact?</h3>
7+
<h4>Unauthorized access to sensitive information</h4>
8+
<p>When file or directory permissions grant access to all users on a system (often represented as "others" or "everyone" in permission models),
9+
attackers who gain access to any user account can read sensitive files containing credentials, configuration data, API keys, database passwords,
10+
personal information, or proprietary business data. This exposure can lead to data breaches, identity theft, compliance violations, and competitive
11+
disadvantage.</p>
12+
<h4>Service disruption and data corruption</h4>
13+
<p>Granting write permissions to broad user categories allows any user on the system to modify or delete critical files and directories. Attackers or
14+
compromised low-privileged accounts can corrupt application data, modify configuration files to alter system behavior or disrupt services, or delete
15+
important resources, leading to service outages, system instability, data loss, and denial of service.</p>
16+
<h4>Privilege escalation</h4>
17+
<p>When executable files or scripts have overly permissive permissions, especially when combined with special permission bits that allow programs to
18+
execute with the permissions of the file owner or group rather than the executing user, attackers can replace legitimate executables with malicious
19+
code. When these modified files are executed by privileged users or processes, the attacker’s code runs with elevated privileges, potentially enabling
20+
them to escalate from a low-privileged account to root or administrator access, install backdoors, or pivot to other systems in the network.</p>
21+
<h2>How to fix it</h2>
22+
<p>Remove permissions for the "others" category by not adding OTHERS_READ, OTHERS_WRITE, or OTHERS_EXECUTE permissions to the permission set. If these
23+
permissions were previously added, explicitly remove them using the <code>remove()</code> method.</p>
24+
<h3>Code examples</h3>
25+
<h4>Noncompliant code example</h4>
1426
<pre data-diff-id="1" data-diff-type="noncompliant">
1527
public void setPermissions(String filePath) throws IOException {
1628
Set&lt;PosixFilePermission&gt; perms = new HashSet&lt;PosixFilePermission&gt;();
@@ -22,20 +34,14 @@ <h2>Sensitive Code Example</h2>
2234
perms.add(PosixFilePermission.GROUP_READ);
2335
perms.add(PosixFilePermission.GROUP_EXECUTE);
2436
// others permissions
25-
perms.add(PosixFilePermission.OTHERS_READ); // Sensitive
26-
perms.add(PosixFilePermission.OTHERS_WRITE); // Sensitive
27-
perms.add(PosixFilePermission.OTHERS_EXECUTE); // Sensitive
37+
perms.add(PosixFilePermission.OTHERS_READ); // Noncompliant
38+
perms.add(PosixFilePermission.OTHERS_WRITE); // Noncompliant
39+
perms.add(PosixFilePermission.OTHERS_EXECUTE); // Noncompliant
2840

