Skip to content

Commit 820c44a

Browse files
guillaume-dequenneguillaume-dequenne
authored
Update rules metadata (#1752)
1 parent e7a9b6b commit 820c44a

File tree

13 files changed

+119
-54
lines changed

13 files changed

+119
-54
lines changed

‎python-checks/src/main/resources/org/sonar/l10n/py/rules/python/S117.html‎

Lines changed: 11 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -9,15 +9,17 @@ <h2>Why is this an issue?</h2>
99
<h3>What is the potential impact?</h3>
1010
<p>Inconsistent naming of local variables and function parameters can lead to several issues in your code:</p>
1111
<ul>
12-
<li> Reduced Readability: inconsistent local variable and function parameter names make the code harder to read and understand; consequently, it is
13-
more difficult to identify the purpose of each variable, spot errors, or comprehend the logic. </li>
14-
<li> Difficulty in Identifying Variables: local variables and function parameters that don’t adhere to a standard naming convention are challenging
15-
to identify; thus, the coding process slows down, especially when dealing with a large codebase. </li>
16-
<li> Increased Risk of Errors: inconsistent or unclear local variable and function parameter names lead to misunderstandings about what the variable
17-
represents. This ambiguity leads to incorrect assumptions and, consequently, bugs in the code. </li>
18-
<li> Collaboration Difficulties: in a team setting, inconsistent naming conventions lead to confusion and miscommunication among team members. </li>
19-
<li> Difficulty in Code Maintenance: inconsistent naming leads to an inconsistent codebase. The code is difficult to understand, and making changes
20-
feels like refactoring constantly, as you face different naming methods. Ultimately, it makes the codebase harder to maintain. </li>
12+
<li> <strong>Reduced Readability</strong>: Inconsistent local variable and function parameter names make the code harder to read and understand;
13+
consequently, it is more difficult to identify the purpose of each variable, spot errors, or comprehend the logic. </li>
14+
<li> <strong>Difficulty in Identifying Variables</strong>: The local variables and function parameters that don’t adhere to a standard naming
15+
convention are challenging to identify; thus, the coding process slows down, especially when dealing with a large codebase. </li>
16+
<li> <strong>Increased Risk of Errors</strong>: Inconsistent or unclear local variable and function parameter names lead to misunderstandings about
17+
what the variable represents. This ambiguity leads to incorrect assumptions and, consequently, bugs in the code. </li>
18+
<li> <strong>Collaboration Difficulties</strong>: In a team setting, inconsistent naming conventions lead to confusion and miscommunication among
19+
team members. </li>
20+
<li> <strong>Difficulty in Code Maintenance</strong>: Inconsistent naming leads to an inconsistent codebase. The code is difficult to understand,
21+
and making changes feels like refactoring constantly, as you face different naming methods. Ultimately, it makes the codebase harder to maintain.
22+
</li>
2123
</ul>
2224
<p>In summary, not adhering to a naming convention for local variables and function parameters can lead to confusion, errors, and inefficiencies,
2325
making the code harder to read, understand, and maintain.</p>

