Skip to content
This repository was archived by the owner on Oct 4, 2024. It is now read-only.

Commit f164d9e

Browse files
petherspethers
committed
prepare release of legacy version.
1 parent 5958341 commit f164d9e

File tree

4 files changed

+181
-23
lines changed

4 files changed

+181
-23
lines changed

‎pom.xml‎

Lines changed: 10 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -8,7 +8,7 @@
88
</parent>
99
<groupId>com.hack23.sonar</groupId>
1010
<artifactId>sonar-cloudformation-plugin</artifactId>
11-
<version>1.6.0</version>
11+
<version>1.6.1-SNAPSHOT</version>
1212
<packaging>sonar-plugin</packaging>
1313
<name>Sonar cloudformation plugin</name>
1414
<url>https://hack23.github.io/sonar-cloudformation-plugin/</url>
@@ -30,7 +30,7 @@
3030
<scm>
3131
<connection>scm:git:https://github.com/Hack23/sonar-cloudformation-plugin.git</connection>
3232
<developerConnection>scm:git:https://github.com/Hack23/sonar-cloudformation-plugin.git</developerConnection>
33-
<tag>sonar-cloudformation-plugin-1.6.0</tag>
33+
<tag>HEAD</tag>
3434
<url>https://github.com/Hack23/sonar-cloudformation-plugin</url>
3535
</scm>
3636
<issueManagement>
@@ -100,7 +100,7 @@
100100
<dependency>
101101
<groupId>org.apache.commons</groupId>
102102
<artifactId>commons-lang3</artifactId>
103-
<version>3.9</version>
103+
<version>3.10</version>
104104
</dependency>
105105
<dependency>
106106
<groupId>com.fasterxml.staxmate</groupId>
@@ -110,7 +110,7 @@
110110
<dependency>
111111
<groupId>com.fasterxml.jackson.core</groupId>
112112
<artifactId>jackson-databind</artifactId>
113-
<version>2.10.3</version>
113+
<version>2.11.0</version>
114114
</dependency>
115115
<dependency>
116116
<groupId>junit</groupId>
@@ -127,7 +127,7 @@
127127
<dependency>
128128
<groupId>org.mockito</groupId>
129129
<artifactId>mockito-core</artifactId>
130-
<version>3.3.3</version>
130+
<version>3.3.9</version>
131131
<scope>test</scope>
132132
</dependency>
133133
</dependencies>
@@ -157,11 +157,11 @@
157157
</pluginRepositories>
158158
<build>
159159
<pluginManagement>
160-
<plugins>
160+
<plugins>
161161
<plugin>
162162
<groupId>org.owasp</groupId>
163163
<artifactId>dependency-check-maven</artifactId>
164-
<version>5.3.1</version>
164+
<version>5.3.2</version>
165165
<dependencies>
166166
<dependency>
167167
<groupId>com.h2database</groupId>
@@ -183,7 +183,7 @@
183183
<plugin>
184184
<groupId>org.apache.maven.plugins</groupId>
185185
<artifactId>maven-gpg-plugin</artifactId>
186-
<version>1.6</version>
186+
<version>3.0.0</version>
187187
</plugin>
188188
<plugin>
189189
<groupId>org.apache.maven.plugins</groupId>
@@ -366,7 +366,7 @@
366366
<docletArtifact>
367367
<groupId>nl.talsmasoftware</groupId>
368368
<artifactId>umldoclet</artifactId>
369-
<version>2.0.8</version>
369+
<version>2.0.9</version>
370370
</docletArtifact>
371371
<useStandardDocletOptions>true</useStandardDocletOptions>
372372
<charset>UTF-8</charset>
@@ -496,7 +496,7 @@
496496
</plugin>
497497
<plugin>
498498
<artifactId>maven-source-plugin</artifactId>
499-
<version>3.0.1</version>
499+
<version>3.2.1</version>
500500
<executions>
501501
<execution>
502502
<id>bundle-sources</id>

‎src/main/java/com/hack23/sonar/cloudformation/CloudformationQualityProfile.java‎

