format JcaCipherGetInstanceCyclicAssignmentTest.java - #533
Merged
Conversation
san-zrl
enabled auto-merge (squash)
August 31, 2026 14:53
san-zrl
disabled auto-merge
August 31, 2026 14:55
sachin9058
added a commit
to sachin9058/sonar-cryptography
that referenced
this pull request
Sep 13, 2026
- Add AlgorithmProperties17 with algorithmFamily and ellipticCurve fields; hide deprecated curve via @JsonIgnore
- Add ProtocolProperties17 with relatedCryptographicAssets; hide deprecated cryptoRefArray via @JsonIgnore
- Add CertificateProperties17 with certificateFileExtension, serialNumber, fingerprint; hide deprecated certificateExtension via @JsonIgnore
- Update AlgorithmComponentBuilder to use AlgorithmProperties17, map algorithmFamily, emit namespaced ellipticCurve values (e.g. nist/P-256), add KeyWrap primitive support
- Update ProtocolComponentBuilder to use ProtocolProperties17, add relatedCryptographicAssets support
- Update CBOMOutputFile to set specVersion 1.7 via reflection, use ProtocolProperties17 natively, add relatedCryptographicAssets from dependency refs
- Update IAlgorithmComponentBuilder with algorithmFamily method
- Update IProtocolComponentBuilder with relatedCryptographicAssets method
- Update AlgorithmTest and ProtocolTest to validate 1.7 schema compliance
- Update README.md example output to specVersion 1.7
- Update TestBase and Utils for 1.7 specVersion support
Signed-off-by: Sachin Kumar <sachinkumar905846@gmail.com>
chore(deps-dev): bump com.diffplug.spotless:spotless-maven-plugin (#536)
Bumps [com.diffplug.spotless:spotless-maven-plugin](https://github.com/diffplug/spotless) from 3.10.0 to 3.10.1.
- [Release notes](https://github.com/diffplug/spotless/releases)
- [Changelog](https://github.com/diffplug/spotless/blob/main/CHANGES.md)
- [Commits](https://github.com/diffplug/spotless/compare/maven/3.10.0...maven/3.10.1)
---
updated-dependencies:
- dependency-name: com.diffplug.spotless:spotless-maven-plugin
dependency-version: 3.10.1
dependency-type: direct:development
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com>
chore(deps-dev): bump ch.qos.logback:logback-classic (#535)
Bumps [ch.qos.logback:logback-classic](https://github.com/qos-ch/logback) from 1.5.38 to 1.6.3.
- [Release notes](https://github.com/qos-ch/logback/releases)
- [Commits](https://github.com/qos-ch/logback/compare/v_1.5.38...v_1.6.3)
---
updated-dependencies:
- dependency-name: ch.qos.logback:logback-classic
dependency-version: 1.6.3
dependency-type: direct:development
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com>
chore(deps): bump actions/setup-java from 5 to 6 (#528)
Bumps [actions/setup-java](https://github.com/actions/setup-java) from 5 to 6.
- [Release notes](https://github.com/actions/setup-java/releases)
- [Commits](https://github.com/actions/setup-java/compare/v5...v6)
---
updated-dependencies:
- dependency-name: actions/setup-java
dependency-version: '6'
dependency-type: direct:production
update-type: version-update:semver-major
...
Signed-off-by: dependabot[bot] <support@github.com>
chore(deps-dev): bump com.diffplug.spotless:spotless-maven-plugin (#524)
Bumps [com.diffplug.spotless:spotless-maven-plugin](https://github.com/diffplug/spotless) from 3.9.0 to 3.10.0.
- [Release notes](https://github.com/diffplug/spotless/releases)
- [Changelog](https://github.com/diffplug/spotless/blob/main/CHANGES.md)
- [Commits](https://github.com/diffplug/spotless/compare/maven/3.9.0...maven/3.10.0)
---
updated-dependencies:
- dependency-name: com.diffplug.spotless:spotless-maven-plugin
dependency-version: 3.10.0
dependency-type: direct:development
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com>
chore(deps): bump actions/setup-python from 6 to 7 (#523)
Bumps [actions/setup-python](https://github.com/actions/setup-python) from 6 to 7.
