Skip to content

Commit 2ff33ca

Browse files
saberducksaberduck
authored
Update metadata before release (#3601)
1 parent c35498d commit 2ff33ca

File tree

12 files changed

+153
-77
lines changed

12 files changed

+153
-77
lines changed

‎css-sonarpedia/sonarpedia.json

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -3,7 +3,7 @@
33
"languages": [
44
"CSS"
55
],
6-
"latest-update": "2022-11-22T14:32:56.265429Z",
6+
"latest-update": "2022-12-05T15:35:17.052030Z",
77
"options": {
88
"no-language-in-filenames": true
99
}

‎javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S5332.html

Lines changed: 20 additions & 20 deletions
Original file line numberDiff line numberDiff line change
@@ -1,20 +1,20 @@
1-
<p>Clear-text protocols such as <code>ftp</code>, <code>telnet</code> or non-secure <code>http</code> lack encryption of transported data, as well as
2-
the capability to build an authenticated connection. It means that an attacker able to sniff traffic from the network can read, modify or corrupt the
1+
<p>Clear-text protocols such as <code>ftp</code>, <code>telnet</code>, or <code>http</code> lack encryption of transported data, as well as the
2+
capability to build an authenticated connection. It means that an attacker able to sniff traffic from the network can read, modify, or corrupt the
33
transported content. These protocols are not secure as they expose applications to an extensive range of risks:</p>
44
<ul>
5-
<li> Sensitive data exposure </li>
6-
<li> Traffic redirected to a malicious endpoint </li>
7-
<li> Malware infected software update or installer </li>
8-
<li> Execution of client side code </li>
9-
<li> Corruption of critical information </li>
5+
<li> sensitive data exposure </li>
6+
<li> traffic redirected to a malicious endpoint </li>
7+
<li> malware-infected software update or installer </li>
8+
<li> execution of client-side code </li>
9+
<li> corruption of critical information </li>
1010
</ul>
1111
<p>Even in the context of isolated networks like offline environments or segmented cloud environments, the insider threat exists. Thus, attacks
1212
involving communications being sniffed or tampered with can still happen.</p>
1313
<p>For example, attackers could successfully compromise prior security layers by:</p>
1414
<ul>
15-
<li> Bypassing isolation mechanisms </li>
16-
<li> Compromising a component of the network </li>
17-
<li> Getting the credentials of an internal IAM account (either from a service account or an actual person) </li>
15+
<li> bypassing isolation mechanisms </li>
16+
<li> compromising a component of the network </li>
17+
<li> getting the credentials of an internal IAM account (either from a service account or an actual person) </li>
1818
</ul>
1919
<p>In such cases, encrypting communications would decrease the chances of attackers to successfully leak data or steal credentials from other network
2020
components. By layering various security practices (segmentation and encryption, for example), the application will follow the
@@ -30,27 +30,27 @@
3030
<h2>Ask Yourself Whether</h2>
3131
<ul>
3232
<li> Application data needs to be protected against falsifications or leaks when transiting over the network. </li>
33-
<li> Application data transits over a network that is considered untrusted. </li>
33+
<li> Application data transits over an untrusted network. </li>
3434
<li> Compliance rules require the service to encrypt data in transit. </li>
3535
<li> Your application renders web pages with a relaxed mixed content policy. </li>
36-
<li> OS level protections against clear-text traffic are deactivated. </li>
36+
<li> OS-level protections against clear-text traffic are deactivated. </li>
3737
</ul>
3838
<p>There is a risk if you answered yes to any of those questions.</p>
3939
<h2>Recommended Secure Coding Practices</h2>
4040
<ul>
4141
<li> Make application data transit over a secure, authenticated and encrypted protocol like TLS or SSH. Here are a few alternatives to the most
4242
common clear-text protocols:
4343
<ul>
44-
<li> Use<code>ssh</code> as an alternative to <code>telnet</code> </li>
45-
<li> Use <code>sftp</code>, <code>scp</code> or <code>ftps</code> instead of <code>ftp</code> </li>
46-
<li> Use <code>https</code> instead of <code>http</code> </li>
47-
<li> Use <code>SMTP</code> over <code>SSL/TLS</code> or <code>SMTP</code> with <code>STARTTLS</code> instead of clear-text SMTP </li>
44+
<li> Use <code>ssh</code> as an alternative to <code>telnet</code>. </li>
45+
<li> Use <code>sftp</code>, <code>scp</code>, or <code>ftps</code> instead of <code>ftp</code>. </li>
46+
<li> Use <code>https</code> instead of <code>http</code>. </li>
47+
<li> Use <code>SMTP</code> over <code>SSL/TLS</code> or <code>SMTP</code> with <code>STARTTLS</code> instead of clear-text SMTP. </li>
4848
</ul> </li>
49-
<li> Enable encryption of cloud components communications whenever it’s possible. </li>
49+
<li> Enable encryption of cloud components communications whenever it is possible. </li>
5050
<li> Configure your application to block mixed content when rendering web pages. </li>
51-
<li> If available, enforce OS level deactivation of all clear-text traffic </li>
51+
<li> If available, enforce OS-level deactivation of all clear-text traffic. </li>
5252
</ul>
53-
<p>It is recommended to secure all transport channels (even local network) as it can take a single non secure connection to compromise an entire
53+
<p>It is recommended to secure all transport channels, even on local networks, as it can take a single non-secure connection to compromise an entire
5454
application or system.</p>
5555
<h2>Sensitive Code Example</h2>
5656
<pre>
@@ -453,7 +453,7 @@ <h2>Compliant Solution</h2>
453453
<h2>Exceptions</h2>
454454
<p>No issue is reported for the following cases because they are not considered sensitive:</p>
455455
<ul>
456-
<li> Insecure protocol scheme followed by loopback addresses like 127.0.0.1 or <code>localhost</code> </li>
456+
<li> Insecure protocol scheme followed by loopback addresses like 127.0.0.1 or <code>localhost</code>. </li>
457457
</ul>
458458
<h2>See</h2>
459459
<ul>

