Update rule metadata

Author: nils-werner-sonarsource

php-checks/src/main/resources/org/sonar/l10n/php/rules/php/S122.html

@@ -1,13 +1,18 @@
 <h2>Why is this an issue?</h2>
 <p>Putting multiple statements on a single line lowers the code readability and makes debugging the code more complex.</p>
 <pre>
-if (someCondition) doSomething(); // Noncompliant
+if (someCondition) { doSomething(); } // Noncompliant
+
+doSomething(); doSomethingElse(); // Noncompliant
 </pre>
 <p>Write one statement per line to improve readability.</p>
 <pre>
 if (someCondition) {
   doSomething();
 }
+
+doSomething();
+doSomethingElse();
 </pre>
 <h3>Exceptions</h3>
 <p>The rule ignores anonymous functions containing a single statement.</p>

php-checks/src/main/resources/org/sonar/l10n/php/rules/php/S2068.html

@@ -3,18 +3,23 @@ <h2>Why is this an issue?</h2>
 open-source applications. This practice exposes your application to significant security risks.</p>
 <p>This rule flags instances of hard-coded credentials used in database and LDAP connections. It looks for hard-coded credentials in connection
 strings, and for variable names that match any of the patterns from the provided list.</p>
+<p>In the past, it has led to the following vulnerabilities:</p>
+<ul>
+  <li> <a href="https://www.cve.org/CVERecord?id=CVE-2019-13466">CVE-2019-13466</a> </li>
+  <li> <a href="https://www.cve.org/CVERecord?id=CVE-2018-15389">CVE-2018-15389</a> </li>
+</ul>
 <h2>How to fix it</h2>
 <p>Credentials should be stored in a configuration file that is not committed to the code repository, in a database, or managed by your cloud
 provider’s secrets management service. If a password is exposed in the source code, it must be changed immediately.</p>
 <h3>Code Examples</h3>
-<h4>Noncompliant Code Example</h4>
+<h4>Noncompliant code example</h4>
 <pre data-diff-id="1" data-diff-type="noncompliant">
 $password = "65DBGgwe4uazdWQA"; // Noncompliant
 
 $httpUrl = "https://example.domain?user=user&amp;password=65DBGgwe4uazdWQA" // Noncompliant
 $sshUrl = "ssh://user:65DBGgwe4uazdWQA@example.domain" // Noncompliant
 </pre>
-<h4>Compliant Solution</h4>
+<h4>Compliant solution</h4>
 <pre data-diff-id="1" data-diff-type="compliant">
 $user = getUser();
 $password = getPassword(); // Compliant

php-checks/src/main/resources/org/sonar/l10n/php/rules/php/S2068.json

@@ -12,6 +12,7 @@
     "func": "Constant\/Issue",
     "constantCost": "30min"
   },
+  "quickfix": "infeasible",
   "tags": [
     "cwe"
   ],
@@ -41,6 +42,5 @@
       "3.5.2",
       "6.4.1"
     ]
-  },
-  "quickfix": "unknown"
+  }
 }

php-checks/src/main/resources/org/sonar/l10n/php/rules/php/S6418.html

@@ -13,9 +13,14 @@ <h4>Noncompliant Code Example</h4>
 $secret = '47828a8dd77ee1eb9dde2d5e93cb221ce8c32b37'; // Noncompliant
 MyClass-&gt;callMyService($secret);
 </pre>
-<h4>Compliant Solution</h4>
-<p>Using <a href="https://github.com/awsdocs/aws-doc-sdk-examples/tree/main/php/example_code/secretsmanager">AWS Secrets Manager</a>:</p>
+<h4>Compliant solution</h4>
+<p>Store the secret in an environment variable or configuration file:</p>
 <pre data-diff-id="1" data-diff-type="compliant">
+$secret = getenv('MY_SECRET');
+MyClass-&gt;callMyService($secret);
+</pre>
+<p>Or using <a href="https://github.com/awsdocs/aws-doc-sdk-examples/tree/main/php/example_code/secretsmanager">AWS Secrets Manager</a>:</p>
+<pre>
 use Aws\SecretsManager\SecretsManagerClient;
 use Aws\Exception\AwsException;
 $client = new SecretsManagerClient(...);
@@ -45,5 +50,6 @@ <h2>Resources</h2>
   <li> OWASP - <a href="https://owasp.org/www-project-top-ten/2017/A2_2017-Broken_Authentication">Top 10 2017 Category A2 - Broken Authentication</a>
   </li>
   <li> CWE - <a href="https://cwe.mitre.org/data/definitions/798">CWE-798 - Use of Hard-coded Credentials</a> </li>
+  <li> MSC - <a href="https://wiki.sei.cmu.edu/confluence/x/OjdGBQ">MSC03-J - Never hard code sensitive information</a> </li>
 </ul>
 

php-checks/src/main/resources/org/sonar/l10n/php/rules/php/S6418.json

@@ -12,6 +12,7 @@
     "func": "Constant\/Issue",
     "constantCost": "30min"
   },
+  "quickfix": "infeasible",
   "tags": [
     "cwe"
   ],
@@ -40,6 +41,5 @@
       "3.5.2",
       "6.4.1"
     ]
-  },
-  "quickfix": "unknown"
+  }
 }

sonarpedia.json

@@ -3,7 +3,7 @@
   "languages": [
     "PHP"
   ],
-  "latest-update": "2026-01-08T10:11:00.424605796Z",
+  "latest-update": "2026-02-02T05:36:28.563406648Z",
   "options": {
     "no-language-in-filenames": true,
     "preserve-filenames": true