diff --git a/sonar-java-plugin/src/main/resources/org/sonar/l10n/java/rules/java/S106.html b/sonar-java-plugin/src/main/resources/org/sonar/l10n/java/rules/java/S106.html index b5e935f9ed..7b01700531 100644 --- a/sonar-java-plugin/src/main/resources/org/sonar/l10n/java/rules/java/S106.html +++ b/sonar-java-plugin/src/main/resources/org/sonar/l10n/java/rules/java/S106.html @@ -41,6 +41,8 @@

Documentation

Monitoring Failures
  • OWASP - Top 10 2017 Category A3 - Sensitive Data Exposure
    • -
  • CERT, ERR02-J. - Prevent exceptions while logging data
    • +
  • CERT, + ERR02-J. - Prevent exceptions while logging data
    • diff --git a/sonar-java-plugin/src/main/resources/org/sonar/l10n/java/rules/java/S1065.html b/sonar-java-plugin/src/main/resources/org/sonar/l10n/java/rules/java/S1065.html index ee08e1648e..282ea34238 100644 --- a/sonar-java-plugin/src/main/resources/org/sonar/l10n/java/rules/java/S1065.html +++ b/sonar-java-plugin/src/main/resources/org/sonar/l10n/java/rules/java/S1065.html @@ -20,6 +20,7 @@

    Compliant solution

    Resources

    diff --git a/sonar-java-plugin/src/main/resources/org/sonar/l10n/java/rules/java/S1111.html b/sonar-java-plugin/src/main/resources/org/sonar/l10n/java/rules/java/S1111.html index 8e0e9a9631..815ad80f11 100644 --- a/sonar-java-plugin/src/main/resources/org/sonar/l10n/java/rules/java/S1111.html +++ b/sonar-java-plugin/src/main/resources/org/sonar/l10n/java/rules/java/S1111.html @@ -18,6 +18,7 @@

    Resources

    diff --git a/sonar-java-plugin/src/main/resources/org/sonar/l10n/java/rules/java/S1113.html b/sonar-java-plugin/src/main/resources/org/sonar/l10n/java/rules/java/S1113.html index 76259bd86b..cf48fb43b2 100644 --- a/sonar-java-plugin/src/main/resources/org/sonar/l10n/java/rules/java/S1113.html +++ b/sonar-java-plugin/src/main/resources/org/sonar/l10n/java/rules/java/S1113.html @@ -29,6 +29,7 @@

    Exceptions

    Resources

    diff --git a/sonar-java-plugin/src/main/resources/org/sonar/l10n/java/rules/java/S1114.html b/sonar-java-plugin/src/main/resources/org/sonar/l10n/java/rules/java/S1114.html index abaac7a092..53080d1181 100644 --- a/sonar-java-plugin/src/main/resources/org/sonar/l10n/java/rules/java/S1114.html +++ b/sonar-java-plugin/src/main/resources/org/sonar/l10n/java/rules/java/S1114.html @@ -24,6 +24,7 @@

    Compliant solution

    Resources

    diff --git a/sonar-java-plugin/src/main/resources/org/sonar/l10n/java/rules/java/S1116.html b/sonar-java-plugin/src/main/resources/org/sonar/l10n/java/rules/java/S1116.html index dcf08dd096..1a5d35754f 100644 --- a/sonar-java-plugin/src/main/resources/org/sonar/l10n/java/rules/java/S1116.html +++ b/sonar-java-plugin/src/main/resources/org/sonar/l10n/java/rules/java/S1116.html @@ -28,10 +28,12 @@

    Compliant solution

    Resources

    Documentation

    diff --git a/sonar-java-plugin/src/main/resources/org/sonar/l10n/java/rules/java/S1117.html b/sonar-java-plugin/src/main/resources/org/sonar/l10n/java/rules/java/S1117.html index 004b0a5bce..c8a0087457 100644 --- a/sonar-java-plugin/src/main/resources/org/sonar/l10n/java/rules/java/S1117.html +++ b/sonar-java-plugin/src/main/resources/org/sonar/l10n/java/rules/java/S1117.html @@ -24,8 +24,8 @@

    Noncompliant code example

    Resources

    Documentation

    Related rules

    diff --git a/sonar-java-plugin/src/main/resources/org/sonar/l10n/java/rules/java/S1699.html b/sonar-java-plugin/src/main/resources/org/sonar/l10n/java/rules/java/S1699.html index 7aeaa3d820..087479dd2c 100644 --- a/sonar-java-plugin/src/main/resources/org/sonar/l10n/java/rules/java/S1699.html +++ b/sonar-java-plugin/src/main/resources/org/sonar/l10n/java/rules/java/S1699.html @@ -38,8 +38,9 @@

    Noncompliant code example

    Resources

    diff --git a/sonar-java-plugin/src/main/resources/org/sonar/l10n/java/rules/java/S1764.html b/sonar-java-plugin/src/main/resources/org/sonar/l10n/java/rules/java/S1764.html index 08f0200dc1..48dda451e0 100644 --- a/sonar-java-plugin/src/main/resources/org/sonar/l10n/java/rules/java/S1764.html +++ b/sonar-java-plugin/src/main/resources/org/sonar/l10n/java/rules/java/S1764.html @@ -39,7 +39,8 @@

    Exceptions

    Resources

    diff --git a/sonar-java-plugin/src/main/resources/org/sonar/l10n/java/rules/java/S1860.html b/sonar-java-plugin/src/main/resources/org/sonar/l10n/java/rules/java/S1860.html index 4755354955..9ade357314 100644 --- a/sonar-java-plugin/src/main/resources/org/sonar/l10n/java/rules/java/S1860.html +++ b/sonar-java-plugin/src/main/resources/org/sonar/l10n/java/rules/java/S1860.html @@ -96,7 +96,8 @@

    Compliant solution

    Resources

    Resources

    diff --git a/sonar-java-plugin/src/main/resources/org/sonar/l10n/java/rules/java/S1989.html b/sonar-java-plugin/src/main/resources/org/sonar/l10n/java/rules/java/S1989.html index e6c1b1f58c..8cb24a12f9 100644 --- a/sonar-java-plugin/src/main/resources/org/sonar/l10n/java/rules/java/S1989.html +++ b/sonar-java-plugin/src/main/resources/org/sonar/l10n/java/rules/java/S1989.html @@ -46,6 +46,8 @@

