From 42659d297db1920888a076e80ecf5f2b8544a0a5 Mon Sep 17 00:00:00 2001
From: zglicz
Date: Thu, 28 Mar 2024 14:05:24 +0100
Subject: [PATCH] Update for release (#4644)
---
README.md | 2 +-
css-sonarpedia/sonarpedia.json | 2 +-
.../javascript/rules/javascript/S106.html | 8 +--
.../javascript/rules/javascript/S107.html | 2 +-
.../javascript/rules/javascript/S1121.html | 2 +-
.../javascript/rules/javascript/S1125.html | 2 +-
.../javascript/rules/javascript/S1126.html | 2 +-
.../javascript/rules/javascript/S1134.html | 2 +-
.../javascript/rules/javascript/S1135.html | 12 ++--
.../javascript/rules/javascript/S117.html | 20 ++++---
.../javascript/rules/javascript/S1192.html | 4 +-
.../javascript/rules/javascript/S128.html | 2 +-
.../javascript/rules/javascript/S131.html | 2 +-
.../javascript/rules/javascript/S1313.html | 6 +-
.../javascript/rules/javascript/S1442.html | 6 +-
.../javascript/rules/javascript/S1444.html | 7 ++-
.../javascript/rules/javascript/S1523.html | 8 +--
.../javascript/rules/javascript/S1525.html | 6 +-
.../javascript/rules/javascript/S1854.html | 2 +-
.../javascript/rules/javascript/S1874.html | 2 +-
.../javascript/rules/javascript/S2068.html | 10 ++--
.../javascript/rules/javascript/S2077.html | 9 ++-
.../javascript/rules/javascript/S2092.html | 14 ++---
.../javascript/rules/javascript/S2245.html | 20 +++----
.../javascript/rules/javascript/S2255.html | 8 +--
.../javascript/rules/javascript/S2486.html | 10 ++--
.../javascript/rules/javascript/S2589.html | 4 +-
.../javascript/rules/javascript/S2598.html | 6 +-
.../javascript/rules/javascript/S2612.html | 10 ++--
.../javascript/rules/javascript/S2681.html | 2 +-
.../javascript/rules/javascript/S2755.html | 10 ++--
.../javascript/rules/javascript/S2817.html | 8 +--
.../javascript/rules/javascript/S2819.html | 6 +-
.../javascript/rules/javascript/S2819.json | 3 +-
.../javascript/rules/javascript/S3271.html | 4 +-
.../javascript/rules/javascript/S3330.html | 8 +--
.../javascript/rules/javascript/S3523.html | 2 +-
.../javascript/rules/javascript/S3735.html | 2 +-
.../javascript/rules/javascript/S3776.html | 20 +++++--
.../javascript/rules/javascript/S3923.html | 2 +-
.../javascript/rules/javascript/S4036.html | 10 ++--
.../javascript/rules/javascript/S4323.html | 7 +++
.../javascript/rules/javascript/S4423.html | 12 ++--
.../javascript/rules/javascript/S4426.html | 55 +++++++++++++------
.../javascript/rules/javascript/S4502.html | 8 +--
.../javascript/rules/javascript/S4507.html | 10 ++--
.../javascript/rules/javascript/S4721.html | 6 +-
.../javascript/rules/javascript/S4784.html | 6 +-
.../javascript/rules/javascript/S4787.html | 22 ++++----
.../javascript/rules/javascript/S4790.html | 20 +++----
.../javascript/rules/javascript/S4817.html | 4 +-
.../javascript/rules/javascript/S4818.html | 10 ++--
.../javascript/rules/javascript/S4823.html | 6 +-
.../javascript/rules/javascript/S4829.html | 2 +-
.../javascript/rules/javascript/S4830.html | 35 ++++++------
.../javascript/rules/javascript/S5042.html | 11 ++--
.../javascript/rules/javascript/S5122.html | 14 ++---
.../javascript/rules/javascript/S5148.html | 8 +--
.../javascript/rules/javascript/S5247.html | 10 ++--
.../javascript/rules/javascript/S5332.html | 18 +++---
.../javascript/rules/javascript/S5443.html | 12 ++--
.../javascript/rules/javascript/S5527.html | 26 ++++-----
.../javascript/rules/javascript/S5542.html | 23 +++++---
.../javascript/rules/javascript/S5547.html | 10 ++--
.../javascript/rules/javascript/S5604.html | 10 ++--
.../javascript/rules/javascript/S5659.html | 8 +--
.../javascript/rules/javascript/S5689.html | 8 +--
.../javascript/rules/javascript/S5691.html | 8 +--
.../javascript/rules/javascript/S5693.html | 10 ++--
.../javascript/rules/javascript/S5725.html | 10 ++--
.../javascript/rules/javascript/S5728.html | 6 +-
.../javascript/rules/javascript/S5730.html | 6 +-
.../javascript/rules/javascript/S5732.html | 10 ++--
.../javascript/rules/javascript/S5734.html | 6 +-
.../javascript/rules/javascript/S5736.html | 8 +--
.../javascript/rules/javascript/S5739.html | 6 +-
.../javascript/rules/javascript/S5742.html | 6 +-
.../javascript/rules/javascript/S5743.html | 6 +-
.../javascript/rules/javascript/S5757.html | 10 ++--
.../javascript/rules/javascript/S5759.html | 6 +-
.../javascript/rules/javascript/S5852.html | 6 +-
.../javascript/rules/javascript/S5876.html | 10 ++--
.../javascript/rules/javascript/S6245.html | 7 ---
.../javascript/rules/javascript/S6249.html | 8 +--
.../javascript/rules/javascript/S6252.html | 3 -
.../javascript/rules/javascript/S6265.html | 7 +--
.../javascript/rules/javascript/S6268.html | 10 ++--
.../javascript/rules/javascript/S6270.html | 7 +--
.../javascript/rules/javascript/S6275.html | 8 +--
.../javascript/rules/javascript/S6281.html | 6 +-
.../javascript/rules/javascript/S6299.html | 10 ++--
.../javascript/rules/javascript/S6302.html | 7 +--
.../javascript/rules/javascript/S6303.html | 2 +-
.../javascript/rules/javascript/S6304.html | 7 +--
.../javascript/rules/javascript/S6308.html | 9 +--
.../javascript/rules/javascript/S6317.html | 5 +-
.../javascript/rules/javascript/S6319.html | 9 +--
.../javascript/rules/javascript/S6321.html | 5 +-
.../javascript/rules/javascript/S6327.html | 9 +--
.../javascript/rules/javascript/S6329.html | 7 +--
.../javascript/rules/javascript/S6330.html | 9 +--
.../javascript/rules/javascript/S6332.html | 9 +--
.../javascript/rules/javascript/S6333.html | 5 +-
.../javascript/rules/javascript/S6654.html | 21 ++++---
.../javascript/rules/javascript/S6661.html | 7 +--
.../javascript/rules/javascript/S6793.html | 2 +-
.../javascript/rules/javascript/S6827.html | 2 +-
.../javascript/rules/javascript/S6840.json | 8 +--
.../javascript/rules/javascript/S6844.html | 18 ++++--
.../javascript/rules/javascript/S6846.json | 2 +-
.../javascript/rules/javascript/S6850.json | 8 +--
.../javascript/rules/javascript/S888.html | 2 +-
.../javascript/rules/javascript/S905.html | 2 +-
sonarpedia.json | 2 +-
114 files changed, 470 insertions(+), 495 deletions(-)
diff --git a/README.md b/README.md
index 8ea8e7cd50a..47e1c3292c7 100644
--- a/README.md
+++ b/README.md
@@ -9,7 +9,7 @@ This SonarSource project is a [static code analyzer](https://en.wikipedia.org/wi
# Features
- Advanced rules based on pattern matching and control flow analysis
-- [389 JS rules](https://rules.sonarsource.com/javascript) and [393 TS rules](https://rules.sonarsource.com/typescript)
+- [397 JS rules](https://rules.sonarsource.com/javascript) and [402 TS rules](https://rules.sonarsource.com/typescript)
- [26 CSS rules](https://rules.sonarsource.com/css)
- Compatible with ECMAScript 2015-2020
- React JSX, Flow, Vue, and AWS lambda functions support for JavaScript and TypeScript
diff --git a/css-sonarpedia/sonarpedia.json b/css-sonarpedia/sonarpedia.json
index 60bb012a4f5..f28dbb4c4ad 100644
--- a/css-sonarpedia/sonarpedia.json
+++ b/css-sonarpedia/sonarpedia.json
@@ -3,7 +3,7 @@
"languages": [
"CSS"
],
- "latest-update": "2023-12-21T17:13:56.851986Z",
+ "latest-update": "2024-03-28T12:39:07.731724Z",
"options": {
"no-language-in-filenames": true
}
