@sonarsource/analyzer-commons-configurations 2.34.0-15495 → 2.36.0-15632

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (6) hide show
  1. package/README.md +72 -3
  2. package/cleartext-protocol-corpus.json +308 -0
  3. package/cleartext-protocol-exclusions.json +74 -0
  4. package/package.json +5 -3
  5. package/secret-exclusion-corpus.json +10 -0
  6. package/secret-patterns.json +1 -0
package/README.md CHANGED
@@ -1,9 +1,10 @@
1
1
  # @sonarsource/analyzer-commons-configurations
2
2
 
3
- Shared analyzer configuration data (secret-exclusion regexes) generated from the sonar-analyzer-commons
4
- SecretClassifier, for use by non-JVM SonarSource analyzers.
3
+ Shared analyzer configuration data generated from sonar-analyzer-commons for non-JVM SonarSource analyzers.
5
4
 
6
- The payload is `secret-patterns.json`.
5
+ ## Secret exclusions
6
+
7
+ The secret-exclusion patterns generated from SecretClassifier are in `secret-patterns.json`.
7
8
 
8
9
  `secret-exclusion-corpus.json` is the matching validation corpus. Every `knownNonSecrets` value must be suppressed by
9
10
  `secret-patterns.json` in your regex engine - either matched by a `patternGroups` regex or equal to an
@@ -12,4 +13,72 @@ be. Assert both in your own test suite, so a pattern that fails to compile or be
12
13
  caught here rather than becoming a missed or a noisy secret finding. A sample's `category` is informational and should
13
14
  not be asserted on.
14
15
 
16
+ ## Cleartext-protocol exclusions
17
+
18
+ `cleartext-protocol-exclusions.json` is generated directly from `CleartextProtocolFilter`.
19
+ It includes the existing exclusions in one document:
20
+
21
+ - `match`: matching semantics for `hostPatterns` and `safeUrlPrefixes`.
22
+ - `cleartextProtocols`: recognized cleartext schemes with the `://` suffix.
23
+ - `hostPatterns`: the `internal`, `namespace` and `documentation` host regexes.
24
+ - `safeUrlPrefixes`: existing identifier URL prefixes that the Java filter treats as safe.
25
+
26
+ Do not maintain a copy of these lists in a consumer or edit the generated JSON by hand.
27
+
28
+ The `match` metadata declares how consumers must apply the exclusions:
29
+
30
+ ```json
31
+ {
32
+ "hostPatterns": {
33
+ "semantics": "find",
34
+ "caseInsensitive": true
35
+ },
36
+ "safeUrlPrefixes": {
37
+ "semantics": "prefix",
38
+ "caseInsensitive": true,
39
+ "target": "fullUrl"
40
+ }
41
+ }
42
+ ```
43
+
44
+ `find` means regex search rather than whole-value matching. `prefix` means starts-with matching;
45
+ `fullUrl` means the complete URL after stripping surrounding whitespace, retaining any port and user information.
46
+ Both matching operations are case-insensitive.
47
+
48
+ ```js
49
+ import exclusions from '@sonarsource/analyzer-commons-configurations/cleartext-protocol-exclusions.json' with { type: 'json' };
50
+
51
+ const hostPatterns = Object.values(exclusions.hostPatterns).map(regex => new RegExp(regex, 'i'));
52
+ ```
53
+
54
+ ### Existing exclusions
55
+
56
+ Preserve `CleartextProtocolFilter.isSafeWithoutTls` semantics:
57
+
58
+ - Strip surrounding whitespace. Check `safeUrlPrefixes` case-insensitively against the complete URL.
59
+ An explicit port or user information changes that prefix and must not be removed before this check.
60
+ - For a valid URI with a scheme and host, non-cleartext schemes are safe. For cleartext schemes, apply
61
+ `hostPatterns` case-insensitively with search semantics to the extracted host. These existing host
62
+ exclusions allow ports.
63
+ - The Java filter also accepts single-label hostnames for valid URIs, excluding IPv6 and decimal or
64
+ hexadecimal numeric IP literals. This parsing logic remains the consuming analyzer's responsibility.
