Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

JS-359 Create rule S6418 (hardcoded-secrets): Hard-coded secrets are security-sensitive (broken) #4920

Merged
merged 37 commits into from
Nov 26, 2024
Merged

JS-359 Create rule S6418 (hardcoded-secrets): Hard-coded secrets are security-sensitive (broken) #4920

merged 37 commits into from
Nov 26, 2024

Conversation

kebetsi
Copy link
Contributor

@kebetsi kebetsi commented Nov 21, 2024 •
edited
Loading

Based on the sonar-python S6418 rule.

RSPEC PR

JS-359

  • Create base Rspec
  • Create base files
  • Understand algorithm
  • Write test cases for hardcoded secrets
  • write hardcoded secrets rule
  • Rename S2068 to HardcodedPassword
  • Update ruling
  • Refine coding example in Rspec
  • handle the diff in parameter numbers

Other ticket tackling S2068

  • write test cases for hardcoded passwords
  • refactor hardcoded passwords rule

@kebetsi kebetsi mentioned this pull request Nov 21, 2024
Closed
@kebetsi kebetsi changed the title JS-359 Create rule S6418 (hardcoded-secrets): secrets should not be hardcoded JS-359 Create rule S6418 (hardcoded-secrets): Hard-coded secrets are security-sensitive Nov 25, 2024
@kebetsi kebetsi marked this pull request as ready for review November 25, 2024 17:57
@kebetsi kebetsi mentioned this pull request Nov 25, 2024
Merged
4 tasks
yassin-kammoun-sonarsource
yassin-kammoun-sonarsource requested changes Nov 25, 2024
View reviewed changes
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Looks great overall, but there are a few things to address.

...lugin/javascript-checks/src/main/java/org/sonar/javascript/checks/HardcodedSecretsCheck.java Outdated Show resolved Hide resolved
packages/jsts/src/rules/S6418/rule.ts Outdated Show resolved Hide resolved
packages/jsts/src/rules/S6418/rule.ts Outdated Show resolved Hide resolved
packages/jsts/src/rules/S6418/rule.ts Outdated Show resolved Hide resolved
packages/jsts/src/rules/S6418/rule.ts Outdated Show resolved Hide resolved
...n/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S6418.html Show resolved Hide resolved
.../javascript-checks/src/test/java/org/sonar/javascript/checks/HardcodedPasswordCheckTest.java Show resolved Hide resolved
kebetsi and others added 5 commits November 26, 2024 09:06
yassin-kammoun-sonarsource
yassin-kammoun-sonarsource approved these changes Nov 26, 2024
View reviewed changes
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Great job!

@sonarqube-next SonarQube-Next
Copy link

Quality Gate passed Quality Gate passed

Issues
0 New issues
0 Fixed issues
0 Accepted issues

Measures
0 Security Hotspots
95.5% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube

@kebetsi kebetsi changed the title JS-359 Create rule S6418 (hardcoded-secrets): Hard-coded secrets are security-sensitive JS-359 Create rule S6418 (hardcoded-secrets): Hard-coded secrets are security-sensitive (broken) Nov 26, 2024
@kebetsi kebetsi closed this Nov 26, 2024
@kebetsi kebetsi mentioned this pull request Nov 26, 2024
Closed
@kebetsi kebetsi reopened this Nov 26, 2024
@kebetsi kebetsi closed this Nov 26, 2024
@kebetsi kebetsi reopened this Nov 26, 2024
@kebetsi kebetsi merged commit ffa208c into master Nov 26, 2024
19 of 20 checks passed
@kebetsi kebetsi deleted the JS-359-implement-S6418 branch November 26, 2024 15:23
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@vdiez vdiez vdiez left review comments

@yassin-kammoun-sonarsource yassin-kammoun-sonarsource yassin-kammoun-sonarsource approved these changes

Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
3 participants
@kebetsi @vdiez @yassin-kammoun-sonarsource