diff --git a/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S106.html b/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S106.html
index d4c024db055..8b943c1c52b 100644
--- a/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S106.html
+++ b/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S106.html
@@ -37,9 +37,9 @@ Code examples
Resources
diff --git a/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S107.html b/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S107.html
index 74ec63f7dc1..f2e1bb1031b 100644
--- a/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S107.html
+++ b/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S107.html
@@ -1,5 +1,5 @@
Why is this an issue?
-Functions with a long parameter list are difficult to use, as maintainers must figure out the role of each parameter and keep track of their
+
Functions with a long parameter list are difficult to use because maintainers must figure out the role of each parameter and keep track of their
position.
function setCoordinates(x1, y1, z1, x2, y2, z2) { // Noncompliant
diff --git a/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S1121.html b/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S1121.html
index 95ee4e4f307..630f29eb0fb 100644
--- a/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S1121.html
+++ b/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S1121.html
@@ -36,6 +36,6 @@ Compliant solution
Resources
diff --git a/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S1125.html b/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S1125.html
index 55b296bd327..67d49e2e0ec 100644
--- a/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S1125.html
+++ b/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S1125.html
@@ -4,7 +4,7 @@ Why is this an issue?
variable or expression that evaluates to a boolean value is unnecessary and can make the code harder to read and understand. The more complex a
boolean expression is, the harder it will be for developers to understand its meaning and expected behavior, and it will favour the introduction of
new bugs.
-How to tix it
+How to fix it
Remove redundant boolean literals from expressions to improve readability and make the code more maintainable.
if (someValue == true) { /* ... */ } // Noncompliant: Redundant comparison
diff --git a/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S1126.html b/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S1126.html
index 9c2dea00dd5..f26f038d4d5 100644
--- a/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S1126.html
+++ b/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S1126.html
@@ -1,6 +1,6 @@
Why is this an issue?
The if...else
statement is used to make decisions based on the truthiness of a boolean expression, and the if
block
-executes when the expression is true
, while the else
block executes when the expression is false.
+executes when the expression is truthy, while the else
block executes when the expression is falsy.
Wrapping a boolean expression in an if...else
statement and returning true
or false
in the respective blocks
is redundant and unnecessary. It can also make the code harder to maintain, as it adds unnecessary lines of code that need to be read and
understood.
diff --git a/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S1134.html b/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S1134.html
index 03e6cdca63c..4f6912ed97f 100644
--- a/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S1134.html
+++ b/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S1134.html
@@ -10,6 +10,6 @@ Why is this an issue?
Resources
Documentation
diff --git a/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S1135.html b/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S1135.html
index cc6d0f8331a..3af845982b6 100644
--- a/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S1135.html
+++ b/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S1135.html
@@ -1,8 +1,8 @@
Why is this an issue?
Developers often use TODO
tags to mark areas in the code where additional work or improvements are needed but are not implemented
-immediately. However, these TODO
tags sometimes get overlooked or forgotten, leading to incomplete or unfinished code. This code smell
-class aims to identify and address such unattended TODO
tags to ensure a clean and maintainable codebase. This description will explore
-why this is a problem and how it can be fixed to improve the overall code quality.
+immediately. However, these TODO
tags sometimes get overlooked or forgotten, leading to incomplete or unfinished code. This rule aims to
+identify and address unattended TODO
tags to ensure a clean and maintainable codebase. This description explores why this is a problem
+and how it can be fixed to improve the overall code quality.
What is the potential impact?
Unattended TODO
tags in code can have significant implications for the development process and the overall codebase.
Incomplete Functionality: When developers leave TODO
tags without implementing the corresponding code, it results in incomplete
@@ -11,8 +11,8 @@
What is the potential impact?
Delayed bug fixes can result in more severe issues and increase the effort required to resolve them later.
Impact on Collaboration: In team-based development environments, unattended TODO
tags can hinder collaboration. Other team members
might not be aware of the intended changes, leading to conflicts or redundant efforts in the codebase.
-Codebase Bloat: Accumulation of unattended TODO
tags over time can clutter the codebase and make it difficult to distinguish between
-work in progress and completed code. This bloat can make it challenging to maintain an organized and efficient codebase.
+Codebase Bloat: The accumulation of unattended TODO
tags over time can clutter the codebase and make it difficult to distinguish
+between work in progress and completed code. This bloat can make it challenging to maintain an organized and efficient codebase.
Addressing this code smell is essential to ensure a maintainable, readable, reliable codebase and promote effective collaboration among
developers.
Noncompliant code example
@@ -23,6 +23,6 @@ Noncompliant code example
Resources
diff --git a/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S117.html b/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S117.html
index 922dd76e687..42c04995a71 100644
--- a/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S117.html
+++ b/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S117.html
@@ -9,15 +9,17 @@ Why is this an issue?
What is the potential impact?
Inconsistent naming of variables, properties, and parameters can lead to several issues in your code:
- - Reduced Readability: inconsistent variable, property, and parameter names make the code harder to read and understand; consequently, it is more
- difficult to identify the purpose of each variable, spot errors, or comprehend the logic.
- - Difficulty in Identifying Variables: variables, properties, and parameters that don’t adhere to a standard naming convention are challenging to
- identify; thus, the coding process slows down, especially when dealing with a large codebase.