‎python-checks/src/main/resources/org/sonar/l10n/py/rules/python/S1481.html‎

Lines changed: 10 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -5,16 +5,16 @@ <h2>Why is this an issue?</h2>
55
<h3>What is the potential impact?</h3>
66
<p>Having unused local variables in your code can lead to several issues:</p>
77
<ul>
8-
<li> Decreased Readability: Unused variables can make your code more difficult to read. They add extra lines and complexity, which can distract from
9-
the main logic of the code. </li>
10-
<li> Misunderstanding: When other developers read your code, they may wonder why a variable is declared but not used. This can lead to confusion and
11-
misinterpretation of the code’s intent. </li>
12-
<li> Potential for Bugs: If a variable is declared but not used, it might indicate a bug or incomplete code. For example, if you declared a variable
13-
intending to use it in a calculation, but then forgot to do so, your program might not work as expected. </li>
14-
<li> Maintenance Issues: Unused variables can make code maintenance more difficult. If a programmer sees an unused variable, they might think it is
15-
a mistake and try to 'fix' the code, potentially introducing new bugs. </li>
16-
<li> Memory Usage: Although modern compilers are smart enough to ignore unused variables, not all compilers do this. In such cases, unused variables
17-
take up memory space, leading to inefficient use of resources. </li>
8+
<li> <strong>Decreased Readability</strong>: Unused variables can make your code more difficult to read. They add extra lines and complexity, which
9+
can distract from the main logic of the code. </li>
10+
<li> <strong>Misunderstanding</strong>: When other developers read your code, they may wonder why a variable is declared but not used. This can lead
11+
to confusion and misinterpretation of the code’s intent. </li>
12+
<li> <strong>Potential for Bugs</strong>: If a variable is declared but not used, it might indicate a bug or incomplete code. For example, if you
13+
declared a variable intending to use it in a calculation, but then forgot to do so, your program might not work as expected. </li>
14+
<li> <strong>Maintenance Issues</strong>: Unused variables can make code maintenance more difficult. If a programmer sees an unused variable, they
15+
might think it is a mistake and try to 'fix' the code, potentially introducing new bugs. </li>
16+
<li> <strong>Memory Usage</strong>: Although modern compilers are smart enough to ignore unused variables, not all compilers do this. In such cases,
17+
unused variables take up memory space, leading to inefficient use of resources. </li>
1818
</ul>
1919
<p>In summary, unused local variables can make your code less readable, more confusing, and harder to maintain, and they can potentially lead to bugs
2020
or inefficient memory use. Therefore, it is best to remove them.</p>

‎python-checks/src/main/resources/org/sonar/l10n/py/rules/python/S2053.html‎

Lines changed: 54 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -37,22 +37,69 @@ <h3>Code examples</h3>
3737
<p>The following code contains examples of hard-coded salts.</p>
3838
<h4>Noncompliant code example</h4>
3939
<pre data-diff-id="1" data-diff-type="noncompliant">
40-
import crypt
40+
import hashlib
4141

42-
hash = crypt.crypt(password) # Noncompliant
42+
hash = hashlib.scrypt(password, salt=b"F3MdWpeHeeSjlUxvKBnzzA", n=2**17, r=8, p=1) # Noncompliant
4343
</pre>
4444
<h4>Compliant solution</h4>
4545
<pre data-diff-id="1" data-diff-type="compliant">
46-
import crypt
46+
import hashlib
47+
import secrets
4748

48-
salt = crypt.mksalt(crypt.METHOD_SHA256)
49-
hash = crypt.crypt(password, salt)
49+
salt = secrets.token_bytes(32)
50+
hash = hashlib.scrypt(password, salt=salt, n=2**17, r=8, p=1)
5051
</pre>
5152
<h3>How does this work?</h3>
5253
<p>This code ensures that each user’s password has a unique salt value associated with it. It generates a salt randomly and with a length that
5354
provides the required security level. It uses a salt length of at least 32 bytes (256 bits), as recommended by industry standards.</p>
54-
<p>Here, the compliant code example ensures the salt is random and has a sufficient length by calling the <code>crypt.mksalt</code> function. This one
55-
internally uses a cryptographically secure pseudo random number generator.</p>
55+
<p>Here, the compliant code example ensures the salt is random and has a sufficient length by calling the <code>secrets.token_bytes</code> function.
56+
This one internally uses a cryptographically secure pseudo random number generator.</p>
57+
<h2>How to fix it in pyca</h2>
58+
<h3>Code examples</h3>
59+
<p>The following code contains examples of hard-coded salts.</p>
60+
<h4>Noncompliant code example</h4>
61+
<pre data-diff-id="2" data-diff-type="noncompliant">
62+
from cryptography.hazmat.primitives.kdf.pbkdf2 import PBKDF2HMAC
63+
from cryptography.hazmat.primitives import hashes
64+
65+
digest = PBKDF2HMAC(hashes.SHA256(), length=32, salt=b"F3MdWpeHeeSjlUxvKBnzzA", iterations=100000).derive(password)
66+
</pre>
67+
<h4>Compliant solution</h4>
68+
<pre data-diff-id="2" data-diff-type="compliant">
69+
import secrets
70+
from cryptography.hazmat.primitives.kdf.pbkdf2 import PBKDF2HMAC
71+
from cryptography.hazmat.primitives import hashes
72+
73+
salt = secrets.token_bytes(32)
74+
digest = PBKDF2HMAC(hashes.SHA256(), length=32, salt=salt, iterations=100000).derive(password)
75+
</pre>
76+
<h3>How does this work?</h3>
77+
<p>This code ensures that each user’s password has a unique salt value associated with it. It generates a salt randomly and with a length that
78+
provides the required security level. It uses a salt length of at least 32 bytes (256 bits), as recommended by industry standards.</p>
79+
<p>Here, the compliant code example ensures the salt is random and has a sufficient length by calling the <code>secrets.token_bytes</code> function.
80+
This one internally uses a cryptographically secure pseudo random number generator.</p>
81+
<h2>How to fix it in Cryptodome</h2>
82+
<h3>Code examples</h3>
83+
<p>The following code contains examples of hard-coded salts.</p>
84+
<h4>Noncompliant code example</h4>
85+
<pre data-diff-id="3" data-diff-type="noncompliant">
86+
from Crypto.Protocol.KDF import scrypt
87+
88+
digest = scrypt(password, salt=b"F3MdWpeHeeSjlUxvKBnzzA", key_len=32, N=2**17, r=8, p=1) # Noncompliant
89+
</pre>
90+
<h4>Compliant solution</h4>
91+
<pre data-diff-id="3" data-diff-type="compliant">
92+
import secrets
93+
from Crypto.Protocol.KDF import scrypt
94+
95+
salt = secrets.token_bytes(32)
96+
digest = scrypt(password, salt=salt, key_len=32, N=2**17, r=8, p=1)
97+
</pre>
98+
<h3>How does this work?</h3>
99+
<p>This code ensures that each user’s password has a unique salt value associated with it. It generates a salt randomly and with a length that
100+
provides the required security level. It uses a salt length of at least 32 bytes (256 bits), as recommended by industry standards.</p>
101+
<p>Here, the compliant code example ensures the salt is random and has a sufficient length by calling the <code>secrets.token_bytes</code> function.
102+
This function internally uses a cryptographically secure pseudo-random number generator.</p>
56103
<h2>Resources</h2>
57104
<h3>Standards</h3>
58105
<ul>

