From 42659d297db1920888a076e80ecf5f2b8544a0a5 Mon Sep 17 00:00:00 2001
From: zglicz
Date: Thu, 28 Mar 2024 14:05:24 +0100
Subject: [PATCH] Update for release (#4644)
---
README.md | 2 +-
css-sonarpedia/sonarpedia.json | 2 +-
.../javascript/rules/javascript/S106.html | 8 +--
.../javascript/rules/javascript/S107.html | 2 +-
.../javascript/rules/javascript/S1121.html | 2 +-
.../javascript/rules/javascript/S1125.html | 2 +-
.../javascript/rules/javascript/S1126.html | 2 +-
.../javascript/rules/javascript/S1134.html | 2 +-
.../javascript/rules/javascript/S1135.html | 12 ++--
.../javascript/rules/javascript/S117.html | 20 ++++---
.../javascript/rules/javascript/S1192.html | 4 +-
.../javascript/rules/javascript/S128.html | 2 +-
.../javascript/rules/javascript/S131.html | 2 +-
.../javascript/rules/javascript/S1313.html | 6 +-
.../javascript/rules/javascript/S1442.html | 6 +-
.../javascript/rules/javascript/S1444.html | 7 ++-
.../javascript/rules/javascript/S1523.html | 8 +--
.../javascript/rules/javascript/S1525.html | 6 +-
.../javascript/rules/javascript/S1854.html | 2 +-
.../javascript/rules/javascript/S1874.html | 2 +-
.../javascript/rules/javascript/S2068.html | 10 ++--
.../javascript/rules/javascript/S2077.html | 9 ++-
.../javascript/rules/javascript/S2092.html | 14 ++---
.../javascript/rules/javascript/S2245.html | 20 +++----
.../javascript/rules/javascript/S2255.html | 8 +--
.../javascript/rules/javascript/S2486.html | 10 ++--
.../javascript/rules/javascript/S2589.html | 4 +-
.../javascript/rules/javascript/S2598.html | 6 +-
.../javascript/rules/javascript/S2612.html | 10 ++--
.../javascript/rules/javascript/S2681.html | 2 +-
.../javascript/rules/javascript/S2755.html | 10 ++--
.../javascript/rules/javascript/S2817.html | 8 +--
.../javascript/rules/javascript/S2819.html | 6 +-
.../javascript/rules/javascript/S2819.json | 3 +-
.../javascript/rules/javascript/S3271.html | 4 +-
.../javascript/rules/javascript/S3330.html | 8 +--
.../javascript/rules/javascript/S3523.html | 2 +-
.../javascript/rules/javascript/S3735.html | 2 +-
.../javascript/rules/javascript/S3776.html | 20 +++++--
.../javascript/rules/javascript/S3923.html | 2 +-
.../javascript/rules/javascript/S4036.html | 10 ++--
.../javascript/rules/javascript/S4323.html | 7 +++
.../javascript/rules/javascript/S4423.html | 12 ++--
.../javascript/rules/javascript/S4426.html | 55 +++++++++++++------
.../javascript/rules/javascript/S4502.html | 8 +--
.../javascript/rules/javascript/S4507.html | 10 ++--
.../javascript/rules/javascript/S4721.html | 6 +-
.../javascript/rules/javascript/S4784.html | 6 +-
.../javascript/rules/javascript/S4787.html | 22 ++++----
.../javascript/rules/javascript/S4790.html | 20 +++----
.../javascript/rules/javascript/S4817.html | 4 +-
.../javascript/rules/javascript/S4818.html | 10 ++--
.../javascript/rules/javascript/S4823.html | 6 +-
.../javascript/rules/javascript/S4829.html | 2 +-
.../javascript/rules/javascript/S4830.html | 35 ++++++------
.../javascript/rules/javascript/S5042.html | 11 ++--
.../javascript/rules/javascript/S5122.html | 14 ++---
.../javascript/rules/javascript/S5148.html | 8 +--
.../javascript/rules/javascript/S5247.html | 10 ++--
.../javascript/rules/javascript/S5332.html | 18 +++---
.../javascript/rules/javascript/S5443.html | 12 ++--
.../javascript/rules/javascript/S5527.html | 26 ++++-----
.../javascript/rules/javascript/S5542.html | 23 +++++---
.../javascript/rules/javascript/S5547.html | 10 ++--
.../javascript/rules/javascript/S5604.html | 10 ++--
.../javascript/rules/javascript/S5659.html | 8 +--
.../javascript/rules/javascript/S5689.html | 8 +--
.../javascript/rules/javascript/S5691.html | 8 +--
.../javascript/rules/javascript/S5693.html | 10 ++--
.../javascript/rules/javascript/S5725.html | 10 ++--
.../javascript/rules/javascript/S5728.html | 6 +-
.../javascript/rules/javascript/S5730.html | 6 +-
.../javascript/rules/javascript/S5732.html | 10 ++--
.../javascript/rules/javascript/S5734.html | 6 +-
.../javascript/rules/javascript/S5736.html | 8 +--
.../javascript/rules/javascript/S5739.html | 6 +-
.../javascript/rules/javascript/S5742.html | 6 +-
.../javascript/rules/javascript/S5743.html | 6 +-
.../javascript/rules/javascript/S5757.html | 10 ++--
.../javascript/rules/javascript/S5759.html | 6 +-
.../javascript/rules/javascript/S5852.html | 6 +-
.../javascript/rules/javascript/S5876.html | 10 ++--
.../javascript/rules/javascript/S6245.html | 7 ---
.../javascript/rules/javascript/S6249.html | 8 +--
.../javascript/rules/javascript/S6252.html | 3 -
.../javascript/rules/javascript/S6265.html | 7 +--
.../javascript/rules/javascript/S6268.html | 10 ++--
.../javascript/rules/javascript/S6270.html | 7 +--
.../javascript/rules/javascript/S6275.html | 8 +--
.../javascript/rules/javascript/S6281.html | 6 +-
.../javascript/rules/javascript/S6299.html | 10 ++--
.../javascript/rules/javascript/S6302.html | 7 +--
.../javascript/rules/javascript/S6303.html | 2 +-
.../javascript/rules/javascript/S6304.html | 7 +--
.../javascript/rules/javascript/S6308.html | 9 +--
.../javascript/rules/javascript/S6317.html | 5 +-
.../javascript/rules/javascript/S6319.html | 9 +--
.../javascript/rules/javascript/S6321.html | 5 +-
.../javascript/rules/javascript/S6327.html | 9 +--
.../javascript/rules/javascript/S6329.html | 7 +--
.../javascript/rules/javascript/S6330.html | 9 +--
.../javascript/rules/javascript/S6332.html | 9 +--
.../javascript/rules/javascript/S6333.html | 5 +-
.../javascript/rules/javascript/S6654.html | 21 ++++---
.../javascript/rules/javascript/S6661.html | 7 +--
.../javascript/rules/javascript/S6793.html | 2 +-
.../javascript/rules/javascript/S6827.html | 2 +-
.../javascript/rules/javascript/S6840.json | 8 +--
.../javascript/rules/javascript/S6844.html | 18 ++++--
.../javascript/rules/javascript/S6846.json | 2 +-
.../javascript/rules/javascript/S6850.json | 8 +--
.../javascript/rules/javascript/S888.html | 2 +-
.../javascript/rules/javascript/S905.html | 2 +-
sonarpedia.json | 2 +-
114 files changed, 470 insertions(+), 495 deletions(-)
diff --git a/README.md b/README.md
index 8ea8e7cd50..47e1c3292c 100644
--- a/README.md
+++ b/README.md
@@ -9,7 +9,7 @@ This SonarSource project is a [static code analyzer](https://en.wikipedia.org/wi
# Features
- Advanced rules based on pattern matching and control flow analysis
-- [389 JS rules](https://rules.sonarsource.com/javascript) and [393 TS rules](https://rules.sonarsource.com/typescript)
+- [397 JS rules](https://rules.sonarsource.com/javascript) and [402 TS rules](https://rules.sonarsource.com/typescript)
- [26 CSS rules](https://rules.sonarsource.com/css)
- Compatible with ECMAScript 2015-2020
- React JSX, Flow, Vue, and AWS lambda functions support for JavaScript and TypeScript
diff --git a/css-sonarpedia/sonarpedia.json b/css-sonarpedia/sonarpedia.json
index 60bb012a4f..f28dbb4c4a 100644
--- a/css-sonarpedia/sonarpedia.json
+++ b/css-sonarpedia/sonarpedia.json
@@ -3,7 +3,7 @@
"languages": [
"CSS"
],
- "latest-update": "2023-12-21T17:13:56.851986Z",
