diff --git a/sonar-xml-plugin/src/main/resources/org/sonar/l10n/xml/rules/xml/S2068.html b/sonar-xml-plugin/src/main/resources/org/sonar/l10n/xml/rules/xml/S2068.html index c3d895ae8..6338b7988 100644 --- a/sonar-xml-plugin/src/main/resources/org/sonar/l10n/xml/rules/xml/S2068.html +++ b/sonar-xml-plugin/src/main/resources/org/sonar/l10n/xml/rules/xml/S2068.html @@ -2,8 +2,8 @@ for applications that are distributed or that are open-source.

In the past, it has led to the following vulnerabilities:

Credentials should be stored outside of the code in a configuration file, a database, or a management service for secrets.

This rule flags instances of hard-coded credentials used in database and LDAP connections. It looks for hard-coded credentials in connection diff --git a/sonar-xml-plugin/src/main/resources/org/sonar/l10n/xml/rules/xml/S2647.html b/sonar-xml-plugin/src/main/resources/org/sonar/l10n/xml/rules/xml/S2647.html index dfadc7918..3758ff3dc 100644 --- a/sonar-xml-plugin/src/main/resources/org/sonar/l10n/xml/rules/xml/S2647.html +++ b/sonar-xml-plugin/src/main/resources/org/sonar/l10n/xml/rules/xml/S2647.html @@ -86,7 +86,7 @@

Standards

  • OWASP Web Service Security Cheat Sheet
  • CWE - CWE-522 - Insufficiently Protected Credentials
    • -
  • STIG Viewer - Application Security and +
  • STIG Viewer - Application Security and Development: V-222533 - The application must authenticate all network connected endpoint devices before establishing any connection.
    • diff --git a/sonar-xml-plugin/src/main/resources/org/sonar/l10n/xml/rules/xml/S3330.html b/sonar-xml-plugin/src/main/resources/org/sonar/l10n/xml/rules/xml/S3330.html index 9df4be7c8..f95bc6f00 100644 --- a/sonar-xml-plugin/src/main/resources/org/sonar/l10n/xml/rules/xml/S3330.html +++ b/sonar-xml-plugin/src/main/resources/org/sonar/l10n/xml/rules/xml/S3330.html @@ -44,7 +44,7 @@

    See

    (XSS)
  • CWE - CWE-1004 - Sensitive Cookie Without 'HttpOnly' Flag
  • Derived from FindSecBugs rule HTTPONLY_COOKIE
    • -
  • STIG Viewer - Application Security and +
  • STIG Viewer - Application Security and Development: V-222575 - The application must set the HTTPOnly flag on session cookies.
    • diff --git a/sonar-xml-plugin/src/main/resources/org/sonar/l10n/xml/rules/xml/S4507.json b/sonar-xml-plugin/src/main/resources/org/sonar/l10n/xml/rules/xml/S4507.json index 7ebfa2f84..3048ca526 100644 --- a/sonar-xml-plugin/src/main/resources/org/sonar/l10n/xml/rules/xml/S4507.json +++ b/sonar-xml-plugin/src/main/resources/org/sonar/l10n/xml/rules/xml/S4507.json @@ -39,6 +39,9 @@ ], "OWASP Top 10 2021": [ "A5" + ], + "ASVS 4.0": [ + "14.3.2" ] }, "quickfix": "unknown" diff --git a/sonar-xml-plugin/src/main/resources/org/sonar/l10n/xml/rules/xml/S5122.html b/sonar-xml-plugin/src/main/resources/org/sonar/l10n/xml/rules/xml/S5122.html index c78c94c0d..7be5c2d89 100644 --- a/sonar-xml-plugin/src/main/resources/org/sonar/l10n/xml/rules/xml/S5122.html +++ b/sonar-xml-plugin/src/main/resources/org/sonar/l10n/xml/rules/xml/S5122.html @@ -1,7 +1,7 @@

    Having a permissive Cross-Origin Resource Sharing policy is security-sensitive. It has led in the past to the following vulnerabilities:

