Skip to content

Commit 6823d16

Browse files
marcosanz-apiqualitymarcosanz-apiquality
authored
Merge pull request #34 from apiaddicts/fix/27/oar_75_less_restrictive
Fix/27/oar 75 less restrictive
2 parents 327d25a + 5649fff commit 6823d16

File tree

14 files changed

+57
-36
lines changed

14 files changed

+57
-36
lines changed

‎src/main/java/apiaddicts/sonar/openapi/checks/security/OAR075StringParameterIntegrityCheck.java‎

Lines changed: 32 additions & 21 deletions
Original file line numberDiff line numberDiff line change
@@ -1,21 +1,39 @@
11
package apiaddicts.sonar.openapi.checks.security;
22

3+
import apiaddicts.sonar.openapi.checks.BaseCheck;
34
import com.google.common.collect.ImmutableSet;
45
import com.sonar.sslr.api.AstNodeType;
6+
import java.util.Arrays;
7+
import java.util.HashSet;
8+
import java.util.Set;
9+
import java.util.stream.Collectors;
510
import org.apiaddicts.apitools.dosonarapi.api.v2.OpenApi2Grammar;
611
import org.apiaddicts.apitools.dosonarapi.api.v3.OpenApi3Grammar;
712
import org.apiaddicts.apitools.dosonarapi.api.v31.OpenApi31Grammar;
813
import org.apiaddicts.apitools.dosonarapi.sslr.yaml.grammar.JsonNode;
914
import org.sonar.check.Rule;
10-
import apiaddicts.sonar.openapi.checks.BaseCheck;
11-
12-
import java.util.Set;
15+
import org.sonar.check.RuleProperty;
1316

1417
@Rule(key = OAR075StringParameterIntegrityCheck.KEY)
1518
public class OAR075StringParameterIntegrityCheck extends BaseCheck {
1619

1720
public static final String KEY = "OAR075";
1821
private static final String MESSAGE = "OAR075.error";
22+
private static final String PARAMETER_INTEGRITY = "minLength,maxLength,enum,format";
23+
24+
@RuleProperty(
25+
key = "parameter_integrity",
26+
description = "String parameters integrity (minLength,maxLength,pattern,enum,format).Comma separated.",
27+
defaultValue = PARAMETER_INTEGRITY
28+
)
29+
private String parameterIntegrityStr = PARAMETER_INTEGRITY;
30+
31+
32+
private Set<String> getActiveIntegrityChecks() {
33+
return Arrays.stream(parameterIntegrityStr.split(","))
34+
.map(String::trim)
35+
.collect(Collectors.toSet());
36+
}
1937

2038
@Override
2139
public Set<AstNodeType> subscribedKinds() {
@@ -40,15 +58,11 @@ public void visitParameterNode(JsonNode node) {
4058
boolean isStringType = typeNode != null && "string".equals(typeNode.getTokenValue());
4159

4260
if (isStringType) {
43-
JsonNode minLengthNode = schemaNode.get("minLength");
44-
JsonNode maxLengthNode = schemaNode.get("maxLength");
45-
JsonNode patternNode = schemaNode.get("pattern");
46-
JsonNode enumNode = schemaNode.get("enum");
47-
JsonNode formatNode = schemaNode.get("format");
48-
49-
boolean lacksLengthRestriction = minLengthNode.isMissing() != maxLengthNode.isMissing();
50-
boolean lacksRestriction = (lacksLengthRestriction || (patternNode.isMissing() && enumNode.isMissing() && formatNode.isMissing()));
51-
if (lacksRestriction) {
61+
Set<String> checks = getActiveIntegrityChecks();
62+
boolean hasChecks = checks.stream()
63+
.allMatch(key -> schemaNode.get(key) != null && !schemaNode.get(key).isMissing());
64+
65+
if (!hasChecks) {
5266
addIssue(KEY, translate(MESSAGE), typeNode);
5367
}
5468
}
@@ -61,15 +75,12 @@ public void visitSwaggerParameterNode(JsonNode node) {
6175
boolean isStringType = typeNode != null && "string".equals(typeNode.getTokenValue());
6276