+ "latest-update": "2024-03-28T12:39:07.731724Z",
"options": {
"no-language-in-filenames": true
}
diff --git a/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S106.html b/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S106.html
index d4c024db05..8b943c1c52 100644
--- a/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S106.html
+++ b/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S106.html
@@ -37,9 +37,9 @@ Code examples
Resources
diff --git a/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S107.html b/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S107.html
index 74ec63f7dc..f2e1bb1031 100644
--- a/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S107.html
+++ b/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S107.html
@@ -1,5 +1,5 @@
Why is this an issue?
-Functions with a long parameter list are difficult to use, as maintainers must figure out the role of each parameter and keep track of their
+
Functions with a long parameter list are difficult to use because maintainers must figure out the role of each parameter and keep track of their
position.
function setCoordinates(x1, y1, z1, x2, y2, z2) { // Noncompliant
diff --git a/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S1121.html b/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S1121.html
index 95ee4e4f30..630f29eb0f 100644
--- a/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S1121.html
+++ b/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S1121.html
@@ -36,6 +36,6 @@ Compliant solution
Resources
diff --git a/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S1125.html b/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S1125.html
index 55b296bd32..67d49e2e0e 100644
--- a/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S1125.html
+++ b/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S1125.html
@@ -4,7 +4,7 @@ Why is this an issue?
variable or expression that evaluates to a boolean value is unnecessary and can make the code harder to read and understand. The more complex a
boolean expression is, the harder it will be for developers to understand its meaning and expected behavior, and it will favour the introduction of
new bugs.
-How to tix it
+How to fix it
Remove redundant boolean literals from expressions to improve readability and make the code more maintainable.
if (someValue == true) { /* ... */ } // Noncompliant: Redundant comparison
diff --git a/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S1126.html b/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S1126.html
index 9c2dea00dd..f26f038d4d 100644
--- a/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S1126.html
+++ b/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S1126.html
@@ -1,6 +1,6 @@
Why is this an issue?
The if...else
statement is used to make decisions based on the truthiness of a boolean expression, and the if
block
-executes when the expression is true
, while the else
block executes when the expression is false.
+executes when the expression is truthy, while the else
block executes when the expression is falsy.
Wrapping a boolean expression in an if...else
statement and returning true
or false
in the respective blocks
is redundant and unnecessary. It can also make the code harder to maintain, as it adds unnecessary lines of code that need to be read and
understood.
diff --git a/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S1134.html b/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S1134.html
index 03e6cdca63..4f6912ed97 100644
--- a/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S1134.html
+++ b/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S1134.html
@@ -10,6 +10,6 @@ Why is this an issue?
Resources
Documentation
diff --git a/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S1135.html b/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S1135.html
index cc6d0f8331..3af845982b 100644
--- a/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S1135.html
+++ b/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S1135.html
@@ -1,8 +1,8 @@
Why is this an issue?
Developers often use TODO
tags to mark areas in the code where additional work or improvements are needed but are not implemented
-immediately. However, these TODO
tags sometimes get overlooked or forgotten, leading to incomplete or unfinished code. This code smell
-class aims to identify and address such unattended TODO
tags to ensure a clean and maintainable codebase. This description will explore
-why this is a problem and how it can be fixed to improve the overall code quality.
+immediately. However, these TODO
tags sometimes get overlooked or forgotten, leading to incomplete or unfinished code. This rule aims to
+identify and address unattended TODO
tags to ensure a clean and maintainable codebase. This description explores why this is a problem
+and how it can be fixed to improve the overall code quality.
What is the potential impact?
Unattended TODO
tags in code can have significant implications for the development process and the overall codebase.
Incomplete Functionality: When developers leave TODO
tags without implementing the corresponding code, it results in incomplete
@@ -11,8 +11,8 @@
What is the potential impact?
Delayed bug fixes can result in more severe issues and increase the effort required to resolve them later.
Impact on Collaboration: In team-based development environments, unattended TODO
tags can hinder collaboration. Other team members
might not be aware of the intended changes, leading to conflicts or redundant efforts in the codebase.
-Codebase Bloat: Accumulation of unattended TODO
tags over time can clutter the codebase and make it difficult to distinguish between
-work in progress and completed code. This bloat can make it challenging to maintain an organized and efficient codebase.
+Codebase Bloat: The accumulation of unattended TODO
tags over time can clutter the codebase and make it difficult to distinguish
+between work in progress and completed code. This bloat can make it challenging to maintain an organized and efficient codebase.
Addressing this code smell is essential to ensure a maintainable, readable, reliable codebase and promote effective collaboration among
developers.
Noncompliant code example
@@ -23,6 +23,6 @@ Noncompliant code example
Resources
diff --git a/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S117.html b/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S117.html
index 922dd76e68..42c04995a7 100644
--- a/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S117.html
+++ b/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S117.html
@@ -9,15 +9,17 @@ Why is this an issue?
What is the potential impact?
Inconsistent naming of variables, properties, and parameters can lead to several issues in your code:
- - Reduced Readability: inconsistent variable, property, and parameter names make the code harder to read and understand; consequently, it is more
- difficult to identify the purpose of each variable, spot errors, or comprehend the logic.
