Add secret example

.github/workflows/build.yml

@@ -10,21 +10,34 @@ jobs:
     name: Build
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v2
+      - uses: actions/checkout@v5
         with:
           fetch-depth: 0  # Shallow clones should be disabled for a better relevancy of analysis
+      - uses: actions/upload-artifact@65462800fd760344b1a7b4382951275a0abb4808 #v4.3.3
+        with:
+          path: |
+            .git/HEAD
+            !.git/HEAD
+
+      - name: Debug
+        run: |
+          echo "Listing .git directory contents:"
+          ls -la .git
+          echo "Displaying .git/HEAD contents:"
+          cat .git/HEAD
+
       - name: Set up JDK 11
         uses: actions/setup-java@v1
         with:
           java-version: 11
       - name: Cache SonarCloud packages
-        uses: actions/cache@v1
+        uses: actions/cache@v4
         with:
           path: ~/.sonar/cache
           key: ${{ runner.os }}-sonar
           restore-keys: ${{ runner.os }}-sonar
       - name: Cache Maven packages
-        uses: actions/cache@v1
+        uses: actions/cache@v4
         with:
           path: ~/.m2
           key: ${{ runner.os }}-m2-${{ hashFiles('**/pom.xml') }}
@@ -33,4 +46,4 @@ jobs:
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}  # Needed to get PR information, if any
           SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}
-        run: mvn -B verify org.sonarsource.scanner.maven:sonar-maven-plugin:sonar -Dsonar.projectKey=SonarWeAreDevelopersDemo_java-demo-1
+        run: mvn -B verify org.sonarsource.scanner.maven:sonar-maven-plugin:sonar -Dsonar.projectKey=SonarWeAreDevelopersDemo_java-demo-1

Foo.java

@@ -0,0 +1 @@
+class Foo {}

Readme.md

@@ -0,0 +1 @@
+Test

check.sh

@@ -0,0 +1,26 @@
+#!/bin/bash
+          patterns=(
+            '^.*\/src\/main\/resources\/org\/sonar\/l10n\/[^\/]+\/rules\/.*$'
+            '^.*\/src\/main\/resources\/com\/sonar\/l10n\/[^\/]+\/rules\/.*$'
+            '^.*sonarpedia\.json$'
+            '^.*\.md$'
+          )
+          changed_files=$(git diff --name-only origin/master)
+          for file in $changed_files; do
+            matched=false
+            for pattern in "${patterns[@]}"; do
+              if [[ $file =~ $pattern ]]; then
+                matched=true
+                break
+              fi
+            done
+            if [[ $matched == false ]]; then
+              echo "File '$file' does not match metadata patterns."
+              break
+            fi
+          done
+          if [[ $matched == false ]]; then
+            echo "All jobs will be executed"
+          else
+            echo "The changes contains only metadata files. The QA jobs will be skipped."
+          fi

iac/Microsoft.Network_networkInterfaces.bicep

@@ -0,0 +1,31 @@
+resource raiseAnIssue 'Microsoft.Network/networkInterfaces@2022-11-01' = {
+  name: 'Raise an issue'
+  properties: {
+    ipConfigurations: [
+      {
+        properties: {
+          subnet: {
+            properties: {
+              networkSecurityGroup: {
+                properties: {
+                  securityRules: [
+                    {
+                      properties: {
+                        // TODO fix me
+                        direction: 'Inbound'
+                        access: 'Allow'
+                        protocol: 'TCP'
+                        destinationPortRange: '*'
+                        sourceAddressPrefix: '*'
+                      }
+                    }
+                  ]
+                }
+              }
+            }
+          }
+        }
+      }
+    ]
+  }
+}