- - Increased Risk of Errors: inconsistent or unclear variable, property, and parameter names lead to misunderstandings about what the variable
- represents. This ambiguity leads to incorrect assumptions and, consequently, bugs in the code.
- - Collaboration Difficulties: in a team setting, inconsistent naming conventions lead to confusion and miscommunication among team members.
- - Difficulty in Code Maintenance: inconsistent naming leads to an inconsistent codebase. The code is difficult to understand, and making changes
- feels like refactoring constantly, as you face different naming methods. Ultimately, it makes the codebase harder to maintain.
+ - Reduced Readability: Inconsistent variable, property, and parameter names make the code harder to read and understand;
+ consequently, it is more difficult to identify the purpose of each variable, spot errors, or comprehend the logic.
+ - Difficulty in Identifying Variables: The variables, properties, and parameters that don’t adhere to a standard naming
+ convention are challenging to identify; thus, the coding process slows down, especially when dealing with a large codebase.
+ - Increased Risk of Errors: Inconsistent or unclear variable, property, and parameter names lead to misunderstandings about what
+ the variable represents. This ambiguity leads to incorrect assumptions and, consequently, bugs in the code.
+ - Collaboration Difficulties: In a team setting, inconsistent naming conventions lead to confusion and miscommunication among
+ team members.
+ - Difficulty in Code Maintenance: Inconsistent naming leads to an inconsistent codebase. The code is difficult to understand,
+ and making changes feels like refactoring constantly, as you face different naming methods. Ultimately, it makes the codebase harder to maintain.
+
In summary, not adhering to a naming convention for variables, properties, and parameters can lead to confusion, errors, and inefficiencies, making
the code harder to read, understand, and maintain.
diff --git a/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S1192.html b/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S1192.html
index b0fe1ee2efc..a6dabf0d720 100644
--- a/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S1192.html
+++ b/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S1192.html
@@ -6,8 +6,8 @@ Exceptions
String literals inside import/export statements and JSX attributes are also ignored. The same goes for statement-like string literals, e.g. 'use
strict';
.
How to fix it
-Instead, use constants to replace the duplicated string literals. Constants can be referenced from many places, but only need to be updated in a
-single place.
+Use constants to replace the duplicated string literals. Constants can be referenced from many places, but only need to be updated in a single
+place.
Code examples
Noncompliant code example
With the default threshold of 3:
diff --git a/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S128.html b/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S128.html
index 3e585eec70b..74eb5fcc7e3 100644
--- a/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S128.html
+++ b/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S128.html
@@ -51,6 +51,6 @@ Exceptions
Resources
diff --git a/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S131.html b/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S131.html
index 0ace60aa5a7..f5d31e4020e 100644
--- a/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S131.html
+++ b/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S131.html
@@ -78,6 +78,6 @@ Exceptions
Resources
diff --git a/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S1313.html b/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S1313.html
index 0aa5b23f9eb..4a83be595f8 100644
--- a/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S1313.html
+++ b/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S1313.html
@@ -60,8 +60,8 @@ Exceptions
See
diff --git a/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S1442.html b/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S1442.html
index 54ef6916f95..ef9b6405f82 100644
--- a/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S1442.html
+++ b/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S1442.html
@@ -10,8 +10,8 @@ Noncompliant code example
Resources
diff --git a/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S1444.html b/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S1444.html
index c2082a52a30..ed60185335c 100644
--- a/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S1444.html
+++ b/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S1444.html
@@ -1,13 +1,13 @@
Why is this an issue?
Public static
fields in TypeScript should be declared as readonly
to prevent them from being modified after their initial
assignment. This is a good practice because it makes the code safer by preventing accidental changes to these fields, which could lead to bugs that
-are hard to detect and fix.
+are hard to detect.
class MyClass {
static myField = 42; // Noncompliant
}
-To fix this, declare you static field with the readonly
qualifier .
+To fix this, declare your static field with the readonly
qualifier.
class MyClass {
static readonly myField = 42;
@@ -16,6 +16,7 @@ Why is this an issue?
Resources
Documentation
diff --git a/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S1523.html b/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S1523.html
index dfebb91c7b7..4851ee8bf06 100644
--- a/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S1523.html
+++ b/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S1523.html
@@ -37,9 +37,9 @@ Exceptions
safe.
See
diff --git a/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S1525.html b/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S1525.html
index 478aee4b528..ce334ad7594 100644
--- a/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S1525.html
+++ b/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S1525.html
@@ -21,8 +21,8 @@ Compliant solution
Resources
diff --git a/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S1854.html b/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S1854.html
index 89fd0618d1d..552c7e97e35 100644
--- a/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S1854.html
+++ b/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S1854.html
@@ -43,7 +43,7 @@ Compliant solution
Resources
Standards
Related rules
const runPromise = () => Promise.resolve();
diff --git a/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S3776.html b/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S3776.html
index 037acddfb0b..c908eccb5d0 100644
--- a/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S3776.html
+++ b/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S3776.html
@@ -6,10 +6,10 @@ Why is this an issue?
Which syntax in code does impact cognitive complexity score?
Here are the core concepts:
- - Cognitive complexity is incremented each time the code breaks the normal linear reading flow.
This concerns, for example:
- Loop structures, Conditionals, Catches, Switches, Jumps to label and mixed operators in condition.
- - Each nesting level adds a malus to the breaking call.
During code reading, the deeper you go through nested layers, the
- harder it becomes to keep the context in mind.
+ - Cognitive complexity is incremented each time the code breaks the normal linear reading flow.
This concerns, for example,
+ loop structures, conditionals, catches, switches, jumps to labels, and conditions mixing multiple operators.
+ - Each nesting level increases complexity.
During code reading, the deeper you go through nested layers, the harder it
+ becomes to keep the context in mind.
- Method calls are free
A well-picked method name is a summary of multiple lines of code. A reader can first explore a
high-level view of what the code is performing then go deeper and deeper by looking at called functions content.
Note: This does not
apply to recursive calls, those will increment cognitive score.
@@ -18,6 +18,15 @@ Which syntax in code does impact cognitive complexity score?
What is the potential impact?
Developers spend more time reading and understanding code than writing it. High cognitive complexity slows down changes and increases the cost of
maintenance.
+Exceptions
+Cognitive complexity calculations exclude logical expressions using the ||
and ??
operators when applied within the
+context of default value code patterns.
+
+function greet(name) {
+ name = name || 'Guest';
+ console.log('Hello, ' + name + '!');
+}
+
How to fix it
Reducing cognitive complexity can be challenging.
Here are a few suggestions:
@@ -30,6 +39,9 @@ How to fix it
- Use null-safe operations (if available in the language).
When available the .?
or ??
operator
replaces multiple tests and simplifies the flow.
+Note that the calculation of cognitive complexity deviates from the documented process when functions are nested. Given the functional nature of
+JavaScript, nesting functions is a prevalent practice, especially within frameworks like React.js. Consequently, the cognitive complexity of functions
+remains independent of each other.