    Articles & blog posts

  • OWASP - Top 10 2017 Category A3 - Sensitive Data Exposure
  • CWE - CWE-600 - Uncaught Exception in Servlet
    • -
  • CERT, ERR01-J. - Do not allow exceptions to expose sensitive information
    • +
  • CERT, + ERR01-J. - Do not allow exceptions to expose sensitive information
    • diff --git a/sonar-java-plugin/src/main/resources/org/sonar/l10n/java/rules/java/S2057.html b/sonar-java-plugin/src/main/resources/org/sonar/l10n/java/rules/java/S2057.html index bb11cb2772..29b2176971 100644 --- a/sonar-java-plugin/src/main/resources/org/sonar/l10n/java/rules/java/S2057.html +++ b/sonar-java-plugin/src/main/resources/org/sonar/l10n/java/rules/java/S2057.html @@ -36,7 +36,8 @@

    Exceptions

    Errors), and classes marked with @SuppressWarnings("serial") are ignored.

    Resources

    diff --git a/sonar-java-plugin/src/main/resources/org/sonar/l10n/java/rules/java/S2059.html b/sonar-java-plugin/src/main/resources/org/sonar/l10n/java/rules/java/S2059.html index 23f8e15f0d..85112ab4bb 100644 --- a/sonar-java-plugin/src/main/resources/org/sonar/l10n/java/rules/java/S2059.html +++ b/sonar-java-plugin/src/main/resources/org/sonar/l10n/java/rules/java/S2059.html @@ -29,6 +29,7 @@

    Compliant solution

    Resources

    diff --git a/sonar-java-plugin/src/main/resources/org/sonar/l10n/java/rules/java/S2061.html b/sonar-java-plugin/src/main/resources/org/sonar/l10n/java/rules/java/S2061.html index 0c5bd6d43b..11df863589 100644 --- a/sonar-java-plugin/src/main/resources/org/sonar/l10n/java/rules/java/S2061.html +++ b/sonar-java-plugin/src/main/resources/org/sonar/l10n/java/rules/java/S2061.html @@ -42,8 +42,8 @@

    Compliant solution

    Resources

    diff --git a/sonar-java-plugin/src/main/resources/org/sonar/l10n/java/rules/java/S2066.html b/sonar-java-plugin/src/main/resources/org/sonar/l10n/java/rules/java/S2066.html index 0f4d137707..4bd688542b 100644 --- a/sonar-java-plugin/src/main/resources/org/sonar/l10n/java/rules/java/S2066.html +++ b/sonar-java-plugin/src/main/resources/org/sonar/l10n/java/rules/java/S2066.html @@ -34,6 +34,7 @@

    Compliant solution

    Resources

    diff --git a/sonar-java-plugin/src/main/resources/org/sonar/l10n/java/rules/java/S2068.json b/sonar-java-plugin/src/main/resources/org/sonar/l10n/java/rules/java/S2068.json index 2d7e1399f5..fc12ceb2ea 100644 --- a/sonar-java-plugin/src/main/resources/org/sonar/l10n/java/rules/java/S2068.json +++ b/sonar-java-plugin/src/main/resources/org/sonar/l10n/java/rules/java/S2068.json @@ -15,7 +15,8 @@ "quickfix": "infeasible", "tags": [ "cwe", - "cert" + "cert", + "former-hotspot" ], "defaultSeverity": "Major", "ruleSpecification": "RSPEC-2068", diff --git a/sonar-java-plugin/src/main/resources/org/sonar/l10n/java/rules/java/S2092.json b/sonar-java-plugin/src/main/resources/org/sonar/l10n/java/rules/java/S2092.json index 56c30f558e..d69ce26444 100644 --- a/sonar-java-plugin/src/main/resources/org/sonar/l10n/java/rules/java/S2092.json +++ b/sonar-java-plugin/src/main/resources/org/sonar/l10n/java/rules/java/S2092.json @@ -16,7 +16,8 @@ "tags": [ "cwe", "spring", - "privacy" + "privacy", + "former-hotspot" ], "defaultSeverity": "Minor", "ruleSpecification": "RSPEC-2092", diff --git a/sonar-java-plugin/src/main/resources/org/sonar/l10n/java/rules/java/S2093.html b/sonar-java-plugin/src/main/resources/org/sonar/l10n/java/rules/java/S2093.html index 83228b6448..59a5ef3be6 100644 --- a/sonar-java-plugin/src/main/resources/org/sonar/l10n/java/rules/java/S2093.html +++ b/sonar-java-plugin/src/main/resources/org/sonar/l10n/java/rules/java/S2093.html @@ -60,8 +60,8 @@

    Compliant solution

    Resources

    diff --git a/sonar-java-plugin/src/main/resources/org/sonar/l10n/java/rules/java/S2111.html b/sonar-java-plugin/src/main/resources/org/sonar/l10n/java/rules/java/S2111.html index 0c1993e620..2d0fb37571 100644 --- a/sonar-java-plugin/src/main/resources/org/sonar/l10n/java/rules/java/S2111.html +++ b/sonar-java-plugin/src/main/resources/org/sonar/l10n/java/rules/java/S2111.html @@ -28,6 +28,7 @@

    Resources

    Documentation

    diff --git a/sonar-java-plugin/src/main/resources/org/sonar/l10n/java/rules/java/S2143.html b/sonar-java-plugin/src/main/resources/org/sonar/l10n/java/rules/java/S2143.html index 695533b054..b4c460a7cb 100644 --- a/sonar-java-plugin/src/main/resources/org/sonar/l10n/java/rules/java/S2143.html +++ b/sonar-java-plugin/src/main/resources/org/sonar/l10n/java/rules/java/S2143.html @@ -1,7 +1,11 @@

    Why is this an issue?