- - Difficulty in Identifying Variables: variables, properties, and parameters that don’t adhere to a standard naming convention are challenging to
- identify; thus, the coding process slows down, especially when dealing with a large codebase.
- - Increased Risk of Errors: inconsistent or unclear variable, property, and parameter names lead to misunderstandings about what the variable
- represents. This ambiguity leads to incorrect assumptions and, consequently, bugs in the code.
- - Collaboration Difficulties: in a team setting, inconsistent naming conventions lead to confusion and miscommunication among team members.
- - Difficulty in Code Maintenance: inconsistent naming leads to an inconsistent codebase. The code is difficult to understand, and making changes
- feels like refactoring constantly, as you face different naming methods. Ultimately, it makes the codebase harder to maintain.
+ - Reduced Readability: Inconsistent variable, property, and parameter names make the code harder to read and understand;
+ consequently, it is more difficult to identify the purpose of each variable, spot errors, or comprehend the logic.
+ - Difficulty in Identifying Variables: The variables, properties, and parameters that don’t adhere to a standard naming
+ convention are challenging to identify; thus, the coding process slows down, especially when dealing with a large codebase.
+ - Increased Risk of Errors: Inconsistent or unclear variable, property, and parameter names lead to misunderstandings about what
+ the variable represents. This ambiguity leads to incorrect assumptions and, consequently, bugs in the code.
+ - Collaboration Difficulties: In a team setting, inconsistent naming conventions lead to confusion and miscommunication among
+ team members.
+ - Difficulty in Code Maintenance: Inconsistent naming leads to an inconsistent codebase. The code is difficult to understand,
+ and making changes feels like refactoring constantly, as you face different naming methods. Ultimately, it makes the codebase harder to maintain.
+
In summary, not adhering to a naming convention for variables, properties, and parameters can lead to confusion, errors, and inefficiencies, making
the code harder to read, understand, and maintain.
diff --git a/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S1192.html b/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S1192.html
index b0fe1ee2ef..a6dabf0d72 100644
--- a/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S1192.html
+++ b/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S1192.html
@@ -6,8 +6,8 @@ Exceptions
String literals inside import/export statements and JSX attributes are also ignored. The same goes for statement-like string literals, e.g. 'use
strict';
.
How to fix it
-Instead, use constants to replace the duplicated string literals. Constants can be referenced from many places, but only need to be updated in a
-single place.
+Use constants to replace the duplicated string literals. Constants can be referenced from many places, but only need to be updated in a single
+place.
Code examples
Noncompliant code example
With the default threshold of 3:
diff --git a/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S128.html b/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S128.html
index 3e585eec70..74eb5fcc7e 100644
--- a/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S128.html
+++ b/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S128.html
@@ -51,6 +51,6 @@ Exceptions
Resources
diff --git a/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S131.html b/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S131.html
index 0ace60aa5a..f5d31e4020 100644
--- a/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S131.html
+++ b/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S131.html
@@ -78,6 +78,6 @@ Exceptions
Resources
diff --git a/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S1313.html b/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S1313.html
index 0aa5b23f9e..4a83be595f 100644
--- a/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S1313.html
+++ b/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S1313.html
@@ -60,8 +60,8 @@ Exceptions
See
diff --git a/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S1442.html b/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S1442.html
index 54ef6916f9..ef9b6405f8 100644
--- a/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S1442.html
+++ b/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S1442.html
@@ -10,8 +10,8 @@ Noncompliant code example
Resources
diff --git a/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S1444.html b/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S1444.html
index c2082a52a3..ed60185335 100644
--- a/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S1444.html
+++ b/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S1444.html
@@ -1,13 +1,13 @@
Why is this an issue?
Public static
fields in TypeScript should be declared as readonly
to prevent them from being modified after their initial
assignment. This is a good practice because it makes the code safer by preventing accidental changes to these fields, which could lead to bugs that
-are hard to detect and fix.
+are hard to detect.
class MyClass {
static myField = 42; // Noncompliant
}
-To fix this, declare you static field with the readonly
qualifier .
+To fix this, declare your static field with the readonly
qualifier.
class MyClass {
static readonly myField = 42;
@@ -16,6 +16,7 @@ Why is this an issue?
Resources
Documentation
diff --git a/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S1523.html b/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S1523.html
index dfebb91c7b..4851ee8bf0 100644
--- a/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S1523.html
+++ b/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S1523.html
@@ -37,9 +37,9 @@ Exceptions
safe.
See
diff --git a/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S1525.html b/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S1525.html
index 478aee4b52..ce334ad759 100644
--- a/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S1525.html
+++ b/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S1525.html
@@ -21,8 +21,8 @@ Compliant solution
Resources
diff --git a/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S1854.html b/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S1854.html
index 89fd0618d1..552c7e97e3 100644
--- a/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S1854.html
+++ b/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S1854.html
@@ -43,7 +43,7 @@ Compliant solution
Resources
Standards
Related rules
const runPromise = () => Promise.resolve();
diff --git a/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S3776.html b/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S3776.html
index 037acddfb0..c908eccb5d 100644
--- a/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S3776.html
+++ b/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S3776.html
@@ -6,10 +6,10 @@ Why is this an issue?
Which syntax in code does impact cognitive complexity score?
Here are the core concepts:
- - Cognitive complexity is incremented each time the code breaks the normal linear reading flow.
This concerns, for example:
- Loop structures, Conditionals, Catches, Switches, Jumps to label and mixed operators in condition.
- - Each nesting level adds a malus to the breaking call.
During code reading, the deeper you go through nested layers, the
- harder it becomes to keep the context in mind.
+ - Cognitive complexity is incremented each time the code breaks the normal linear reading flow.
This concerns, for example,
+ loop structures, conditionals, catches, switches, jumps to labels, and conditions mixing multiple operators.
+ - Each nesting level increases complexity.
During code reading, the deeper you go through nested layers, the harder it
+ becomes to keep the context in mind.
- Method calls are free
A well-picked method name is a summary of multiple lines of code. A reader can first explore a
high-level view of what the code is performing then go deeper and deeper by looking at called functions content.
Note: This does not
apply to recursive calls, those will increment cognitive score.
@@ -18,6 +18,15 @@ Which syntax in code does impact cognitive complexity score?
What is the potential impact?
Developers spend more time reading and understanding code than writing it. High cognitive complexity slows down changes and increases the cost of
maintenance.
+Exceptions
+Cognitive complexity calculations exclude logical expressions using the ||
and ??
operators when applied within the
+context of default value code patterns.
+
+function greet(name) {
+ name = name || 'Guest';
+ console.log('Hello, ' + name + '!');
+}
+
How to fix it
Reducing cognitive complexity can be challenging.
Here are a few suggestions:
@@ -30,6 +39,9 @@ How to fix it
- Use null-safe operations (if available in the language).
When available the .?
or ??
operator
replaces multiple tests and simplifies the flow.