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -107,6 +107,9 @@ public final class CloudformationQualityProfile implements BuiltInQualityProfile
107107
SUPPORTED_RULES.add("F76");
108108
SUPPORTED_RULES.add("F77");
109109
SUPPORTED_RULES.add("F78");
110+
SUPPORTED_RULES.add("F79");
111+
SUPPORTED_RULES.add("F80");
112+
110113
SUPPORTED_RULES.add("F665");
111114
SUPPORTED_RULES.add("F1000");
112115
SUPPORTED_RULES.add("F2000");
@@ -173,6 +176,15 @@ public final class CloudformationQualityProfile implements BuiltInQualityProfile
173176
SUPPORTED_RULES.add("W67");
174177
SUPPORTED_RULES.add("W68");
175178
SUPPORTED_RULES.add("W69");
179+
SUPPORTED_RULES.add("W70");
180+
SUPPORTED_RULES.add("W71");
181+
SUPPORTED_RULES.add("W72");
182+
SUPPORTED_RULES.add("W73");
183+
SUPPORTED_RULES.add("W74");
184+
SUPPORTED_RULES.add("W75");
185+
186+
SUPPORTED_RULES.add("W1200");
187+
SUPPORTED_RULES.add("W1201");
176188
}
177189

178190
public static boolean hasRule(final String id) {

‎src/main/resources/cloudformation-rules.xml‎

Lines changed: 158 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -1179,6 +1179,38 @@
11791179
<tag>cweid-308</tag>
11801180
<remediationFunction>CONSTANT_ISSUE</remediationFunction>
11811181
<remediationFunctionBaseEffort>10min</remediationFunctionBaseEffort>
1182+
</rule>
1183+
<rule>
1184+
<key>F79</key>
1185+
<name>A NetworkACL's rule numbers cannot be repeated unless one is egress and one is ingress.</name>
1186+
<internalKey>F79</internalKey>
1187+
<description>A NetworkACL's rule numbers cannot be repeated unless one is egress and one is ingress.</description>
1188+
<severity>BLOCKER</severity>
1189+
<cardinality>SINGLE</cardinality>
1190+
<status>READY</status>
1191+
<type>VULNERABILITY</type>
1192+
<tag>security</tag>
1193+
<tag>cfn-nag</tag>
1194+
<tag>owasp-a6</tag>
1195+
<tag>cweid-284</tag>
1196+
<remediationFunction>CONSTANT_ISSUE</remediationFunction>
1197+
<remediationFunctionBaseEffort>10min</remediationFunctionBaseEffort>
1198+
</rule>
1199+
<rule>
1200+
<key>F80</key>
1201+
<name>RDS instance should have deletion protection enabled.</name>
1202+
<internalKey>F80</internalKey>
1203+
<description>RDS instance should have deletion protection enabled.</description>
1204+
<severity>BLOCKER</severity>
1205+
<cardinality>SINGLE</cardinality>
1206+
<status>READY</status>
1207+
<type>VULNERABILITY</type>
1208+
<tag>security</tag>
1209+
<tag>cfn-nag</tag>
1210+
<tag>owasp-a6</tag>
1211+
<tag>cweid-693</tag>
1212+
<remediationFunction>CONSTANT_ISSUE</remediationFunction>
1213+
<remediationFunctionBaseEffort>10min</remediationFunctionBaseEffort>
11821214
</rule>
11831215
<rule>
11841216
<key>F665</key>
@@ -1835,7 +1867,6 @@
18351867
<remediationFunction>CONSTANT_ISSUE</remediationFunction>
18361868
<remediationFunctionBaseEffort>10min</remediationFunctionBaseEffort>
18371869
</rule>
1838-
18391870
<rule>
18401871
<key>W46</key>
18411872
<name>ApiGateway V2 should have access logging configured</name>
@@ -1852,8 +1883,6 @@
18521883
<remediationFunction>CONSTANT_ISSUE</remediationFunction>
18531884
<remediationFunctionBaseEffort>10min</remediationFunctionBaseEffort>
18541885
</rule>
1855-
1856-
18571886
<rule>
18581887
<key>W47</key>
18591888
<name>SNS Topic should specify KmsMasterKeyId property</name>
@@ -1934,7 +1963,6 @@
19341963
<remediationFunction>CONSTANT_ISSUE</remediationFunction>
19351964
<remediationFunctionBaseEffort>10min</remediationFunctionBaseEffort>
19361965
</rule>
1937-
19381966
<rule>
19391967
<key>W52</key>
19401968
<name>Elastic Load Balancer V2 should have access logging enabled</name>
@@ -2015,8 +2043,6 @@
20152043
<remediationFunction>CONSTANT_ISSUE</remediationFunction>