    -

    The old, much-derided Date and Calendar classes have always been confusing and difficult to use properly, particularly in -a multi-threaded context. JodaTime has long been a popular alternative, but now an even better option is built-in. Java 8’s JSR 310 -implementation offers specific classes for:

    +

    The old, much-derided Date and Calendar classes have always been confusing and error-prone, particularly in a +multi-threaded context. The JodaTime library has long been a popular alternative, but it is also considered outdated. Starting from Java SE 8, the +built-in java.time (JSR-310) API provides a modern, immutable, and thread-safe framework that addresses these long-standing design +flaws.

    +

    Note: While Joda-Time remains the standard for handling date and time in java versions prior to 8, users of newer versions should +migrate to the java.time API.

    +

    The java.time package offers specific classes for:

    @@ -16,34 +20,34 @@

    Why is this an issue?

    @@ -70,6 +74,14 @@

    Why is this an issue?

    the date and time with a time zone and offset

    + + + +
    -

    LocalDate

    +

    Instant

    		 -

    a date, without time of day, offset, or zone

    +

    a timestamp
    -

    LocalTime

    +

    LocalDate

    		 -

    the time of day, without date, offset, or zone

    +

    a date, without time of day, offset, or zone
    -

    LocalDateTime

    +

    LocalTime

    		 -

    the date and time, without offset, or zone

    +

    the time of day, without date, offset, or zone
    -

    OffsetDate

    +

    LocalDateTime

    		 -

    a date with an offset such as +02:00, without time of day, or zone

    +

    the date and time, without offset, or zone
    +

    Year

    +     		+

    a year

    +

    YearMonth

    @@ -88,49 +100,63 @@

    Why is this an issue?

    -

    Year/MonthOfDay/DayOfWeek/…​

    +

    Month/DayOfWeek

    		 -

    classes for the important fields

    +

    enum classes for date fields
    -

    DateTimeFields

    +

    Period

    		 -

    stores a map of field-value pairs which may be invalid

    +

    a date-based amount of time, such as "2 months and 3 days"
    -

    Calendrical

    +

    Duration

    		 -

    access to the low-level API

    +

    a time-based amount of time, such as "34.5 seconds"
    -

    Period

    +

    Clock

    		 -

    a descriptive amount of time, such as "2 months and 3 days"

    +

    a clock providing access to the current instant, date and time
    +

    How to fix it

    +

    Use the java.time API instead of java.util.Calendar, java.util.Date or JodaTime.

    Noncompliant code example

    +

    Use of java.util.Date or java.util.Calendar

     Date now = new Date();  // Noncompliant
 DateFormat df = new SimpleDateFormat("dd.MM.yyyy");
 Calendar christmas  = Calendar.getInstance();  // Noncompliant
 christmas.setTime(df.parse("25.12.2020"));
    +

    Use of Joda-Time

    +
    +DateTime dateTime =  new DateTime(); // Noncompliant
+

    Compliant solution

    -LocalDate now = LocalDate.now();  // gets calendar date. no time component
-LocalTime now2 = LocalTime.now(); // gets current time. no date component
-LocalDate christmas = LocalDate.of(2020,12,25);
+LocalDate nowUTC = LocalDate.now(ZoneOffset.UTC);  // gets current date in UTC
+LocalDate christmas = LocalDate.of(2020, Month.DECEMBER,25); // create date from year/month/day
+ZonedDateTime nowParis = ZonedDateTime.now(ZoneId.of("Europe/Paris")); // get current time in Paris with time-zone information
    +

    Resources

    +

    Documentation

    + diff --git a/sonar-java-plugin/src/main/resources/org/sonar/l10n/java/rules/java/S2151.html b/sonar-java-plugin/src/main/resources/org/sonar/l10n/java/rules/java/S2151.html index 171be0e8fd..c2d16048cf 100644 --- a/sonar-java-plugin/src/main/resources/org/sonar/l10n/java/rules/java/S2151.html +++ b/sonar-java-plugin/src/main/resources/org/sonar/l10n/java/rules/java/S2151.html @@ -21,6 +21,7 @@

    Compliant solution

    Resources

    diff --git a/sonar-java-plugin/src/main/resources/org/sonar/l10n/java/rules/java/S2159.html b/sonar-java-plugin/src/main/resources/org/sonar/l10n/java/rules/java/S2159.html index c60184b912..f3e7a437bb 100644 --- a/sonar-java-plugin/src/main/resources/org/sonar/l10n/java/rules/java/S2159.html +++ b/sonar-java-plugin/src/main/resources/org/sonar/l10n/java/rules/java/S2159.html @@ -53,6 +53,7 @@

    Noncompliant code example

    Resources

    diff --git a/sonar-java-plugin/src/main/resources/org/sonar/l10n/java/rules/java/S2162.html b/sonar-java-plugin/src/main/resources/org/sonar/l10n/java/rules/java/S2162.html index 159d0296d2..f331611156 100644 --- a/sonar-java-plugin/src/main/resources/org/sonar/l10n/java/rules/java/S2162.html +++ b/sonar-java-plugin/src/main/resources/org/sonar/l10n/java/rules/java/S2162.html @@ -63,7 +63,7 @@

    Compliant solution

    Resources

    diff --git a/sonar-java-plugin/src/main/resources/org/sonar/l10n/java/rules/java/S2164.html b/sonar-java-plugin/src/main/resources/org/sonar/l10n/java/rules/java/S2164.html index b45e3e8410..a1126a382d 100644 --- a/sonar-java-plugin/src/main/resources/org/sonar/l10n/java/rules/java/S2164.html +++ b/sonar-java-plugin/src/main/resources/org/sonar/l10n/java/rules/java/S2164.html @@ -25,7 +25,7 @@

    Exceptions

    Resources

    diff --git a/sonar-java-plugin/src/main/resources/org/sonar/l10n/java/rules/java/S2168.html b/sonar-java-plugin/src/main/resources/org/sonar/l10n/java/rules/java/S2168.html index 9008b5d254..1728a99007 100644 --- a/sonar-java-plugin/src/main/resources/org/sonar/l10n/java/rules/java/S2168.html +++ b/sonar-java-plugin/src/main/resources/org/sonar/l10n/java/rules/java/S2168.html @@ -56,7 +56,8 @@