- [Release notes](https://github.com/actions/setup-python/releases)
- [Commits](https://github.com/actions/setup-python/compare/v6...v7)
---
updated-dependencies:
- dependency-name: actions/setup-python
dependency-version: '7'
dependency-type: direct:production
update-type: version-update:semver-major
...
Signed-off-by: dependabot[bot] <support@github.com>
chore(deps): bump org.antlr:antlr4-runtime from 4.13.1 to 4.13.2 (#522)
Bumps [org.antlr:antlr4-runtime](https://github.com/antlr/antlr4) from 4.13.1 to 4.13.2.
- [Release notes](https://github.com/antlr/antlr4/releases)
- [Changelog](https://github.com/antlr/antlr4/blob/dev/CHANGES.txt)
- [Commits](https://github.com/antlr/antlr4/compare/4.13.1...4.13.2)
---
updated-dependencies:
- dependency-name: org.antlr:antlr4-runtime
dependency-version: 4.13.2
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com>
format (#533)
Signed-off-by: san-zrl <san@zurich.ibm.com>
CBOM generation disabled (#532)
Signed-off-by: san-zrl <san@zurich.ibm.com>
fix: stop endless recursion in resolveValues on assignment cycles (#530)
Fixes #525.
resolveValues follows a variable's assignments and its initializer to
find its value. It had no cycle check. Code like
String algorithm = "AES";
String copy = algorithm;
...
algorithm = copy;
made it recurse forever and crash the scan with a StackOverflowError.
The existing selections.size() > 15 guard never fires here, because
identifier-to-identifier hops do not grow the selections list.
The bug is old, but 1.6.1 exposed it: since e1fdab3b the engine
resolves the arguments of every method call (for detached call
records), not only the arguments of matched crypto calls. So a cycle
anywhere in the scanned code now reaches resolveValues.
The fix moves the variable branch into resolveVariableValues and
tracks which variables are being resolved on the current path. A
variable that is already on the path is not followed again. The
variable is released again when its resolution is done, so two
sibling branches may still resolve through the same variable.
A new red-green test reproduces the exact alternating stack trace
from the issue and checks that the value still resolves through the
cycle to the constant initializer.
fix: demote log msg for constructors with more than one argument to trace (#531)
Signed-off-by: san-zrl <san@zurich.ibm.com>
feat(csharp): add C# ChaCha20Poly1305 detection rules (#506)
* added chacha20poly1305 detection rules
Signed-off-by: Kaldesyvon <martinnovysedlak99@gmail.com>
* added chacha20poly1305 detection rules
Signed-off-by: Kaldesyvon <martinnovysedlak99@gmail.com>
* resolving comments in detection rules
Signed-off-by: Kaldesyvon <martinnovysedlak99@gmail.com>
* fixing detection rules and adding tests
Signed-off-by: Kaldesyvon <martinnovysedlak99@gmail.com>
* minor changes in .cs test file
Signed-off-by: Kaldesyvon <martinnovysedlak99@gmail.com>
* replacing encrypt/decrypt values with CipherAction
Signed-off-by: Kaldesyvon <martinnovysedlak99@gmail.com>
* removing unused imports
Signed-off-by: Kaldesyvon <martinnovysedlak99@gmail.com>
* adding more test cases
Signed-off-by: Kaldesyvon <martinnovysedlak99@gmail.com>
* added cipheraction and improved tests to that
Signed-off-by: Kaldesyvon <martinnovysedlak99@gmail.com>
---------
Signed-off-by: Kaldesyvon <martinnovysedlak99@gmail.com>
Signed-off-by: fynnth <42970655+fynnth@users.noreply.github.com>
Csharp first comprehensive rules (#520)
feat(csharp): Covers System.Security.Cryptography and captures constructors, primary methods and property setters. Complete parameter capturing and variable tracking are not yet supported.
Signed-off-by: Fynn Thierling <fynnth@outlook.de>
chore(deps-dev): bump com.google.guava:guava (#512)
Bumps [com.google.guava:guava](https://github.com/google/guava) from 33.6.0-jre to 33.7.1-jre.
