Skip to content

Commit 033f8a4

Browse files
mary-georgiou-sonarsourcesonartech
mary-georgiou-sonarsource
authored and
sonartech
committedFeb 28, 2025·
NET-1040 Update RSPEC before 10.7 release
1 parent d9a8fd0 commit 033f8a4

35 files changed

+16
-119
lines changed
 

‎analyzers/rspec/cs/S1133.json

+1-1
Original file line numberDiff line numberDiff line change
@@ -3,7 +3,7 @@
33
"type": "CODE_SMELL",
44
"code": {
55
"impacts": {
6-
"MAINTAINABILITY": "LOW"
6+
"MAINTAINABILITY": "INFO"
77
},
88
"attribute": "CLEAR"
99
},

‎analyzers/rspec/cs/S1135.json

+1-1
Original file line numberDiff line numberDiff line change
@@ -3,7 +3,7 @@
33
"type": "CODE_SMELL",
44
"code": {
55
"impacts": {
6-
"MAINTAINABILITY": "LOW"
6+
"MAINTAINABILITY": "INFO"
77
},
88
"attribute": "COMPLETE"
99
},

‎analyzers/rspec/cs/S1227.html

+1
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,4 @@
1+
<p>This rule is deprecated, and will eventually be removed.</p>
12
<h2>Why is this an issue?</h2>
23
<p><code>break;</code> is an unstructured control flow statement which makes code harder to read.</p>
34
<p>Ideally, every loop should have a single termination condition.</p>

‎analyzers/rspec/cs/S1227.json

+1-1
Original file line numberDiff line numberDiff line change
@@ -7,7 +7,7 @@
77
},
88
"attribute": "CLEAR"
99
},
10-
"status": "ready",
10+
"status": "deprecated",
1111
"remediation": {
1212
"func": "Constant\/Issue",
1313
"constantCost": "10min"

‎analyzers/rspec/cs/S2115.json

+1-1
Original file line numberDiff line numberDiff line change
@@ -3,7 +3,7 @@
33
"type": "VULNERABILITY",
44
"code": {
55
"impacts": {
6-
"SECURITY": "HIGH"
6+
"SECURITY": "BLOCKER"
77
},
88
"attribute": "TRUSTWORTHY"
99
},

‎analyzers/rspec/cs/S2245.html

-5
Original file line numberDiff line numberDiff line change
@@ -57,15 +57,10 @@ <h2>See</h2>
5757
<li> OWASP - <a href="https://owasp.org/Top10/A02_2021-Cryptographic_Failures/">Top 10 2021 Category A2 - Cryptographic Failures</a> </li>
5858
<li> OWASP - <a href="https://owasp.org/www-project-top-ten/2017/A3_2017-Sensitive_Data_Exposure">Top 10 2017 Category A3 - Sensitive Data
5959
Exposure</a> </li>
60-
<li> OWASP - <a href="https://mas.owasp.org/checklists/MASVS-CRYPTO/">Mobile AppSec Verification Standard - Cryptography Requirements</a> </li>
61-
<li> OWASP - <a href="https://owasp.org/www-project-mobile-top-10/2016-risks/m5-insufficient-cryptography">Mobile Top 10 2016 Category M5 -
62-
Insufficient Cryptography</a> </li>
6360
<li> CWE - <a href="https://cwe.mitre.org/data/definitions/338">CWE-338 - Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG)</a>
6461
</li>
6562
<li> CWE - <a href="https://cwe.mitre.org/data/definitions/330">CWE-330 - Use of Insufficiently Random Values</a> </li>
6663
<li> CWE - <a href="https://cwe.mitre.org/data/definitions/326">CWE-326 - Inadequate Encryption Strength</a> </li>
6764
<li> CWE - <a href="https://cwe.mitre.org/data/definitions/1241">CWE-1241 - Use of Predictable Algorithm in Random Number Generator</a> </li>
68-
<li> Derived from FindSecBugs rule <a href="https://h3xstream.github.io/find-sec-bugs/bugs.htm#PREDICTABLE_RANDOM">Predictable Pseudo Random Number
69-
Generator</a> </li>
7065
</ul>
7166

‎analyzers/rspec/cs/S2245.json

-6
Original file line numberDiff line numberDiff line change
@@ -29,12 +29,6 @@
2929
"OWASP": [
3030
"A3"
3131
],
32-
"OWASP Mobile": [
33-
"M5"
34-
],
35-
"MASVS": [
36-
"MSTG-CRYPTO-6"
37-
],
3832
"OWASP Top 10 2021": [
3933
"A2"
4034
],

