Keywords & Patterns for SonarQube Rule Violations

aworm · October 22, 2019, 2:44pm

I am attempting to find a list of keywords or patterns for the default rules used in SonarQube.

As an example, let’s take the Java rule : Databases should be password-protected
found here: https://rules.sonarsource.com/java/

How does SonarQube determine which variables are passwords or other sensitive information? I’ve looked through the Github documentation & files, but I have yet to find a list of values that influence rule violations.

Michael · October 24, 2019, 7:42am

Hello @aworm, and welcome in this community.

I would advise you to have another look at the implementation of the rule S2115. Most of our plugins are Open Source and you can dig directly into the code.

In the present case, you will find everything here:

github.com

SonarSource/sonar-java/blob/master/java-checks/src/main/java/org/sonar/java/checks/security/EmptyDatabasePasswordCheck.java#L35


import java.util.regex.Pattern;
import org.sonar.check.Rule;
import org.sonar.java.checks.helpers.ExpressionsHelper;
import org.sonar.java.checks.methods.AbstractMethodDetection;
import org.sonar.java.matcher.MethodMatcher;
import org.sonar.plugins.java.api.tree.Arguments;
import org.sonar.plugins.java.api.tree.ExpressionTree;
import org.sonar.plugins.java.api.tree.MethodInvocationTree;


@Rule(key = "S2115")
public class EmptyDatabasePasswordCheck extends AbstractMethodDetection {


  private static final String MESSAGE = "Add password protection to this database.";
  private static final int PASSWORD_ARGUMENT = 2;
  private static final int URL_ARGUMENT = 0;
  private static final Pattern EMPTY_PASSWORD_PATTERN = Pattern.compile(".*password\\s*=\\s*([&;\\)].*|$)");
  private static final Pattern URL_PATTERN = Pattern.compile("(jdbc:mysql://[^:]*:?(?<password>.*)@.*)|(jdbc:oracle:[^:]*:?.*/(?<password2>.*)@.*)");
  private static final List<MethodMatcher> METHOD_MATCHERS = Collections.singletonList(
    MethodMatcher.create().typeDefinition("java.sql.DriverManager").name("getConnection").withAnyParameters());

Looking at it, you will then see that the rule rely on a REGEX rather than a list of values. Regarding how to detect when we expect a password. I’ll let you play with the code.

Regards,
Michael