- [Release notes](https://github.com/google/guava/releases)
- [Commits](https://github.com/google/guava/commits)
---
updated-dependencies:
- dependency-name: com.google.guava:guava
dependency-version: 33.7.1-jre
dependency-type: direct:development
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com>
chore(deps): manage sonar-analyzer-test-commons in the parent pom (#519)
The version of sonar-analyzer-test-commons was hardcoded in two module
poms. Dependabot had to patch both files for every bump (#513).
Move the version into a property and a dependencyManagement entry in the
parent pom, and bump it to 2.30.0.5193. The go module keeps the
dependency but without a version.
Drop the dependency from the csharp module. No C# test imports anything
from org.sonarsource.analyzer.commons. The RuleMetadataLoader used in
CSharpScannerRuleDefinition comes from the sonar-analyzer-commons
artifact, which is a different, compile-scoped, transitive dependency.
Because this uses dependencyManagement, no other module gains a new
dependency.
Closes #513
Signed-off-by: Nicklas Körtge <Nicklas.Koertge1@ibm.com>
ci: run the dependency graph submission before the CBOM step (#518)
The first run on main failed:
Error: EACCES: permission denied, scandir
'/home/runner/work/sonar-cryptography/sonar-cryptography/76d3.../1508...'
The CBOM step is a Docker action. It runs as root with the workspace
mounted, and the Sonar Java analyzer inside it leaves temp folders in the
workspace. Those folders belong to root and the runner user cannot read
them. The dependency submission action walks the whole workspace to find
its depgraph files, hits such a folder, and stops.
Running it before the CBOM step means it walks a clean workspace. Nothing
else depends on the order. It still runs after the clean-tree check, and
it only writes into target/, which is ignored.
fix: stop the build from rewriting the cipher-suite source files (#516)
* fix: stop the build from rewriting the cipher-suite source files
The mapper module bound exec-maven-plugin to the compile phase to run
download-cipher-suites.sh. That script downloaded ciphersuites.json from
ciphersuite.info over the checked-in copy, then regenerated
JsonCipherSuites.java in the source tree. So every `mvn compile` left both
files modified in the working tree.
This was blamed on Spotless truncating the file. It was not truncation.
The generator writes one Map.entry per line and no license header, which
gives a 363-line file. Spotless runs later, at the package phase, and
expands it back to 3861 lines with the header. Stop at compile, or skip
Spotless, and you are left with the short header-less version. All 348
entries were always there.
The data also drifts: the API returns 351 entries today against 348 in
the repo, so even a full `mvn package` left the tree dirty. And the
shipped cipher-suite data depended on what the API said at build time.
Changes:
- Remove exec-maven-plugin from mapper/pom.xml. The two generated files
stay in git and the build just compiles them.
- Add a scheduled `Update cipher suites` workflow that runs the refresh
monthly and opens a pull request, so data changes get reviewed.
- Harden download-cipher-suites.sh: set -eu, curl --fail, download to a
temp file, and refuse to write if the entry count drops by more than
10%. A failed or shrunken response can no longer clobber good data.
- Add a CI step that fails if the build modified any tracked file.
- Fix the stale explanation in docs/PERFORMANCE_TESTING.md and document
the refresh in CLAUDE.md.
* chore: drop the explanatory comment in mapper/pom.xml and the note in PERFORMANCE_TESTING.md
ci: submit the real Maven dependency graph to GitHub (#515)
GitHub builds the dependency graph by parsing the pom.xml files itself.
Its copy is stale: it lists sonar-java-plugin 8.18.0 and
sonar-python-plugin 5.16.0 while main uses 8.22.0 and 5.29.0, and it has
no entry for the csharp module. So it carries the old transitive Jackson
and Spring versions and raises Dependabot alerts for versions we never
build with.
All 167 open alerts are false positives. The versions we resolve are
already patched: jackson 2.22.1, spring 6.2.11, logback-core 1.5.35,
assertj 3.27.7, bcprov 1.84.
This enables the dependency submission action, which was already in the
workflow but commented out. It uploads the resolved tree after each build
on main, so Dependabot can close the stale alerts.
chore(deps-dev): bump org.bouncycastle:bcprov-jdk18on (#503)
Bumps [org.bouncycastle:bcprov-jdk18on](https://github.com/bcgit/bc-java) from 1.84 to 1.85.2.