‎javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S6477.html

Lines changed: 26 additions & 16 deletions
Original file line numberDiff line numberDiff line change
@@ -1,28 +1,38 @@
1-
<p>React expects a unique identifier <code>key</code> in each component to optimize rendering. Missing keys will negatively impact performance and can
2-
bring your application to a halt when there are enough elements.</p>
3-
<p>Avoid Array indexes since they are not stable. Instead, use a unique attribute like an id.</p>
1+
<p>React expects a unique identifier <code>key</code> in list components to optimize rendering. Missing keys will negatively impact performance and
2+
can bring your application to a halt when there are enough elements. Avoid <code>Array</code> indexes since they are not stable. Instead, use a unique
3+
attribute like an ID or a combination of attributes.</p>
44
<h2>Noncompliant Code Example</h2>
55
<pre>
6-
const React = require('react');
7-
class App extends React.Component {
8-
render() {
9-
&lt;LoginButton /&gt;;
10-
}
6+
function Blog(props) {
7+
return (
8+
&lt;ul&gt;
9+
{props.posts.map((post) =&gt;
10+
&lt;li&gt;
11+
{post.title}
12+
&lt;/li&gt;
13+
)}
14+
&lt;/ul&gt;
15+
);
1116
}
1217
</pre>
1318
<h2>Compliant Solution</h2>
1419
<pre>
15-
const React = require('react');
16-
class App extends React.Component {
17-
render() {
18-
&lt;LoginButton key="loginBtn" /&gt;;
19-
}
20+
function Blog(props) {
21+
return (
22+
&lt;ul&gt;
23+
{props.posts.map((post) =&gt;
24+
&lt;li key={post.id}&gt;
25+
{post.title}
26+
&lt;/li&gt;
27+
)}
28+
&lt;/ul&gt;
29+
);
2030
}
2131
</pre>
2232
<h2>See</h2>
2333
<ul>
24-
<li> <a
25-
href="https://reactjs.org/docs/reconciliation.html#recursing-on-children">https://reactjs.org/docs/reconciliation.html#recursing-on-children</a> -
26-
React API reference </li>
34+
<li> <a href="https://reactjs.org/docs/reconciliation.html#recursing-on-children">Recursing On Children</a> - React API reference </li>
35+
<li> {rule:javascript:S6479} </li>
36+
<li> {rule:javascript:S6486} </li>
2737
</ul>
2838