    Compliant solution

    Resources

    diff --git a/sonar-java-plugin/src/main/resources/org/sonar/l10n/java/rules/java/S2251.html b/sonar-java-plugin/src/main/resources/org/sonar/l10n/java/rules/java/S2251.html index a4a3033bf5..f07d76c824 100644 --- a/sonar-java-plugin/src/main/resources/org/sonar/l10n/java/rules/java/S2251.html +++ b/sonar-java-plugin/src/main/resources/org/sonar/l10n/java/rules/java/S2251.html @@ -60,7 +60,9 @@

    Compliant solution

    Resources

    Documentation

    Articles & blog posts

    diff --git a/sonar-java-plugin/src/main/resources/org/sonar/l10n/java/rules/java/S2612.json b/sonar-java-plugin/src/main/resources/org/sonar/l10n/java/rules/java/S2612.json index 49909d4f51..c4484e9d75 100644 --- a/sonar-java-plugin/src/main/resources/org/sonar/l10n/java/rules/java/S2612.json +++ b/sonar-java-plugin/src/main/resources/org/sonar/l10n/java/rules/java/S2612.json @@ -14,7 +14,8 @@ }, "tags": [ "cwe", - "cert" + "cert", + "former-hotspot" ], "defaultSeverity": "Major", "ruleSpecification": "RSPEC-2612", diff --git a/sonar-java-plugin/src/main/resources/org/sonar/l10n/java/rules/java/S2674.html b/sonar-java-plugin/src/main/resources/org/sonar/l10n/java/rules/java/S2674.html index 02037e629f..98f76ffd67 100644 --- a/sonar-java-plugin/src/main/resources/org/sonar/l10n/java/rules/java/S2674.html +++ b/sonar-java-plugin/src/main/resources/org/sonar/l10n/java/rules/java/S2674.html @@ -32,6 +32,7 @@

    Compliant solution

    Resources

    diff --git a/sonar-java-plugin/src/main/resources/org/sonar/l10n/java/rules/java/S2681.html b/sonar-java-plugin/src/main/resources/org/sonar/l10n/java/rules/java/S2681.html index b0c47c5b67..9ae6931760 100644 --- a/sonar-java-plugin/src/main/resources/org/sonar/l10n/java/rules/java/S2681.html +++ b/sonar-java-plugin/src/main/resources/org/sonar/l10n/java/rules/java/S2681.html @@ -30,6 +30,8 @@

    Why is this an issue?

    Resources

    diff --git a/sonar-java-plugin/src/main/resources/org/sonar/l10n/java/rules/java/S2693.html b/sonar-java-plugin/src/main/resources/org/sonar/l10n/java/rules/java/S2693.html index b869287bed..e77e22454e 100644 --- a/sonar-java-plugin/src/main/resources/org/sonar/l10n/java/rules/java/S2693.html +++ b/sonar-java-plugin/src/main/resources/org/sonar/l10n/java/rules/java/S2693.html @@ -16,6 +16,7 @@

    Noncompliant code example

    Resources

    diff --git a/sonar-java-plugin/src/main/resources/org/sonar/l10n/java/rules/java/S2886.html b/sonar-java-plugin/src/main/resources/org/sonar/l10n/java/rules/java/S2886.html index bc5ac236b8..b3da1ad24f 100644 --- a/sonar-java-plugin/src/main/resources/org/sonar/l10n/java/rules/java/S2886.html +++ b/sonar-java-plugin/src/main/resources/org/sonar/l10n/java/rules/java/S2886.html @@ -75,7 +75,9 @@

    Articles & blog posts

    Standards

    diff --git a/sonar-java-plugin/src/main/resources/org/sonar/l10n/java/rules/java/S3011.html b/sonar-java-plugin/src/main/resources/org/sonar/l10n/java/rules/java/S3011.html index 63fee75c65..0355cc0875 100644 --- a/sonar-java-plugin/src/main/resources/org/sonar/l10n/java/rules/java/S3011.html +++ b/sonar-java-plugin/src/main/resources/org/sonar/l10n/java/rules/java/S3011.html @@ -17,7 +17,7 @@

    Resources

    Documentation

    diff --git a/sonar-java-plugin/src/main/resources/org/sonar/l10n/java/rules/java/S3014.html b/sonar-java-plugin/src/main/resources/org/sonar/l10n/java/rules/java/S3014.html index 2bf4901911..d30a1c09c3 100644 --- a/sonar-java-plugin/src/main/resources/org/sonar/l10n/java/rules/java/S3014.html +++ b/sonar-java-plugin/src/main/resources/org/sonar/l10n/java/rules/java/S3014.html @@ -33,6 +33,7 @@

    Compliant solution

    Resources

    diff --git a/sonar-java-plugin/src/main/resources/org/sonar/l10n/java/rules/java/S3034.html b/sonar-java-plugin/src/main/resources/org/sonar/l10n/java/rules/java/S3034.html index e26fbb411d..b443752393 100644 --- a/sonar-java-plugin/src/main/resources/org/sonar/l10n/java/rules/java/S3034.html +++ b/sonar-java-plugin/src/main/resources/org/sonar/l10n/java/rules/java/S3034.html @@ -62,7 +62,8 @@

    Compliant solution

    Resources

    diff --git a/sonar-java-plugin/src/main/resources/org/sonar/l10n/java/rules/java/S3064.html b/sonar-java-plugin/src/main/resources/org/sonar/l10n/java/rules/java/S3064.html index 346dfcd70a..179d9f5edf 100644 --- a/sonar-java-plugin/src/main/resources/org/sonar/l10n/java/rules/java/S3064.html +++ b/sonar-java-plugin/src/main/resources/org/sonar/l10n/java/rules/java/S3064.html @@ -44,7 +44,8 @@

    Compliant solution

    Resources

    Related rules

    diff --git a/sonar-java-plugin/src/main/resources/org/sonar/l10n/java/rules/java/S4423.html b/sonar-java-plugin/src/main/resources/org/sonar/l10n/java/rules/java/S4423.html index a951338360..dfbc3dc887 100644 --- a/sonar-java-plugin/src/main/resources/org/sonar/l10n/java/rules/java/S4423.html +++ b/sonar-java-plugin/src/main/resources/org/sonar/l10n/java/rules/java/S4423.html @@ -144,6 +144,8 @@

