SAST Engine custom config for Java for annotations

[Victor_Ciresica]

Hello,

I am trying to write a custom configuration for Java SAST Engine for the @RestQuery annotation. I want to mark parameters annotated with @RestQuery as a source. I cannot figure out how I can do it from the documentation.
Is there a specific way to add annotations as a source in SAST Engine using json custom configuration?
Do I have to dig into the documentation from the library for the consumer of this annotation, and try to add to the SAST Engine config the method that assigns the value to the annotated parameter based on the presence of the annotation?

My aim is to be able to enable sonar rules to detect issues for RestQuery, as it does for QueryParam for example:

VS

[ganncamp (G Ann Campbell)]

Hi,

Welcome to the community!

That mechanism was intended for naming specific methods, rather than for declaring a pattern for recognition. So what you’re after isn’t currently possible.

And I’ll let the PMs know about the need.

 
Ann

[Victor_Ciresica]

Hello,

Thank you for the response. It is a pity that it’s not possible. Would be great if annotations would be supported in a future release, but I don’t know how complicated the implementation would be, so I will not get my hopes too high.

[Alexandre_Gigleux]

Hello,

Do you confirm you are using SonarQube Enterprise Edition? Which version?

For such API provided by Quarkus (@RestQuery), I believe Sonar should support it out of the box.
The engine’s customization was designed to support APIs that Sonar can’t know. For example, an internal API only used in your company.

I’ll double check with our AppSec team to see if @RestQuery should be considered out of the box as a “source”.

Alex

[Victor_Ciresica]

Hello,

Yes, I am using SonarQube Enterprise, version 10.7. It would be great if it was supported out of the box.

Thank you,
Victor

[Hendrik_Buchwald]

Hello Victor,

can you please try this custom configuration?

{
  "common": {
    "sources": [
      {
        "methodId": "org.jboss.resteasy.reactive.RestQuery"
      }
    ]
  }
}

I will create tickets now to support this (and some other related annotations) out of the box.

[Victor_Ciresica]

The configuration works! So it was that simple.

Thank you.

[Hendrik_Buchwald]

Great, thanks for the update! I will make sure that it is included in the January release.