‎javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S6477.json

Lines changed: 4 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -7,14 +7,15 @@
77
"constantCost": "5min"
88
},
99
"tags": [
10-
"reactjs",
11-
"jsx"
10+
"react",
11+
"jsx",
12+
"performance"
1213
],
1314
"defaultSeverity": "Major",
1415
"ruleSpecification": "RSPEC-6477",
1516
"sqKey": "S6477",
1617
"scope": "All",
17-
"quickfix": "unknown",
18+
"quickfix": "infeasible",
1819
"compatibleLanguages": [
1920
"JAVASCRIPT",
2021
"TYPESCRIPT"

‎javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S6478.html

Lines changed: 20 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -1,12 +1,12 @@
1-
<p>Nested components are recreated on each render because React does not know that they haven’t changed. This hurts performance as the components are
2-
recreated at each render. However, this can also hide surprising bugs where the state of the nested components is lost between renders. Trying to
3-
<code>useCallback</code> hooks for child components should also be discouraged. You should refactor this code to define the component on its own,
4-
passing props if required.</p>
1+
<p>Nested components are defined in an enclosing one and can be simple functions or arrow expressions. React recreates them systematically during the
2+
render pass because it doesn’t know they haven’t changed. This hurts performance as the components are recreated too many times. However, this can
3+
also hide surprising bugs where the state of the nested components is lost between renders. Trying to use <code>useCallback</code> hooks for child
4+
components is also discouraged. You should actually refactor this code to define a component on its own, passing props if needed.</p>
55
<h2>Noncompliant Code Example</h2>
66
<pre>
77
function Component() {
88
function UnstableNestedComponent() {
9-
return &lt;div/&gt;;
9+
return &lt;div /&gt;;
1010
}
1111

1212
return (
@@ -28,7 +28,7 @@ <h2>Noncompliant Code Example</h2>
2828
function Component() {
2929
return (
3030
&lt;div&gt;
31-
&lt;SomeComponent footer={ () =&gt; &lt;div /&gt; } /&gt;
31+
&lt;SomeComponent footer={ () =&gt; &lt;div /&gt; } /&gt; { /* footer is a component nested inside 'Component' */ }
3232
&lt;/div&gt;
3333
);
3434
}
@@ -67,6 +67,19 @@ <h2>Compliant Solution</h2>
6767
return &lt;SomeComponent footer={ &lt;div /&gt; } /&gt;;
6868
}
6969
</pre>
70+
<pre>
71+
class Component extends React.Component {
72+
render() {
73+
return (
74+
&lt;div&gt;
75+
&lt;SomeComponent /&gt;
76+
&lt;/div&gt;
77+
);
78+
}
79+
}
80+
</pre>
7081
<h2>See</h2>
71-
<p>TODO</p>
82+
<ul>
83+
<li> <a href="https://reactjs.org/docs/reconciliation.html#elements-of-different-types">Elements Of Different Types</a> - React documentation </li>
84+
</ul>
7285

‎javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S6478.json

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -7,7 +7,9 @@
77
"constantCost": "5min"
88
},
99
"tags": [
10-
"react"
10+
"react",
11+
"jsx",
12+
"performance"
1113
],
1214
"defaultSeverity": "Major",
1315
"ruleSpecification": "RSPEC-6478",