6377
if (isStringType) {
64-
JsonNode minLengthNode = node.get("minLength");
65-
JsonNode maxLengthNode = node.get("maxLength");
66-
JsonNode patternNode = node.get("pattern");
67-
JsonNode enumNode = node.get("enum");
68-
JsonNode formatNode = node.get("format");
69-
70-
boolean lacksLengthRestriction = minLengthNode.isMissing() != maxLengthNode.isMissing();
71-
boolean lacksRestriction = (lacksLengthRestriction || (patternNode.isMissing() && enumNode.isMissing() && formatNode.isMissing()));
72-
if (lacksRestriction) {
78+
79+
Set<String> checks = getActiveIntegrityChecks();
80+
boolean hasChecks = checks.stream()
81+
.allMatch(key -> node.get(key) != null && !node.get(key).isMissing());
82+
83+
if (!hasChecks) {
7384
addIssue(KEY, translate(MESSAGE), typeNode);
7485
}
7586
}

‎src/main/resources/messages/errors.properties‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -83,7 +83,7 @@ OAR071.error=Query parameters {0} must be defined
8383
OAR072.error=Non OK responses shouldnt have stackTraces
8484
OAR073.error=API should include a 429 response to indicate rate limiting
8585
OAR074.error=Numeric parameters should have minimum, maximum, or format restriction
86-
OAR075.error=String parameters should have minLength, maxLength, pattern (regular expression), or enum restriction
86+
OAR075.error=String parameters should have minLength, maxLength, pattern (regular expression), or enum restriction that are defined in the properties
8787
OAR076.error=Numeric types requires a valid format
8888
OAR077.error=All parameters in query must be snake_case
8989
OAR078.error=All API methods must have security

‎src/main/resources/messages/errors_es.properties‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -83,7 +83,7 @@ OAR071.error=Parametros in: query {0} deben ser definidos
8383
OAR072.error=Las respuestas que no son de la gama 2XX no deberían llevar stackTraces
8484
OAR073.error=La API debería incluir una respuesta 429 para indicar la limitación de la tasa
8585
OAR074.error=Los parámetros numéricos deben tener restricciones de mínimo, máximo o formato
86-
OAR075.error=Los parámetros de tipo String deberían tener restricciones de minLength, maxLength, pattern (expresión regular) o enum
86+
OAR075.error=Los parámetros de tipo String deberían tener restricciones de minLength, maxLength, pattern (expresión regular) o enum que se definen en las propiedades
8787
OAR076.error=Las propiedades de tipo numérico deben definir un formato
8888
OAR077.error=Todos los parámetros in query deben ser snake_case
8989
OAR078.error=Todos los métodos de una API deben tener seguridad

‎src/main/resources/org/sonar/l10n/openapi/rules/openapi/security/OAR075.html‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
1-
<p>String parameters should have minimum length, maximum length, regular expression, or enum restriction.</p>
1+
<p>String parameters should have minimum length, maximum length, regular expression,format or enum restriction.</p>
22
<h2>Noncompliant Code Example (OpenAPI 2)</h2>
33
<pre>
44
swagger: '2.0'
@@ -12,7 +12,7 @@ <h2>Noncompliant Code Example (OpenAPI 2)</h2>
1212
- name: id
1313
in: path
1414
required: true
15-
type: string <span class="error-info" style="color: #FD8E18;"># Noncompliant {{OAR075: String parameters should have minLength, maxLength, pattern (regular expression), or enum restriction}}</span>
15+
type: string <span class="error-info" style="color: #FD8E18;"># Noncompliant {{OAR075: String parameters should have minLength, maxLength, pattern (regular expression), or enum restriction that are defined in the properties}}</span>
1616
responses:
1717
'200':
1818
description: Un usuario
@@ -56,7 +56,7 @@ <h2>Noncompliant Code Example (OpenAPI 3)</h2>
5656
in: path
5757
required: true
5858
schema:
59-
type: string <span class="error-info" style="color: #FD8E18;"># Noncompliant {{OAR075: String parameters should have minLength, maxLength, pattern (regular expression), or enum restriction}}</span>
59+
type: string <span class="error-info" style="color: #FD8E18;"># Noncompliant {{OAR075: String parameters should have minLength, maxLength, pattern (regular expression), or enum restriction that are defined in the properties}}</span>
6060
responses:
6161
'200':
6262
description: Un usuario