‎python-checks/src/main/resources/org/sonar/l10n/py/rules/python/S4784.html‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -79,8 +79,8 @@ <h2>Sensitive Code Example</h2>
7979
regex.subn('(a*)*b', replacement, input) # Sensitive
8080
</pre>
8181
<h2>Exceptions</h2>
82-
<p>Some corner-case regular expressions will not raise an issue even though they might be vulnerable. For example: <code>(a|aa)``,
83-
``(a|a?)</code>.</p>
82+
<p>Some corner-case regular expressions will not raise an issue even though they might be vulnerable. For example: <code>(a|aa)+</code>,
83+
<code>(a|a?)+</code>.</p>
8484
<p>It is a good idea to test your regular expression if it has the same pattern on both side of a "<code>|</code>".</p>
8585
<h2>See</h2>
8686
<ul>

‎python-checks/src/main/resources/org/sonar/l10n/py/rules/python/S5542.html‎

Lines changed: 20 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -14,8 +14,10 @@ <h2>Why is this an issue?</h2>
1414
</ol>
1515
<p>For these reasons, as soon as cryptography is included in a project, it is important to choose encryption algorithms that are considered strong and
1616
secure by the cryptography community.</p>
17-
<p>For AES, the weakest modes are CBC (Cipher Block Chaining) and ECB (Electronic Codebook) because they are either vulnerable to padding oracles or
18-
do not provide authentication mechanisms.</p>
17+
<p>For AES, the weakest mode is ECB (Electronic Codebook). Repeated blocks of data are encrypted to the same value, making them easy to identify and
18+
reducing the difficulty of recovering the original cleartext.</p>
19+
<p>Unauthenticated modes such as CBC (Cipher Block Chaining) may be used but are prone to attacks that manipulate the ciphertext. They must be used
20+
with caution.</p>
1921
<p>For RSA, the weakest algorithms are either using it without padding or using the PKCS1v1.5 padding scheme.</p>
2022
<h3>What is the potential impact?</h3>
2123
<p>The cleartext of an encrypted message might be recoverable. Additionally, it might be possible to modify the cleartext of an encrypted message.</p>
@@ -58,7 +60,8 @@ <h4>Compliant solution</h4>
5860
<h3>How does this work?</h3>
5961
<p>As a rule of thumb, use the cryptographic algorithms and mechanisms that are considered strong by the cryptographic community.</p>
6062
<p>Appropriate choices are currently the following.</p>
61-
<h4>For AES: Use Galois/Counter mode (GCM)</h4>
63+
<h4>For AES: use authenticated encryption modes</h4>
64+
<p>The best-known authenticated encryption mode for AES is Galois/Counter mode (GCM).</p>
6265
<p>GCM mode combines encryption with authentication and integrity checks using a cryptographic hash function and provides both confidentiality and
6366
authenticity of data.</p>
6467
<p>Other similar modes are:</p>
@@ -69,8 +72,8 @@ <h4>For AES: Use Galois/Counter mode (GCM)</h4>
6972
<li> IAPM: <code>Integer Authenticated Parallelizable Mode</code> </li>
7073
<li> OCB: <code>Offset Codebook Mode</code> </li>
7174
</ul>
72-
<p>It is also possible to use AES-CBC with HMAC for integrity checks. However, it</p>
73-
<p>is considered more straightforward to use AES-GCM directly instead.</p>
75+
<p>It is also possible to use AES-CBC with HMAC for integrity checks. However, it is considered more straightforward to use AES-GCM directly
76+
instead.</p>
7477
<h4>For RSA: use the OAEP scheme</h4>
7578
<p>The Optimal Asymmetric Encryption Padding scheme (OAEP) adds randomness and a secure hash function that strengthens the regular inner workings of
7679
RSA.</p>
@@ -147,7 +150,8 @@ <h4>Compliant solution</h4>
147150
<h3>How does this work?</h3>
148151
<p>As a rule of thumb, use the cryptographic algorithms and mechanisms that are considered strong by the cryptographic community.</p>
149152
<p>Appropriate choices are currently the following.</p>
150-
<h4>For AES: Use Galois/Counter mode (GCM)</h4>
153+
<h4>For AES: use authenticated encryption modes</h4>
154+
<p>The best-known authenticated encryption mode for AES is Galois/Counter mode (GCM).</p>