65
+ - When strict URI parsing fails or yields no host, use the Java filter's lenient cleartext-authority
66
+ extraction (skipping optional user information) and apply only the host patterns. Do not grant the
67
+ single-label-host exception through this fallback. If no cleartext authority can be extracted,
68
+ a string is safe only when it does not start with a recognized cleartext protocol prefix.
69
+
70
+ ### Shared regression cases
71
+
72
+ `cleartext-protocol-corpus.json` is exported from the shared resource
73
+ `commons/src/test/resources/org/sonarsource/analyzer/commons/appsec/cleartext-protocol-corpus.json`.
74
+ Both the Commons filter tests and the configurations module consume these cases. Update this resource when adding
75
+ regression examples; Maven copies it into the configurations module without adding it to the Commons runtime JAR.
76
+
77
+ - `safeUrls` and `unsafeUrls` are expected to return `true` and `false` respectively from the baseline safety filter.
78
+
79
+ Run these cases against your consumer to check parity with the Java safety filter.
80
+
81
+ Maven verification checks the exported configuration and corpus in Java. Consuming analyzers such as SonarJS
82
+ must verify npm imports and run the complete shared corpus in their own runtime, where URL parsing may differ.
83
+
15
84
  See [SonarSource/sonar-analyzer-commons](https://github.com/SonarSource/sonar-analyzer-commons) for details.
package/cleartext-protocol-corpus.json ADDED
@@ -0,0 +1,308 @@
1
+ {
2
+ "safeUrls": [
3
+ "https://example.com",
4
+ "sftp://example.com",
5
+ "wss://acme.com",
6
+ "ircs://acme.com",
7
+ "http://localhost",
8
+ "http://LOCALHOST:3000",
9
+ "http://127.0.0.1:8080",
10
+ "http://127.255.255.254/path",
11
+ "http://[::1]/path",
12
+ "http://[0:0:0:0:0:0:0:1]",
13
+ "http://169.254.169.254/latest/meta-data/",
14
+ "http://169.254.169.254/latest/api/token",
15
+ "http://169.254.0.1/",
16
+ "http://169.254.255.254/",
17
+ "http://[fd00:ec2::254]/latest/meta-data/",
18
+ "http://168.63.129.16/",
19
+ "http://168.63.129.16:32526/vmAgentLog",
20
+ "http://100.100.100.200/latest/meta-data/",
21
+ "http://metadata.google.internal/computeMetadata/v1",
22
+ "http://metadata.internal/",
23
+ "http://10.0.2.2/",
24
+ "http://10.0.2.3/",
25
+ "http://10.0.2.15/",
26
+ "http://host.docker.internal:8085/metrics",
27
+ "http://gateway.docker.internal",
28
+ "http://vault.vault.svc.cluster.local:8200",
29
+ "http://auth-service.prod.svc.cluster.local:3001/auth",
30
+ "http://otel-collector.observability.svc.cluster.local:4317",
31
+ "http://www.w3.org/2001/XMLSchema",
32
+ "http://www.w3.org/2005/sparql-results#",
33
+ "http://www.w3.org/2005/Atom",
34
+ "http://www.w3.org/1999/xhtml",
35
+ "http://schemas.android.com/apk/res/android",
36
+ "http://schemas.xmlsoap.org/soap/envelope/",
37
+ "http://schemas.microsoft.com/winfx/2006/xaml",
38
+ "http://www.sap.com/adt/core",
39
+ "http://www.opengis.net/gml",
40
+ "http://hl7.org/fhir",
41
+ "http://unitsofmeasure.org",