+Note that the calculation of cognitive complexity deviates from the documented process when functions are nested. Given the functional nature of
+JavaScript, nesting functions is a prevalent practice, especially within frameworks like React.js. Consequently, the cognitive complexity of functions
+remains independent of each other.
Code examples
Extraction of a complex condition in a new function.
Noncompliant code example
diff --git a/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S3923.html b/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S3923.html
index e71161c411..99ceefa1e4 100644
--- a/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S3923.html
+++ b/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S3923.html
@@ -25,7 +25,7 @@ Why is this an issue?
doSomething();
}
-Either there is a copy-paste error that needs fixing or an unnecessary switch
or if
chain that needs removing.
+Either there is a copy-paste error that needs fixing or an unnecessary switch
or if
chain that should be removed.
Exceptions
This rule does not apply to if
chains without else
, nor to switch
without a default
clause.
diff --git a/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S4036.html b/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S4036.html
index 884f8a1fa8..e6bfbbd66d 100644
--- a/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S4036.html
+++ b/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S4036.html
@@ -20,10 +20,10 @@ Compliant Solution
See
diff --git a/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S4323.html b/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S4323.html
index 3f2e4c9594..c32a583ee2 100644
--- a/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S4323.html
+++ b/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S4323.html
@@ -43,6 +43,13 @@ Why is this an issue?
/* ... */
}
+The rule disregards nullable types, irrespective of their frequency within the codebase. This includes types of the form T | null |
+undefined
, where T
can represent any type.
+
+function foo(x: T | null | undefined) {
+ /* ... */
+}
+
Resources
Documentation
diff --git a/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S4423.html b/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S4423.html
index 5415b9ec00..524b52374e 100644
--- a/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S4423.html
+++ b/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S4423.html
@@ -205,9 +205,13 @@ Articles & blog posts
Standards
diff --git a/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S4426.html b/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S4426.html
index 6c53204ccd..346159c432 100644
--- a/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S4426.html
+++ b/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S4426.html
@@ -77,7 +77,7 @@ Noncompliant code example
},
callback);
-Here is an example of an Elliptic Curve (EC) initialization. It implicitly generates a private key whose size is indicated in the algorithm
+
Here is an example of an Elliptic Curve (EC) initialization. It implicitly generates a private key whose size is indicated in the elliptic curve
name:
const crypto = require('crypto');
@@ -118,7 +118,7 @@ Compliant solution
},
callback);
-Here is an example of an Elliptic Curve (EC) initialization. It implicitly generates a private key whose size is indicated in the algorithm
+
Here is an example of an Elliptic Curve (EC) initialization. It implicitly generates a private key whose size is indicated in the elliptic curve
name:
const crypto = require('crypto');
@@ -133,11 +133,12 @@ Compliant solution
callback);
How does this work?
-As a rule of thumb, use the cryptographic algorithms and mechanisms that are considered strong by the cryptographic community.
+As a rule of thumb, use the cryptographic algorithms and mechanisms that are considered strong by the cryptography community.
The appropriate choices are the following.
RSA (Rivest-Shamir-Adleman) and DSA (Digital Signature Algorithm)
The security of these algorithms depends on the difficulty of attacks attempting to solve their underlying mathematical problem.
-In general, a minimum key size of 2048 bits is recommended for both.
+In general, a minimum key size of 2048 bits is recommended for both. It provides 112 bits of security. A key length of
+3072 or 4092 should be preferred when possible.
AES (Advanced Encryption Standard)
AES supports three key sizes: 128 bits, 192 bits and 256 bits. The security of the AES algorithm is based on the computational complexity of trying
all possible keys.
A larger key size increases the number of possible keys and makes exhaustive search attacks computationally infeasible.
@@ -145,8 +146,17 @@
AES (Advanced Encryption Standard)
Currently, a minimum key size of 128 bits is recommended for AES.
Elliptic Curve Cryptography (ECC)
Elliptic curve cryptography is also used in various algorithms, such as ECDSA, ECDH, or ECMQV. The length of keys generated with elliptic curve
-algorithms are mentioned directly in their names. For example, secp256k1
generates a 256-bits long private key.
-Currently, a minimum key size of 224 bits is recommended for EC algorithms.
+algorithms is mentioned directly in their names. For example, secp256k1
generates a 256-bits long private key.
+Currently, a minimum key size of 224 bits is recommended for EC-based algorithms.
+Additionally, some curves that theoretically provide sufficiently long keys are still discouraged. This can be because of a flaw in the curve
+parameters, a bad overall design, or poor performance. It is generally advised to use a NIST-approved elliptic curve wherever possible. Such curves
+currently include:
+
+ - NIST P curves with a size of at least 224 bits, e.g. secp256r1.
+ - Curve25519, generally known as ed25519 or x25519 depending on its application.
+ - Curve448.
+ - Brainpool curves with a size of at least 224 bits, e.g. brainpoolP224r1
+
Going the extra mile
Pre-Quantum Cryptography
Encrypted data and communications recorded today could be decrypted in the future by an attack from a quantum computer.
It is important to keep
@@ -155,6 +165,15 @@
Pre-Quantum Cryptography
Thus, if data is to remain secure beyond 2030, proactive measures should be taken now to ensure its safety.
Learn more here.
Resources
+
Articles & blog posts
Standards
diff --git a/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S4502.html b/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S4502.html
index b3504f1738..31171b8d8c 100644
--- a/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S4502.html
+++ b/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S4502.html
@@ -68,10 +68,10 @@ Compliant Solution
See
diff --git a/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S4507.html b/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S4507.html
index e7a2f74e27..e3e5bec504 100644
--- a/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S4507.html
+++ b/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S4507.html
@@ -32,10 +32,10 @@ Compliant Solution
See
diff --git a/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S4721.html b/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S4721.html
index 4e78bc6320..f65b686363 100644
--- a/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S4721.html
+++ b/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S4721.html
@@ -28,8 +28,8 @@ Compliant Solution
See
diff --git a/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S4784.html b/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S4784.html
index 1d60571317..05962cb453 100644
--- a/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S4784.html
+++ b/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S4784.html
@@ -42,9 +42,9 @@ Exceptions
It is a good idea to test your regular expression if it has the same pattern on both side of a "|
".
See
diff --git a/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S4787.html b/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S4787.html
index bcf8beeb5c..4a79750803 100644
--- a/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S4787.html
+++ b/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S4787.html
@@ -71,16 +71,16 @@ Sensitive Code Example
See
diff --git a/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S4790.html b/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S4790.html
index 04af48b547..f13f139c8d 100644
--- a/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S4790.html
+++ b/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S4790.html
@@ -28,15 +28,15 @@ Compliant Solution
See
diff --git a/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S4817.html b/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S4817.html
index 1c854da241..0a54ed7662 100644
--- a/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S4817.html
+++ b/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S4817.html
@@ -38,7 +38,7 @@ Sensitive Code Example
See
diff --git a/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S4818.html b/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S4818.html
index b54c45b465..fe18445a2e 100644
--- a/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S4818.html
+++ b/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S4818.html
@@ -42,10 +42,10 @@ Sensitive Code Example
See
diff --git a/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S4823.html b/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S4823.html
index dbe196e137..49212522ff 100644
--- a/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S4823.html
+++ b/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S4823.html
@@ -29,8 +29,8 @@ Sensitive Code Example
See
diff --git a/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S4829.html b/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S4829.html
index 63e876732b..f99578b58e 100644
--- a/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S4829.html
+++ b/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S4829.html
@@ -35,6 +35,6 @@ Sensitive Code Example
See
diff --git a/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S4830.html b/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S4830.html
index 79c0ed41c3..633c9edc55 100644
--- a/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S4830.html
+++ b/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S4830.html
@@ -1,16 +1,15 @@
This vulnerability makes it possible that an encrypted communication is intercepted.