‎src/main/resources/org/sonar/l10n/openapi/rules/openapi/security/OAR075.json‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
{
2-
"title": "OAR075 - StringParameterIntegrityCheck - String parameters should have minLength, maxLength, pattern (regular expression), or enum restriction",
2+
"title": "OAR075 - StringParameterIntegrityCheck - String parameters should have minLength, maxLength, pattern (regular expression),format or enum restriction",
33
"type": "VULNERABILITY",
44
"status": "ready",
55
"remediation": {

‎src/test/java/org/sonar/samples/openapi/checks/security/OAR075StringParameterIntegrityCheckTest.java‎

Lines changed: 9 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,13 +1,13 @@
11
package org.sonar.samples.openapi.checks.security;
22

3+
import apiaddicts.sonar.openapi.checks.security.OAR075StringParameterIntegrityCheck;
34
import org.junit.Before;
45
import org.junit.Test;
56
import org.sonar.api.rule.Severity;
67
import org.sonar.api.rules.RuleType;
8+
import org.sonar.api.server.rule.RuleParamType;
79
import org.sonar.samples.openapi.BaseCheckTest;
810

9-
import apiaddicts.sonar.openapi.checks.security.OAR075StringParameterIntegrityCheck;
10-
1111
public class OAR075StringParameterIntegrityCheckTest extends BaseCheckTest {
1212

1313
@Before
@@ -38,8 +38,14 @@ public void verifyInV3noRestrictions() {
3838
verifyV3("no-restrictions");
3939
}
4040

41+
@Override
42+
public void verifyParameters() {
43+
assertNumberOfParameters(1);
44+
assertParameterProperties("parameter_integrity", "minLength,maxLength,enum,format", RuleParamType.STRING);
45+
}
46+
4147
@Override
4248
public void verifyRule() {
43-
assertRuleProperties("OAR075 - StringParameterIntegrityCheck - String parameters should have minLength, maxLength, pattern (regular expression), or enum restriction", RuleType.VULNERABILITY, Severity.MAJOR, tags("safety"));
49+
assertRuleProperties("OAR075 - StringParameterIntegrityCheck - String parameters should have minLength, maxLength, pattern (regular expression),format or enum restriction", RuleType.VULNERABILITY, Severity.MAJOR, tags("safety"));
4450
}
4551
}

‎src/test/resources/checks/v2/security/OAR075/no-restrictions.json‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -12,7 +12,7 @@
1212
"name": "id",
1313
"in": "path",
1414
"required": true,
15-
"type": "string" # Noncompliant {{OAR075: String parameters should have minLength, maxLength, pattern (regular expression), or enum restriction}}
15+
"type": "string" # Noncompliant {{OAR075: String parameters should have minLength, maxLength, pattern (regular expression), or enum restriction that are defined in the properties}}
1616
}
1717
],
1818
"responses": {

‎src/test/resources/checks/v2/security/OAR075/no-restrictions.yaml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -9,7 +9,7 @@ paths:
99
- name: id
1010
in: path
1111
required: true
12-
type: string # Noncompliant {{OAR075: String parameters should have minLength, maxLength, pattern (regular expression), or enum restriction}}
12+
type: string # Noncompliant {{OAR075: String parameters should have minLength, maxLength, pattern (regular expression), or enum restriction that are defined in the properties}}
1313
responses:
1414
'200':
1515
description: Un usuario

‎src/test/resources/checks/v2/security/OAR075/with-restrictions.json‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -15,7 +15,8 @@
1515
"type": "string",
1616
"minLength": 10,
1717
"maxLength": 100,
18-
"enum": ["admin", "user", "guest"]
18+
"enum": ["admin", "user", "guest"],
19+
"format": "date"
1920
}
2021
],
2122
"responses": {

‎src/test/resources/checks/v2/security/OAR075/with-restrictions.yaml‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -13,6 +13,7 @@ paths:
1313
minLength: 10
1414
maxLength: 100
1515
enum: ['admin', 'user', 'guest']
16+
format: date
1617
responses:
1718
'200':
1819
description: Un usuario

0 commit comments

Comments
 (0)