‎analyzers/rspec/cs/S2755.json

+1-1
Original file line numberDiff line numberDiff line change
@@ -3,7 +3,7 @@
33
"type": "VULNERABILITY",
44
"code": {
55
"impacts": {
6-
"SECURITY": "HIGH"
6+
"SECURITY": "BLOCKER"
77
},
88
"attribute": "COMPLETE"
99
},

‎analyzers/rspec/cs/S4423.json

-6
Original file line numberDiff line numberDiff line change
@@ -30,12 +30,6 @@
3030
"A3",
3131
"A6"
3232
],
33-
"OWASP Mobile": [
34-
"M3"
35-
],
36-
"MASVS": [
37-
"MSTG-NETWORK-2"
38-
],
3933
"OWASP Top 10 2021": [
4034
"A2",
4135
"A7"

‎analyzers/rspec/cs/S4426.html

+1-4
Original file line numberDiff line numberDiff line change
@@ -116,7 +116,7 @@ <h3>How does this work?</h3>
116116
<h4>RSA (Rivest-Shamir-Adleman) and DSA (Digital Signature Algorithm)</h4>
117117
<p>The security of these algorithms depends on the difficulty of attacks attempting to solve their underlying mathematical problem.</p>
118118
<p>In general, a minimum key size of <strong>2048</strong> bits is recommended for both. It provides 112 bits of security. A key length of
119-
<strong>3072</strong> or <strong>4092</strong> should be preferred when possible.</p>
119+
<strong>3072</strong> or <strong>4096</strong> should be preferred when possible.</p>
120120
<h4>AES (Advanced Encryption Standard)</h4>
121121
<p>AES supports three key sizes: 128 bits, 192 bits and 256 bits. The security of the AES algorithm is based on the computational complexity of trying
122122
all possible keys.<br> A larger key size increases the number of possible keys and makes exhaustive search attacks computationally infeasible.
@@ -182,9 +182,6 @@ <h3>Standards</h3>
182182
Exposure</a> </li>
183183
<li> OWASP - <a href="https://owasp.org/www-project-top-ten/2017/A6_2017-Security_Misconfiguration">Top 10 2017 Category A6 - Security
184184
Misconfiguration</a> </li>
185-
<li> OWASP - <a href="https://mas.owasp.org/checklists/MASVS-CRYPTO/">Mobile AppSec Verification Standard - Cryptography Requirements</a> </li>
186-
<li> OWASP - <a href="https://owasp.org/www-project-mobile-top-10/2016-risks/m5-insufficient-cryptography">Mobile Top 10 2016 Category M5 -
187-
Insufficient Cryptography</a> </li>
188185
<li> <a href="https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-131Ar1.pdf">NIST 800-131A</a> - Recommendation for Transitioning the
189186
Use of Cryptographic Algorithms and Key Lengths </li>
190187
<li> CWE - <a href="https://cwe.mitre.org/data/definitions/326">CWE-326 - Inadequate Encryption Strength</a> </li>

‎analyzers/rspec/cs/S4426.json

-6
Original file line numberDiff line numberDiff line change
@@ -28,12 +28,6 @@
2828
"A3",
2929
"A6"
3030
],
31-
"OWASP Mobile": [
32-
"M5"
33-
],
34-
"MASVS": [
35-
"MSTG-CRYPTO-3"
36-
],
3731
"OWASP Top 10 2021": [
3832
"A2"
3933
],

‎analyzers/rspec/cs/S4487.html

+1-1
Original file line numberDiff line numberDiff line change
@@ -17,7 +17,7 @@ <h2>Why is this an issue?</h2>
1717
{
1818
get
1919
{
20-
return length * width;
20+
return length * length;
2121
}
2222
}
2323
}

‎analyzers/rspec/cs/S4790.html

-3
Original file line numberDiff line numberDiff line change
@@ -34,9 +34,6 @@ <h2>See</h2>
3434
Exposure</a> </li>
3535
<li> OWASP - <a href="https://owasp.org/www-project-top-ten/2017/A6_2017-Security_Misconfiguration">Top 10 2017 Category A6 - Security
3636
Misconfiguration</a> </li>
37-
<li> OWASP - <a href="https://mas.owasp.org/checklists/MASVS-CRYPTO/">Mobile AppSec Verification Standard - Cryptography Requirements</a> </li>
38-
<li> OWASP - <a href="https://owasp.org/www-project-mobile-top-10/2016-risks/m5-insufficient-cryptography">Mobile Top 10 2016 Category M5 -
39-
Insufficient Cryptography</a> </li>
4037
<li> CWE - <a href="https://cwe.mitre.org/data/definitions/1240">CWE-1240 - Use of a Risky Cryptographic Primitive</a> </li>
4138
</ul>
4239