Why is this an issue?
-Transport Layer Security (TLS) provides secure communication between systems over the internet by encrypting the data sent between them. The role
-of certificate validation in this process is to ensure that a system is indeed the one it claims to be, adding an extra layer of trust and
-security.
-When certificate validation is disabled, the client skips this critical check. This creates an opportunity for attackers to pose as a trusted
+
Transport Layer Security (TLS) provides secure communication between systems over the internet by encrypting the data sent between them.
+Certificate validation adds an extra layer of trust and security to this process to ensure that a system is indeed the one it claims to be.
+When certificate validation is disabled, the client skips a critical security check. This creates an opportunity for attackers to pose as a trusted
entity and intercept, manipulate, or steal the data being transmitted.
What is the potential impact?
Establishing trust in a secure way is a non-trivial task. When you disable certificate validation, you are removing a key mechanism designed to
build this trust in internet communication, opening your system up to a number of potential threats.
Identity spoofing
If a system does not validate certificates, it cannot confirm the identity of the other party involved in the communication. An attacker can
-exploit this by creating a fake server and masquerading it as a legitimate one. For example, they might set up a server that looks like your bank’s
+exploit this by creating a fake server and masquerading as a legitimate one. For example, they might set up a server that looks like your bank’s
server, tricking your system into thinking it is communicating with the bank. This scenario, called identity spoofing, allows the attacker to collect
any data your system sends to them, potentially leading to significant data breaches.
Loss of data integrity
@@ -132,18 +131,18 @@ Working with self-signed certificates or non-standard CAs
Resources
Standards
diff --git a/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S5042.html b/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S5042.html
index 04c6bfdc54..fb35770656 100644
--- a/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S5042.html
+++ b/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S5042.html
@@ -271,12 +271,13 @@ Compliant Solution
See
diff --git a/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S5122.html b/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S5122.html
index 3cdfbafca7..5fce79a216 100644
--- a/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S5122.html
+++ b/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S5122.html
@@ -86,16 +86,16 @@ Compliant Solution
See
diff --git a/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S5148.html b/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S5148.html
index 12bd03d485..4c0abf64c3 100644
--- a/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S5148.html
+++ b/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S5148.html
@@ -22,11 +22,11 @@ Compliant Solution
See
diff --git a/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S5247.html b/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S5247.html
index 29f355f8eb..94662ba5c9 100644
--- a/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S5247.html
+++ b/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S5247.html
@@ -115,12 +115,12 @@ Compliant Solution
See
diff --git a/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S5332.html b/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S5332.html
index 3c96093bf9..d94de70386 100644
--- a/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S5332.html
+++ b/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S5332.html
@@ -457,15 +457,15 @@ Exceptions
See
- - OWASP Top 10 2021 Category A2 - Cryptographic Failures
- - OWASP Top 10 2017 Category A3 - Sensitive Data
- Exposure
- - Mobile AppSec Verification
- Standard - Network Communication Requirements
- - OWASP Mobile Top 10 2016 Category M3 - Insecure
- Communication
- - MITRE, CWE-200 - Exposure of Sensitive Information to an Unauthorized Actor
- - MITRE, CWE-319 - Cleartext Transmission of Sensitive Information
+ - OWASP - Top 10 2021 Category A2 - Cryptographic Failures
+ - OWASP - Top 10 2017 Category A3 - Sensitive Data Exposure
+
+ - OWASP - Mobile AppSec
+ Verification Standard - Network Communication Requirements
+ - OWASP - Mobile Top 10 2016 Category M3 - Insecure
+ Communication
+ - CWE - CWE-200 - Exposure of Sensitive Information to an Unauthorized Actor
+ - CWE - CWE-319 - Cleartext Transmission of Sensitive Information
- Google, Moving towards more secure web
- Mozilla, Deprecating non secure http
- AWS Documentation - Listeners
diff --git a/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S5443.html b/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S5443.html
index d10ce34e91..cc01a9b694 100644
--- a/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S5443.html
+++ b/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S5443.html
@@ -67,13 +67,13 @@
Compliant Solution
See
diff --git a/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S5527.html b/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S5527.html
index e43c7d7272..21ca411cf5 100644
--- a/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S5527.html
+++ b/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S5527.html
@@ -99,18 +99,18 @@ Use valid certificates
Resources
Standards
diff --git a/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S5542.html b/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S5542.html
index 5c76776e8c..207834b87e 100644
--- a/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S5542.html
+++ b/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S5542.html
@@ -14,8 +14,10 @@ Why is this an issue?
For these reasons, as soon as cryptography is included in a project, it is important to choose encryption algorithms that are considered strong and
secure by the cryptography community.
-For AES, the weakest modes are CBC (Cipher Block Chaining) and ECB (Electronic Codebook) because they are either vulnerable to padding oracles or
-do not provide authentication mechanisms.
+For AES, the weakest mode is ECB (Electronic Codebook). Repeated blocks of data are encrypted to the same value, making them easy to identify and
+reducing the difficulty of recovering the original cleartext.
+Unauthenticated modes such as CBC (Cipher Block Chaining) may be used but are prone to attacks that manipulate the ciphertext. They must be used
+with caution.
For RSA, the weakest algorithms are either using it without padding or using the PKCS1v1.5 padding scheme.
What is the potential impact?
The cleartext of an encrypted message might be recoverable. Additionally, it might be possible to modify the cleartext of an encrypted message.
@@ -45,7 +47,8 @@ Compliant solution
How does this work?
As a rule of thumb, use the cryptographic algorithms and mechanisms that are considered strong by the cryptographic community.
Appropriate choices are currently the following.
-For AES: Use Galois/Counter mode (GCM)
+For AES: use authenticated encryption modes
+The best-known authenticated encryption mode for AES is Galois/Counter mode (GCM).
GCM mode combines encryption with authentication and integrity checks using a cryptographic hash function and provides both confidentiality and
authenticity of data.
Other similar modes are:
@@ -56,8 +59,8 @@ For AES: Use Galois/Counter mode (GCM)
- IAPM:
Integer Authenticated Parallelizable Mode
- OCB:
Offset Codebook Mode
-It is also possible to use AES-CBC with HMAC for integrity checks. However, it
-is considered more straightforward to use AES-GCM directly instead.