2941
Files.setPosixFilePermissions(Paths.get(filePath), perms);
3042
}
3143
</pre>
32-
<pre data-diff-id="2" data-diff-type="noncompliant">
33-
public void setOthersPermissionsHardCoded(String filePath ) {
34-
Files.setPosixFilePermissions(Paths.get(filePath), PosixFilePermissions.fromString("rwxrwxrwx")); // Sensitive
35-
}
36-
</pre>
37-
<h2>Compliant Solution</h2>
38-
<p>On operating systems that implement POSIX standard. This will throw a <code>UnsupportedOperationException</code> on Windows.</p>
44+
<h4>Compliant solution</h4>
3945
<pre data-diff-id="1" data-diff-type="compliant">
4046
public void setPermissions(String filePath) throws IOException {
4147
Set&lt;PosixFilePermission&gt; perms = new HashSet&lt;PosixFilePermission&gt;();
@@ -54,26 +60,23 @@ <h2>Compliant Solution</h2>
5460
Files.setPosixFilePermissions(Paths.get(filePath), perms);
5561
}
5662
</pre>
57-
<pre data-diff-id="2" data-diff-type="compliant">
58-
public void setOthersPermissionsHardCoded(String filePath ) {
59-
Files.setPosixFilePermissions(Paths.get(filePath), PosixFilePermissions.fromString("rwxrwx---"));
60-
}
61-
</pre>
62-
<h2>See</h2>
63+
<h2>Resources</h2>
64+
<h3>Documentation</h3>
65+
<ul>
66+
<li>OWASP File Permission Testing Guide - <a
67+
href="https://owasp.org/www-project-web-security-testing-guide/latest/4-Web_Application_Security_Testing/02-Configuration_and_Deployment_Management_Testing/09-Test_File_Permission">OWASP guidance on testing file permissions in web applications</a></li>
68+
</ul>
69+
<h3>Standards</h3>
6370
<ul>
64-
<li>OWASP - <a href="https://owasp.org/Top10/A01_2021-Broken_Access_Control/">Top 10 2021 Category A1 - Broken Access Control</a></li>
65-
<li>OWASP - <a href="https://owasp.org/Top10/A04_2021-Insecure_Design/">Top 10 2021 Category A4 - Insecure Design</a></li>
66-
<li>OWASP - <a href="https://owasp.org/www-project-top-ten/2017/A5_2017-Broken_Access_Control">Top 10 2017 Category A5 - Broken Access
67-
Control</a></li>
68-
<li><a
69-
href="https://owasp.org/www-project-web-security-testing-guide/latest/4-Web_Application_Security_Testing/02-Configuration_and_Deployment_Management_Testing/09-Test_File_Permission">OWASP File Permission</a></li>
70-
<li>CWE - <a href="https://cwe.mitre.org/data/definitions/732">CWE-732 - Incorrect Permission Assignment for Critical Resource</a></li>
7171
<li>CWE - <a href="https://cwe.mitre.org/data/definitions/266">CWE-266 - Incorrect Privilege Assignment</a></li>
72-
<li><a href="https://wiki.sei.cmu.edu/confluence/display/java/FIO01-J.+Create+files+with+appropriate+access+permissions">CERT, FIO01-J.</a> - Create
73-
files with appropriate access permissions</li>
74-
<li><a href="https://wiki.sei.cmu.edu/confluence/display/c/FIO06-C.+Create+files+with+appropriate+access+permissions">CERT, FIO06-C.</a> - Create
75-
files with appropriate access permissions</li>
72+
<li>CWE - <a href="https://cwe.mitre.org/data/definitions/732">CWE-732 - Incorrect Permission Assignment for Critical Resource</a></li>
7673
<li>STIG Viewer - <a href="https://stigviewer.com/stigs/application_security_and_development/2024-12-06/finding/V-222430">Application Security and
77-
Development: V-222430</a> - The application must execute without excessive account permissions.</li>
74+
Development: V-222430</a> - The application must execute without excessive account permissions</li>
75+
<li>OWASP - <a href="https://owasp.org/Top10/A01_2021-Broken_Access_Control/">Top 10 2021 Category A1 - Broken Access Control</a></li>
76+
<li>OWASP - <a href="https://owasp.org/Top10/A04_2021-Insecure_Design/">Top 10 2021 Category A4 - Insecure Design</a></li>
77+
<li>OWASP - <a href="https://owasp.org/www-project-top-ten/2017/A5_2017-Broken_Access_Control">Top 10 2017 Category A5 - Broken Access Control -
78+
OWASP Top 10 2017</a></li>
79+
<li>CERT FIO01-J - <a href="https://wiki.sei.cmu.edu/confluence/display/java/FIO01-J.+Create+files+with+appropriate+access+permissions">CERT
80+
guideline for creating files with appropriate access permissions in Java</a></li>
7881
</ul>
7982

‎sonar-java-plugin/src/main/resources/org/sonar/l10n/java/rules/java/S2612.json‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
{
2-
"title": "Setting loose POSIX file permissions is security-sensitive",
3-
"type": "SECURITY_HOTSPOT",
2+
"title": "File permissions should not be set to world-accessible values",
3+
"type": "VULNERABILITY",
44
"code": {
55
"impacts": {
66
"SECURITY": "MEDIUM"