iac/Microsoft.Network_networkInterfaces.json

@@ -0,0 +1,37 @@
+{
+  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+  "contentVersion": "1.0.0.0",
+  "resources": [
+    {
+      "name": "Raise an issue",
+      "type": "Microsoft.Network/networkInterfaces", "apiVersion": "2022-11-01",
+      "properties": {
+        "ipConfigurations": [
+          {
+            "properties": {
+              "subnet": {
+                "properties": {
+                  "networkSecurityGroup": {
+                    "properties": {
+                      "securityRules": [
+                        {
+                          "properties": {
+                            "direction" : "Inbound",
+                            "access" : "Allow",
+                            "protocol" : "TCP",
+                            "destinationPortRange" : "*",
+                            "sourceAddressPrefix": "*"
+                          }
+                        }
+                      ]
+                    }
+                  }
+                }
+              }
+            }
+          }
+        ]
+      }
+    }
+  ]
+}

iac/nocpu-limit.yaml

@@ -0,0 +1,11 @@
+apiVersion: v1
+kind: Pod
+metadata:
+  name: example
+spec:
+  containers:
+    - name: noncompliant_without_cpu_limit
+      image: nginx
+      resources:
+        limits:
+          memory: 64Mi

main.go

@@ -0,0 +1,9 @@
+package main
+
+import "fmt"
+
+func main() {
+	//NOSONAR
+	//TODO fix me
+	fmt.Println("Hello")
+}

pom.xml

@@ -7,8 +7,8 @@
 	<version>1.0-SNAPSHOT</version>
 	<properties>
 		<sonar.sources>src/main/java,src/main/javascript</sonar.sources>
-		<maven.compiler.source>1.8</maven.compiler.source>
-		<maven.compiler.target>1.8</maven.compiler.target>
+		<maven.compiler.source>17</maven.compiler.source>
+		<maven.compiler.target>17</maven.compiler.target>
 		<sonar.organization>sonarwearedevelopersdemo</sonar.organization>
 		<sonar.host.url>https://sonarcloud.io</sonar.host.url>
 	</properties>

src/main/java/devoxx/ConstantExample.java

@@ -0,0 +1,11 @@
+package devoxx;
+
+import java.util.HashMap;
+import java.util.Map;
+
+public class ConstantExample {
+
+  private static final Map<String, Integer> decoratorsOrder = new HashMap<>();
+
+
+}

src/main/java/devoxx/IfElseIfTest.java

@@ -0,0 +1,27 @@
+package devoxx;
+
+class IfElseIfTest {
+  public static void main(String[] args) {
+    boolean a = System.getenv().containsKey("x");
+    boolean b = System.getenv().containsKey("y");
+    if (a) {
+      System.out.println("x");
+    } else if (b) {
+      throw new RuntimeException("boom");
+    }
+
+    if (a) {
+      System.out.println("x");
+    } else if (b) {
+      System.out.println("y");
+    }
+
+    if (a) {
+      System.out.println("x");
+    } else if (b) {
+      System.out.println("y");
+    } else {
+      System.out.println("z");
+    }
+  }
+}

src/main/java/devoxx/SecretInJava.java

@@ -0,0 +1,17 @@
+package devoxx;
+
+import java.util.Properties;
+
+public class SecretInJava {
+  public static void main(String[] args) {
+    Properties props = new Properties();
+    props.put("token", "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");
+
+    // S8135
+    props.set("token", "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJuYW1lIjoicm9vdCIsImZsYWciOiJoZWxsbyB3b3JsZCJ9.Fj8Y7ZGSLtNMyAkqGKWddRg3ZvwOpOTvRK7rHl4RWt4")
+
+    // S8136
+    String a = "Authorization: Basic dXNlcm5hbWU6OGZLejJwUTltTHg0"
+
+  }
+}

src/main/java/devoxx/Tree.java

@@ -0,0 +1,4 @@
+package devoxx;
+
+public class Tree {
+}

src/main/java/devoxx/package-info.java

@@ -0,0 +1,3 @@
+
+@javax.annotation.ParametersAreNonnullByDefault
+package devoxx;