    Standards

  • OWASP - Mobile Top 10 2024 Category M5 - Insecure Communication
  • CWE - CWE-327 - Use of a Broken or Risky Cryptographic Algorithm
    • -
  • CERT, MSC61-J. - Do not use insecure or weak cryptographic algorithms
    • +
  • CERT, + MSC61-J. - Do not use insecure or weak cryptographic algorithms
    • diff --git a/sonar-java-plugin/src/main/resources/org/sonar/l10n/java/rules/java/S4426.html b/sonar-java-plugin/src/main/resources/org/sonar/l10n/java/rules/java/S4426.html index 7bca208490..9d167750e9 100644 --- a/sonar-java-plugin/src/main/resources/org/sonar/l10n/java/rules/java/S4426.html +++ b/sonar-java-plugin/src/main/resources/org/sonar/l10n/java/rules/java/S4426.html @@ -184,6 +184,8 @@

    Standards

    Use of Cryptographic Algorithms and Key Lengths
  • CWE - CWE-326 - Inadequate Encryption Strength
  • CWE - CWE-327 - Use of a Broken or Risky Cryptographic Algorithm
    • -
  • CERT, MSC61-J. - Do not use insecure or weak cryptographic algorithms
    • +
  • CERT, + MSC61-J. - Do not use insecure or weak cryptographic algorithms
    • diff --git a/sonar-java-plugin/src/main/resources/org/sonar/l10n/java/rules/java/S4512.html b/sonar-java-plugin/src/main/resources/org/sonar/l10n/java/rules/java/S4512.html index 42ebd686f7..6138c4c471 100644 --- a/sonar-java-plugin/src/main/resources/org/sonar/l10n/java/rules/java/S4512.html +++ b/sonar-java-plugin/src/main/resources/org/sonar/l10n/java/rules/java/S4512.html @@ -1,31 +1,18 @@ -

    Setting JavaBean properties is security sensitive. Doing it with untrusted values has led in the past to the following vulnerability:

    - -

    JavaBeans can have their properties or nested properties set by population functions. An attacker can leverage this feature to push into the -JavaBean malicious data that can compromise the software integrity. A typical attack will try to manipulate the ClassLoader and finally execute -malicious code.

    -

    This rule raises an issue when:

    - -

    Ask Yourself Whether

    - -

    There is a risk if you answered yes to any of those questions.

    -

    Recommended Secure Coding Practices

    -

    Sanitize all values used as JavaBean properties.

    -

    Don’t set any sensitive properties. Keep full control over which properties are set. If the property names are provided by an unstrusted source, -filter them with a whitelist.

    -

    Sensitive Code Example

    -
    +
    Setting JavaBean properties from untrusted user input can allow an attacker to manipulate arbitrary object properties, including sensitive
+internals such as class.classLoader.
    
+
    Why is this an issue?
    
+
    JavaBean property population functions such as BeanUtils.populate(), BeanUtils.setProperty(),
+BeanUtilsBean.populate(), and BeanUtilsBean.setProperty() from Apache Commons BeanUtils, and
+BeanWrapper.setPropertyValue() and BeanWrapper.setPropertyValues() from Spring, allow setting arbitrary bean properties by
+name. When the property names or values are derived from untrusted input without validation, an attacker can set sensitive properties — for example,
+class.classLoader — and use them to load and execute malicious code.
    
+
    What is the potential impact?
    
+
    If successfully exploited, this vulnerability can lead to remote code execution, full application compromise, data exfiltration, or lateral
+movement within the network.
    
+
    How to fix it
    
+
    Code examples
    
+
    Noncompliant code example
    
+
     Company bean = new Company();
 HashMap map = new HashMap();
 Enumeration names = request.getParameterNames();
@@ -33,17 +20,35 @@ 
    Sensitive Code Example
    
     String name = (String) names.nextElement();
     map.put(name, request.getParameterValues(name));
 }
-BeanUtils.populate(bean, map); // Sensitive: "map" is populated with data coming from user input, here "request.getParameterNames()"
+BeanUtils.populate(bean, map); // Noncompliant: "map" is populated with data coming from user input, here "request.getParameterNames()"
 
    
-
    See
    
+
    Compliant solution
    
+
    +Company bean = new Company();
+HashMap map = new HashMap();
+Set<String> allowedProperties = Set.of("name", "address"); // define allowed properties
+Enumeration names = request.getParameterNames();
+while (names.hasMoreElements()) {
+    String name = (String) names.nextElement();
+    if (allowedProperties.contains(name)) {
+        map.put(name, request.getParameterValues(name));
+    }
+}
+BeanUtils.populate(bean, map);
+
    
+
    Resources
    
+
    Articles & blog posts
    
+
+
    Standards
    
 
 
diff --git a/sonar-java-plugin/src/main/resources/org/sonar/l10n/java/rules/java/S4512.json b/sonar-java-plugin/src/main/resources/org/sonar/l10n/java/rules/java/S4512.json
index 475d991a75..311e6924b8 100644
--- a/sonar-java-plugin/src/main/resources/org/sonar/l10n/java/rules/java/S4512.json
+++ b/sonar-java-plugin/src/main/resources/org/sonar/l10n/java/rules/java/S4512.json
@@ -1,6 +1,6 @@
 {
-  "title": "Setting JavaBean properties is security-sensitive",
-  "type": "SECURITY_HOTSPOT",
+  "title": "JavaBean properties should not be populated from untrusted input",
+  "type": "VULNERABILITY",
   "code": {
     "impacts": {
       "SECURITY": "HIGH"
@@ -14,7 +14,8 @@
   },
   "tags": [
     "cwe",
-    "cert"
+    "cert",
+    "former-hotspot"
   ],
   "defaultSeverity": "Critical",
   "ruleSpecification": "RSPEC-4512",
diff --git a/sonar-java-plugin/src/main/resources/org/sonar/l10n/java/rules/java/S4830.html b/sonar-java-plugin/src/main/resources/org/sonar/l10n/java/rules/java/S4830.html
index 05240565e0..dc94cc5c2d 100644
--- a/sonar-java-plugin/src/main/resources/org/sonar/l10n/java/rules/java/S4830.html
+++ b/sonar-java-plugin/src/main/resources/org/sonar/l10n/java/rules/java/S4830.html
@@ -67,7 +67,7 @@ 
    Standards
    