Code examples
Extraction of a complex condition in a new function.
Noncompliant code example
diff --git a/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S3923.html b/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S3923.html
index e71161c411c..99ceefa1e40 100644
--- a/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S3923.html
+++ b/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S3923.html
@@ -25,7 +25,7 @@ Why is this an issue?
doSomething();
}
-Either there is a copy-paste error that needs fixing or an unnecessary switch
or if
chain that needs removing.
+Either there is a copy-paste error that needs fixing or an unnecessary switch
or if
chain that should be removed.
Exceptions
This rule does not apply to if
chains without else
, nor to switch
without a default
clause.
diff --git a/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S4036.html b/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S4036.html
index 884f8a1fa80..e6bfbbd66d2 100644
--- a/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S4036.html
+++ b/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S4036.html
@@ -20,10 +20,10 @@ Compliant Solution
See
diff --git a/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S4323.html b/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S4323.html
index 3f2e4c9594d..c32a583ee27 100644
--- a/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S4323.html
+++ b/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S4323.html
@@ -43,6 +43,13 @@ Why is this an issue?
/* ... */
}
+The rule disregards nullable types, irrespective of their frequency within the codebase. This includes types of the form T | null |
+undefined
, where T
can represent any type.
+
+function foo(x: T | null | undefined) {
+ /* ... */
+}
+
Resources
Documentation
diff --git a/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S4423.html b/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S4423.html
index 5415b9ec004..524b52374e0 100644
--- a/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S4423.html
+++ b/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S4423.html
@@ -205,9 +205,13 @@ Articles & blog posts
Standards
diff --git a/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S4426.html b/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S4426.html
index 6c53204ccd6..346159c4326 100644
--- a/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S4426.html
+++ b/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S4426.html
@@ -77,7 +77,7 @@ Noncompliant code example
},
callback);
-Here is an example of an Elliptic Curve (EC) initialization. It implicitly generates a private key whose size is indicated in the algorithm
+
Here is an example of an Elliptic Curve (EC) initialization. It implicitly generates a private key whose size is indicated in the elliptic curve
name:
const crypto = require('crypto');
@@ -118,7 +118,7 @@ Compliant solution
},
callback);
-Here is an example of an Elliptic Curve (EC) initialization. It implicitly generates a private key whose size is indicated in the algorithm
+
Here is an example of an Elliptic Curve (EC) initialization. It implicitly generates a private key whose size is indicated in the elliptic curve
name:
const crypto = require('crypto');
@@ -133,11 +133,12 @@ Compliant solution
callback);
How does this work?
-As a rule of thumb, use the cryptographic algorithms and mechanisms that are considered strong by the cryptographic community.
+As a rule of thumb, use the cryptographic algorithms and mechanisms that are considered strong by the cryptography community.
The appropriate choices are the following.
RSA (Rivest-Shamir-Adleman) and DSA (Digital Signature Algorithm)
The security of these algorithms depends on the difficulty of attacks attempting to solve their underlying mathematical problem.
-In general, a minimum key size of 2048 bits is recommended for both.
+In general, a minimum key size of 2048 bits is recommended for both. It provides 112 bits of security. A key length of
+3072 or 4092 should be preferred when possible.
AES (Advanced Encryption Standard)
AES supports three key sizes: 128 bits, 192 bits and 256 bits. The security of the AES algorithm is based on the computational complexity of trying
all possible keys.
A larger key size increases the number of possible keys and makes exhaustive search attacks computationally infeasible.
@@ -145,8 +146,17 @@
AES (Advanced Encryption Standard)
Currently, a minimum key size of 128 bits is recommended for AES.
Elliptic Curve Cryptography (ECC)
Elliptic curve cryptography is also used in various algorithms, such as ECDSA, ECDH, or ECMQV. The length of keys generated with elliptic curve
-algorithms are mentioned directly in their names. For example, secp256k1
generates a 256-bits long private key.
-Currently, a minimum key size of 224 bits is recommended for EC algorithms.
+algorithms is mentioned directly in their names. For example, secp256k1
generates a 256-bits long private key.
+Currently, a minimum key size of 224 bits is recommended for EC-based algorithms.
+Additionally, some curves that theoretically provide sufficiently long keys are still discouraged. This can be because of a flaw in the curve
+parameters, a bad overall design, or poor performance. It is generally advised to use a NIST-approved elliptic curve wherever possible. Such curves
+currently include:
+
+ - NIST P curves with a size of at least 224 bits, e.g. secp256r1.
+ - Curve25519, generally known as ed25519 or x25519 depending on its application.
+ - Curve448.
+ - Brainpool curves with a size of at least 224 bits, e.g. brainpoolP224r1
+
Going the extra mile
Pre-Quantum Cryptography
Encrypted data and communications recorded today could be decrypted in the future by an attack from a quantum computer.
It is important to keep
@@ -155,6 +165,15 @@
Pre-Quantum Cryptography
Thus, if data is to remain secure beyond 2030, proactive measures should be taken now to ensure its safety.
Learn more here.
Resources
+
Articles & blog posts
Standards
diff --git a/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S4502.html b/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S4502.html
index b3504f1738b..31171b8d8c7 100644
--- a/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S4502.html
+++ b/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S4502.html
@@ -68,10 +68,10 @@ Compliant Solution
See
diff --git a/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S4507.html b/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S4507.html
index e7a2f74e27d..e3e5bec5045 100644
--- a/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S4507.html
+++ b/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S4507.html
@@ -32,10 +32,10 @@ Compliant Solution
See
diff --git a/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S4721.html b/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S4721.html
index 4e78bc6320f..f65b686363d 100644
--- a/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S4721.html
+++ b/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S4721.html
@@ -28,8 +28,8 @@ Compliant Solution
See
diff --git a/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S4784.html b/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S4784.html
index 1d605713177..05962cb453b 100644
--- a/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S4784.html
+++ b/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S4784.html
@@ -42,9 +42,9 @@ Exceptions
It is a good idea to test your regular expression if it has the same pattern on both side of a "|
".
See
diff --git a/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S4787.html b/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S4787.html
index bcf8beeb5c6..4a797508038 100644
--- a/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S4787.html
+++ b/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S4787.html
@@ -71,16 +71,16 @@ Sensitive Code Example
See
diff --git a/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S4790.html b/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S4790.html
index 04af48b547f..f13f139c8dd 100644
--- a/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S4790.html
+++ b/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S4790.html
@@ -28,15 +28,15 @@ Compliant Solution
See
diff --git a/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S4817.html b/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S4817.html
index 1c854da2418..0a54ed7662a 100644
--- a/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S4817.html
+++ b/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S4817.html
@@ -38,7 +38,7 @@ Sensitive Code Example
See
diff --git a/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S4818.html b/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S4818.html
index b54c45b4650..fe18445a2e1 100644
--- a/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S4818.html
+++ b/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S4818.html
@@ -42,10 +42,10 @@ Sensitive Code Example
See
diff --git a/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S4823.html b/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S4823.html
index dbe196e137b..49212522ff2 100644
--- a/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S4823.html
+++ b/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S4823.html
@@ -29,8 +29,8 @@ Sensitive Code Example
See
diff --git a/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S4829.html b/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S4829.html
index 63e876732b1..f99578b58ee 100644
--- a/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S4829.html
+++ b/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S4829.html
@@ -35,6 +35,6 @@ Sensitive Code Example
See
diff --git a/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S4830.html b/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S4830.html
index 79c0ed41c3a..633c9edc558 100644
--- a/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S4830.html
+++ b/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S4830.html
@@ -1,16 +1,15 @@
This vulnerability makes it possible that an encrypted communication is intercepted.