42
+ "http://purl.org/dc/elements/1.1/",
43
+ "http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd",
44
+ "http://xmlns.com/foaf/0.1/",
45
+ "http://json-ld.org/contexts/person.jsonld",
46
+ "http://schema.org/Person",
47
+ "http://www.springframework.org/schema/beans",
48
+ "http://maven.apache.org/POM/4.0.0",
49
+ "http://dublincore.org/documents/dces/",
50
+ "http://ogp.me/ns#",
51
+ "http://example.com",
52
+ "http://example.net",
53
+ "http://example.org",
54
+ "http://example.com/path/to/resource",
55
+ "ftp://example.com/file",
56
+ "http://api.example.com/v1/users",
57
+ "http://something.example.com",
58
+ "http://sub.example.org/path",
59
+ "http://myservice.example",
60
+ "http://api.myservice.example/v1",
61
+ "http://myapi.test",
62
+ "http://db.myapi.test:5432",
63
+ "http://myapp.localhost",
64
+ "http://service.myapp.localhost:8080",
65
+ "http://127.1",
66
+ "http://127.0.1",
67
+ "http://127.1:8080/api",
68
+ "ws://localhost",
69
+ "ws://example.com",
70
+ "telnet://127.0.0.1",
71
+ "rtmp://example.com/live",
72
+ "tftp://example.com/file",
73
+ "gopher://example.com",
74
+ "irc://localhost/channel",
75
+ "smtp://localhost:25",
76
+ "smtp://mail.example.com",
77
+ "ldap://localhost/dc=example,dc=com",
78
+ "ldap://127.0.0.1:389",
79
+ "amqp://localhost/vhost",
80
+ "amqp://example.com/queue",
81
+ "mqtt://localhost:1883",
82
+ "mqtt://broker.example.com",
83
+ "imap://localhost:143",
84
+ "imap://mail.example.com",
85
+ "pop3://localhost:110",
86
+ "pop3://mail.example.com",
87
+ "nntp://news.example.com",
88
+ "sip://localhost",
89
+ "sip://example.com",
90
+ "stomp://localhost:61613",
91
+ "stomp://example.com",
92
+ "http://user:password@localhost",
93
+ "http://user:pass@example.com",
94
+ "http://user:${password}@localhost",
95
+ "http://localhost:${port}/api",
96
+ "ftp://files.example.com:${port}/data",
97
+ "ws://localhost:${port}/socket",
98
+ "http://my_service.svc.cluster.local:8200",
99
+ "http://my_app.example.com/path",
100
+ "http://xml.apache.org/xslt",
101
+ "http://schemas.openxmlformats.org/drawingml/2006/main",
102
+ "http://rdfs.org/ns/void#",
103
+ "http://schemas.google.com/g/2005",
104
+ "http://a9.com/-/spec/opensearch/1.1/",
105
+ "http://ns.adobe.com/xap/1.0/",
106
+ "http://ltsc.ieee.org/xsd/LOM",
107
+ "http://docbook.org/ns/docbook",
108
+ "http://graphml.graphdrawing.org/graphml",
109
+ "http://json-schema.org/draft-07/schema",
110
+ "http://www.eclipse.org/emf/2002/Ecore",
111
+ "http://www.mulesoft.org/schema/mule/core",
112
+ "http://www.mulesoft.org/schema/mule/http",
113
+ "http://jabber.org/protocol/disco#items",
114
+ "http://jabber.org/protocol/pubsub#owner",
115
+ "http://jabber.org/features/",
116
+ "http://jabber.org/features/compress",
117
+ "HTTP://JABBER.ORG/FEATURES/COMPRESS",
118
+ "http://apache.org/xml/features/nonvalidating/load-dtd-grammar",
119
+ "http://apache.org/xml/features/nonvalidating/load-external-dtd",
120
+ "http://apache.org/xml/features/dom/create-entity-ref-nodes",
121
