Problems with S5144 and S5145 in languages != Java?

[Rebse (Gilbert Rebhan)]

Hi,

Sonarqube 9.9 LTS
Recently, we had false positives for these 2 rules confirmed by Sonarsource Support.

Java static code analysis: Server-side requests should not be vulnerable to...

Java static code analysis: Logging should not be vulnerable to injection attacks

it’s also mentioned here

Taint Vulnerabilities - JavaSecurity:S5145 false positive

We encountered a JavaSecurity:S5145 (“Change this code to not log user-controlled data”) false positive. A very similar issue was reported in 2019 (and fixed in 2021): False positive tainted input (JavaSecurity:S5145), except there the user input is received/validated as a path variable: @PutMapping("log/pathvariable/{value}") public void logPatternValidated(@PathVariable @Pattern(regexp = "^[A-Za-z0-9]+$") final String value) { LOG.info("Value is pattern validated: {}", value); } whe…

Is this only a problem with the Java rules for S5144 and S5145 or are implementations for other languages also affected / are there known issues too ?

Gilbert

[ganncamp (G Ann Campbell)]

Hi Gilbert,

Are you asking because you’re experiencing something, or are you trying to get out ahead of potential problems? I believe the core implementation is shared, but that doesn’t mean we’ll necessarily have the same problems in multiple languages.

 
Ann

[Rebse (Gilbert Rebhan)]

Hi Ann,

it’s the second case, means trying to get out ahead of potential problems.
Maybe other users have / had issues with other languages.

Gilbert

[sebastien.andrivet]

Hi,

The two rules do exist for other languages and some detection logic is shared between the different languages. However, the details (what is considered as a source, as a sanitizer, a skin, …) are dependant on the language. Moreover, it is dependent on the libraries used. So when you get a false positive in one language, it does not mean that you will get the same false positive in all languages.

Best regards,

Sebastien