diff --git a/css-sonarpedia/sonarpedia.json b/css-sonarpedia/sonarpedia.json index 39969479c21..f6a6d52d5b1 100644 --- a/css-sonarpedia/sonarpedia.json +++ b/css-sonarpedia/sonarpedia.json @@ -3,7 +3,7 @@ "languages": [ "CSS" ], - "latest-update": "2024-09-25T13:47:31.326757900Z", + "latest-update": "2024-11-15T08:36:47.923296Z", "options": { "no-language-in-filenames": true } diff --git a/package.json b/package.json index 21fa5e66018..9ee1f9f6564 100644 --- a/package.json +++ b/package.json @@ -30,7 +30,7 @@ "td": "npm --prefix typedoc/searchable-parameters-plugin run setup && npx typedoc --options typedoc/typedoc.js", "prepare": "husky install", "precommit": "pretty-quick --staged", - "count-rules": "node tools/count-rules.js", + "count-rules": "node tools/count-rules.cjs", "_:bridge:copy-protofiles": "cpy --flat packages/jsts/src/parsers/estree.proto sonar-plugin/bridge/src/main/protobuf && cpy --flat packages/jsts/src/parsers/estree.proto lib/jsts/src/parsers", "_:bridge:clear": "rimraf --glob lib/*", "_:plugin:prepare-bridge": "npm pack && node tools/check-distribution-filepath-length.cjs && npm run _:plugin:copy-bridge && npm run generate-rules-list", @@ -44,7 +44,7 @@ "eslint-plugin:types": "tsc -p tsconfig-plugin.json --declaration true --emitDeclarationOnly --outDir lib/types", "eslint-plugin:package-json": "node generate-eslint-package-json.mjs", "eslint-plugin:copy-assets": "cpy LICENSE.txt lib/ --rename LICENSE && cpy packages/jsts/src/rules/README.md lib/ --flat", - "eslint-docs": "npm run compile && eslint-doc-generator lib" + "eslint-docs": "npm run eslint-plugin:compile && eslint-doc-generator lib --init-rule-docs" }, "repository": { "type": "git", diff --git a/sonar-plugin/css/src/main/resources/org/sonar/l10n/css/rules/css/S4650.json b/sonar-plugin/css/src/main/resources/org/sonar/l10n/css/rules/css/S4650.json index 4adb2d5f23a..aa0d48ce3a4 100644 --- a/sonar-plugin/css/src/main/resources/org/sonar/l10n/css/rules/css/S4650.json +++ b/sonar-plugin/css/src/main/resources/org/sonar/l10n/css/rules/css/S4650.json @@ -3,7 +3,7 @@ "type": "BUG", "code": { "impacts": { - "RELIABILITY": "HIGH" + "RELIABILITY": "BLOCKER" }, "attribute": "LOGICAL" }, diff --git a/sonar-plugin/css/src/main/resources/org/sonar/l10n/css/rules/css/S4653.json b/sonar-plugin/css/src/main/resources/org/sonar/l10n/css/rules/css/S4653.json index 872ba12ccea..0696bc7d700 100644 --- a/sonar-plugin/css/src/main/resources/org/sonar/l10n/css/rules/css/S4653.json +++ b/sonar-plugin/css/src/main/resources/org/sonar/l10n/css/rules/css/S4653.json @@ -3,7 +3,7 @@ "type": "BUG", "code": { "impacts": { - "RELIABILITY": "HIGH" + "RELIABILITY": "BLOCKER" }, "attribute": "LOGICAL" }, diff --git a/sonar-plugin/css/src/main/resources/org/sonar/l10n/css/rules/css/S4654.json b/sonar-plugin/css/src/main/resources/org/sonar/l10n/css/rules/css/S4654.json index e47e21b396f..b629efca58e 100644 --- a/sonar-plugin/css/src/main/resources/org/sonar/l10n/css/rules/css/S4654.json +++ b/sonar-plugin/css/src/main/resources/org/sonar/l10n/css/rules/css/S4654.json @@ -3,7 +3,7 @@ "type": "BUG", "code": { "impacts": { - "RELIABILITY": "HIGH" + "RELIABILITY": "BLOCKER" }, "attribute": "LOGICAL" }, diff --git a/sonar-plugin/css/src/main/resources/org/sonar/l10n/css/rules/css/S4668.json b/sonar-plugin/css/src/main/resources/org/sonar/l10n/css/rules/css/S4668.json index cf26cb92d4d..156796d8665 100644 --- a/sonar-plugin/css/src/main/resources/org/sonar/l10n/css/rules/css/S4668.json +++ b/sonar-plugin/css/src/main/resources/org/sonar/l10n/css/rules/css/S4668.json @@ -3,7 +3,7 @@ "type": "BUG", "code": { "impacts": { - "RELIABILITY": "HIGH" + "RELIABILITY": "BLOCKER" }, "attribute": "LOGICAL" }, diff --git a/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S1219.json b/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S1219.json index 0e64d2986d1..203087debd3 100644 --- a/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S1219.json +++ b/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S1219.json @@ -3,7 +3,7 @@ "type": "CODE_SMELL", "code": { "impacts": { - "MAINTAINABILITY": "HIGH" + "MAINTAINABILITY": "BLOCKER" }, "attribute": "CLEAR" }, diff --git a/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S128.json b/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S128.json index 5ed1edb707b..93a3d3856ed 100644 --- a/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S128.json +++ b/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S128.json @@ -3,7 +3,7 @@ "type": "CODE_SMELL", "code": { "impacts": { - "MAINTAINABILITY": "HIGH" + "MAINTAINABILITY": "BLOCKER" }, "attribute": "CLEAR" }, diff --git a/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S1314.json b/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S1314.json index a9793bc31eb..a872f1fe49f 100644 --- a/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S1314.json +++ b/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S1314.json @@ -3,7 +3,7 @@ "type": "CODE_SMELL", "code": { "impacts": { - "MAINTAINABILITY": "HIGH" + "MAINTAINABILITY": "BLOCKER" }, "attribute": "CLEAR" }, diff --git a/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S1451.json b/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S1451.json index 83d2264c70e..5f7419d49a8 100644 --- a/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S1451.json +++ b/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S1451.json @@ -3,7 +3,7 @@ "type": "CODE_SMELL", "code": { "impacts": { - "MAINTAINABILITY": "HIGH" + "MAINTAINABILITY": "BLOCKER" }, "attribute": "LAWFUL" }, diff --git a/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S1526.json b/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S1526.json index 827413edad2..8c25a3282de 100644 --- a/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S1526.json +++ b/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S1526.json @@ -3,7 +3,7 @@ "type": "CODE_SMELL", "code": { "impacts": { - "MAINTAINABILITY": "HIGH" + "MAINTAINABILITY": "BLOCKER" }, "attribute": "CONVENTIONAL" }, diff --git a/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S1527.json b/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S1527.json index e4a6eaf6314..dccb77a7d24 100644 --- a/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S1527.json +++ b/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S1527.json @@ -3,7 +3,7 @@ "type": "CODE_SMELL", "code": { "impacts": { - "MAINTAINABILITY": "HIGH" + "MAINTAINABILITY": "BLOCKER" }, "attribute": "CONVENTIONAL" }, diff --git a/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S2068.json b/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S2068.json index dbaa2ded61c..ab8c1d283eb 100644 --- a/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S2068.json +++ b/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S2068.json @@ -3,7 +3,7 @@ "type": "SECURITY_HOTSPOT", "code": { "impacts": { - "SECURITY": "HIGH" + "SECURITY": "BLOCKER" }, "attribute": "TRUSTWORTHY" }, diff --git a/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S2187.json b/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S2187.json index 534af358f86..218228c1078 100644 --- a/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S2187.json +++ b/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S2187.json @@ -3,7 +3,7 @@ "type": "CODE_SMELL", "code": { "impacts": { - "MAINTAINABILITY": "HIGH" + "MAINTAINABILITY": "BLOCKER" }, "attribute": "TESTED" }, diff --git a/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S2189.json b/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S2189.json index 5c9a4932502..1b19d9f752f 100644 --- a/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S2189.json +++ b/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S2189.json @@ -3,7 +3,7 @@ "type": "BUG", "code": { "impacts": { - "RELIABILITY": "HIGH" + "RELIABILITY": "BLOCKER" }, "attribute": "LOGICAL" }, diff --git a/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S2245.html b/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S2245.html index 0e5246e1b99..ddfdb012b7c 100644 --- a/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S2245.html +++ b/sonar-plugin/javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S2245.html @@ -1,11 +1,19 @@ -