+It is also possible to use AES-CBC with HMAC for integrity checks. However, it is considered more straightforward to use AES-GCM directly
+instead.
For RSA: use the OAEP scheme
The Optimal Asymmetric Encryption Padding scheme (OAEP) adds randomness and a secure hash function that strengthens the regular inner workings of
RSA.
@@ -75,9 +78,11 @@ Articles & blog posts
Standards
diff --git a/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S5547.html b/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S5547.html
index 94225ace16..76d55f9f2a 100644
--- a/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S5547.html
+++ b/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S5547.html
@@ -46,9 +46,11 @@ Use a secure algorithm
Resources
Standards
diff --git a/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S5604.html b/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S5604.html
index 55d9288d84..e7eece7de1 100644
--- a/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S5604.html
+++ b/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S5604.html
@@ -46,11 +46,11 @@ Compliant Solution
See
- - OWASP Top 10 2021 Category A1 - Broken Access Control
- - OWASP Web Top 10 2017 Category A3 - Sensitive Data
- Exposure
- - MITRE, CWE-250 - Execution with Unnecessary Privileges
- - MITRE, CWE-359 - Exposure of Private Information
+ - OWASP - Top 10 2021 Category A1 - Broken Access Control
+ - OWASP - Web Top 10 2017 Category A3 - Sensitive Data
+ Exposure
+ - CWE - CWE-250 - Execution with Unnecessary Privileges
+ - CWE - CWE-359 - Exposure of Private Information
- W3C - Permissions
- Mozilla - Does Firefox share my location with
websites?
diff --git a/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S5659.html b/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S5659.html
index b8b0365f33..85267848ba 100644
--- a/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S5659.html
+++ b/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S5659.html
@@ -85,9 +85,9 @@ Rotate your secret keys
Resources
Standards
diff --git a/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S5689.html b/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S5689.html
index e779576286..92944727ec 100644
--- a/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S5689.html
+++ b/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S5689.html
@@ -48,11 +48,11 @@ Compliant Solution
See
diff --git a/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S5691.html b/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S5691.html
index 86ce5e99c2..54ed816bf0 100644
--- a/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S5691.html
+++ b/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S5691.html
@@ -33,11 +33,11 @@ Compliant Solution
See
diff --git a/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S5693.html b/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S5693.html
index 01a9d0b8b4..aa71168d3d 100644
--- a/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S5693.html
+++ b/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S5693.html
@@ -65,12 +65,12 @@ Compliant Solution
See
diff --git a/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S5725.html b/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S5725.html
index b487ca972b..95757c05c5 100644
--- a/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S5725.html
+++ b/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S5725.html
@@ -56,11 +56,11 @@ Compliant Solution
See
diff --git a/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S5728.html b/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S5728.html
index b3aa47c7cc..af9ed60a75 100644
--- a/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S5728.html
+++ b/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S5728.html
@@ -48,10 +48,10 @@ Compliant Solution
See
diff --git a/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S5730.html b/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S5730.html
index b053feaedd..af2c25094c 100644
--- a/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S5730.html
+++ b/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S5730.html
@@ -54,9 +54,9 @@ Compliant Solution
See
- - OWASP Top 10 2021 Category A5 - Security Misconfiguration
- - OWASP Top 10 2017 Category A3 -
- Sensitive Data Exposure
+ - OWASP - Top 10 2021 Category A5 - Security Misconfiguration
+ - OWASP - Top 10 2017 Category A3 - Sensitive Data
+ Exposure
- developer.mozilla.org - Mixed-content
- developer.mozilla.org - Content Security Policy (CSP)
- w3.org - Content Security Policy Level 3
diff --git a/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S5732.html b/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S5732.html
index fb893c6dca..8caeadb84e 100644
--- a/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S5732.html
+++ b/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S5732.html
@@ -62,16 +62,16 @@ Compliant Solution
See
diff --git a/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S5734.html b/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S5734.html
index 2a7cfe2a71..c545f5d0e7 100644
--- a/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S5734.html
+++ b/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S5734.html
@@ -53,9 +53,9 @@ Compliant Solution
See
- - OWASP Top 10 2021 Category A5 - Security Misconfiguration
- - OWASP Top 10 2017 Category A6 -
- Security Misconfiguration
+ - OWASP - Top 10 2021 Category A5 - Security Misconfiguration
+ - OWASP - Top 10 2017 Category A6 - Security
+ Misconfiguration
- developer.mozilla.org - X-Content-Type-Options
- blog.mozilla.org - Mitigating MIME
diff --git a/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S5736.html b/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S5736.html
index 9bf21c018b..a596184ce1 100644
--- a/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S5736.html
+++ b/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S5736.html
@@ -73,12 +73,12 @@
Compliant Solution
See
diff --git a/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S5739.html b/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S5739.html
index b1ed9625a1..3a308420c9 100644
--- a/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S5739.html
+++ b/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S5739.html
@@ -48,9 +48,9 @@ Compliant Solution
See
diff --git a/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S5742.html b/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S5742.html
index 84d75997ea..130d21a792 100644
--- a/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S5742.html
+++ b/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S5742.html
@@ -45,9 +45,9 @@ Compliant Solution
See
- - OWASP Top 10 2021 Category A5 - Security Misconfiguration
- - OWASP Top 10 2017 Category A3 -
- Sensitive Data Exposure
+ - OWASP - Top 10 2021 Category A5 - Security Misconfiguration
+ - OWASP - Top 10 2017 Category A3 - Sensitive Data
+ Exposure
- developer.mozilla.org - Certificate Transparency
- wikipedia.org - Certificate Authority
diff --git a/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S5743.html b/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S5743.html
index a256f61150..7426985838 100644
--- a/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S5743.html
+++ b/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S5743.html
@@ -50,9 +50,9 @@ Compliant Solution
See
- - OWASP Top 10 2021 Category A5 - Security Misconfiguration
- - OWASP Top 10 2017 Category
- A3 - Sensitive Data Exposure
+ - OWASP - Top 10 2021 Category A5 - Security Misconfiguration
+ - OWASP - Top 10 2017 Category A3 - Sensitive Data
+ Exposure
- developer.mozilla.org - X-DNS-Prefetch-Control
- developer.mozilla.org - Using dns-prefetch
diff --git a/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S5757.html b/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S5757.html
index 8edc8e8d4e..3cf5b5086f 100644
--- a/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S5757.html
+++ b/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S5757.html
@@ -53,10 +53,10 @@ Compliant Solution
See
diff --git a/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S5759.html b/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S5759.html
index 621175c9c9..2d474a7cf9 100644
--- a/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S5759.html
+++ b/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S5759.html
@@ -51,9 +51,9 @@ Compliant Solution
See
diff --git a/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S5852.html b/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S5852.html
index a2488e3648..1a9c587ce3 100644
--- a/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S5852.html
+++ b/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S5852.html
@@ -79,9 +79,9 @@ Compliant Solution
See
Standards
diff --git a/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S6245.html b/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S6245.html
index 3eb3b8fe39..eb58300401 100644
--- a/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S6245.html
+++ b/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S6245.html
@@ -55,13 +55,6 @@ Compliant Solution
See
- - OWASP Top 10 2021 Category A4 - Insecure Design
- - OWASP Top 10 2021 Category A5 - Security Misconfiguration
- - MITRE, CWE-311 - Missing Encryption of Sensitive Data
- - OWASP Top 10 2017 Category A3 - Sensitive Data
- Exposure
