SONARPY-489 Rule S2092: Creating cookies without the "secure" flag is security-sensitive

[andrea-guarino-sonarsource]

No description provided.

[guillaume-dequenne]

If I understood correctly, we won't cover this case at first, so I guess it might be worth updating the rule description.

[guillaume-dequenne]

This implementation seems to assume the secure flag will always be passed as a keyword argument, with a risk of FP if it's passed as a positional argument. I haven't checked for django but I believe it's possible to use positional arguments with flask at least.
Would you consider accounting for positional arguments as well to avoid those FP (maybe by doing something similar to PredictableSaltCheck) ?

[andrea-guarino-sonarsource]

Yes good point, I'll check for positional argument

[guillaume-dequenne]

I think you forgot to rename this variable.

[andrea-guarino-sonarsource]

Indeed, thanks! :)

[guillaume-dequenne]

Just a thought: do you think it would actually be feasible to raise on cases like:
cookie['c1'] = 'value' # FN
by checking whether the cookie symbol has another assignment usage with the same c1 subscript as well as a secure one?
Maybe it's not worth doing as I believe this is not the usual way to set cookies and it might be more complex to do than it looks, but I prefer mentioning it, feel free to disregard this!

[andrea-guarino-sonarsource]

That's a fair point. However I have the feeling that the value doesn't justify the extra complexity. I suggest to create a ticket to keep track of this FN.

[andrea-guarino-sonarsource]

Ticket created https://jira.sonarsource.com/browse/SONARPY-577

[guillaume-dequenne]

Just a comment about Optional#orElse, otherwise lgtm

[guillaume-dequenne]

Could you use Optional#orElseGet instead of orElse ? As the latter is always evaluated no matter whether the former is present or not.

[andrea-guarino-sonarsource]

good catch! thanks!