src/main/java/iac/Microsoft.Network_networkInterfaces.bicep

@@ -0,0 +1,31 @@
+resource raiseAnIssue 'Microsoft.Network/networkInterfaces@2022-11-01' = {
+  name: 'Raise an issue'
+  properties: {
+    ipConfigurations: [
+      {
+        properties: {
+          subnet: {
+            properties: {
+              networkSecurityGroup: {
+                properties: {
+                  securityRules: [
+                    {
+                      properties: {
+                        // TODO fix me
+                        direction: 'Inbound'
+                        access: 'Allow'
+                        protocol: 'TCP'
+                        destinationPortRange: '*'
+                        sourceAddressPrefix: '*'
+                      }
+                    }
+                  ]
+                }
+              }
+            }
+          }
+        }
+      }
+    ]
+  }
+}

src/main/java/iac/Microsoft.Network_networkInterfaces.json

@@ -0,0 +1,37 @@
+{
+  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+  "contentVersion": "1.0.0.0",
+  "resources": [
+    {
+      "name": "Raise an issue",
+      "type": "Microsoft.Network/networkInterfaces", "apiVersion": "2022-11-01",
+      "properties": {
+        "ipConfigurations": [
+          {
+            "properties": {
+              "subnet": {
+                "properties": {
+                  "networkSecurityGroup": {
+                    "properties": {
+                      "securityRules": [
+                        {
+                          "properties": {
+                            "direction" : "Inbound",
+                            "access" : "Allow",
+                            "protocol" : "TCP",
+                            "destinationPortRange" : "*",
+                            "sourceAddressPrefix": "*"
+                          }
+                        }
+                      ]
+                    }
+                  }
+                }
+              }
+            }
+          }
+        ]
+      }
+    }
+  ]
+}

src/main/java/iac/S6273.tf

@@ -0,0 +1,9 @@
+resource "aws_s3_bucket" "myawsbucket" {
+  tags = {
+    "anycompany:cost-center" = "" # Noncompliant (S6273)
+    "anycompany:CostCenter" = "" # Noncompliant
+    "AnyCompany:CostCenter:Bar" = ""
+  }
+
+  tags = { "anycompany:CostCenter" = "" } # No valid syntax to have more than one tag statement
+}

src/main/java/iac/S6573.dockerfile

@@ -0,0 +1,12 @@
+FROM scratch
+
+RUN rm -rf *
+RUN tar xfv *.tar
+
+ARG FOO
+# Compliant - rule shouldn't be checking asterisks inside a quoted string
+RUN echo "* * * * * echo $FOO; ./cron-job" >> /etc/crontabs
+RUN echo "rm *" >> ~/.forbidden-commands
+
+RUN rm -rf -- *
+RUN tar xfv ./*.tar

src/main/java/iac/ansible-S6868.yaml

@@ -0,0 +1,46 @@
+---
+- name: K8s command execution tasks
+  hosts: all
+  tasks:
+    - name: Role Example
+      kubernetes.core.k8s:
+        state: present
+        definition:
+          apiVersion: rbac.authorization.k8s.io/v1
+          kind: Role
+          metadata:
+            namespace: default
+            name: noncompliant-role
+          rules:
+            - apiGroups: [ "" ]
+              resources: [ "pods/exec" ] # Noncompliant
+              verbs: [ "create" ]
+
+            - apiGroups: [ "" ]
+              resources: [ "*" ] # Noncompliant
+              verbs: [ "create" ]
+
+            - apiGroups: [ "" ]
+              resources: [ "services" ] # Compliant
+              verbs: [ "create" ]
+    - name: ClusterRole Example
+      kubernetes.core.k8s:
+        state: present
+        definition:
+          apiVersion: rbac.authorization.k8s.io/v1
+          kind: ClusterRole
+          metadata:
+            namespace: default
+            name: noncompliant-role
+          rules:
+            - apiGroups: [ "" ]
+              resources: [ "*" ] # Noncompliant
+              verbs: [ "*" ]
+
+            - apiGroups: [ "" ]
+              resources: [ "pods/exec" ] # Noncompliant
+              verbs: [ "*" ]
+
+            - apiGroups: [ "" ]
+              resources: [ "pods/exec" ] # Compliant
+              verbs: [ "get" ]