From 87a13a85ff547b3b859f9437413d13ab3081e97e Mon Sep 17 00:00:00 2001 From: "renovate[bot]" <29139614+renovate[bot]@users.noreply.github.com> Date: Fri, 17 Jul 2026 17:53:28 +0000 Subject: [PATCH 1/2] Update slf4j.version --- its/vibebot/pom.xml | 2 +- pom.xml | 10 +++++----- 2 files changed, 6 insertions(+), 6 deletions(-) diff --git a/its/vibebot/pom.xml b/its/vibebot/pom.xml index db6c149bffc..e139d1e7771 100644 --- a/its/vibebot/pom.xml +++ b/its/vibebot/pom.xml @@ -11,7 +11,7 @@ UTF-8 21 - 1.7.30 + 1.7.36 diff --git a/pom.xml b/pom.xml index aa44a924bb1..7ed619ea3d8 100644 --- a/pom.xml +++ b/pom.xml @@ -92,10 +92,10 @@ 13.8.0.4399 13.4.1.4007 - 11.6.0.85952 + 11.7.0.86025 its/**,java-checks-test-sources/** - 2.25.0.4954 - 6.1.0.3962 + 2.28.0.5085 + 6.3.1.4538 1.26.0.4194 -Xmx512m sonar-java @@ -105,7 +105,7 @@ ${project.groupId}:sonar-java-plugin:jar - 0.8.14 + 0.8.15 5.23.0 ${project.build.directory}/test-java-agent-libs @@ -113,7 +113,7 @@ mockito-core-${mockito-core.version}.jar - 1.7.30 + 1.7.36 2.0.18 From 2d4d7f243dc4589de7177c6a77608ed6737e166b Mon Sep 17 00:00:00 2001 From: Victor Diez Date: Fri, 17 Jul 2026 20:08:36 +0200 Subject: [PATCH 2/2] Update credential rule expectations --- .../test/resources/autoscan/diffs/diff_S6437.json | 2 +- .../java/checks/HardCodedPasswordCheckSample.java | 12 ++++++------ .../main/java/checks/HardCodedSecretCheckSample.java | 10 +++++----- 3 files changed, 12 insertions(+), 12 deletions(-) diff --git a/its/autoscan/src/test/resources/autoscan/diffs/diff_S6437.json b/its/autoscan/src/test/resources/autoscan/diffs/diff_S6437.json index 0962a59b2b9..29ec35fc71e 100644 --- a/its/autoscan/src/test/resources/autoscan/diffs/diff_S6437.json +++ b/its/autoscan/src/test/resources/autoscan/diffs/diff_S6437.json @@ -1,6 +1,6 @@ { "ruleKey": "S6437", "hasTruePositives": true, - "falseNegatives": 62, + "falseNegatives": 61, "falsePositives": 0 } diff --git a/java-checks-test-sources/default/src/main/java/checks/HardCodedPasswordCheckSample.java b/java-checks-test-sources/default/src/main/java/checks/HardCodedPasswordCheckSample.java index 8d887563c13..348d4ec3e13 100644 --- a/java-checks-test-sources/default/src/main/java/checks/HardCodedPasswordCheckSample.java +++ b/java-checks-test-sources/default/src/main/java/checks/HardCodedPasswordCheckSample.java @@ -45,8 +45,8 @@ private void a(char[] pwd, String var) throws SQLException { String query1_1 = "password=???"; // Compliant // Password starting with "\"" are ignored String query7 = "\"password=\""; // Compliant - // Password starting with ":" are reported - String query2 = "password=:password"; // Noncompliant + // Passwords starting with ":" are reported unless excluded by the fake value filter + String query2 = "password=:password"; // Compliant, fake value filter String query3 = "password=:param"; // Noncompliant // Password containing "%s" are ignored String query5 = "password=%s"; // Compliant @@ -73,8 +73,8 @@ private void a(char[] pwd, String var) throws SQLException { String query13 = "password=anonymous\tuser=user"; // Noncompliant String query14 = "password=anonymous\nuser=user"; // Noncompliant String query15 = "password=something&user=user%s"; // Noncompliant - // Password starting with ":" are reported - String query16 = "passwordProtected password=:notAPassword"; // Noncompliant + // Passwords starting with ":" are reported unless excluded by the fake value filter + String query16 = "passwordProtected password=:notAPassword"; // Compliant, fake value filter // ========== 1.2 Urls ========== // Exclusions also apply when the password if found in an url @@ -161,7 +161,7 @@ private void a(char[] pwd, String var) throws SQLException { passphrase = "xvxf6_gaa".toCharArray(); // Noncompliant passphrase = "whatever".toCharArray(); // Compliant, fake value filter passphrase = "xvxf6_gaa".toCharArray(); // Noncompliant - passphrase = PASSED.toCharArray(); // Noncompliant + passphrase = PASSED.toCharArray(); // Compliant, fake value filter passphrase = "".toCharArray(); passphrase = "X".toCharArray(); // Contains a fake password keyword: password @@ -184,7 +184,7 @@ private void a(char[] pwd, String var) throws SQLException { if("xvxf6_gaa".equals(password)) { // Noncompliant // ^^^^^^^^ } - if(PASSED.equals(password)) { // Noncompliant + if(PASSED.equals(password)) { // Compliant, fake value filter } // Short password are ignored if(password.equals("X")) { diff --git a/java-checks-test-sources/default/src/main/java/checks/HardCodedSecretCheckSample.java b/java-checks-test-sources/default/src/main/java/checks/HardCodedSecretCheckSample.java index 4215489b5d7..61f51677dc2 100644 --- a/java-checks-test-sources/default/src/main/java/checks/HardCodedSecretCheckSample.java +++ b/java-checks-test-sources/default/src/main/java/checks/HardCodedSecretCheckSample.java @@ -62,7 +62,7 @@ private void a(char[] secret, String var) throws SQLException { String query6 = "secret=\"%s\""; // Compliant String query7 = "\"secret=\""; // Compliant - String params1 = "user=admin&secret=Secret1023456789021345678"; // Noncompliant + String params1 = "user=admin&secret=Secret1023456789021345678"; // Compliant, fake value filter String params2 = "secret=no\nuser=admin0213456789"; // Compliant String sqlserver1= "pgsql:host=localhost port=5432 dbname=test user=postgres secret=bacdefghijklmnopqrs"; // Noncompliant String sqlserver2 = "pgsql:host=localhost port=5432 dbname=test secret=no user=bacdefghijklmnopqrs"; // Compliant @@ -123,10 +123,10 @@ private void a(char[] secret, String var) throws SQLException { String secret018 = "&12&345678021345678021345&67801&"; // Noncompliant - // Don't filter when the secret is containing any of the secret word. - String secretConst = "Secret_0213456789021345678"; // Noncompliant - String secrets = "secret_0213456789021345678"; // Noncompliant - final String SECRET = "Secret_0213456789021345678"; // Noncompliant + // Values containing a fake-secret keyword are filtered. + String secretConst = "Secret_0213456789021345678"; // Compliant, fake value filter + String secrets = "secret_0213456789021345678"; // Compliant, fake value filter + final String SECRET = "Secret_0213456789021345678"; // Compliant, fake value filter // Simple constants will be filtered thanks to the entropy check final String SECRET_INPUT = "[id='secret']"; // Compliant final String SECRET_PROPERTY = "custom.secret"; // Compliant