‎analyzers/rspec/cs/S4790.json

-6
Original file line numberDiff line numberDiff line change
@@ -23,12 +23,6 @@
2323
"A3",
2424
"A6"
2525
],
26-
"OWASP Mobile": [
27-
"M5"
28-
],
29-
"MASVS": [
30-
"MSTG-CRYPTO-4"
31-
],
3226
"OWASP Top 10 2021": [
3327
"A2"
3428
],

‎analyzers/rspec/cs/S4830.html

-4
Original file line numberDiff line numberDiff line change
@@ -59,10 +59,6 @@ <h3>Standards</h3>
5959
Exposure</a> </li>
6060
<li> OWASP - <a href="https://owasp.org/www-project-top-ten/2017/A6_2017-Security_Misconfiguration">Top 10 2017 Category A6 - Security
6161
Misconfiguration</a> </li>
62-
<li> OWASP - <a href="https://owasp.org/www-project-mobile-top-10/2016-risks/m3-insecure-communication">Mobile Top 10 2016 Category M3 - Insecure
63-
Communication</a> </li>
64-
<li> OWASP - <a href="https://mas.owasp.org/checklists/MASVS-NETWORK/">Mobile AppSec Verification Standard - Network Communication Requirements</a>
65-
</li>
6662
<li> CWE - <a href="https://cwe.mitre.org/data/definitions/295">CWE-295 - Improper Certificate Validation</a> </li>
6763
<li> STIG Viewer - <a href="https://stigviewer.com/stig/application_security_and_development/2023-06-08/finding/V-222550">Application Security and
6864
Development: V-222550</a> - The application must validate certificates by constructing a certification path to an accepted trust anchor. </li>

‎analyzers/rspec/cs/S4830.json

-6
Original file line numberDiff line numberDiff line change
@@ -29,12 +29,6 @@
2929
"A6",
3030
"A3"
3131
],
32-
"OWASP Mobile": [
33-
"M3"
34-
],
35-
"MASVS": [
36-
"MSTG-NETWORK-3"
37-
],
3832
"OWASP Top 10 2021": [
3933
"A2",
4034
"A5",

‎analyzers/rspec/cs/S5332.html

-4
Original file line numberDiff line numberDiff line change
@@ -96,10 +96,6 @@ <h3>Standards</h3>
9696
<li> OWASP - <a href="https://owasp.org/www-project-top-ten/2017/A3_2017-Sensitive_Data_Exposure">Top 10 2017 Category A3 - Sensitive Data
9797
Exposure</a> </li>
9898
<li> OWASP - <a href="https://owasp.org/Top10/A02_2021-Cryptographic_Failures/">Top 10 2021 Category A2 - Cryptographic Failures</a> </li>
99-
<li> OWASP - <a href="https://mas.owasp.org/checklists/MASVS-NETWORK/">Mobile AppSec Verification Standard - Network Communication Requirements</a>
100-
</li>
101-
<li> OWASP - <a href="https://owasp.org/www-project-mobile-top-10/2016-risks/m3-insecure-communication">Mobile Top 10 2016 Category M3 - Insecure
102-
Communication</a> </li>
10399
<li> CWE - <a href="https://cwe.mitre.org/data/definitions/200">CWE-200 - Exposure of Sensitive Information to an Unauthorized Actor</a> </li>
104100
<li> CWE - <a href="https://cwe.mitre.org/data/definitions/319">CWE-319 - Cleartext Transmission of Sensitive Information</a> </li>
105101
<li> STIG Viewer - <a href="https://stigviewer.com/stig/application_security_and_development/2023-06-08/finding/V-222397">Application Security and

‎analyzers/rspec/cs/S5332.json

-6
Original file line numberDiff line numberDiff line change
@@ -23,12 +23,6 @@
2323
"OWASP": [
2424
"A3"
2525
],
26-
"OWASP Mobile": [
27-
"M3"
28-
],
29-
"MASVS": [
30-
"MSTG-NETWORK-1"
31-
],
3226
"OWASP Top 10 2021": [
3327
"A2"
3428
],