+ "http://jabber.org/protocol/${node}",
122
+ "http://apache.org/xml/features/${feature}",
123
+ "http://local-kubernetes-hostname/something",
124
+ "http://local-kubernetes-hostname:8080/something",
125
+ "ws://my-service",
126
+ "http://0x7f000001/",
127
+ "http://0X7F000001/",
128
+ "http://0x7fffffff/",
129
+ "HTTP://LOCALHOST:8080",
130
+ "FTP://127.0.0.1",
131
+ "HTTP://metadata.google.internal",
132
+ "http://WWW.W3.ORG/2001/XMLSchema",
133
+ " http://localhost ",
134
+ "http://www.w3.org/2000/svg",
135
+ "HTTP://WWW.W3.ORG/2000/SVG",
136
+ "http://www.w3.org:8080/2000/svg",
137
+ "http://www.w3.org",
138
+ "http://www.w3.org?query=value#fragment",
139
+ " http://www.w3.org/2000/svg ",
140
+ "http://www.mulesoft.org/schema",
141
+ "http://www.eclipse.org/emf",
142
+ "http://jabber.org/protocol/muc",
143
+ "HTTP://JABBER.ORG/PROTOCOL/MUC",
144
+ "http://jabber.org/protocol/<name>",
145
+ "http://apache.org/xml/features/disallow-doctype-decl",
146
+ "http://localhost:8080/api",
147
+ "http://localhost:<port>",
148
+ "http://127.1/api",
149
+ "http://0x7f000001/api",
150
+ "http://[::1]/api",
151
+ "http://169.254.169.254/latest/meta-data",
152
+ "http://10.0.2.2/api",
153
+ "http://metadata.google.internal/api",
154
+ "http://service.ns.svc.cluster.local",
155
+ "http://example.org/api",
156
+ "http://sub.example.org/api",
157
+ "http://service.test/api",
158
+ "http://my-service/api",
159
+ "https://insecure.com",
160
+ "not-a-url",
161
+ "",
162
+ "http://adnovum.ch/nevisidm/ws",
163
+ "http://auth0.com/oauth/grant-type/password-realm",
164
+ "http://bigcontent.io/cms/schema",
165
+ "http://cv.iptc.org/newscodes/digitalsourcetype",
166
+ "http://dashif.org/guidelines",
167
+ "http://dashif.org/thumbnail_tile",
168
+ "http://data.europa.eu/esco",
169
+ "http://data.europa.eu/p27",
170
+ "http://dbpedia.org/ontology",
171
+ "http://dbpedia.org/property",
172
+ "http://dbpedia.org/resource",
173
+ "http://hapifhir.io/fhir",
174
+ "http://macedir.org/entity-category",
175
+ "http://metadatahub.bijnpo.nl/graph",
176
+ "http://neverssl.com",
177
+ "http://osmand.net/",
178
+ "http://pds.nasa.gov/pds4",
179
+ "http://powerbi.com/product/schema",
180
+ "http://purl.oclc.org/ooxml",
181
+ "http://snomed.info/sct",
182
+ "http://terminology.hl7.org/CodeSystem",
183
+ "http://tizen.org/feature",
184
+ "http://tizen.org/system",
185
+ "http://www.ebu.ch/metadata/ontologies",
186
+ "http://www.garmin.com/xmlschemas",
187
+ "http://www.iab.com/VAST",
188
+ "http://www.ifxforum.org/IFX_150",
189
+ "http://www.naxml.org/POSBO",
190
+ "http://www.nlm.nih.gov/research/umls/rxnorm",
191
+ "http://www.openarchives.org/OAI",
192
+ "http://www.pcats.org/schema",
193
+ "http://www.sat.gob.gt/face2",
194
+ "http://www.sitemaps.org/schemas",
195
+ "http://www.topografix.com/GPX",
196
+ "HTTP://WWW.TOPOGRAFIX.COM/GPX/1/1",
197
+ " \thttp://auth0.com/oauth/grant-type/password-realm\n",
198
+ "http://neverssl.com?query=value",
199
+ "http://osmand.net#identifier",
200
