SONARJAVA-6528 S2068, S6418, and S6437: Make use of common secret exclusion filter

[pierre-loup-tristant-sonarsource]

Part of SONARJAVA-6528

---

Summary by Gitar

• Dependency updates:
  • Upgraded analyzer-commons to version 2.25.0.4954.
• Security checks improvements:
  • Integrated SecretClassifier into S2068, S6418, and S6437 to filter out known non-secret fake values.
  • Refactored AbstractHardCodedCredentialChecker to use SecretClassifier for identifying potential credentials instead of hardcoded lists and length checks.

_{This will update automatically on new commits.}

[hashicorp-vault-sonar-prod]

SONARJAVA-6528

[asya-vorobeva]

💯

[teemu-rytilahti-sonarsource]

Thank you @pierre-loup-tristant-sonarsource, looks great already! I made some suggestions inline on how to improve this, let me know if something feels off and/or unclear!

[gitar-bot]

Code Review ✅ Approved 1 resolved / 1 findings

Integrates SecretClassifier into security rules S2068, S6418, and S6437 to improve credential filtering, while resolving typos in test-fixture comments. No issues found.

✅ 1 resolved

✅ Quality: Typos in new test-fixture comments

📄 java-checks-test-sources/default/src/main/java/checks/HardCodedPasswordCheckCustom.java:20 📄 java-checks-test-sources/default/src/main/java/checks/HardCodedPasswordCheckCustom.java:28 📄 java-checks-test-sources/default/src/main/java/checks/HardCodedPasswordCheckSample.java:226 📄 java-checks-test-sources/aws/src/main/java/checks/security/HardCodedCredentialsShouldNotBeUsedCheckSample.java:146
A few of the newly added/modified explanatory comments contain typos:

• HardCodedPasswordCheckCustom.java:20 and :28 both read // Compliant, , short value filter with a doubled comma.
• HardCodedPasswordCheckSample.java:226 uses a triple-slash /// instead of // (myA.setProperty("password", "xxxxx"); /// Compliant, short value filter).

These are harmless to the check semantics (comments only) but worth cleaning up for consistency with the surrounding fixtures. Fix by removing the extra comma and the extra slash respectively.

Options

Auto-apply is off → Gitar will not commit updates to this branch.
Display: compact → Showing less information.

Comment with these commands to change the behavior for this request:

Auto-apply	Compact
gitar auto-apply:on	gitar display:verbose

_{Was this helpful? React with 👍 / 👎 | Gitar}

[teemu-rytilahti-sonarsource]

LGTM, thanks @pierre-loup-tristant-sonarsource! 🚀

[sonarqube-next]

Quality Gate passed

Issues
0 New issues
0 Fixed issues
0 Accepted issues

Measures
0 Security Hotspots
0 Dependency risks
100.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube

[gitar-bot]

Code Review ✅ Approved 1 resolved / 1 findings

Integrates SecretClassifier into security rules S2068, S6418, and S6437 to improve credential filtering, while resolving typos in test-fixture comments. No issues found.

✅ 1 resolved

✅ Quality: Typos in new test-fixture comments

📄 java-checks-test-sources/default/src/main/java/checks/HardCodedPasswordCheckCustom.java:20 📄 java-checks-test-sources/default/src/main/java/checks/HardCodedPasswordCheckCustom.java:28 📄 java-checks-test-sources/default/src/main/java/checks/HardCodedPasswordCheckSample.java:226 📄 java-checks-test-sources/aws/src/main/java/checks/security/HardCodedCredentialsShouldNotBeUsedCheckSample.java:146
A few of the newly added/modified explanatory comments contain typos:

• HardCodedPasswordCheckCustom.java:20 and :28 both read // Compliant, , short value filter with a doubled comma.
• HardCodedPasswordCheckSample.java:226 uses a triple-slash /// instead of // (myA.setProperty("password", "xxxxx"); /// Compliant, short value filter).

These are harmless to the check semantics (comments only) but worth cleaning up for consistency with the surrounding fixtures. Fix by removing the extra comma and the extra slash respectively.

Options

Auto-apply is off → Gitar will not commit updates to this branch.
Display: compact → Showing less information.

Comment with these commands to change the behavior for this request:

Auto-apply	Compact
gitar auto-apply:on	gitar display:verbose

_{Was this helpful? React with 👍 / 👎 | Gitar}