20162044
<remediationFunctionBaseEffort>10min</remediationFunctionBaseEffort>
20172045
</rule>
2018-
2019-
20202046
<rule>
20212047
<key>W57</key>
20222048
<name>AWS::Cognito::IdentityPool AllowUnauthenticatedIdentities property should be false but CAN be true if proper restrictive IAM roles and permissions are established for unauthenticated users.</name>
@@ -2129,8 +2155,6 @@
21292155
<remediationFunction>CONSTANT_ISSUE</remediationFunction>
21302156
<remediationFunctionBaseEffort>10min</remediationFunctionBaseEffort>
21312157
</rule>
2132-
2133-
21342158
<rule>
21352159
<key>W64</key>
21362160
<name>AWS::ApiGateway::Stage resources should be associated with an AWS::ApiGateway::UsagePlan.</name>
@@ -2146,9 +2170,6 @@
21462170
<remediationFunction>CONSTANT_ISSUE</remediationFunction>
21472171
<remediationFunctionBaseEffort>10min</remediationFunctionBaseEffort>
21482172
</rule>
2149-
2150-
2151-
21522173
<rule>
21532174
<key>W65</key>
21542175
<name>GameLift fleet EC2InboundPermissions found with port range instead of just a single port</name>
@@ -2165,7 +2186,6 @@
21652186
<remediationFunction>CONSTANT_ISSUE</remediationFunction>
21662187
<remediationFunctionBaseEffort>10min</remediationFunctionBaseEffort>
21672188
</rule>
2168-
21692189
<rule>
21702190
<key>W66</key>
21712191
<name>To avoid opening all ports for Allow rules, EC2 NetworkACL Entry Protocol should be specified</name>
@@ -2230,4 +2250,130 @@
22302250
<remediationFunction>CONSTANT_ISSUE</remediationFunction>
22312251
<remediationFunctionBaseEffort>10min</remediationFunctionBaseEffort>
22322252
</rule>
2253+
<rule>
2254+
<key>W70</key>
2255+
<name>Cloudfront should use minimum protocol version TLS 1.2</name>
2256+
<internalKey>W70</internalKey>
2257+
<description>Cloudfront should use minimum protocol version TLS 1.2</description>
2258+
<severity>BLOCKER</severity>
2259+
<cardinality>SINGLE</cardinality>
2260+
<status>READY</status>
2261+
<type>VULNERABILITY</type>
2262+
<tag>security</tag>
2263+
<tag>cfn-nag</tag>
2264+
<tag>owasp-a6</tag>
2265+
<tag>cweid-326</tag>
2266+
<remediationFunction>CONSTANT_ISSUE</remediationFunction>
2267+
<remediationFunctionBaseEffort>10min</remediationFunctionBaseEffort>
2268+
</rule>
2269+
<rule>
2270+
<key>W71</key>
2271+
<name>NetworkACL Entry Deny rules should affect all CIDR ranges.</name>
2272+
<internalKey>W71</internalKey>
2273+
<description>NetworkACL Entry Deny rules should affect all CIDR ranges.</description>
2274+
<severity>BLOCKER</severity>
2275+
<cardinality>SINGLE</cardinality>
2276+
<status>READY</status>
2277+
<type>VULNERABILITY</type>
2278+
<tag>security</tag>
2279+
<tag>cfn-nag</tag>
2280+
<tag>owasp-a6</tag>
2281+
<tag>cweid-284</tag>
2282+
<remediationFunction>CONSTANT_ISSUE</remediationFunction>
2283+
<remediationFunctionBaseEffort>10min</remediationFunctionBaseEffort>
2284+
</rule>
2285+
<rule>
2286+
<key>W72</key>
2287+
<name>NetworkACL Entries are reusing or overlapping ports which may create ineffective rules.</name>
2288+
<internalKey>W72</internalKey>
2289+
<description>NetworkACL Entries are reusing or overlapping ports which may create ineffective rules.</description>
2290+
<severity>BLOCKER</severity>
2291+
<cardinality>SINGLE</cardinality>
2292+
<status>READY</status>
2293+
<type>VULNERABILITY</type>
2294+
<tag>security</tag>
2295+
<tag>cfn-nag</tag>
2296+
<tag>owasp-a6</tag>
2297+
<tag>cweid-284</tag>
2298+
<remediationFunction>CONSTANT_ISSUE</remediationFunction>
2299+
<remediationFunctionBaseEffort>10min</remediationFunctionBaseEffort>
2300+
</rule>
2301+
<rule>
2302+
<key>W73</key>
2303+
<name>DynamoDB table should have billing mode set to either PAY_PER_REQUEST or PROVISIONED</name>