‎sonar-java-plugin/src/main/resources/org/sonar/l10n/java/rules/java/S5194.html‎

Lines changed: 68 additions & 41 deletions
Original file line numberDiff line numberDiff line change
@@ -2,49 +2,76 @@ <h2>Why is this an issue?</h2>
22
<p>Many existing switch statements are essentially simulations of switch expressions, where each arm either assigns to a common target variable or
33
returns a value. Expressing this as a statement is roundabout, repetitive, and error-prone.</p>
44
<p>Java 14 added support for switch expressions, which provide more succinct and less error-prone version of switch.</p>
5-
<h3>Noncompliant code example</h3>
6-
<pre>
7-
void day_of_week(DoW day) {
8-
int numLetters;
9-
switch (day) { // Noncompliant
10-
case MONDAY:
11-
case FRIDAY:
12-
case SUNDAY:
13-
numLetters = 6;
14-
break;
15-
case TUESDAY:
16-
numLetters = 7;
17-
break;
18-
case THURSDAY:
19-
case SATURDAY:
20-
numLetters = 8;
21-
break;
22-
case WEDNESDAY:
23-
numLetters = 9;
24-
break;
25-
default:
26-
throw new IllegalStateException("Wat: " + day);
27-
}
5+
<h3>Noncompliant code examples</h3>
6+
<pre data-diff-id="1" data-diff-type="noncompliant">
7+
void countLetters(String day) {
8+
int numLetters;
9+
switch (day) {
10+
case "Monday", "Friday", "Sunday":
11+
numLetters = 6;
12+
break;
13+
case "Tuesday":
14+
numLetters = 7;
15+
break;
16+
case "Thursday", "Saturday":
17+
numLetters = 8;
18+
break;
19+
case "Wednesday":
20+
numLetters = 9;
21+
break;
22+
default:
23+
throw new IllegalArgumentException("Invalid day: " + day);
24+
}
25+
System.out.println(numLetters);
2826
}
29-
30-
int return_switch(int x) {
31-
switch (x) { // Noncompliant
32-
case 1:
33-
return 1;
34-
case 2:
35-
return 2;
36-
default:
37-
throw new IllegalStateException();
38-
}
27+
</pre>
28+
<pre data-diff-id="2" data-diff-type="noncompliant">
29+
Day dayOfWeek(String text) {
30+
switch (text) {
31+
case "Monday":
32+
return Day.MONDAY;
33+
case "Tuesday":
34+
return Day.TUESDAY;
35+
case "Wednesday":
36+
return Day.WEDNESDAY;
37+
case "Thursday":
38+
return Day.THURSDAY;
39+
case "Friday":
40+
return Day.FRIDAY;
41+
case "Saturday":
42+
return Day.SATURDAY;
43+
case "Sunday":
44+
return Day.SUNDAY;
45+
default:
46+
throw new IllegalArgumentException("Invalid day: " + text);
47+
}
48+
}
49+
</pre>
50+
<h3>Compliant solutions</h3>
51+
<pre data-diff-id="1" data-diff-type="compliant">
52+
void countLetters(String day) {
53+
int numLetters = switch (day) {
54+
case "Monday", "Friday", "Sunday" -&gt; 6;
55+
case "Tuesday" -&gt; 7;
56+
case "Thursday", "Saturday" -&gt; 8;
57+
case "Wednesday" -&gt; 9;
58+
default -&gt; throw new IllegalArgumentException("Invalid day: " + day);
59+
};
60+
System.out.println(numLetters);
3961
}
4062
</pre>
41-
<h3>Compliant solution</h3>
42-
<pre>
43-
int numLetters = switch (day) {
44-
case MONDAY, FRIDAY, SUNDAY -&gt; 6;
45-
case TUESDAY -&gt; 7;
46-
case THURSDAY, SATURDAY -&gt; 8;
47-
case WEDNESDAY -&gt; 9;
48-
};
63+
<pre data-diff-id="2" data-diff-type="compliant">
64+
Day dayOfWeek(String text) {
65+
return switch (text) {
66+
case "Monday" -&gt; Day.MONDAY;
67+
case "Tuesday" -&gt; Day.TUESDAY;
68+
case "Wednesday" -&gt; Day.WEDNESDAY;
69+
case "Thursday" -&gt; Day.THURSDAY;
70+
case "Friday" -&gt; Day.FRIDAY;
71+
case "Saturday" -&gt; Day.SATURDAY;
72+
case "Sunday" -&gt; Day.SUNDAY;
73+
default -&gt; throw new IllegalArgumentException("Invalid day: " + text);
74+
};
75+
}
4976
</pre>
5077

‎sonar-java-plugin/src/main/resources/org/sonar/l10n/java/rules/java/S5838.json‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
{
2-
"title": "Chained AssertJ assertions should be simplified to the corresponding dedicated assertion",
2+
"title": "AssertJ assertions should be simplified to the corresponding dedicated assertion",
33
"type": "CODE_SMELL",
44
"code": {
55
"impacts": {

‎sonar-java-plugin/src/main/resources/org/sonar/l10n/java/rules/java/S7466.json‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -13,7 +13,7 @@
1313
"ruleSpecification": "RSPEC-7466",
1414
"sqKey": "S7466",
1515
"scope": "All",
16-
"quickfix": "targeted",
16+
"quickfix": "covered",
1717
"code": {
1818
"impacts": {
1919
"MAINTAINABILITY": "LOW"

‎sonar-java-plugin/src/main/resources/org/sonar/l10n/java/rules/java/S7467.json‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -13,7 +13,7 @@
1313
"ruleSpecification": "RSPEC-7467",
1414
"sqKey": "S7467",
1515
"scope": "All",
16-
"quickfix": "targeted",
16+
"quickfix": "covered",
1717
"code": {
1818
"impacts": {
1919
"MAINTAINABILITY": "LOW"

‎sonar-java-plugin/src/main/resources/org/sonar/l10n/java/rules/java/S7475.json‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -14,7 +14,7 @@
1414
"ruleSpecification": "RSPEC-7475",
1515
"sqKey": "S7475",
1616
"scope": "All",
17-
"quickfix": "targeted",
17+
"quickfix": "covered",
1818
"code": {
1919
"impacts": {
2020
"MAINTAINABILITY": "INFO"

‎sonar-java-plugin/src/main/resources/org/sonar/l10n/java/rules/java/S7477.json‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -13,7 +13,7 @@
1313
"ruleSpecification": "RSPEC-7477",
1414
"sqKey": "S7477",
1515
"scope": "All",
16-
"quickfix": "targeted",
16+
"quickfix": "covered",
1717
"code": {
1818
"impacts": {
1919
"MAINTAINABILITY": "LOW"

‎sonar-java-plugin/src/main/resources/org/sonar/l10n/java/rules/java/S7629.json‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -13,7 +13,7 @@
1313
"ruleSpecification": "RSPEC-7629",
1414
"sqKey": "S7629",
1515
"scope": "All",
16-
"quickfix": "unknown",
16+
"quickfix": "covered",
1717
"code": {
1818
"impacts": {
1919
"MAINTAINABILITY": "LOW"

0 commit comments

Comments
 (0)