SONARPY-989 Provide OWASP Top 10 2021 security standards for rules metadata (#1094)

Author: nils-werner-sonarsource

pom.xml

@@ -89,9 +89,9 @@
     <logback.version>1.2.3</logback.version>
     <maven.project.version>2.2.1</maven.project.version>
     <mockito.version>3.9.0</mockito.version>
-    <sonar.version>8.9.0.43852</sonar.version>
+    <sonar.version>9.3.0.51899</sonar.version>
     <sonar.orchestrator.version>3.36.0.63</sonar.orchestrator.version>
-    <sonar-analyzer-commons.version>1.22.0.848</sonar-analyzer-commons.version>
+    <sonar-analyzer-commons.version>1.24.0.965</sonar-analyzer-commons.version>
     <sonarlint-core.version>6.0.0.32513</sonarlint-core.version>
     <sslr.version>1.23</sslr.version>
     <protobuf.version>3.17.3</protobuf.version>

sonar-python-plugin/src/main/java/org/sonar/plugins/python/PythonRuleRepository.java

@@ -24,6 +24,7 @@
 import java.util.Set;
 import java.util.stream.Collectors;
 import java.util.stream.StreamSupport;
+import org.sonar.api.SonarRuntime;
 import org.sonar.api.server.rule.RulesDefinition;
 import org.sonar.python.checks.CheckList;
 import org.sonarsource.analyzer.commons.RuleMetadataLoader;
@@ -36,13 +37,19 @@ public class PythonRuleRepository implements RulesDefinition {
 
   private static final Set<String> TEMPLATE_RULE_KEYS = Collections.singleton("CommentRegularExpression");
 
+  private final SonarRuntime runtime;
+
+  public PythonRuleRepository(SonarRuntime runtime) {
+    this.runtime = runtime;
+  }
+
   @Override
   public void define(Context context) {
     NewRepository repository = context
       .createRepository(CheckList.REPOSITORY_KEY, Python.KEY)
       .setName(REPOSITORY_NAME);
 
-    RuleMetadataLoader loader = new RuleMetadataLoader(RESOURCE_FOLDER, PythonProfile.PROFILE_LOCATION);
+    RuleMetadataLoader loader = new RuleMetadataLoader(RESOURCE_FOLDER, PythonProfile.PROFILE_LOCATION, runtime);
     loader.addRulesByAnnotatedClass(repository, getCheckClasses());
 
     repository.rules().stream()

sonar-python-plugin/src/test/java/org/sonar/plugins/python/PythonRuleRepositoryTest.java

@@ -25,8 +25,13 @@
 import java.util.List;
 import java.util.stream.Collectors;
 import org.junit.Test;
+import org.sonar.api.SonarEdition;
+import org.sonar.api.SonarQubeSide;
+import org.sonar.api.SonarRuntime;
+import org.sonar.api.internal.SonarRuntimeImpl;
 import org.sonar.api.rules.RuleType;
 import org.sonar.api.server.rule.RulesDefinition;
+import org.sonar.api.utils.Version;
 import org.sonar.python.checks.CheckList;
 
 import static org.assertj.core.api.Assertions.assertThat;
@@ -58,6 +63,19 @@ public void createRulesTest() throws IOException {
     }
   }
 
+  @Test
+  public void owaspSecurityStandard() {
+    RulesDefinition.Repository repository_9_3 = buildRepository(9, 3);
+    RulesDefinition.Rule s4721_9_3 = repository_9_3.rule("S4721");
+    assertThat(s4721_9_3).isNotNull();
+    assertThat(s4721_9_3.securityStandards()).contains("owaspTop10-2021:a3");
+
+    RulesDefinition.Repository repository_9_2 = buildRepository(9, 2);
+    RulesDefinition.Rule s4721_9_2 = repository_9_2.rule("S4721");
+    assertThat(s4721_9_2).isNotNull();
+    assertThat(s4721_9_2.securityStandards()).doesNotContain("owaspTop10-2021:a3");
+  }
+
   private List<String> nonAbstractCheckFiles() throws IOException {
     return Files.walk(new File("../python-checks/src/main/java/org/sonar/python/checks").toPath())
       .filter(Files::isRegularFile)
@@ -98,7 +116,12 @@ public void hotspotRules() {
   }
 
   private static RulesDefinition.Repository buildRepository() {
-    PythonRuleRepository ruleRepository = new PythonRuleRepository();
+    return buildRepository(9, 3);
+  }
+
+  private static RulesDefinition.Repository buildRepository(int majorVersion, int minorVersion) {
+    SonarRuntime sonarRuntime = SonarRuntimeImpl.forSonarQube(Version.create(majorVersion, minorVersion), SonarQubeSide.SERVER, SonarEdition.DEVELOPER);
+    PythonRuleRepository ruleRepository = new PythonRuleRepository(sonarRuntime);
     RulesDefinition.Context context = new RulesDefinition.Context();
     ruleRepository.define(context);
     return context.repository(CheckList.REPOSITORY_KEY);