Why is this an issue?
-Transport Layer Security (TLS) provides secure communication between systems over the internet by encrypting the data sent between them. The role
-of certificate validation in this process is to ensure that a system is indeed the one it claims to be, adding an extra layer of trust and
-security.
-When certificate validation is disabled, the client skips this critical check. This creates an opportunity for attackers to pose as a trusted
+
Transport Layer Security (TLS) provides secure communication between systems over the internet by encrypting the data sent between them.
+Certificate validation adds an extra layer of trust and security to this process to ensure that a system is indeed the one it claims to be.
+When certificate validation is disabled, the client skips a critical security check. This creates an opportunity for attackers to pose as a trusted
entity and intercept, manipulate, or steal the data being transmitted.
What is the potential impact?
Establishing trust in a secure way is a non-trivial task. When you disable certificate validation, you are removing a key mechanism designed to
build this trust in internet communication, opening your system up to a number of potential threats.
Identity spoofing
If a system does not validate certificates, it cannot confirm the identity of the other party involved in the communication. An attacker can
-exploit this by creating a fake server and masquerading it as a legitimate one. For example, they might set up a server that looks like your bank’s
+exploit this by creating a fake server and masquerading as a legitimate one. For example, they might set up a server that looks like your bank’s
server, tricking your system into thinking it is communicating with the bank. This scenario, called identity spoofing, allows the attacker to collect
any data your system sends to them, potentially leading to significant data breaches.
Loss of data integrity
@@ -132,18 +131,18 @@ Working with self-signed certificates or non-standard CAs
Resources
Standards
diff --git a/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S5042.html b/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S5042.html
index 04c6bfdc54c..fb357706569 100644
--- a/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S5042.html
+++ b/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S5042.html
@@ -271,12 +271,13 @@ Compliant Solution
See
diff --git a/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S5122.html b/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S5122.html
index 3cdfbafca70..5fce79a2163 100644
--- a/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S5122.html
+++ b/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S5122.html
@@ -86,16 +86,16 @@ Compliant Solution
See
diff --git a/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S5148.html b/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S5148.html
index 12bd03d4850..4c0abf64c39 100644
--- a/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S5148.html
+++ b/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S5148.html
@@ -22,11 +22,11 @@ Compliant Solution
See
diff --git a/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S5247.html b/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S5247.html
index 29f355f8eb7..94662ba5c9d 100644
--- a/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S5247.html
+++ b/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S5247.html
@@ -115,12 +115,12 @@ Compliant Solution
See
diff --git a/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S5332.html b/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S5332.html
index 3c96093bf97..d94de703866 100644
--- a/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S5332.html
+++ b/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S5332.html
@@ -457,15 +457,15 @@ Exceptions
See
- - OWASP Top 10 2021 Category A2 - Cryptographic Failures
- - OWASP Top 10 2017 Category A3 - Sensitive Data
- Exposure
- - Mobile AppSec Verification
- Standard - Network Communication Requirements
- - OWASP Mobile Top 10 2016 Category M3 - Insecure
- Communication
- - MITRE, CWE-200 - Exposure of Sensitive Information to an Unauthorized Actor
- - MITRE, CWE-319 - Cleartext Transmission of Sensitive Information
+ - OWASP - Top 10 2021 Category A2 - Cryptographic Failures
+ - OWASP - Top 10 2017 Category A3 - Sensitive Data Exposure
+
+ - OWASP - Mobile AppSec
+ Verification Standard - Network Communication Requirements
+ - OWASP - Mobile Top 10 2016 Category M3 - Insecure
+ Communication
+ - CWE - CWE-200 - Exposure of Sensitive Information to an Unauthorized Actor
+ - CWE - CWE-319 - Cleartext Transmission of Sensitive Information
- Google, Moving towards more secure web
- Mozilla, Deprecating non secure http
- AWS Documentation - Listeners
diff --git a/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S5443.html b/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S5443.html
index d10ce34e91a..cc01a9b694f 100644
--- a/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S5443.html
+++ b/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S5443.html
@@ -67,13 +67,13 @@
Compliant Solution
See
diff --git a/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S5527.html b/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S5527.html
index e43c7d72728..21ca411cf5b 100644
--- a/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S5527.html
+++ b/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S5527.html
@@ -99,18 +99,18 @@ Use valid certificates
Resources
Standards
diff --git a/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S5542.html b/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S5542.html
index 5c76776e8c6..207834b87ee 100644
--- a/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S5542.html
+++ b/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S5542.html
@@ -14,8 +14,10 @@ Why is this an issue?
For these reasons, as soon as cryptography is included in a project, it is important to choose encryption algorithms that are considered strong and
secure by the cryptography community.
-For AES, the weakest modes are CBC (Cipher Block Chaining) and ECB (Electronic Codebook) because they are either vulnerable to padding oracles or
-do not provide authentication mechanisms.
+For AES, the weakest mode is ECB (Electronic Codebook). Repeated blocks of data are encrypted to the same value, making them easy to identify and
+reducing the difficulty of recovering the original cleartext.
+Unauthenticated modes such as CBC (Cipher Block Chaining) may be used but are prone to attacks that manipulate the ciphertext. They must be used
+with caution.
For RSA, the weakest algorithms are either using it without padding or using the PKCS1v1.5 padding scheme.
What is the potential impact?
The cleartext of an encrypted message might be recoverable. Additionally, it might be possible to modify the cleartext of an encrypted message.
@@ -45,7 +47,8 @@ Compliant solution
How does this work?
As a rule of thumb, use the cryptographic algorithms and mechanisms that are considered strong by the cryptographic community.
Appropriate choices are currently the following.
-For AES: Use Galois/Counter mode (GCM)
+For AES: use authenticated encryption modes
+The best-known authenticated encryption mode for AES is Galois/Counter mode (GCM).
GCM mode combines encryption with authentication and integrity checks using a cryptographic hash function and provides both confidentiality and
authenticity of data.
Other similar modes are:
@@ -56,8 +59,8 @@ For AES: Use Galois/Counter mode (GCM)
- IAPM:
Integer Authenticated Parallelizable Mode
- OCB:
Offset Codebook Mode
-It is also possible to use AES-CBC with HMAC for integrity checks. However, it
-is considered more straightforward to use AES-GCM directly instead.