+ "http://www.topografix.com/GPX?version=1#route",
201
+ "http://www.topografix.com/GPXextra",
202
+ "http://neverssl.com/",
203
+ "http://osmand.net?mode=extensions#schema",
204
+ " http://www.topografix.com/GPX ",
205
+ "https://auth0.com/oauth/grant-type",
206
+ "auth0.com/oauth/grant-type",
207
+ "http://auth0.com/OAUTH/grant-type",
208
+ "http://www.topografix.com/gpx",
209
+ "http://auth0.com/oauth/grant-type extra",
210
+ "http://auth0.com/oauth/grant-type\tmore",
211
+ "http://auth0.com/oauth/grant-type\nmore",
212
+ "http://auth0.com/oauth/grant-type\\extra",
213
+ "http://osmand.net",
214
+ "http://osmand.net/api",
215
+ "http://neverssl.com/api",
216
+ "http://NEVERSSL.COM:8080/api"
217
+ ],
218
+ "unsafeUrls": [
219
+ "http://acme.com",
220
+ "http://api.acme.com/v1/users",
221
+ "ftp://files.acme.com",
222
+ "HTTP://ACME.COM",
223
+ "ws://acme.com",
224
+ "telnet://acme.com",
225
+ "rtmp://acme.com/live",
226
+ "tftp://acme.com/file",
227
+ "gopher://acme.com",
228
+ "irc://acme.com/channel",
229
+ "smtp://mail.acme.com",
230
+ "ldap://acme.com/dc=acme,dc=com",
231
+ "amqp://acme.com/vhost",
232
+ "mqtt://broker.acme.com",
233
+ "imap://mail.acme.com",
234
+ "pop3://mail.acme.com",
235
+ "nntp://news.acme.com",
236
+ "sip://acme.com",
237
+ "stomp://acme.com",
238
+ "http://notexample.com",
239
+ "http://example.com.evil.com",
240
+ "http://localhost.evil.com",
241
+ "http://127.0.0.1.evil.com",
242
+ "http://169.254.169.254.evil.com",
243
+ "http://metadata.google.internal.evil.com",
244
+ "http://www.w3.org.evil.com/x",
245
+ "http://schema.org.evil.com/Person",
246
+ "http://www.mulesoft.org.evil.com/schema",
247
+ "http://10.0.2.2.evil.com",
248
+ "http://apache.org/",
249
+ "http://apache.org.evil.com/xml/features/nonvalidating/load-dtd-grammar",
250
+ "http://user:pass@apache.org/xml/features/disallow-doctype-decl",
251
+ "http://jabber.org/other/${x}",
252
+ "http://10.0.1.2/",
253
+ "http://10.0.3.2/",
254
+ "http://10.0.2.100/",
255
+ "http://10.0.2.2555/",
256
+ "http://www.w3.org@evil.com",
257
+ "http://localhost@evil.com",
258
+ "http://localhost:${password}@acme.com",
259
+ "http://localhost:password@acme_corp.com",
260
+ " http://acme.com ",
261
+ "http://",
262
+ "ftp://",
263
+ "ws://",
264
+ "http://foo bar.com",
265
+ "http://[unclosed",
266
+ "http://2130706433/",
267
+ "http://[2001:db8::1]/path",
268
+ "http://insecure.com",
269
+ "ftp://insecure.com",
270
+ "ws://insecure.com",
271
+ "http://www.w3.org.anotherdomain.org/2000/svg",
272
+ "http://localhost.anotherdomain.org",
273
+ "http://example.org.anotherdomain.org",
274
+ "http://jabber.org/",
275
+ "http://jabber.org/other",
276
+ "http://jabber.org/featuresx/compress",
277
+ "http://jabber.org.anotherdomain.org/features/compress",
278
+ "http://jabber.org:80/protocol/muc",
279
+ "http://jabber.org/other/<name>",
280
+ "http://apache.org/xml/featuresx/disallow-doctype-decl",
281
+ "http://user:pass@jabber.org/protocol/muc",
282
+ "http://www.w3.org@anotherdomain.org/2000/svg",
283