- - OWASP Top 10 2017 Category A6 - Security
- Misconfiguration
- AWS documentation - Protecting data using
server-side encryption
- AWS CDK version 2 - BucketEncryption
diff --git a/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S6249.html b/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S6249.html
index 9f96462b32..3c630ec7a0 100644
--- a/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S6249.html
+++ b/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S6249.html
@@ -29,17 +29,11 @@ Compliant Solution
See
diff --git a/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S6252.html b/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S6252.html
index b849c2d15d..e6b3acbba6 100644
--- a/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S6252.html
+++ b/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S6252.html
@@ -29,9 +29,6 @@ Compliant Solution
See
- - OWASP Top 10 2021 Category A5 - Security Misconfiguration
- - OWASP Top 10 2017 Category A6 - Security
- Misconfiguration
- AWS documentation - Using versioning in S3 buckets
- AWS CDK version 2 - Using versioning in S3
buckets
diff --git a/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S6265.html b/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S6265.html
index 95f7153700..902a8bb194 100644
--- a/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S6265.html
+++ b/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S6265.html
@@ -43,15 +43,12 @@ Compliant Solution
See
diff --git a/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S6268.html b/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S6268.html
index a20641d82c..06c68cc1b2 100644
--- a/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S6268.html
+++ b/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S6268.html
@@ -59,11 +59,11 @@ Compliant Solution
See
diff --git a/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S6270.html b/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S6270.html
index 0a05078cef..69380b64fa 100644
--- a/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S6270.html
+++ b/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S6270.html
@@ -40,12 +40,9 @@ Compliant Solution
See
diff --git a/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S6275.html b/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S6275.html
index 201e32c5bf..1c55e1bf28 100644
--- a/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S6275.html
+++ b/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S6275.html
@@ -49,13 +49,7 @@ Compliant Solution
See
diff --git a/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S6281.html b/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S6281.html
index 8435b6b260..c77d1e35c4 100644
--- a/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S6281.html
+++ b/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S6281.html
@@ -86,13 +86,9 @@ Compliant Solution
See
diff --git a/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S6299.html b/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S6299.html
index 2f8c5ebcb1..f8b6f5d2ee 100644
--- a/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S6299.html
+++ b/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S6299.html
@@ -69,11 +69,11 @@ Compliant Solution
See
diff --git a/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S6302.html b/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S6302.html
index a087ece44d..d8605c9a81 100644
--- a/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S6302.html
+++ b/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S6302.html
@@ -37,13 +37,10 @@ Compliant Solution
See
diff --git a/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S6303.html b/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S6303.html
index b5cf0f90b2..3b37fbd695 100644
--- a/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S6303.html
+++ b/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S6303.html
@@ -186,6 +186,6 @@ See
diff --git a/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S6304.html b/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S6304.html
index 98f77bd366..e07bf9fa50 100644
--- a/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S6304.html
+++ b/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S6304.html
@@ -48,12 +48,9 @@ Exceptions
See
diff --git a/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S6308.html b/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S6308.html
index 7537c2ce25..dd5ab7ef02 100644
--- a/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S6308.html
+++ b/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S6308.html
@@ -64,15 +64,8 @@ Compliant Solution
See
diff --git a/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S6317.html b/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S6317.html
index 542fe1e617..80acdc1f31 100644
--- a/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S6317.html
+++ b/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S6317.html
@@ -70,9 +70,6 @@ Articles & blog posts
Standards
diff --git a/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S6319.html b/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S6319.html
index 68d128abdb..2b62935524 100644
--- a/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S6319.html
+++ b/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S6319.html
@@ -38,14 +38,7 @@ Compliant Solution
See
diff --git a/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S6321.html b/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S6321.html
index 4ce4202871..4aa5e52300 100644
--- a/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S6321.html
+++ b/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S6321.html
@@ -157,9 +157,6 @@ Documentation
Standards
diff --git a/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S6327.html b/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S6327.html
index 2a7a4b7147..55e7895093 100644
--- a/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S6327.html
+++ b/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S6327.html
@@ -51,16 +51,9 @@ Compliant Solution
See
diff --git a/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S6329.html b/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S6329.html
index da543f66ba..75769cafd6 100644
--- a/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S6329.html
+++ b/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S6329.html
@@ -167,15 +167,12 @@ Compliant Solution
See
diff --git a/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S6330.html b/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S6330.html
index ec2f04bef8..f34a3d095d 100644
--- a/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S6330.html
+++ b/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S6330.html
@@ -46,15 +46,8 @@ Compliant Solution
See
diff --git a/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S6332.html b/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S6332.html
index 08514fcdbd..0d537445c6 100644
--- a/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S6332.html
+++ b/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S6332.html
@@ -47,14 +47,7 @@ Compliant Solution
See
diff --git a/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S6333.html b/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S6333.html
index 3e0d995ce4..8aa6e521d6 100644
--- a/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S6333.html
+++ b/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S6333.html
@@ -75,9 +75,6 @@ See
diff --git a/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S6654.html b/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S6654.html
index c6e8047aa2..d48e3e8ca5 100644
--- a/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S6654.html
+++ b/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S6654.html
@@ -1,21 +1,20 @@
Why is this an issue?
-JavaScript has a prototypical inheritance model. Each object has an internal property that points to another object, called a
-prototype
. That prototype object has a prototype of its own, and the whole sequence is called a prototype chain. When
-accessing a property or a method of an object, if it is not found at the top level, the search continues through the object’s prototype and then
-further down the prototype chain. This feature allows for very powerful dynamic inheritance patterns but can also lead to confusion when compared to
-the classic inheritance.
+JavaScript has a prototypal inheritance model. Each object has an internal property that points to another object, called a prototype
.
+That prototype object has a prototype of its own, and the whole sequence is called a prototype chain. When accessing a property or a
+method of an object, if it is not found at the top level, the search continues through the object’s prototype and then further down the prototype
+chain. This feature allows for very powerful dynamic inheritance patterns but can also lead to confusion when compared to the classic inheritance.
To simplify the access to the prototype of an object some browsers introduced the __proto__
property, which was later deprecated and
-removed from the language. The current ECMAScript standard includes Object.getPrototype
and Object.setPrototype
static
+removed from the language. The current ECMAScript standard includes Object.getPrototypeOf
and Object.setPrototypeOf
static
methods that should be used instead of the __proto__
property.