2304+
<internalKey>W73</internalKey>
2305+
<description>DynamoDB table should have billing mode set to either PAY_PER_REQUEST or PROVISIONED</description>
2306+
<severity>MAJOR</severity>
2307+
<cardinality>SINGLE</cardinality>
2308+
<status>READY</status>
2309+
<type>VULNERABILITY</type>
2310+
<tag>security</tag>
2311+
<tag>cfn-nag</tag>
2312+
<remediationFunction>CONSTANT_ISSUE</remediationFunction>
2313+
<remediationFunctionBaseEffort>10min</remediationFunctionBaseEffort>
2314+
</rule>
2315+
<rule>
2316+
<key>W74</key>
2317+
<name>DynamoDB table should have encryption enabled using a CMK stored in KMS</name>
2318+
<internalKey>W74</internalKey>
2319+
<description>DynamoDB table should have encryption enabled using a CMK stored in KMS</description>
2320+
<severity>BLOCKER</severity>
2321+
<cardinality>SINGLE</cardinality>
2322+
<status>READY</status>
2323+
<type>VULNERABILITY</type>
2324+
<tag>security</tag>
2325+
<tag>cfn-nag</tag>
2326+
<tag>owasp-a6</tag>
2327+
<tag>cweid-311</tag>
2328+
<remediationFunction>CONSTANT_ISSUE</remediationFunction>
2329+
<remediationFunctionBaseEffort>10min</remediationFunctionBaseEffort>
2330+
</rule>
2331+
<rule>
2332+
<key>W75</key>
2333+
<name>RDS instance should have backup retention period greater than 0.</name>
2334+
<internalKey>W75</internalKey>
2335+
<description>RDS instance should have backup retention period greater than 0.</description>
2336+
<severity>BLOCKER</severity>
2337+
<cardinality>SINGLE</cardinality>
2338+
<status>READY</status>
2339+
<type>VULNERABILITY</type>
2340+
<tag>security</tag>
2341+
<tag>cfn-nag</tag>
2342+
<tag>owasp-a6</tag>
2343+
<tag>cweid-693</tag>
2344+
<remediationFunction>CONSTANT_ISSUE</remediationFunction>
2345+
<remediationFunctionBaseEffort>10min</remediationFunctionBaseEffort>
2346+
</rule>
2347+
<rule>
2348+
<key>W1200</key>
2349+
<name>SageMaker EndpointConfig should have a KmsKeyId property set.</name>
2350+
<internalKey>W1200</internalKey>
2351+
<description>SageMaker EndpointConfig should have a KmsKeyId property set.</description>
2352+
<severity>BLOCKER</severity>
2353+
<cardinality>SINGLE</cardinality>
2354+
<status>READY</status>
2355+
<type>VULNERABILITY</type>
2356+
<tag>security</tag>
2357+
<tag>cfn-nag</tag>
2358+
<tag>owasp-a6</tag>
2359+
<tag>cweid-311</tag>
2360+
<remediationFunction>CONSTANT_ISSUE</remediationFunction>
2361+
<remediationFunctionBaseEffort>10min</remediationFunctionBaseEffort>
2362+
</rule>
2363+
<rule>
2364+
<key>W1201</key>
2365+
<name>SageMaker NotebookInstance should have a KmsKeyId property set.</name>
2366+
<internalKey>W1201</internalKey>
2367+
<description>SageMaker NotebookInstance should have a KmsKeyId property set.</description>
2368+
<severity>BLOCKER</severity>
2369+
<cardinality>SINGLE</cardinality>
2370+
<status>READY</status>
2371+
<type>VULNERABILITY</type>
2372+
<tag>security</tag>
2373+
<tag>cfn-nag</tag>
2374+
<tag>owasp-a6</tag>
2375+
<tag>cweid-311</tag>
2376+
<remediationFunction>CONSTANT_ISSUE</remediationFunction>
2377+
<remediationFunctionBaseEffort>10min</remediationFunctionBaseEffort>
2378+
</rule>
22332379
</cloudformation-rules>

‎src/test/java/com/hack23/sonar/cloudformation/CloudformationQualityProfileTest.java‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -39,7 +39,7 @@ public void defineTest() {
3939
final BuiltInQualityProfile qualityProfile = context.profile(CloudformationLanguage.KEY,"Cloudformation Rules");
4040
assertNotNull(qualityProfile);
4141
assertTrue(qualityProfile.isDefault());
42-
assertEquals(139,qualityProfile.rules().size());
42+
assertEquals(149,qualityProfile.rules().size());
4343
}
4444

4545
}

0 commit comments

Comments
 (0)