   Misconfiguration
   
  • OWASP - Mobile Top 10 2016 Category M3 - Insecure
   Communication
    • 
-  
  • OWASP - Mobile Top 10 2024 Category M5 - Insecure
+  
  • OWASP - Mobile Top 10 2023 Category M5 - Insecure
   Communication
    • 
   
  • OWASP - Mobile AppSec Verification Standard - Network Communication
   Requirements
    • 
@@ -75,6 +75,7 @@ 
    Standards
    
   
  • STIG Viewer - Application Security and
   Development: V-222550 - The application must validate certificates by constructing a certification path to an accepted trust anchor.
    • 
   
  • https://wiki.sei.cmu.edu/confluence/display/java/MSC61-J.+Do+not+use+insecure+or+weak+cryptographic+algorithms
    • 
+  href="https://cmu-sei.github.io/secure-coding-standards/sei-cert-oracle-coding-standard-for-java/recommendations/miscellaneous-msc/msc61-j">MSC61-J
+  - Do not use insecure or weak cryptographic algorithms
 
 
diff --git a/sonar-java-plugin/src/main/resources/org/sonar/l10n/java/rules/java/S4973.html b/sonar-java-plugin/src/main/resources/org/sonar/l10n/java/rules/java/S4973.html
index 6d67615f6f..3688ed27f5 100644
--- a/sonar-java-plugin/src/main/resources/org/sonar/l10n/java/rules/java/S4973.html
+++ b/sonar-java-plugin/src/main/resources/org/sonar/l10n/java/rules/java/S4973.html
@@ -19,8 +19,10 @@ 
    Resources
    
 
 
diff --git a/sonar-java-plugin/src/main/resources/org/sonar/l10n/java/rules/java/S5042.html b/sonar-java-plugin/src/main/resources/org/sonar/l10n/java/rules/java/S5042.html
index 42cc42aaed..5c728b672b 100644
--- a/sonar-java-plugin/src/main/resources/org/sonar/l10n/java/rules/java/S5042.html
+++ b/sonar-java-plugin/src/main/resources/org/sonar/l10n/java/rules/java/S5042.html
@@ -3,27 +3,24 @@
 lead to denial of service. A Zip bomb is usually a malicious archive file of a few kilobytes of compressed data but turned into gigabytes of
 uncompressed data. To achieve this extreme compression ratio, attackers will
 compress irrelevant data (eg: a long string of repeated bytes).
    
-
    Ask Yourself Whether
    
-
    Archives to expand are untrusted and:
    
-
-
    There is a risk if you answered yes to any of those questions.
    
-
    Recommended Secure Coding Practices
    
-
-
    Sensitive Code Example
    
-
    +
    Why is this an issue?
    
+
    Expanding archive files without controlling the size of the extracted data can lead to denial of service. A Zip bomb is a malicious archive of a
+few kilobytes of compressed data that expands into gigabytes of uncompressed data by compressing highly repetitive content. Applications that fail to
+validate the number of entries, total uncompressed size, or compression ratio of an archive are vulnerable to this attack.
    
+
    What is the potential impact?
    
+
    Denial of service
    
+
    An attacker who can supply a malicious archive can exhaust the server’s disk space, memory, or CPU by triggering unbounded decompression. This can
+make the application completely unavailable to legitimate users and may require manual intervention to recover the affected system.
    
+
    How to fix it in Java SE
    
+
    Validate the number of entries, total uncompressed size, and compression ratio when extracting archive files. Do not rely on getSize to retrieve the uncompressed size, as this value
+comes from archive headers that can be forged; calculate the actual size while reading.
    
+
    Code examples
    
+
    Noncompliant code example
    
+
     File f = new File("ZipBomb.zip");
 ZipFile zipFile = new ZipFile(f);
-Enumeration<? extends ZipEntry> entries = zipFile.entries(); // Sensitive
+Enumeration<? extends ZipEntry> entries = zipFile.entries(); // Noncompliant
 
 while(entries.hasMoreElements()) {
   ZipEntry ze = entries.nextElement();
@@ -31,19 +28,16 @@ 
    Sensitive Code Example
    
   Files.copy(zipFile.getInputStream(ze), out.toPath(), StandardCopyOption.REPLACE_EXISTING);
 }
 
    
-
    Compliant Solution
    
-
    Do not rely on getsize to retrieve the size of an
-uncompressed entry because this method returns what is defined in the archive headers which can be forged by attackers, instead calculate the actual
-entry size when unzipping it:
    
-
    +
    Compliant solution
    
+
     File f = new File("ZipBomb.zip");
 ZipFile zipFile = new ZipFile(f);
 Enumeration<? extends ZipEntry> entries = zipFile.entries();
 
 int THRESHOLD_ENTRIES = 10000;
-int THRESHOLD_SIZE = 1000000000; // 1 GB
+long THRESHOLD_SIZE = 1000000000L; // 1 GB
 double THRESHOLD_RATIO = 10;
-int totalSizeArchive = 0;
+long totalSizeArchive = 0;
 int totalEntryArchive = 0;
 
 while(entries.hasMoreElements()) {
@@ -57,7 +51,7 @@ 
    Compliant Solution
    
   byte[] buffer = new byte[2048];
   int totalSizeEntry = 0;
 
-  while((nBytes = in.read(buffer)) > 0) { // Compliant
+  while((nBytes = in.read(buffer)) > 0) {
       out.write(buffer, 0, nBytes);
       totalSizeEntry += nBytes;
       totalSizeArchive += nBytes;
@@ -80,7 +74,12 @@ 
    Compliant Solution
    