-let prototype = foo.__proto__; // Noncompliant: use Object.getPrototype
-foo.__proto__ = bar; // Noncompliant: use Object.setPrototype
+let prototype = foo.__proto__; // Noncompliant: use Object.getPrototypeOf
+foo.__proto__ = bar; // Noncompliant: use Object.setPrototypeOf
-To fix your code replace __proto__
with calls to Object.getPrototype
and Object.setPrototype
static
+
To fix your code replace __proto__
with calls to Object.getPrototypeOf
and Object.setPrototypeOf
static
methods.
-let prototype = Object.getPrototype(foo);
-Object.setPrototype(foo, bar);
+let prototype = Object.getPrototypeOf(foo);
+Object.setPrototypeOf(foo, bar);
Resources
Documentation
diff --git a/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S6661.html b/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S6661.html
index e65ca32af1..5ed1f87978 100644
--- a/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S6661.html
+++ b/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S6661.html
@@ -1,11 +1,10 @@
Why is this an issue?
When merging objects or copying properties from one object to another, use the object spread syntax instead of Object.assign()
. The
-Object spread syntax was introduced in ES2018 and allows shallow-cloning or merging of objects with a more concise and readable syntax.
+object spread syntax was introduced in ES2018 and allows shallow-cloning or merging of objects with a more concise and readable syntax.
The Object.assign()
also allows to mutate an object, which is not possible with the spread syntax, so the rule only applies to cases
where the first argument of the Object.assign()
is an object literal.
-The object spread syntax improves clarity when you’re modifying an object, as demonstrated in this example: foo = { bar: 42, …baz
-}
.
-Additionally, it provides a more concise way to perform a shallow clone. Instead of using foo = Object.assign({}, bar)
, you can simply
+
The object spread syntax improves clarity when you’re modifying an object, as demonstrated in this example: foo = { bar: 42, …baz }
.
+Additionally, it provides a more concise way to perform a shallow clone. Instead of using foo = Object.assign({}, bar)
, you can simply
write foo = { …bar }
.
const a = Object.assign({}, foo); // Noncompliant: Use spread syntax to clone or merge objects
diff --git a/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S6793.html b/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S6793.html
index a0521d8387..2043d112e0 100644
--- a/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S6793.html
+++ b/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S6793.html
@@ -2,7 +2,7 @@ Why is this an issue?
ARIA (Accessible Rich Internet Applications) attributes are used to enhance the accessibility of web content and web applications. These attributes
provide additional information about an element’s role, state, properties, and values to assistive technologies like screen readers.
This rule checks that the values of ARIA attributes "aria-*" in DOM elements are valid.
-How to fix it in JSX
+How to fix
Check that each element with a defined ARIA attribute has a valid value.
<span aria-hidden="ok">foo</span>
diff --git a/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S6827.html b/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S6827.html
index f16a9c62d7..54d48caad1 100644
--- a/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S6827.html
+++ b/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S6827.html
@@ -6,7 +6,7 @@ Why is this an issue?
of the anchor or navigate the website effectively.
This rule checks that anchors do not use the aria-hidden
property and have content provided either between the tags or as
aria-label
or title
property.
-How to fix it in JSX
+How to fix it
Ensure that anchors either have content or an aria-label
or title
attribute, and they should not use the
aria-hidden
property.
Code examples
diff --git a/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S6840.json b/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S6840.json
index 41b3bd520f..1f9602a7a7 100644
--- a/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S6840.json
+++ b/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S6840.json
@@ -6,10 +6,6 @@
"func": "Constant\/Issue",
"constantCost": "5min"
},
- "tags": [
- "accessibility",
- "react"
- ],
"defaultSeverity": "Major",
"ruleSpecification": "RSPEC-6840",
"sqKey": "S6840",
@@ -22,6 +18,10 @@
},
"attribute": "CONVENTIONAL"
},
+ "tags": [
+ "accessibility",
+ "react"
+ ],
"compatibleLanguages": [
"JAVASCRIPT",
"TYPESCRIPT"
diff --git a/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S6844.html b/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S6844.html
index bc8256f9d7..f3bd6124ce 100644
--- a/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S6844.html
+++ b/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S6844.html
@@ -27,14 +27,22 @@ How to fix it
Code examples
Noncompliant code example
-<a href="javascript:void(0)" onClick={foo}>Perform action</a>
-<a href="#" onClick={foo}>Perform action</a>
-<a onClick={foo}>Perform action</a>
+const MyComponent = () => {
+ return <>
+ <a href="javascript:void(0)" onClick={foo}>Perform action</a>
+ <a href="#" onClick={foo}>Perform action</a>
+ <a onClick={foo}>Perform action</a>
+ </>;
+};
Compliant solution
-<button onClick={foo}>Perform action</button>
-<a href="#section" onClick={foo} />
+const MyComponent = () => {
+ return <>
+ <button onClick={foo}>Perform action</button>
+ <a href="#section" onClick={foo}>Perform action</a>
+ </>;
+};
Resources
Documentation
diff --git a/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S6846.json b/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S6846.json
index 27edb4d35e..856e84fd42 100644
--- a/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S6846.json
+++ b/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S6846.json
@@ -10,7 +10,7 @@
"accessibility",
"react"
],
- "defaultSeverity": "Major",
+ "defaultSeverity": "Minor",
"ruleSpecification": "RSPEC-6846",
"sqKey": "S6846",
"scope": "All",
diff --git a/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S6850.json b/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S6850.json
index 249b9ea479..f918e65a0c 100644
--- a/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S6850.json
+++ b/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S6850.json
@@ -6,10 +6,6 @@
"func": "Constant\/Issue",
"constantCost": "5min"
},
- "tags": [
- "accessibility",
- "react"
- ],
"defaultSeverity": "Major",
"ruleSpecification": "RSPEC-6850",
"sqKey": "S6850",
@@ -22,6 +18,10 @@
},
"attribute": "CONVENTIONAL"
},
+ "tags": [
+ "accessibility",
+ "react"
+ ],
"compatibleLanguages": [
"JAVASCRIPT",
"TYPESCRIPT"
diff --git a/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S888.html b/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S888.html
index 13d79761bc..b66db8cc18 100644
--- a/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S888.html
+++ b/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S888.html
@@ -34,6 +34,6 @@ Exceptions
Resources
diff --git a/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S905.html b/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S905.html
index 9c61f6ee4c..7c70e34b05 100644
--- a/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S905.html
+++ b/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S905.html
@@ -45,6 +45,6 @@ Compliant solution
Resources
Standards
diff --git a/sonarpedia.json b/sonarpedia.json
index 50da762af9..109e3ca10a 100644
--- a/sonarpedia.json
+++ b/sonarpedia.json
@@ -3,7 +3,7 @@
"languages": [
"JS"
],
- "latest-update": "2023-12-21T17:10:12.037032Z",
+ "latest-update": "2024-03-28T12:38:08.293231Z",
"options": {
"no-language-in-filenames": true,
"preserve-filenames": true