‎analyzers/rspec/cs/S5542.json

-6
Original file line numberDiff line numberDiff line change
@@ -29,12 +29,6 @@
2929
"A6",
3030
"A3"
3131
],
32-
"OWASP Mobile": [
33-
"M5"
34-
],
35-
"MASVS": [
36-
"MSTG-CRYPTO-3"
37-
],
3832
"OWASP Top 10 2021": [
3933
"A2"
4034
],

‎analyzers/rspec/cs/S5547.json

-6
Original file line numberDiff line numberDiff line change
@@ -29,12 +29,6 @@
2929
"A3",
3030
"A6"
3131
],
32-
"OWASP Mobile": [
33-
"M5"
34-
],
35-
"MASVS": [
36-
"MSTG-CRYPTO-3"
37-
],
3832
"OWASP Top 10 2021": [
3933
"A2"
4034
],

‎analyzers/rspec/cs/S7131.json

+1-1
Original file line numberDiff line numberDiff line change
@@ -9,7 +9,7 @@
99
"tags": [
1010
"symbolic-execution"
1111
],
12-
"defaultSeverity": "Major",
12+
"defaultSeverity": "Critical",
1313
"ruleSpecification": "RSPEC-7131",
1414
"sqKey": "S7131",
1515
"scope": "All",

‎analyzers/rspec/cs/S7133.json

+1-1
Original file line numberDiff line numberDiff line change
@@ -9,7 +9,7 @@
99
"tags": [
1010
"symbolic-execution"
1111
],
12-
"defaultSeverity": "Major",
12+
"defaultSeverity": "Critical",
1313
"ruleSpecification": "RSPEC-7133",
1414
"sqKey": "S7133",
1515
"scope": "All",

‎analyzers/rspec/vbnet/S1133.json

+1-1
Original file line numberDiff line numberDiff line change
@@ -3,7 +3,7 @@
33
"type": "CODE_SMELL",
44
"code": {
55
"impacts": {
6-
"MAINTAINABILITY": "LOW"
6+
"MAINTAINABILITY": "INFO"
77
},
88
"attribute": "CLEAR"
99
},

‎analyzers/rspec/vbnet/S1135.json

+1-1
Original file line numberDiff line numberDiff line change
@@ -3,7 +3,7 @@
33
"type": "CODE_SMELL",
44
"code": {
55
"impacts": {
6-
"MAINTAINABILITY": "LOW"
6+
"MAINTAINABILITY": "INFO"
77
},
88
"attribute": "COMPLETE"
99
},

‎analyzers/rspec/vbnet/S4423.json

-6
Original file line numberDiff line numberDiff line change
@@ -30,12 +30,6 @@
3030
"A3",
3131
"A6"
3232
],
33-
"OWASP Mobile": [
34-
"M3"
35-
],
36-
"MASVS": [
37-
"MSTG-NETWORK-2"
38-
],
3933
"OWASP Top 10 2021": [
4034
"A2",
4135
"A7"

‎analyzers/rspec/vbnet/S4790.html

-3
Original file line numberDiff line numberDiff line change
@@ -54,9 +54,6 @@ <h2>See</h2>
5454
Exposure</a> </li>
5555
<li> OWASP - <a href="https://owasp.org/www-project-top-ten/2017/A6_2017-Security_Misconfiguration">Top 10 2017 Category A6 - Security
5656
Misconfiguration</a> </li>
57-
<li> OWASP - <a href="https://mas.owasp.org/checklists/MASVS-CRYPTO/">Mobile AppSec Verification Standard - Cryptography Requirements</a> </li>
58-
<li> OWASP - <a href="https://owasp.org/www-project-mobile-top-10/2016-risks/m5-insufficient-cryptography">Mobile Top 10 2016 Category M5 -
59-
Insufficient Cryptography</a> </li>
6057
<li> CWE - <a href="https://cwe.mitre.org/data/definitions/1240">CWE-1240 - Use of a Risky Cryptographic Primitive</a> </li>
6158
</ul>
6259

‎analyzers/rspec/vbnet/S4790.json

-6
Original file line numberDiff line numberDiff line change
@@ -23,12 +23,6 @@
2323
"A3",
2424
"A6"
2525
],
26-
"OWASP Mobile": [
27-
"M5"
28-
],
29-
"MASVS": [
30-
"MSTG-CRYPTO-4"
31-
],
3226
"OWASP Top 10 2021": [
3327
"A2"
3428
],