   }
 }
 
    
-
    See
    
+
    Resources
    
+
    Articles & blog posts
    
+
+
    Standards
    
 
 
diff --git a/sonar-java-plugin/src/main/resources/org/sonar/l10n/java/rules/java/S5042.json b/sonar-java-plugin/src/main/resources/org/sonar/l10n/java/rules/java/S5042.json
index 32484b21a1..71dc87a9c6 100644
--- a/sonar-java-plugin/src/main/resources/org/sonar/l10n/java/rules/java/S5042.json
+++ b/sonar-java-plugin/src/main/resources/org/sonar/l10n/java/rules/java/S5042.json
@@ -1,9 +1,10 @@
 {
-  "title": "Expanding archive files without controlling resource consumption is security-sensitive",
-  "type": "SECURITY_HOTSPOT",
+  "title": "Expanding archive files should not be done without controlling resource consumption",
+  "type": "CODE_SMELL",
+  "quickfix": "unknown",
   "code": {
     "impacts": {
-      "SECURITY": "HIGH"
+      "RELIABILITY": "MEDIUM"
     },
     "attribute": "COMPLETE"
   },
@@ -14,9 +15,10 @@
   },
   "tags": [
     "cwe",
-    "cert"
+    "cert",
+    "former-hotspot"
   ],
-  "defaultSeverity": "Critical",
+  "defaultSeverity": "Major",
   "ruleSpecification": "RSPEC-5042",
   "sqKey": "S5042",
   "scope": "Main",
@@ -38,6 +40,5 @@
     "ASVS 4.0": [
       "12.1.2"
     ]
-  },
-  "quickfix": "unknown"
+  }
 }
diff --git a/sonar-java-plugin/src/main/resources/org/sonar/l10n/java/rules/java/S5324.html b/sonar-java-plugin/src/main/resources/org/sonar/l10n/java/rules/java/S5324.html
index fe780b822e..884ad1e6d0 100644
--- a/sonar-java-plugin/src/main/resources/org/sonar/l10n/java/rules/java/S5324.html
+++ b/sonar-java-plugin/src/main/resources/org/sonar/l10n/java/rules/java/S5324.html
@@ -52,7 +52,7 @@ 
    Standards
    
   Requirements
   
  • OWASP - Mobile Top 10 2016 Category M2 - Insecure Data
   Storage
    • 
-  
  • OWASP - Mobile Top 10 2024 Category M9 - Insecure Data
+  
  • OWASP - Mobile Top 10 2023 Category M9 - Insecure Data
   Storage
    • 
   
  • CWE - CWE-312 - Cleartext Storage of Sensitive Information
    • 
 
diff --git a/sonar-java-plugin/src/main/resources/org/sonar/l10n/java/rules/java/S5527.html b/sonar-java-plugin/src/main/resources/org/sonar/l10n/java/rules/java/S5527.html
index a3fe627402..342cd394b1 100644
--- a/sonar-java-plugin/src/main/resources/org/sonar/l10n/java/rules/java/S5527.html
+++ b/sonar-java-plugin/src/main/resources/org/sonar/l10n/java/rules/java/S5527.html
@@ -203,12 +203,12 @@ 
    Standards
    
   Requirements
   
  • OWASP - Mobile Top 10 2016 Category M3 - Insecure
   Communication
    • 
-  
  • OWASP - Mobile Top 10 2024 Category M5 - Insecure
+  
  • OWASP - Mobile Top 10 2023 Category M5 - Insecure
   Communication
    • 
   
  • CWE - CWE-297 - Improper Validation of Certificate with Host Mismatch
    • 
   
  • STIG Viewer - Application Security and
   Development: V-222550 - The application must validate certificates by constructing a certification path to an accepted trust anchor.
    • 
   
  • https://wiki.sei.cmu.edu/confluence/display/java/MSC61-J.+Do+not+use+insecure+or+weak+cryptographic+algorithms
    • 
+  href="https://cmu-sei.github.io/secure-coding-standards/sei-cert-oracle-coding-standard-for-java/recommendations/miscellaneous-msc/msc61-j">https://cmu-sei.github.io/secure-coding-standards/sei-cert-oracle-coding-standard-for-java/recommendations/miscellaneous-msc/msc61-j
 
 
diff --git a/sonar-java-plugin/src/main/resources/org/sonar/l10n/java/rules/java/S5542.html b/sonar-java-plugin/src/main/resources/org/sonar/l10n/java/rules/java/S5542.html
index 1f911e35fa..f6498d2ca9 100644
--- a/sonar-java-plugin/src/main/resources/org/sonar/l10n/java/rules/java/S5542.html
+++ b/sonar-java-plugin/src/main/resources/org/sonar/l10n/java/rules/java/S5542.html
@@ -134,6 +134,8 @@ 
    Standards
    
   Insufficient Cryptography
   
  • CWE - CWE-327 - Use of a Broken or Risky Cryptographic Algorithm
    • 
   
  • CWE - CWE-780 - Use of RSA Algorithm without OAEP
    • 
-  
  • CERT, MSC61-J. - Do not use insecure or weak cryptographic algorithms
    • 
+  
  • CERT,
+  MSC61-J. - Do not use insecure or weak cryptographic algorithms
    • 
 
 
diff --git a/sonar-java-plugin/src/main/resources/org/sonar/l10n/java/rules/java/S5738.html b/sonar-java-plugin/src/main/resources/org/sonar/l10n/java/rules/java/S5738.html
index f87da44a39..58cfc1c181 100644
--- a/sonar-java-plugin/src/main/resources/org/sonar/l10n/java/rules/java/S5738.html
+++ b/sonar-java-plugin/src/main/resources/org/sonar/l10n/java/rules/java/S5738.html
@@ -58,7 +58,8 @@ 
    Noncompliant code example
    
 
    Resources
    
 
 
diff --git a/sonar-java-plugin/src/main/resources/org/sonar/l10n/java/rules/java/S6418.html b/sonar-java-plugin/src/main/resources/org/sonar/l10n/java/rules/java/S6418.html
index 088f3504ee..9271b6a528 100644
--- a/sonar-java-plugin/src/main/resources/org/sonar/l10n/java/rules/java/S6418.html
+++ b/sonar-java-plugin/src/main/resources/org/sonar/l10n/java/rules/java/S6418.html
@@ -73,7 +73,9 @@ 
    Resources
    