151155
<p>GCM mode combines encryption with authentication and integrity checks using a cryptographic hash function and provides both confidentiality and
152156
authenticity of data.</p>
153157
<p>Other similar modes are:</p>
@@ -158,8 +162,8 @@ <h4>For AES: Use Galois/Counter mode (GCM)</h4>
158162
<li> IAPM: <code>Integer Authenticated Parallelizable Mode</code> </li>
159163
<li> OCB: <code>Offset Codebook Mode</code> </li>
160164
</ul>
161-
<p>It is also possible to use AES-CBC with HMAC for integrity checks. However, it</p>
162-
<p>is considered more straightforward to use AES-GCM directly instead.</p>
165+
<p>It is also possible to use AES-CBC with HMAC for integrity checks. However, it is considered more straightforward to use AES-GCM directly
166+
instead.</p>
163167
<h4>For RSA: use the OAEP scheme</h4>
164168
<p>The Optimal Asymmetric Encryption Padding scheme (OAEP) adds randomness and a secure hash function that strengthens the regular inner workings of
165169
RSA.</p>
@@ -198,7 +202,8 @@ <h4>Compliant solution</h4>
198202
<h3>How does this work?</h3>
199203
<p>As a rule of thumb, use the cryptographic algorithms and mechanisms that are considered strong by the cryptographic community.</p>
200204
<p>Appropriate choices are currently the following.</p>
201-
<h4>For AES: Use Galois/Counter mode (GCM)</h4>
205+
<h4>For AES: use authenticated encryption modes</h4>
206+
<p>The best-known authenticated encryption mode for AES is Galois/Counter mode (GCM).</p>
202207
<p>GCM mode combines encryption with authentication and integrity checks using a cryptographic hash function and provides both confidentiality and
203208
authenticity of data.</p>
204209
<p>Other similar modes are:</p>
@@ -209,8 +214,8 @@ <h4>For AES: Use Galois/Counter mode (GCM)</h4>
209214
<li> IAPM: <code>Integer Authenticated Parallelizable Mode</code> </li>
210215
<li> OCB: <code>Offset Codebook Mode</code> </li>
211216
</ul>
212-
<p>It is also possible to use AES-CBC with HMAC for integrity checks. However, it</p>
213-
<p>is considered more straightforward to use AES-GCM directly instead.</p>
217+
<p>It is also possible to use AES-CBC with HMAC for integrity checks. However, it is considered more straightforward to use AES-GCM directly
218+
instead.</p>
214219
<h4>For RSA: use the OAEP scheme</h4>
215220
<p>The Optimal Asymmetric Encryption Padding scheme (OAEP) adds randomness and a secure hash function that strengthens the regular inner workings of
216221
RSA.</p>
@@ -237,7 +242,8 @@ <h4>Compliant solution</h4>
237242
<h3>How does this work?</h3>
238243
<p>As a rule of thumb, use the cryptographic algorithms and mechanisms that are considered strong by the cryptographic community.</p>
239244
<p>Appropriate choices are currently the following.</p>
240-
<h4>For AES: Use Galois/Counter mode (GCM)</h4>
245+
<h4>For AES: use authenticated encryption modes</h4>
246+
<p>The best-known authenticated encryption mode for AES is Galois/Counter mode (GCM).</p>
241247
<p>GCM mode combines encryption with authentication and integrity checks using a cryptographic hash function and provides both confidentiality and
242248
authenticity of data.</p>
243249
<p>Other similar modes are:</p>
@@ -248,8 +254,8 @@ <h4>For AES: Use Galois/Counter mode (GCM)</h4>
248254
<li> IAPM: <code>Integer Authenticated Parallelizable Mode</code> </li>
249255
<li> OCB: <code>Offset Codebook Mode</code> </li>
250256
</ul>
251-
<p>It is also possible to use AES-CBC with HMAC for integrity checks. However, it</p>
252-
<p>is considered more straightforward to use AES-GCM directly instead.</p>
257+
<p>It is also possible to use AES-CBC with HMAC for integrity checks. However, it is considered more straightforward to use AES-GCM directly
258+
instead.</p>
253259
<h4>For RSA: use the OAEP scheme</h4>
254260
<p>The Optimal Asymmetric Encryption Padding scheme (OAEP) adds randomness and a secure hash function that strengthens the regular inner workings of
255261
RSA.</p>