+ "http://10.0.3.2/api",
284
+ "http://2130706433",
285
+ "http://0x08080808",
286
+ "http://[2001:db8::1]",
287
+ "http://metadatahub.bijnpo.nl/api",
288
+ "http://identifier.invalid",
289
+ "ftp://auth0.com/oauth/grant-type",
290
+ "http://auth0.com",
291
+ "http://auth0.com?oauth/grant-type",
292
+ "http://auth0.com#oauth/grant-type",
293
+ "http://auth0.com/api",
294
+ "http://auth0.com:80/oauth/grant-type",
295
+ "http://auth0.com:8080/oauth/grant-type",
296
+ "http://sub.auth0.com/oauth/grant-type",
297
+ "http://auth0.com./oauth/grant-type",
298
+ "http://www.topografix.com.anotherdomain.org/GPX/1/1",
299
+ "http://auth0.com.anotherdomain.org/oauth/grant-type/password-realm",
300
+ "http://user@auth0.com/oauth/grant-type",
301
+ "http://auth0.com@anotherdomain.org/oauth/grant-type",
302
+ "http://auth0.com\\other/oauth/grant-type",
303
+ "http://auth0.com/%6fauth/grant-type",
304
+ "http://auth0.com/other/../oauth/grant-type",
305
+ "http://neverssl.com.anotherdomain.org/api",
306
+ "http://osmand.net.anotherdomain.org/api"
307
+ ]
308
+ }
package/cleartext-protocol-exclusions.json ADDED
@@ -0,0 +1,74 @@
1
+ {
2
+ "match": {
3
+ "hostPatterns": {
4
+ "semantics": "find",
5
+ "caseInsensitive": true
6
+ },
7
+ "safeUrlPrefixes": {
8
+ "semantics": "prefix",
9
+ "caseInsensitive": true,
10
+ "target": "fullUrl"
11
+ }
12
+ },
13
+ "cleartextProtocols": [
14
+ "amqp://",
15
+ "ftp://",
16
+ "gopher://",
17
+ "http://",
18
+ "imap://",
19
+ "irc://",
20
+ "ldap://",
21
+ "mqtt://",
22
+ "nntp://",
23
+ "pop3://",
24
+ "rtmp://",
25
+ "sip://",
26
+ "smtp://",
27
+ "stomp://",
28
+ "telnet://",
29
+ "tftp://",
30
+ "ws://"
31
+ ],
32
+ "hostPatterns": {
33
+ "documentation": "(?:(?:^|\\.)example\\.(?:com|net|org)|\\.(?:example|test|localhost))(?=:|$)",
34
+ "internal": "(?:^localhost|^127(?:\\.\\d+){1,3}|^0x7f[0-9a-f]{6}|^\\[(?:0*:){7}:?0*1\\]|^\\[::1\\]|^169\\.254\\.\\d+\\.\\d+|^\\[fd00:ec2::254\\]|^168\\.63\\.129\\.16|^100\\.100\\.100\\.200|^10\\.0\\.2\\.(?:1[56]|[1-6])|^metadata\\.google\\.internal|^metadata\\.internal|^host\\.docker\\.internal|^gateway\\.docker\\.internal|\\.svc\\.cluster\\.local)(?=:|$)",
35
+ "namespace": "(?:^www\\.w3\\.org|^schemas\\.android\\.com|^schemas\\.microsoft\\.com|^schemas\\.xmlsoap\\.org|^www\\.sap\\.com|^www\\.opengis\\.net|^hl7\\.org|^unitsofmeasure\\.org|^purl\\.org|^docs\\.oasis-open\\.org|^xmlns\\.com|^json-ld\\.org|^schema\\.org|^www\\.springframework\\.org|^www\\.mulesoft\\.org|^maven\\.apache\\.org|^dublincore\\.org|^ogp\\.me|^xml\\.apache\\.org|^schemas\\.openxmlformats\\.org|^rdfs\\.org|^schemas\\.google\\.com|^a9\\.com|^ns\\.adobe\\.com|^ltsc\\.ieee\\.org|^docbook\\.org|^graphml\\.graphdrawing\\.org|^json-schema\\.org|^www\\.eclipse\\.org|^neverssl\\.com|^osmand\\.net)(?=:|$)"
36
+ },
37
+ "safeUrlPrefixes": [
38
+ "http://adnovum.ch/nevisidm/ws",
39
+ "http://apache.org/xml/features/",
40
+ "http://auth0.com/oauth/grant-type",
41
+ "http://bigcontent.io/cms/schema",
42
+ "http://cv.iptc.org/newscodes/digitalsourcetype",
43