   
  • OWASP - Top 10 2017 Category A2 - Broken
   Authentication
    • 
   
  • CWE - CWE-798 - Use of Hard-coded Credentials
    • 
-  
  • MSC - MSC03-J - Never hard code sensitive information
    • 
+  
  • MSC - MSC03-J - Never
+  hard code sensitive information
    • 
   
  • OWASP - Mobile Top 10 2024 Category M1 -
   Improper Credential Usage
    • 
 
diff --git a/sonar-java-plugin/src/main/resources/org/sonar/l10n/java/rules/java/S6418.json b/sonar-java-plugin/src/main/resources/org/sonar/l10n/java/rules/java/S6418.json
index 99c7c5b6f3..6c5dda39b5 100644
--- a/sonar-java-plugin/src/main/resources/org/sonar/l10n/java/rules/java/S6418.json
+++ b/sonar-java-plugin/src/main/resources/org/sonar/l10n/java/rules/java/S6418.json
@@ -15,7 +15,8 @@
   "quickfix": "infeasible",
   "tags": [
     "cwe",
-    "cert"
+    "cert",
+    "former-hotspot"
   ],
   "defaultSeverity": "Blocker",
   "ruleSpecification": "RSPEC-6418",
diff --git a/sonar-java-plugin/src/main/resources/org/sonar/l10n/java/rules/java/S7409.html b/sonar-java-plugin/src/main/resources/org/sonar/l10n/java/rules/java/S7409.html
index dfc9747a5f..68d5db16f4 100644
--- a/sonar-java-plugin/src/main/resources/org/sonar/l10n/java/rules/java/S7409.html
+++ b/sonar-java-plugin/src/main/resources/org/sonar/l10n/java/rules/java/S7409.html
@@ -91,9 +91,9 @@ 
    Documentation
    
 
    Standards
    
 
diff --git a/sonar-java-plugin/src/main/resources/org/sonar/l10n/java/rules/java/S818.html b/sonar-java-plugin/src/main/resources/org/sonar/l10n/java/rules/java/S818.html
index 1cdff6a117..0bb0963eff 100644
--- a/sonar-java-plugin/src/main/resources/org/sonar/l10n/java/rules/java/S818.html
+++ b/sonar-java-plugin/src/main/resources/org/sonar/l10n/java/rules/java/S818.html
@@ -14,7 +14,9 @@ 
    Compliant solution
    
 
    
 
    Resources
    
 
 
diff --git a/sonar-java-plugin/src/main/resources/org/sonar/l10n/java/rules/java/S864.html b/sonar-java-plugin/src/main/resources/org/sonar/l10n/java/rules/java/S864.html
index e1e6bee426..b823528f85 100644
--- a/sonar-java-plugin/src/main/resources/org/sonar/l10n/java/rules/java/S864.html
+++ b/sonar-java-plugin/src/main/resources/org/sonar/l10n/java/rules/java/S864.html
@@ -138,8 +138,11 @@ 
    Compliant solution
    
 
    
 
    Resources
    
 
 
diff --git a/sonar-java-plugin/src/main/resources/org/sonar/l10n/java/rules/java/S881.html b/sonar-java-plugin/src/main/resources/org/sonar/l10n/java/rules/java/S881.html
index 52f2de1922..d9d8843c85 100644
--- a/sonar-java-plugin/src/main/resources/org/sonar/l10n/java/rules/java/S881.html
+++ b/sonar-java-plugin/src/main/resources/org/sonar/l10n/java/rules/java/S881.html
@@ -21,9 +21,11 @@ 
    Compliant solution

    Resources

    diff --git a/sonar-java-plugin/src/main/resources/org/sonar/l10n/java/rules/java/S888.html b/sonar-java-plugin/src/main/resources/org/sonar/l10n/java/rules/java/S888.html index 8182a1d39f..3b9b399ae9 100644 --- a/sonar-java-plugin/src/main/resources/org/sonar/l10n/java/rules/java/S888.html +++ b/sonar-java-plugin/src/main/resources/org/sonar/l10n/java/rules/java/S888.html @@ -35,6 +35,7 @@

    Exceptions

    Resources

    diff --git a/sonar-java-plugin/src/main/resources/org/sonar/l10n/java/rules/java/S899.html b/sonar-java-plugin/src/main/resources/org/sonar/l10n/java/rules/java/S899.html index 989095024b..f866415d84 100644 --- a/sonar-java-plugin/src/main/resources/org/sonar/l10n/java/rules/java/S899.html +++ b/sonar-java-plugin/src/main/resources/org/sonar/l10n/java/rules/java/S899.html @@ -33,8 +33,10 @@

    Compliant solution

    Resources

    diff --git a/sonar-java-plugin/src/main/resources/org/sonar/l10n/java/rules/java/S923.html b/sonar-java-plugin/src/main/resources/org/sonar/l10n/java/rules/java/S923.html index 76470ab698..1c6bff832f 100644 --- a/sonar-java-plugin/src/main/resources/org/sonar/l10n/java/rules/java/S923.html +++ b/sonar-java-plugin/src/main/resources/org/sonar/l10n/java/rules/java/S923.html @@ -13,7 +13,7 @@

    Noncompliant code example

    Resources

    diff --git a/sonar-java-plugin/src/main/resources/org/sonar/l10n/java/rules/java/Sonar_way_profile.json b/sonar-java-plugin/src/main/resources/org/sonar/l10n/java/rules/java/Sonar_way_profile.json index ab7c96504a..8183be0098 100644 --- a/sonar-java-plugin/src/main/resources/org/sonar/l10n/java/rules/java/Sonar_way_profile.json +++ b/sonar-java-plugin/src/main/resources/org/sonar/l10n/java/rules/java/Sonar_way_profile.json @@ -156,6 +156,7 @@ "S2139", "S2140", "S2142", + "S2143", "S2147", "S2151", "S2153", diff --git a/sonarpedia.json b/sonarpedia.json index 48d6762342..38f66f406f 100644 --- a/sonarpedia.json +++ b/sonarpedia.json @@ -3,7 +3,7 @@ "languages": [ "JAVA" ], - "latest-update": "2026-04-24T14:36:54.720528421Z", + "latest-update": "2026-05-07T15:03:31.056802325Z", "options": { "no-language-in-filenames": true, "preserve-filenames": false