SONARJAVA-6356 Update rule metadata

[hashicorp-vault-sonar-prod]

Rule Metadata Update Summary

Sonarpedia	Rules to update	Rules updated
./sonarpedia.json	686	108
Total	686	108

Rule API Version: 2.20.0.5857

This PR was automatically generated to update rule metadata across all supported languages.

[hashicorp-vault-sonar-prod]

SONARJAVA-6356

[sonar-review-alpha]

Summary

This PR updates rule metadata across 114 files in the sonar-java-plugin. The primary change is a bulk migration of CERT (SEI CERT Coding Standards) reference links from the deprecated CMU wiki format to the new GitHub Pages documentation, affecting resource links in HTML rule documentation across ~108 rules. Additionally, minor JSON metadata updates are made to rule tags and a timestamp refresh in sonarpedia.json reflects the Rule API version 2.20.0.5857.

What reviewers should know

What's changing:

• Resource link updates in HTML rule documentation files (S106.html, S1065.html, etc.): Old URLs like https://wiki.sei.cmu.edu/confluence/x/[code] are being replaced with new URLs like https://cmu-sei.github.io/secure-coding-standards/sei-cert-*/rules/[category]/[rule-id]
• Rule metadata (JSON files): Tags and metadata fields updated to align with CERT standards naming
• Sonarpedia.json: Timestamp updated to 2026-05-07T15:03:31.056802325Z

How to review:

1. Spot-check a few HTML files (e.g., S106.html, S1206.html) to verify link patterns are correct
2. Verify the new links resolve (sample: the CERT, ERR02-J link in S106 should now point to the new GitHub Pages URL)
3. Check if any rule tags were intentionally added/removed (e.g., S1313.json adds "former-hotspot")
4. The 419 insertions / 265 deletions reflect reformatted links (URLs are typically longer than the old wiki format, hence net increase)

No logic changes — this is purely metadata and documentation link maintenance.

---

• Generate Walkthrough
• Generate Diagram

🗣️ Give feedback

[sonarqube-next]

Quality Gate passed

Issues
0 New issues
0 Fixed issues
0 Accepted issues

Measures
0 Security Hotspots
0 Dependency risks
No data about Coverage
No data about Duplication

See analysis details on SonarQube

[sonar-review-alpha]

LGTM! ✅

Clean PR overall — the URL migrations look correct and the content rewrites are accurate. Three behavioral changes are worth calling out explicitly before merge.

S4512 promoted from SECURITY_HOTSPOT to VULNERABILITY: This is the most impactful change. Hotspots require a human to review and mark them Safe/Reviewed; vulnerabilities are automatically raised as active issues and block quality gates. Any codebase using BeanUtils.populate() or BeanWrapper.setPropertyValues() with unfiltered user input will now get a quality gate failure instead of a review prompt. The accompanying HTML rewrite and the removal of the incorrectly placed CERT MSC61-J reference (about cryptographic algorithms — unrelated to bean property injection) are both correct.

S5042 downgraded from SECURITY_HOTSPOT to CODE_SMELL and deprecated: The HTML now opens with a deprecation notice. Severity drops from Critical to Major, and the security impact is removed. Projects relying on this hotspot to surface zip-bomb risks will lose that coverage when the rule is eventually removed.

S2143 added to Sonar_way_profile.json: The rule (enforce java.time over java.util.Date/Calendar/JodaTime) is now part of the default profile. Projects on Java 8+ with legacy date code will start seeing new issues. The HTML table was also corrected — the previous version mixed JodaTime-specific classes (OffsetDate, DateTimeFields, Calendrical) with java.time classes; the new table lists actual java.time types (Instant, Year, Period, Duration, Clock).

One minor correctness improvement in the S5042 compliant example: THRESHOLD_SIZE and totalSizeArchive are changed from int to long, which is the right type for byte counts that can exceed 2 GB.

All CERT reference URLs have been consistently migrated from wiki.sei.cmu.edu/confluence (short hash URLs) to the structured cmu-sei.github.io/secure-coding-standards paths. Spot-checked rule IDs in link text against URL path slugs across multiple rules — no mismatches found.

🗣️ Give feedback