Using pseudorandom number generators (PRNGs) is security-sensitive. For example, it has led in the past to the following vulnerabilities:

+

PRNGs are algorithms that produce sequences of numbers that only approximate true randomness. While they are suitable for applications like +simulations or modeling, they are not appropriate for security-sensitive contexts because their outputs can be predictable if the internal state is +known.

+

In contrast, cryptographically secure pseudorandom number generators (CSPRNGs) are designed to be secure against prediction attacks. CSPRNGs use +cryptographic algorithms to ensure that the generated sequences are not only random but also unpredictable, even if part of the sequence or the +internal state becomes known. This unpredictability is crucial for security-related tasks such as generating encryption keys, tokens, or any other +values that must remain confidential and resistant to guessing attacks.

+

For example, the use of non-cryptographic PRNGs has led to vulnerabilities such as:

When software generates predictable values in a context requiring unpredictability, it may be possible for an attacker to guess the next value that -will be generated, and use this guess to impersonate another user or access sensitive information.

+will be generated, and use this guess to impersonate another user or access sensitive information. Therefore, it is critical to use CSPRNGs in any +security-sensitive application to ensure the robustness and security of the system.

As the Math.random() function relies on a weak pseudorandom number generator, this function should not be used for security-critical applications or for protecting sensitive data. In such context, a cryptographically strong pseudorandom number generator (CSPRNG) should be used instead.

@@ -13,14 +21,14 @@

Ask Yourself Whether

There is a risk if you answered yes to any of those questions.

Recommended Secure Coding Practices

@@ -34,18 +42,20 @@

Compliant Solution

// === Client side === const crypto = window.crypto || window.msCrypto; var array = new Uint32Array(1); -crypto.getRandomValues(array); // Compliant for security-sensitive use cases +crypto.getRandomValues(array); // === Server side === const crypto = require('crypto'); -const buf = crypto.randomBytes(1); // Compliant for security-sensitive use cases +const buf = crypto.randomBytes(1);

See