+It is also possible to use AES-CBC with HMAC for integrity checks. However, it is considered more straightforward to use AES-GCM directly
+instead.
For RSA: use the OAEP scheme
The Optimal Asymmetric Encryption Padding scheme (OAEP) adds randomness and a secure hash function that strengthens the regular inner workings of
RSA.
@@ -75,9 +78,11 @@ Articles & blog posts
Standards
diff --git a/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S5547.html b/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S5547.html
index 94225ace165..76d55f9f2a0 100644
--- a/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S5547.html
+++ b/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S5547.html
@@ -46,9 +46,11 @@ Use a secure algorithm
Resources
Standards
diff --git a/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S5604.html b/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S5604.html
index 55d9288d84f..e7eece7de1b 100644
--- a/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S5604.html
+++ b/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S5604.html
@@ -46,11 +46,11 @@ Compliant Solution
See
- - OWASP Top 10 2021 Category A1 - Broken Access Control
- - OWASP Web Top 10 2017 Category A3 - Sensitive Data
- Exposure
- - MITRE, CWE-250 - Execution with Unnecessary Privileges
- - MITRE, CWE-359 - Exposure of Private Information
+ - OWASP - Top 10 2021 Category A1 - Broken Access Control
+ - OWASP - Web Top 10 2017 Category A3 - Sensitive Data
+ Exposure
+ - CWE - CWE-250 - Execution with Unnecessary Privileges
+ - CWE - CWE-359 - Exposure of Private Information
- W3C - Permissions
- Mozilla - Does Firefox share my location with
websites?
diff --git a/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S5659.html b/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S5659.html
index b8b0365f33f..85267848ba0 100644
--- a/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S5659.html
+++ b/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S5659.html
@@ -85,9 +85,9 @@ Rotate your secret keys
Resources
Standards
diff --git a/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S5689.html b/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S5689.html
index e7795762869..92944727ecc 100644
--- a/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S5689.html
+++ b/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S5689.html
@@ -48,11 +48,11 @@ Compliant Solution
See
diff --git a/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S5691.html b/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S5691.html
index 86ce5e99c22..54ed816bf04 100644
--- a/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S5691.html
+++ b/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S5691.html
@@ -33,11 +33,11 @@ Compliant Solution
See
diff --git a/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S5693.html b/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S5693.html
index 01a9d0b8b48..aa71168d3d5 100644
--- a/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S5693.html
+++ b/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S5693.html
@@ -65,12 +65,12 @@ Compliant Solution
See
diff --git a/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S5725.html b/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S5725.html
index b487ca972b1..95757c05c5a 100644
--- a/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S5725.html
+++ b/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S5725.html
@@ -56,11 +56,11 @@ Compliant Solution
See
diff --git a/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S5728.html b/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S5728.html
index b3aa47c7cc4..af9ed60a758 100644
--- a/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S5728.html
+++ b/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S5728.html
@@ -48,10 +48,10 @@ Compliant Solution
See
diff --git a/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S5730.html b/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S5730.html
index b053feaeddb..af2c25094cb 100644
--- a/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S5730.html
+++ b/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S5730.html
@@ -54,9 +54,9 @@ Compliant Solution
See
- - OWASP Top 10 2021 Category A5 - Security Misconfiguration
- - OWASP Top 10 2017 Category A3 -
- Sensitive Data Exposure
+ - OWASP - Top 10 2021 Category A5 - Security Misconfiguration
+ - OWASP - Top 10 2017 Category A3 - Sensitive Data
+ Exposure
- developer.mozilla.org - Mixed-content
- developer.mozilla.org - Content Security Policy (CSP)
- w3.org - Content Security Policy Level 3
diff --git a/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S5732.html b/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S5732.html
index fb893c6dca8..8caeadb84ef 100644
--- a/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S5732.html
+++ b/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S5732.html
@@ -62,16 +62,16 @@ Compliant Solution
See
diff --git a/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S5734.html b/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S5734.html
index 2a7cfe2a714..c545f5d0e72 100644
--- a/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S5734.html
+++ b/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S5734.html
@@ -53,9 +53,9 @@ Compliant Solution
See
- - OWASP Top 10 2021 Category A5 - Security Misconfiguration
- - OWASP Top 10 2017 Category A6 -
- Security Misconfiguration
+ - OWASP - Top 10 2021 Category A5 - Security Misconfiguration
+ - OWASP - Top 10 2017 Category A6 - Security
+ Misconfiguration
- developer.mozilla.org - X-Content-Type-Options
- blog.mozilla.org - Mitigating MIME
diff --git a/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S5736.html b/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S5736.html
index 9bf21c018b1..a596184ce12 100644
--- a/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S5736.html
+++ b/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S5736.html
@@ -73,12 +73,12 @@
Compliant Solution
See
diff --git a/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S5739.html b/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S5739.html
index b1ed9625a15..3a308420c96 100644
--- a/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S5739.html
+++ b/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S5739.html
@@ -48,9 +48,9 @@ Compliant Solution
See
diff --git a/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S5742.html b/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S5742.html
index 84d75997ea5..130d21a7926 100644
--- a/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S5742.html
+++ b/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S5742.html
@@ -45,9 +45,9 @@ Compliant Solution
See
- - OWASP Top 10 2021 Category A5 - Security Misconfiguration
- - OWASP Top 10 2017 Category A3 -
- Sensitive Data Exposure
+ - OWASP - Top 10 2021 Category A5 - Security Misconfiguration
+ - OWASP - Top 10 2017 Category A3 - Sensitive Data
+ Exposure
- developer.mozilla.org - Certificate Transparency
- wikipedia.org - Certificate Authority
diff --git a/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S5743.html b/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S5743.html
index a256f61150e..74269858385 100644
--- a/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S5743.html
+++ b/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S5743.html
@@ -50,9 +50,9 @@ Compliant Solution
See
- - OWASP Top 10 2021 Category A5 - Security Misconfiguration
- - OWASP Top 10 2017 Category
- A3 - Sensitive Data Exposure
+ - OWASP - Top 10 2021 Category A5 - Security Misconfiguration
+ - OWASP - Top 10 2017 Category A3 - Sensitive Data
+ Exposure
- developer.mozilla.org - X-DNS-Prefetch-Control
- developer.mozilla.org - Using dns-prefetch
diff --git a/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S5757.html b/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S5757.html
index 8edc8e8d4e8..3cf5b5086f8 100644
--- a/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S5757.html
+++ b/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S5757.html
@@ -53,10 +53,10 @@ Compliant Solution
See
diff --git a/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S5759.html b/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S5759.html
index 621175c9c9a..2d474a7cf9c 100644
--- a/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S5759.html
+++ b/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S5759.html
@@ -51,9 +51,9 @@ Compliant Solution
See
diff --git a/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S5852.html b/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S5852.html
index a2488e36481..1a9c587ce3c 100644
--- a/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S5852.html
+++ b/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S5852.html
@@ -79,9 +79,9 @@ Compliant Solution
See
Standards
diff --git a/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S6245.html b/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S6245.html
index 3eb3b8fe391..eb58300401f 100644
--- a/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S6245.html
+++ b/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S6245.html
@@ -55,13 +55,6 @@ Compliant Solution
See
- - OWASP Top 10 2021 Category A4 - Insecure Design
- - OWASP Top 10 2021 Category A5 - Security Misconfiguration
- - MITRE, CWE-311 - Missing Encryption of Sensitive Data
- - OWASP Top 10 2017 Category A3 - Sensitive Data
- Exposure