    Same origin policy in browsers prevents, by default and for security-reasons, a javascript frontend to perform a cross-origin HTTP request to a resource that has a different origin (domain, protocol, or port) diff --git a/sonar-xml-plugin/src/main/resources/org/sonar/l10n/xml/rules/xml/S5322.html b/sonar-xml-plugin/src/main/resources/org/sonar/l10n/xml/rules/xml/S5322.html index 511bc5a91..450a79ac2 100644 --- a/sonar-xml-plugin/src/main/resources/org/sonar/l10n/xml/rules/xml/S5322.html +++ b/sonar-xml-plugin/src/main/resources/org/sonar/l10n/xml/rules/xml/S5322.html @@ -1,8 +1,8 @@

    Android applications can receive broadcasts from the system or other applications. Receiving intents is security-sensitive. For example, it has led in the past to the following vulnerabilities:

    Receivers can be declared in the manifest or in the code to make them context-specific. If the receiver is declared in the manifest Android will start the application if it is not already running once a matching broadcast is received. The receiver is an entry point into the application.

    diff --git a/sonar-xml-plugin/src/main/resources/org/sonar/l10n/xml/rules/xml/S5332.html b/sonar-xml-plugin/src/main/resources/org/sonar/l10n/xml/rules/xml/S5332.html index 17a96d1f9..cdaac368d 100644 --- a/sonar-xml-plugin/src/main/resources/org/sonar/l10n/xml/rules/xml/S5332.html +++ b/sonar-xml-plugin/src/main/resources/org/sonar/l10n/xml/rules/xml/S5332.html @@ -90,27 +90,27 @@

    Standards

  • OWASP - Top 10 2021 Category A2 - Cryptographic Failures
  • CWE - CWE-200 - Exposure of Sensitive Information to an Unauthorized Actor
  • CWE - CWE-319 - Cleartext Transmission of Sensitive Information
    • -
  • STIG Viewer - Application Security and +
  • STIG Viewer - Application Security and Development: V-222397 - The application must implement cryptographic mechanisms to protect the integrity of remote access sessions.
    • -
  • STIG Viewer - Application Security and +
  • STIG Viewer - Application Security and Development: V-222534 - Service-Oriented Applications handling non-releasable data must authenticate endpoint devices via mutual SSL/TLS.
    • -
  • STIG Viewer - Application Security and +
  • STIG Viewer - Application Security and Development: V-222562 - Applications used for non-local maintenance must implement cryptographic mechanisms to protect the integrity of maintenance and diagnostic communications.
    • -
  • STIG Viewer - Application Security and +
  • STIG Viewer - Application Security and Development: V-222563 - Applications used for non-local maintenance must implement cryptographic mechanisms to protect the confidentiality of maintenance and diagnostic communications.
    • -
  • STIG Viewer - Application Security and +
  • STIG Viewer - Application Security and Development: V-222577 - The application must not expose session IDs.
    • -
  • STIG Viewer - Application Security and +
  • STIG Viewer - Application Security and Development: V-222596 - The application must protect the confidentiality and integrity of transmitted information.
    • -
  • STIG Viewer - Application Security and +
  • STIG Viewer - Application Security and Development: V-222597 - The application must implement cryptographic mechanisms to prevent unauthorized disclosure of information and/or detect changes to information during transmission.
    • -
  • STIG Viewer - Application Security and +
  • STIG Viewer - Application Security and Development: V-222598 - The application must maintain the confidentiality and integrity of information during preparation for transmission.
    • -
  • STIG Viewer - Application Security and +
  • STIG Viewer - Application Security and Development: V-222599 - The application must maintain the confidentiality and integrity of information during reception.
    • diff --git a/sonarpedia.json b/sonarpedia.json index b5f529923..c1cc3d854 100644 --- a/sonarpedia.json +++ b/sonarpedia.json @@ -3,7 +3,7 @@ "languages": [ "XML" ], - "latest-update": "2025-04-03T15:02:09.825524Z", + "latest-update": "2025-11-24T13:42:34.135101Z", "options": { "no-language-in-filenames": true }