‎javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S6479.html

Lines changed: 12 additions & 15 deletions
Original file line numberDiff line numberDiff line change
@@ -1,31 +1,28 @@
11
<p>React expects a unique identifier for performance optimizations. An array index is not a stable identifier most of the time. This results in
22
unnecessary renders when the array items change index following some mutation. When components have state, this might also provoke bugs that are hard
3-
to diagnose. We recommend using an explicit identifier to avoid misuse and accidental re-renders. If there is no unique attribute available, consider
4-
concatenating properties to create one. Using generated values like <code>Math.random()</code> or <code>Date.now()</code> is discouraged as it would
5-
force a re-render every time and might also provoke bugs if values collide.</p>
6-
<p>React expects a unique identifier <code>key</code> in each component to optimize rendering. Missing keys will negatively impact performance and can
7-
bring your application to a halt when there are enough elements.</p>
8-
<p>Avoid Array indexes since they are not stable. Instead, use a unique attribute like an id.</p>
3+
to diagnose.</p>
4+
<p>We recommend using an explicit identifier to avoid misuse and accidental re-renders. If there is no unique attribute available, consider
5+
concatenating existing properties - hashing them if necessary - or creating a dedicated unique identifier.</p>
96
<h2>Noncompliant Code Example</h2>
107
<pre>
11-
function generateButtons(buttons) {
12-
return buttons.map((button, index) =&gt; {
13-
&lt;Button key={index}&gt;button.number&lt;/Button&gt;
8+
function generateButtons(props) {
9+
return props.buttons.map((button, index) =&gt; {
10+
&lt;Button key={index}&gt;{button.number}&lt;/Button&gt;
1411
});
1512
}
1613
</pre>
1714
<h2>Compliant Solution</h2>
1815
<pre>
19-
function generateButtons(buttons) {
20-
return buttons.map((button, index) =&gt; {
21-
&lt;Button key={button.number}&gt;button.number&lt;/Button&gt;
16+
function generateButtons(props) {
17+
return props.buttons.map((button, index) =&gt; {
18+
&lt;Button key={button.number}&gt;{button.number}&lt;/Button&gt;
2219
});
2320
}
2421
</pre>
2522
<h2>See</h2>
2623
<ul>
27-
<li> <a
28-
href="https://reactjs.org/docs/reconciliation.html#recursing-on-children">https://reactjs.org/docs/reconciliation.html#recursing-on-children</a> -
29-
React API reference </li>
24+
<li> <a href="https://reactjs.org/docs/reconciliation.html#recursing-on-children">Recursing On Children</a> - React API reference </li>
25+
<li> {rule:javascript:S6477} </li>
26+
<li> {rule:javascript:S6486} </li>
3027
</ul>
3128

‎javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S6479.json

Lines changed: 5 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,20 +1,21 @@
11
{
2-
"title": "Stable unique keys for JSX list components",
2+
"title": "No array index for keys in JSX list components",
33
"type": "CODE_SMELL",
44
"status": "ready",
55
"remediation": {
66
"func": "Constant\/Issue",
77
"constantCost": "5min"
88
},
99
"tags": [
10-
"reactjs",
11-
"jsx"
10+
"react",
11+
"jsx",
12+
"performance"
1213
],
1314
"defaultSeverity": "Major",
1415
"ruleSpecification": "RSPEC-6479",
1516
"sqKey": "S6479",
1617
"scope": "All",
17-
"quickfix": "unknown",
18+
"quickfix": "infeasible",
1819
"compatibleLanguages": [
1920
"JAVASCRIPT",
2021
"TYPESCRIPT"