‎analyzers/rspec/vbnet/S4830.html

-4
Original file line numberDiff line numberDiff line change
@@ -57,10 +57,6 @@ <h3>Standards</h3>
5757
Exposure</a> </li>
5858
<li> OWASP - <a href="https://owasp.org/www-project-top-ten/2017/A6_2017-Security_Misconfiguration">Top 10 2017 Category A6 - Security
5959
Misconfiguration</a> </li>
60-
<li> OWASP - <a href="https://owasp.org/www-project-mobile-top-10/2016-risks/m3-insecure-communication">Mobile Top 10 2016 Category M3 - Insecure
61-
Communication</a> </li>
62-
<li> OWASP - <a href="https://mas.owasp.org/checklists/MASVS-NETWORK/">Mobile AppSec Verification Standard - Network Communication Requirements</a>
63-
</li>
6460
<li> CWE - <a href="https://cwe.mitre.org/data/definitions/295">CWE-295 - Improper Certificate Validation</a> </li>
6561
<li> STIG Viewer - <a href="https://stigviewer.com/stig/application_security_and_development/2023-06-08/finding/V-222550">Application Security and
6662
Development: V-222550</a> - The application must validate certificates by constructing a certification path to an accepted trust anchor. </li>

‎analyzers/rspec/vbnet/S4830.json

-6
Original file line numberDiff line numberDiff line change
@@ -29,12 +29,6 @@
2929
"A6",
3030
"A3"
3131
],
32-
"OWASP Mobile": [
33-
"M3"
34-
],
35-
"MASVS": [
36-
"MSTG-NETWORK-3"
37-
],
3832
"OWASP Top 10 2021": [
3933
"A2",
4034
"A5",

‎analyzers/rspec/vbnet/S5542.json

-6
Original file line numberDiff line numberDiff line change
@@ -29,12 +29,6 @@
2929
"A6",
3030
"A3"
3131
],
32-
"OWASP Mobile": [
33-
"M5"
34-
],
35-
"MASVS": [
36-
"MSTG-CRYPTO-3"
37-
],
3832
"OWASP Top 10 2021": [
3933
"A2"
4034
],

‎analyzers/rspec/vbnet/S5547.json

-6
Original file line numberDiff line numberDiff line change
@@ -29,12 +29,6 @@
2929
"A3",
3030
"A6"
3131
],
32-
"OWASP Mobile": [
33-
"M5"
34-
],
35-
"MASVS": [
36-
"MSTG-CRYPTO-3"
37-
],
3832
"OWASP Top 10 2021": [
3933
"A2"
4034
],

‎analyzers/rspec/vbnet/S7131.json

+1-1
Original file line numberDiff line numberDiff line change
@@ -9,7 +9,7 @@
99
"tags": [
1010
"symbolic-execution"
1111
],
12-
"defaultSeverity": "Major",
12+
"defaultSeverity": "Critical",
1313
"ruleSpecification": "RSPEC-7131",
1414
"sqKey": "S7131",
1515
"scope": "All",

‎analyzers/rspec/vbnet/S7133.json

+1-1
Original file line numberDiff line numberDiff line change
@@ -9,7 +9,7 @@
99
"tags": [
1010
"symbolic-execution"
1111
],
12-
"defaultSeverity": "Major",
12+
"defaultSeverity": "Critical",
1313
"ruleSpecification": "RSPEC-7133",
1414
"sqKey": "S7133",
1515
"scope": "All",

‎analyzers/src/SonarAnalyzer.CSharp/sonarpedia.json

+1-1
Original file line numberDiff line numberDiff line change
@@ -3,7 +3,7 @@
33
"languages": [
44
"CSH"
55
],
6-
"latest-update": "2025-01-28T15:19:07.499237500Z",
6+
"latest-update": "2025-02-26T15:40:04.929306Z",
77
"options": {
88
"no-language-in-filenames": true
99
}

‎analyzers/src/SonarAnalyzer.VisualBasic/sonarpedia.json

+1-1
Original file line numberDiff line numberDiff line change
@@ -3,7 +3,7 @@
33
"languages": [
44
"VBNET"
55
],
6-
"latest-update": "2025-01-28T15:22:46.290683900Z",
6+
"latest-update": "2025-02-26T15:39:24.192698400Z",
77
"options": {
88
"no-language-in-filenames": true
99
}

0 commit comments

Comments
 (0)