- - OWASP Top 10 2017 Category A6 - Security
- Misconfiguration
- AWS documentation - Protecting data using
server-side encryption
- AWS CDK version 2 - BucketEncryption
diff --git a/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S6249.html b/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S6249.html
index 9f96462b322..3c630ec7a08 100644
--- a/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S6249.html
+++ b/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S6249.html
@@ -29,17 +29,11 @@ Compliant Solution
See
diff --git a/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S6252.html b/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S6252.html
index b849c2d15d7..e6b3acbba64 100644
--- a/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S6252.html
+++ b/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S6252.html
@@ -29,9 +29,6 @@ Compliant Solution
See
- - OWASP Top 10 2021 Category A5 - Security Misconfiguration
- - OWASP Top 10 2017 Category A6 - Security
- Misconfiguration
- AWS documentation - Using versioning in S3 buckets
- AWS CDK version 2 - Using versioning in S3
buckets
diff --git a/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S6265.html b/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S6265.html
index 95f71537009..902a8bb194d 100644
--- a/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S6265.html
+++ b/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S6265.html
@@ -43,15 +43,12 @@ Compliant Solution
See
diff --git a/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S6268.html b/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S6268.html
index a20641d82c8..06c68cc1b24 100644
--- a/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S6268.html
+++ b/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S6268.html
@@ -59,11 +59,11 @@ Compliant Solution
See
diff --git a/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S6270.html b/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S6270.html
index 0a05078cef9..69380b64fa2 100644
--- a/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S6270.html
+++ b/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S6270.html
@@ -40,12 +40,9 @@ Compliant Solution
See
diff --git a/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S6275.html b/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S6275.html
index 201e32c5bf2..1c55e1bf28f 100644
--- a/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S6275.html
+++ b/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S6275.html
@@ -49,13 +49,7 @@ Compliant Solution
See
diff --git a/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S6281.html b/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S6281.html
index 8435b6b2608..c77d1e35c4d 100644
--- a/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S6281.html
+++ b/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S6281.html
@@ -86,13 +86,9 @@ Compliant Solution
See
diff --git a/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S6299.html b/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S6299.html
index 2f8c5ebcb12..f8b6f5d2ee6 100644
--- a/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S6299.html
+++ b/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S6299.html
@@ -69,11 +69,11 @@ Compliant Solution
See
diff --git a/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S6302.html b/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S6302.html
index a087ece44d0..d8605c9a817 100644
--- a/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S6302.html
+++ b/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S6302.html
@@ -37,13 +37,10 @@ Compliant Solution
See
diff --git a/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S6303.html b/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S6303.html
index b5cf0f90b2e..3b37fbd6958 100644
--- a/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S6303.html
+++ b/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S6303.html
@@ -186,6 +186,6 @@ See
diff --git a/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S6304.html b/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S6304.html
index 98f77bd3669..e07bf9fa50f 100644
--- a/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S6304.html
+++ b/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S6304.html
@@ -48,12 +48,9 @@ Exceptions
See
diff --git a/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S6308.html b/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S6308.html
index 7537c2ce25f..dd5ab7ef02c 100644
--- a/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S6308.html
+++ b/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S6308.html
@@ -64,15 +64,8 @@ Compliant Solution
See
diff --git a/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S6317.html b/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S6317.html
index 542fe1e6170..80acdc1f310 100644
--- a/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S6317.html
+++ b/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S6317.html
@@ -70,9 +70,6 @@ Articles & blog posts
Standards
diff --git a/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S6319.html b/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S6319.html
index 68d128abdbc..2b62935524c 100644
--- a/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S6319.html
+++ b/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S6319.html
@@ -38,14 +38,7 @@ Compliant Solution
See
diff --git a/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S6321.html b/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S6321.html
index 4ce4202871e..4aa5e523009 100644
--- a/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S6321.html
+++ b/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S6321.html
@@ -157,9 +157,6 @@ Documentation
Standards
diff --git a/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S6327.html b/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S6327.html
index 2a7a4b7147a..55e7895093a 100644
--- a/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S6327.html
+++ b/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S6327.html
@@ -51,16 +51,9 @@ Compliant Solution
See
diff --git a/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S6329.html b/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S6329.html
index da543f66ba9..75769cafd65 100644
--- a/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S6329.html
+++ b/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S6329.html
@@ -167,15 +167,12 @@ Compliant Solution
See
diff --git a/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S6330.html b/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S6330.html
index ec2f04bef89..f34a3d095d2 100644
--- a/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S6330.html
+++ b/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S6330.html
@@ -46,15 +46,8 @@ Compliant Solution
See
diff --git a/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S6332.html b/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S6332.html
index 08514fcdbd2..0d537445c60 100644
--- a/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S6332.html
+++ b/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S6332.html
@@ -47,14 +47,7 @@ Compliant Solution
See
diff --git a/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S6333.html b/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S6333.html
index 3e0d995ce48..8aa6e521d6f 100644
--- a/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S6333.html
+++ b/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S6333.html
@@ -75,9 +75,6 @@ See
diff --git a/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S6654.html b/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S6654.html
index c6e8047aa28..d48e3e8ca5d 100644
--- a/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S6654.html
+++ b/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S6654.html
@@ -1,21 +1,20 @@
Why is this an issue?
-JavaScript has a prototypical inheritance model. Each object has an internal property that points to another object, called a
-prototype
. That prototype object has a prototype of its own, and the whole sequence is called a prototype chain. When
-accessing a property or a method of an object, if it is not found at the top level, the search continues through the object’s prototype and then
-further down the prototype chain. This feature allows for very powerful dynamic inheritance patterns but can also lead to confusion when compared to
-the classic inheritance.
+JavaScript has a prototypal inheritance model. Each object has an internal property that points to another object, called a prototype
.
+That prototype object has a prototype of its own, and the whole sequence is called a prototype chain. When accessing a property or a
+method of an object, if it is not found at the top level, the search continues through the object’s prototype and then further down the prototype
+chain. This feature allows for very powerful dynamic inheritance patterns but can also lead to confusion when compared to the classic inheritance.
To simplify the access to the prototype of an object some browsers introduced the __proto__
property, which was later deprecated and
-removed from the language. The current ECMAScript standard includes Object.getPrototype
and Object.setPrototype
static
+removed from the language. The current ECMAScript standard includes Object.getPrototypeOf
and Object.setPrototypeOf
static
methods that should be used instead of the __proto__
property.
