S2068, S6418, and S6437: Make use of common secret exclusion filter

Author: pierre-loup-tristant-sonarsource

its/ruling/src/test/resources/jboss-ejb3-tutorial/java-S2068.json

@@ -1,9 +1,5 @@
 {
-"org.regex-examples:regex-examples:src/main/java/org/regex/examples/RegexDatabase1.java": [
-749
-],
 "org.regex-examples:regex-examples:src/main/java/org/regex/examples/RegexDatabase8.java": [
-727,
-1257
+727
 ]
 }

its/ruling/src/test/resources/regex-examples/java-S2068.json

@@ -62,6 +62,10 @@
       <artifactId>commons-io</artifactId>
       <scope>test</scope>
     </dependency>
+    <dependency>
+      <groupId>org.sonarsource.analyzer-commons</groupId>
+      <artifactId>sonar-analyzer-commons</artifactId>
+    </dependency>
     <dependency>
       <groupId>org.sonarsource.analyzer-commons</groupId>
       <artifactId>sonar-analyzer-recognizers</artifactId>

java-checks-aws/pom.xml

@@ -28,7 +28,9 @@
 import org.sonar.java.annotations.VisibleForTesting;
 import org.sonar.java.checks.helpers.CredentialMethod;
 import org.sonar.java.checks.helpers.CredentialMethodsLoader;
+import org.sonar.java.checks.helpers.ExpressionsHelper;
 import org.sonar.plugins.java.api.IssuableSubscriptionVisitor;
+import org.sonarsource.analyzer.commons.appsec.SecretClassifier;
 import org.sonar.plugins.java.api.JavaFileScannerContext;
 import org.sonar.plugins.java.api.semantic.MethodMatchers;
 import org.sonar.plugins.java.api.tree.Arguments;
@@ -108,6 +110,10 @@ private void checkArguments(Arguments arguments, CredentialMethod method) {
       ExpressionTree argument = arguments.get(targetArgumentIndex);
       var secondaryLocations = new ArrayList<JavaFileScannerContext.Location>();
       if (isExpressionDerivedFromPlainText(argument, secondaryLocations, new HashSet<>())) {
+        String value = ExpressionsHelper.getConstantValueAsString(argument).value();
+        if (value != null && SecretClassifier.isKnownNonSecret(value)) {
+          continue;
+        }
         reportIssue(argument, ISSUE_MESSAGE, secondaryLocations, null);
       }
     }

java-checks-aws/src/main/java/org/sonar/java/checks/security/HardCodedCredentialsShouldNotBeUsedCheck.java

@@ -8,8 +8,8 @@
 class HardCodedPasswordCheckSample {
 
   private void a(char[] pwd, String var) throws SQLException {
-    MyUnknownClass.myUnknownMethod("password", "xxxxx"); // Noncompliant
-    MyUnknownClass.myUnknownMethod("other", "xxxxx");    // Compliant
+    MyUnknownClass.myUnknownMethod("password", "xvxf6_gaa"); // Noncompliant
+    MyUnknownClass.myUnknownMethod("other", "xvxf6_gaa");    // Compliant
   }
 
 }

java-checks-test-sources/default/src/main/files/non-compiling/checks/HardCodedPasswordCheckSample.java

@@ -8,35 +8,40 @@ class HardCodedPasswordCheckCustom {
   String fieldNameWithBazookaInIt;
 
   private void a(char[] pwd, String var) {
-    String variable2 = "login=a&password=xxx"; // Compliant
-    String variable3 = "login=a&passwd=xxx"; // Compliant
-    String variable4 = "login=a&pwd=xxx"; // Compliant
-    String variable5 = "login=a&marmalade=xxx"; // Noncompliant {{'marmalade' detected in this expression, review this potentially hard-coded password.}}
-//                     ^^^^^^^^^^^^^^^^^^^^^^^
-    String variable6 = "login=a&bazooka=xxx "; // Noncompliant
-
-    String variableNameWithBazookaInIt = "xxx"; // Noncompliant
-//         ^^^^^^^^^^^^^^^^^^^^^^^^^^^
-    String variableNameWithmarMalAdeInIt = "xxx"; // Noncompliant
+    String variable2 = "login=a&password=xvxf6_gaa"; // Compliant
+    String variable3 = "login=a&passwd=xvxf6_gaa"; // Compliant
+    String variable4 = "login=a&pwd=xvxf6_gaa"; // Compliant
+    String variable5 = "login=a&marmalade=xxx"; // Compliant, short value filter
+    String variable5_2 = "login=a&marmalade=xvxf6_gaa"; // Noncompliant {{'marmalade' detected in this expression, review this potentially hard-coded password.}}
+//                       ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
+    String variable6 = "login=a&bazooka=xxx"; // Compliant, short value filter
+    String variable6_2 = "login=a&bazooka=xvxf6_gaa"; // Noncompliant
+
+    String variableNameWithBazookaInIt = "xxx"; // Compliant, , short value filter
+    String variableNameWithBazookaInIt_2 = "xvxf6_gaa"; // Noncompliant
 //         ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
-    String variableNameWithPwdInIt = "xxx"; // Compliant
+    String variableNameWithmarMalAdeInIt = "xvxf6_gaa"; // Noncompliant
+//         ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
+    String variableNameWithPwdInIt = "xvxf6_gaa"; // Compliant
     String otherVariableNameWithPasswordInIt;
-    fieldNameWithPasswordInIt = "xx"; // Compliant
-    this.fieldNameWithBazookaInIt = "xx"; // Noncompliant
+    fieldNameWithPasswordInIt = "xx";
+    this.fieldNameWithBazookaInIt = "xx"; // Compliant, , short value filter
 
 
     HardCodedPasswordCheckCustom myA = new HardCodedPasswordCheckCustom();
-    myA.setProperty("marmalade", "xxxxx"); // Noncompliant
-    myA.setProperty("passwd", "xxxxx"); //Compliant
-    myA.setProperty("pwd", "xxxxx"); // Compliant
+    myA.setProperty("marmalade", "xxxxx"); // Compliant, short value filter
+    myA.setProperty("marmalade", "xvxf6_gaa"); // Noncompliant
+    myA.setProperty("marmalade", "marmalade"); // Compliant
+    myA.setProperty("passwd", "xvxf6_gaa"); //Compliant
+    myA.setProperty("pwd", "xvxf6_gaa"); // Compliant
 
 
-    new PasswordAuthentication("userName", "1234".toCharArray()); // Compliant, handled by S6437
+    new PasswordAuthentication("userName", "xvxf6_gaa".toCharArray()); // Compliant, handled by S6437
     new PasswordAuthentication("userName", pwd); // Compliant
     new PasswordAuthentication("userName", getPwd(var)); // Compliant
     new PasswordAuthentication("userName", var.toCharArray()); // Compliant
 
-    new OtherPasswordAuthentication("userName", "1234".toCharArray()); // Compliant
+    new OtherPasswordAuthentication("userName", "xvxf6_gaa".toCharArray()); // Compliant
   }
 
   private void setProperty(Object property, Object Value) { }