+ "http://dashif.org/guidelines",
44
+ "http://dashif.org/thumbnail_tile",
45
+ "http://data.europa.eu/esco",
46
+ "http://data.europa.eu/p27",
47
+ "http://dbpedia.org/ontology",
48
+ "http://dbpedia.org/property",
49
+ "http://dbpedia.org/resource",
50
+ "http://hapifhir.io/fhir",
51
+ "http://jabber.org/features/",
52
+ "http://jabber.org/protocol/",
53
+ "http://macedir.org/entity-category",
54
+ "http://metadatahub.bijnpo.nl/graph",
55
+ "http://pds.nasa.gov/pds4",
56
+ "http://powerbi.com/product/schema",
57
+ "http://purl.oclc.org/ooxml",
58
+ "http://snomed.info/sct",
59
+ "http://terminology.hl7.org/codesystem",
60
+ "http://tizen.org/feature",
61
+ "http://tizen.org/system",
62
+ "http://www.ebu.ch/metadata/ontologies",
63
+ "http://www.garmin.com/xmlschemas",
64
+ "http://www.iab.com/vast",
65
+ "http://www.ifxforum.org/ifx_150",
66
+ "http://www.naxml.org/posbo",
67
+ "http://www.nlm.nih.gov/research/umls/rxnorm",
68
+ "http://www.openarchives.org/oai",
69
+ "http://www.pcats.org/schema",
70
+ "http://www.sat.gob.gt/face2",
71
+ "http://www.sitemaps.org/schemas",
72
+ "http://www.topografix.com/gpx"
73
+ ]
74
+ }
package/package.json CHANGED
@@ -1,12 +1,14 @@
1
1
  {
2
2
  "name": "@sonarsource/analyzer-commons-configurations",
3
- "version": "2.34.0-15495",
4
- "description": "Shared analyzer configuration data (secret-exclusion regexes) generated from the sonar-analyzer-commons SecretClassifier, for use by non-JVM SonarSource analyzers. The payload is secret-patterns.json, with the sample values those patterns must reproduce in secret-exclusion-corpus.json.",
3
+ "version": "2.36.0-15632",
4
+ "description": "Shared secret-exclusion and cleartext-protocol configuration and validation corpora from sonar-analyzer-commons for non-JVM SonarSource analyzers.",
5
5
  "license": "LGPL-3.0-only",
6
6
  "files": [
7
7
  "README.md",
8
8
  "secret-patterns.json",
9
- "secret-exclusion-corpus.json"
9
+ "secret-exclusion-corpus.json",
10
+ "cleartext-protocol-exclusions.json",
11
+ "cleartext-protocol-corpus.json"
10
12
  ],
11
13
  "repository": {
12
14
  "type": "git",
package/secret-exclusion-corpus.json CHANGED
@@ -65,6 +65,14 @@
65
65
  "value": "null",
66
66
  "category": "FAKE_VALUE"
67
67
  },
68
+ {
69
+ "value": "(bool)True",
70
+ "category": "FAKE_VALUE"
71
+ },
72
+ {
73
+ "value": "(bool)False",
74
+ "category": "FAKE_VALUE"
75
+ },
68
76
  {
69
77
  "value": "yourpassword",
70
78
  "category": "FAKE_VALUE"
@@ -306,6 +314,8 @@
306
314
  "Xk9Lm2Qp7Rs4Tv1Wz0",
307
315
  "9f8e7d6c5b4a392817",
308
316
  "Tr0ub4dor&3xpl0!t",
317
+ "prefix(bool)True",
318
+ "(bool)FalseSuffix",
309
319
  "__not_closed",
310
320
  "mytoken123",
311
321
  "this_should_remain_unknown"
package/secret-patterns.json CHANGED
@@ -19,6 +19,7 @@
19
19
  "^(my)?pass(word|wd)?\\d{0,5}$",
20
20
  "p[@a]ssw[o0]rd",
21
21
  "^(?:none|undefined|null|true|false|yes|no|1|0)$",
22
+ "^\\(bool\\)(?:true|false)$",
22
23
  "^your",
23
24
  "(?<repeated>.)\\k<repeated>{3}",
24
25
  "\\.\\.\\."