-let prototype = foo.__proto__; // Noncompliant: use Object.getPrototype
-foo.__proto__ = bar; // Noncompliant: use Object.setPrototype
+let prototype = foo.__proto__; // Noncompliant: use Object.getPrototypeOf
+foo.__proto__ = bar; // Noncompliant: use Object.setPrototypeOf
-To fix your code replace __proto__
with calls to Object.getPrototype
and Object.setPrototype
static
+
To fix your code replace __proto__
with calls to Object.getPrototypeOf
and Object.setPrototypeOf
static
methods.
-let prototype = Object.getPrototype(foo);
-Object.setPrototype(foo, bar);
+let prototype = Object.getPrototypeOf(foo);
+Object.setPrototypeOf(foo, bar);
Resources
Documentation
diff --git a/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S6661.html b/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S6661.html
index e65ca32af15..5ed1f87978a 100644
--- a/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S6661.html
+++ b/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S6661.html
@@ -1,11 +1,10 @@
Why is this an issue?
When merging objects or copying properties from one object to another, use the object spread syntax instead of Object.assign()
. The
-Object spread syntax was introduced in ES2018 and allows shallow-cloning or merging of objects with a more concise and readable syntax.
+object spread syntax was introduced in ES2018 and allows shallow-cloning or merging of objects with a more concise and readable syntax.
The Object.assign()
also allows to mutate an object, which is not possible with the spread syntax, so the rule only applies to cases
where the first argument of the Object.assign()
is an object literal.
-The object spread syntax improves clarity when you’re modifying an object, as demonstrated in this example: foo = { bar: 42, …baz
-}
.
-Additionally, it provides a more concise way to perform a shallow clone. Instead of using foo = Object.assign({}, bar)
, you can simply
+
The object spread syntax improves clarity when you’re modifying an object, as demonstrated in this example: foo = { bar: 42, …baz }
.
+Additionally, it provides a more concise way to perform a shallow clone. Instead of using foo = Object.assign({}, bar)
, you can simply
write foo = { …bar }
.
const a = Object.assign({}, foo); // Noncompliant: Use spread syntax to clone or merge objects
diff --git a/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S6793.html b/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S6793.html
index a0521d83870..2043d112e07 100644
--- a/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S6793.html
+++ b/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S6793.html
@@ -2,7 +2,7 @@ Why is this an issue?
ARIA (Accessible Rich Internet Applications) attributes are used to enhance the accessibility of web content and web applications. These attributes
provide additional information about an element’s role, state, properties, and values to assistive technologies like screen readers.
This rule checks that the values of ARIA attributes "aria-*" in DOM elements are valid.
-How to fix it in JSX
+How to fix
Check that each element with a defined ARIA attribute has a valid value.
<span aria-hidden="ok">foo</span>
diff --git a/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S6827.html b/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S6827.html
index f16a9c62d73..54d48caad18 100644
--- a/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S6827.html
+++ b/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S6827.html
@@ -6,7 +6,7 @@ Why is this an issue?
of the anchor or navigate the website effectively.
This rule checks that anchors do not use the aria-hidden
property and have content provided either between the tags or as
aria-label
or title
property.
-How to fix it in JSX
+How to fix it
Ensure that anchors either have content or an aria-label
or title
attribute, and they should not use the
aria-hidden
property.
Code examples
diff --git a/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S6840.json b/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S6840.json
index 41b3bd520f9..1f9602a7a77 100644
--- a/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S6840.json
+++ b/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S6840.json
@@ -6,10 +6,6 @@
"func": "Constant\/Issue",
"constantCost": "5min"
},
- "tags": [
- "accessibility",
- "react"
- ],
"defaultSeverity": "Major",
"ruleSpecification": "RSPEC-6840",
"sqKey": "S6840",
@@ -22,6 +18,10 @@
},
"attribute": "CONVENTIONAL"
},
+ "tags": [
+ "accessibility",
+ "react"
+ ],
"compatibleLanguages": [
"JAVASCRIPT",
"TYPESCRIPT"
diff --git a/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S6844.html b/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S6844.html
index bc8256f9d70..f3bd6124ce0 100644
--- a/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S6844.html
+++ b/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S6844.html
@@ -27,14 +27,22 @@ How to fix it
Code examples
Noncompliant code example
-<a href="javascript:void(0)" onClick={foo}>Perform action</a>
-<a href="#" onClick={foo}>Perform action</a>
-<a onClick={foo}>Perform action</a>
+const MyComponent = () => {
+ return <>
+ <a href="javascript:void(0)" onClick={foo}>Perform action</a>
+ <a href="#" onClick={foo}>Perform action</a>
+ <a onClick={foo}>Perform action</a>
+ </>;
+};
Compliant solution
-<button onClick={foo}>Perform action</button>
-<a href="#section" onClick={foo} />
+const MyComponent = () => {
+ return <>
+ <button onClick={foo}>Perform action</button>
+ <a href="#section" onClick={foo}>Perform action</a>
+ </>;
+};
Resources
Documentation
diff --git a/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S6846.json b/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S6846.json
index 27edb4d35e3..856e84fd429 100644
--- a/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S6846.json
+++ b/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S6846.json
@@ -10,7 +10,7 @@
"accessibility",
"react"
],
- "defaultSeverity": "Major",
+ "defaultSeverity": "Minor",
"ruleSpecification": "RSPEC-6846",
"sqKey": "S6846",
"scope": "All",
diff --git a/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S6850.json b/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S6850.json
index 249b9ea479a..f918e65a0cd 100644
--- a/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S6850.json
+++ b/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S6850.json
@@ -6,10 +6,6 @@
"func": "Constant\/Issue",
"constantCost": "5min"
},
- "tags": [
- "accessibility",
- "react"
- ],
"defaultSeverity": "Major",
"ruleSpecification": "RSPEC-6850",
"sqKey": "S6850",
@@ -22,6 +18,10 @@
},
"attribute": "CONVENTIONAL"
},
+ "tags": [
+ "accessibility",
+ "react"
+ ],
"compatibleLanguages": [
"JAVASCRIPT",
"TYPESCRIPT"
diff --git a/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S888.html b/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S888.html
index 13d79761bc7..b66db8cc183 100644
--- a/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S888.html
+++ b/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S888.html
@@ -34,6 +34,6 @@ Exceptions
Resources
diff --git a/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S905.html b/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S905.html
index 9c61f6ee4c6..7c70e34b057 100644
--- a/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S905.html
+++ b/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S905.html
@@ -45,6 +45,6 @@ Compliant solution
Resources
Standards
diff --git a/sonarpedia.json b/sonarpedia.json
index 50da762af96..109e3ca10a4 100644
--- a/sonarpedia.json
+++ b/sonarpedia.json
@@ -3,7 +3,7 @@
"languages": [
"JS"
],
- "latest-update": "2023-12-21T17:10:12.037032Z",
+ "latest-update": "2024-03-28T12:38:08.293231Z",
"options": {
"no-language-in-filenames": true,
"preserve-filenames": true