‎javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S6480.html

Lines changed: 55 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
<p>Using <code>Function.prototype.bind</code> and arrows functions as attributes will negatively impact performance in React. Each time the parent is
22
rendered, the function will be re-created and trigger a render of the component causing excessive renders and more memory use. Wrapping the function
3-
in a useCallback hook will avoid additional renders. This rule ignores <code>Refs</code>. This rule does not raise findings on DOM nodes since that
4-
may require wrapping the DOM in a component. Still, better performance can be achieved if this rule is respected in DOM nodes too.</p>
3+
in a <code>useCallback</code> hook will avoid additional renders. This rule ignores <code>Refs</code>. This rule does not raise findings on DOM nodes
4+
since that may require wrapping the DOM in a component. Still, better performance can be achieved if this rule is respected in DOM nodes too.</p>
55
<h2>Noncompliant Code Example</h2>
66
<pre>
77
&lt;Component onClick={this._handleClick.bind(this)}&gt;&lt;/Component&gt;
@@ -16,6 +16,59 @@ <h2>Compliant Solution</h2>
1616

1717
&lt;Component onClick={handleClick}&gt;&lt;/Component&gt;
1818
</pre>
19+
<p>Situation can become more complicated when you need to pass additional parameters to the handler. Consider following component printing the list of
20+
letters. Consider following non-compliant example</p>
21+
<pre>
22+
class Alphabet extends React.Component {
23+
handleClick(letter) {
24+
console.log(`clicked ${letter}`);
25+
}
26+
render() {
27+
return (&lt;div&gt;&lt;ul&gt;
28+
{letters.map(letter =&gt;
29+
&lt;li key={letter} onClick={() =&gt; this.handleClick(letter)}&gt;{letter}&lt;/li&gt;
30+
)}
31+
&lt;/ul&gt;&lt;/div&gt;)
32+
}
33+
}
34+
</pre>
35+
<p>To avoid creating the arrow function you can factor out <code>li</code> element as separate child component and use <code>props</code> to pass the
36+
<code>letter</code> and <code>onClick</code> handler.</p>
37+
<pre>
38+
class Alphabet extends React.Component {
39+
handleClick(letter) {
40+
console.log(`clicked ${letter}`);
41+
}
42+
render() {
43+
return (&lt;div&gt;&lt;ul&gt;
44+
{letters.map(letter =&gt;
45+
&lt;Letter key={letter} letter={letter} handleClick={this.handleClick}&gt;&lt;/Letter&gt;
46+
)}
47+
&lt;/ul&gt;&lt;/div&gt;)
48+
}
49+
}
50+
51+
class Letter extends React.Component {
52+
constructor(props) {
53+
super(props);
54+
this.handleClick = this.handleClick.bind(this)
55+
}
56+
handleClick() {
57+
this.props.handleClick(this.props.letter);
58+
}
59+
render() {
60+
return &lt;li onClick={this.handleClick}&gt; {this.props.letter} &lt;/li&gt;
61+
}
62+
}
63+
</pre>
64+
<p>alternatively you could rewrite <code>Letter</code> as a function and use <code>useCallback</code></p>
65+
<pre>
66+
function Letter({ handleClick, letter }) {
67+
const onClick = React.useCallback(() =&gt; handleClick(letter), [letter])
68+
69+
return &lt;li onClick={onClick}&gt;{letter}&lt;/li&gt;
70+
}
71+
</pre>
1972
<h2>See</h2>
2073
<ul>
2174
<li> <a href="https://reactjs.org/docs/faq-functions.html">Passing Functions to Components</a> - React documentation </li>

‎javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S6480.json

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,13 +1,13 @@
11
{
2-
"title": "Disallow `.bind()` and arrow functions in JSX props ",
2+
"title": "Disallow `.bind()` and arrow functions in JSX props",
33
"type": "CODE_SMELL",
44
"status": "ready",
55
"remediation": {
66
"func": "Constant\/Issue",
77
"constantCost": "5min"
88
},
99
"tags": [
10-
"reactjs",
10+
"react",
1111
"jsx",
1212
"performance"
1313
],

0 commit comments

Comments
 (0)