In Unix, "others" class refers to all users except the owner of the file and the members of the group assigned to this file.
Granting permissions to this group can lead to unintended access to files.
+In Unix file system permissions, the "others" category refers to all users except the owner of the file system resource and the
+members of the group assigned to this resource.
Granting permissions to this category can lead to unintended access to files or directories that could allow attackers to obtain sensitive +information, disrupt services or elevate privileges.
Delivering code in production with debug features activated is security-sensitive. It has led in the past to the following vulnerabilities:
- -An application’s debug features enable developers to find bugs more easily and thus facilitate also the work of attackers. It often gives access to -detailed information on both the system running the application and users.
+Development tools and frameworks usually have options to make debugging easier for developers. Although these features are useful during +development, they should never be enabled for applications deployed in production. Debug instructions or error messages can leak detailed information +about the system, like the application’s path or file names.
There is a risk if you answered yes to any of those questions.
Do not enable debug features on production servers or applications distributed to end users.
+Do not enable debugging features on production servers or applications distributed to end users.
Throwable.printStackTrace(...) prints a Throwable and its stack trace to System.Err (by default) which is not easily
parseable and can expose sensitive information:
Receivers can be declared in the manifest or in the code to make them context specific. If the receiver is declared in the manifest Android will +
Receivers can be declared in the manifest or in the code to make them context-specific. If the receiver is declared in the manifest Android will start the application if it is not already running once a matching broadcast is received. The receiver is an entry point into the application.
Other applications can send potentially malicious broadcasts, so it is important to consider broadcasts as untrusted and to limit the applications that can send broadcasts to the receiver.
Permissions can be specified to restrict broadcasts to authorized applications. Restrictions can be enforced by both the sender and receiver of a broadcast. If permissions are specified when registering a broadcast receiver, then only broadcasters who were granted this permission can send a message to the receiver.
-This rule raises an issue when a receiver is registered without specifying any "broadcast permission".
+This rule raises an issue when a receiver is registered without specifying any broadcast permission.
There is a risk if you answered yes to any of those questions.
Restrict the access to broadcasted intents. See Restrict the access to broadcasted intents. See the Android documentation for more information.
Android WebView can be configured to allow a secure origin to load content from any other origin, even if that origin is insecure (mixed -content);
+content):import android.webkit.WebView @@ -79,22 +79,22 @@Compliant Solution
Use instead these clients from Apache commons net and JSch/ssh library:
-JSch jsch = new JSch(); // Compliant +JSch jsch = new JSch(); if(implicit) { // implicit mode is considered deprecated but offer the same security than explicit mode - FTPSClient ftpsClient = new FTPSClient(true); // Compliant + FTPSClient ftpsClient = new FTPSClient(true); } else { - FTPSClient ftpsClient = new FTPSClient(); // Compliant + FTPSClient ftpsClient = new FTPSClient(); } if(implicit) { // implicit mode is considered deprecated but offer the same security than explicit mode - SMTPSClient smtpsClient = new SMTPSClient(true); // Compliant + SMTPSClient smtpsClient = new SMTPSClient(true); } else { - SMTPSClient smtpsClient = new SMTPSClient(); // Compliant + SMTPSClient smtpsClient = new SMTPSClient(); smtpsClient.connect("127.0.0.1", 25); if (smtpsClient.execTLS()) { // commands @@ -103,10 +103,10 @@Compliant Solution
Perform HTTP encrypted connections, with okhttp library for instance:
-ConnectionSpec spec = new ConnectionSpec.Builder(ConnectionSpec.MODERN_TLS) // Compliant +ConnectionSpec spec = new ConnectionSpec.Builder(ConnectionSpec.MODERN_TLS) .build();-The most secure mode for Android WebView is
+MIXED_CONTENT_NEVER_ALLOW;The most secure mode for Android WebView is
MIXED_CONTENT_NEVER_ALLOW:import android.webkit.WebView diff --git a/java-checks/src/main/resources/org/sonar/l10n/java/rules/java/S5810.json b/java-checks/src/main/resources/org/sonar/l10n/java/rules/java/S5810.json index cf8251bf4cd..af285bfeb67 100644 --- a/java-checks/src/main/resources/org/sonar/l10n/java/rules/java/S5810.json +++ b/java-checks/src/main/resources/org/sonar/l10n/java/rules/java/S5810.json @@ -14,5 +14,5 @@ "ruleSpecification": "RSPEC-5810", "sqKey": "S5810", "scope": "Tests", - "quickfix": "unknown" + "quickfix": "covered" } diff --git a/java-checks/src/main/resources/org/sonar/l10n/java/rules/java/S6362.html b/java-checks/src/main/resources/org/sonar/l10n/java/rules/java/S6362.html index 571ec55b7ab..65a90eb1a09 100644 --- a/java-checks/src/main/resources/org/sonar/l10n/java/rules/java/S6362.html +++ b/java-checks/src/main/resources/org/sonar/l10n/java/rules/java/S6362.html @@ -1,6 +1,6 @@WebViews can be used to display web content as part of a mobile application. A browser engine is used to render and display the content. Like a web -application a mobile application that uses WebViews can be vulnerable to Cross-Site Scripting if untrusted code is rendered. In the context of a -WebView JavaScript code can exfiltrate local files that might be sensitive or even worse, access exposed functions of the application that can result +application, a mobile application that uses WebViews can be vulnerable to Cross-Site Scripting if untrusted code is rendered. In the context of a +WebView, JavaScript code can exfiltrate local files that might be sensitive or even worse, access exposed functions of the application that can result in more severe vulnerabilities such as code injection. Thus JavaScript support should not be enabled for WebViews unless it is absolutely necessary and the authenticity of the web resources can be guaranteed.
Ask Yourself Whether
@@ -10,7 +10,7 @@Ask Yourself Whether
There is a risk if you answered yes to any of those questions.
Recommended Secure Coding Practices
-It’s recommended to disable JavaScript support for WebViews unless it is necessary to execute JavaScript code. Only trusted pages should be +
It is recommended to disable JavaScript support for WebViews unless it is necessary to execute JavaScript code. Only trusted pages should be rendered.
Sensitive Code Example
diff --git a/java-checks/src/main/resources/org/sonar/l10n/java/rules/java/S6363.html b/java-checks/src/main/resources/org/sonar/l10n/java/rules/java/S6363.html index 130e617b6a3..577980201c1 100644 --- a/java-checks/src/main/resources/org/sonar/l10n/java/rules/java/S6363.html +++ b/java-checks/src/main/resources/org/sonar/l10n/java/rules/java/S6363.html @@ -1,5 +1,5 @@WebViews can be used to display web content as part of a mobile application. A browser engine is used to render and display the content. Like a web -application a mobile application that uses WebViews can be vulnerable to Cross-Site Scripting if untrusted code is rendered.
+application, a mobile application that uses WebViews can be vulnerable to Cross-Site Scripting if untrusted code is rendered.If malicious JavaScript code in a WebView is executed this can leak the contents of sensitive files when access to local files is enabled.
Ask Yourself Whether
There is a risk if you answered yes to any of those questions.
It’s recommended to disable access to local files for WebViews unless it is necessary. In the case of a successful attack through a Cross-Site +
It is recommended to disable access to local files for WebViews unless it is necessary. In the case of a successful attack through a Cross-Site Scripting vulnerability the attackers attack surface decreases drastically if no files can be read out.
diff --git a/sonarpedia.json b/sonarpedia.json
index e37dd3ba73d..894b35a9753 100644
--- a/sonarpedia.json
+++ b/sonarpedia.json
@@ -3,7 +3,7 @@
"languages": [
"JAVA"
],
- "latest-update": "2023-01-06T15:19:03.336873100Z",
+ "latest-update": "2023-02-13T09:48:50.128257Z",
"options": {
"no-language-in-filenames": true,
"preserve-filenames": false