‎python-checks/src/main/resources/org/sonar/l10n/py/rules/python/S6554.html‎

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -26,5 +26,7 @@ <h4>Compliant solution</h4>
2626
</pre>
2727
<h2>Resources</h2>
2828
<h3>Documentation</h3>
29-
<p><a href="https://docs.djangoproject.com/en/4.1/ref/models/instances/#django.db.models.Model.<em>str</em>">Django Model.<em>str</em>()</a></p>
29+
<p><a
30+
href="https://docs.djangoproject.com/en/4.1/ref/models/instances/#django.db.models.Model">https://docs.djangoproject.com/en/4.1/ref/models/instances/#django.db.models.Model</a>.<em>str</em>[Django
31+
Model.<em>str</em>()]</p>
3032

‎python-checks/src/main/resources/org/sonar/l10n/py/rules/python/S6662.html‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -31,7 +31,8 @@ <h4>Compliant solution</h4>
3131
<h2>Resources</h2>
3232
<h3>Documentation</h3>
3333
<ul>
34-
<li> Python Documentation - <a href="https://docs.python.org/3/reference/datamodel.html#object.<em>hash</em>">object.<em>hash</em></a> </li>
34+
<li> Python Documentation - <a
35+
href="https://docs.python.org/3/reference/datamodel.html#object">https://docs.python.org/3/reference/datamodel.html#object</a>.<em>hash</em>[object.<em>hash</em>] </li>
3536
<li> Python Documentation - <a href="https://docs.python.org/3/library/functions.html#hash">the hash built-in function</a> </li>
3637
</ul>
3738

‎python-checks/src/main/resources/org/sonar/l10n/py/rules/python/S6663.html‎

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -34,5 +34,7 @@ <h4>Compliant solution</h4>
3434
</pre>
3535
<h2>Resources</h2>
3636
<h3>Documentation</h3>
37-
<p>Python Documentation - <a href="https://docs.python.org/3/library/operator.html#operator.<em>index</em>"><em>index</em> method</a></p>
37+
<p>Python Documentation - <a
38+
href="https://docs.python.org/3/library/operator.html#operator">https://docs.python.org/3/library/operator.html#operator</a>.<em>index</em>[<em>index</em>
39+
method]</p>
3840

0 commit comments

Comments
 (0)