- [Changelog](https://github.com/bcgit/bc-java/blob/main/docs/releasenotes.html)
- [Commits](https://github.com/bcgit/bc-java/commits)
---
updated-dependencies:
- dependency-name: org.bouncycastle:bcprov-jdk18on
dependency-version: 1.85.2
dependency-type: direct:development
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com>
chore(deps-dev): bump org.apache.maven.plugins:maven-surefire-plugin (#507)
Bumps [org.apache.maven.plugins:maven-surefire-plugin](https://github.com/apache/maven-surefire) from 3.5.4 to 3.5.6.
- [Release notes](https://github.com/apache/maven-surefire/releases)
- [Commits](https://github.com/apache/maven-surefire/compare/surefire-3.5.4...surefire-3.5.6)
---
updated-dependencies:
- dependency-name: org.apache.maven.plugins:maven-surefire-plugin
dependency-version: 3.5.6
dependency-type: direct:development
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com>
chore(deps-dev): bump com.diffplug.spotless:spotless-maven-plugin (#508)
Bumps [com.diffplug.spotless:spotless-maven-plugin](https://github.com/diffplug/spotless) from 3.2.0 to 3.9.0.
- [Release notes](https://github.com/diffplug/spotless/releases)
- [Changelog](https://github.com/diffplug/spotless/blob/main/CHANGES.md)
- [Commits](https://github.com/diffplug/spotless/compare/lib/3.2.0...maven/3.9.0)
---
updated-dependencies:
- dependency-name: com.diffplug.spotless:spotless-maven-plugin
dependency-version: 3.9.0
dependency-type: direct:development
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com>
Loads Parser/Lexer as dependency (#496)
* Re-created csharp files
Signed-off-by: san-zrl <san@zurich.ibm.com>
Signed-off-by: Fynn Thierling <fynnth@outlook.de>
* load csharp parser as dependency
Signed-off-by: Fynn Thierling <fynnth@outlook.de>
---------
Signed-off-by: san-zrl <san@zurich.ibm.com>
Signed-off-by: Fynn Thierling <fynnth@outlook.de>
chore(deps): bump sonar.python.version from 5.25.0.34794 to 5.29.0.35837 (#500)
Bumps `sonar.python.version` from 5.25.0.34794 to 5.29.0.35837.
Updates `org.sonarsource.python:sonar-python-plugin` from 5.25.0.34794 to 5.29.0.35837
- [Release notes](https://github.com/SonarCommunity/sonar-python/releases)
- [Commits](https://github.com/SonarCommunity/sonar-python/commits)
Updates `org.sonarsource.python:python-checks-testkit` from 5.25.0.34794 to 5.29.0.35837
- [Release notes](https://github.com/SonarSource/sonar-python/releases)
- [Commits](https://github.com/SonarSource/sonar-python/commits)
---
updated-dependencies:
- dependency-name: org.sonarsource.python:sonar-python-plugin
dependency-version: 5.29.0.35837
dependency-type: direct:production
update-type: version-update:semver-minor
- dependency-name: org.sonarsource.python:python-checks-testkit
dependency-version: 5.29.0.35837
dependency-type: direct:development
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com>
chore(deps): bump sonar.plugin.api.version (#502)
Bumps `sonar.plugin.api.version` from 13.8.0.4399 to 13.11.0.4459.
Updates `org.sonarsource.api.plugin:sonar-plugin-api` from 13.8.0.4399 to 13.11.0.4459
- [Release notes](https://github.com/SonarSource/sonar-plugin-api/releases)
- [Changelog](https://github.com/SonarSource/sonar-plugin-api/blob/master/CHANGELOG.md)
- [Commits](https://github.com/SonarSource/sonar-plugin-api/compare/13.8.0.4399...13.11.0.4459)
Updates `org.sonarsource.api.plugin:sonar-plugin-api-test-fixtures` from 13.8.0.4399 to 13.11.0.4459
- [Release notes](https://github.com/SonarSource/sonar-plugin-api/releases)
- [Changelog](https://github.com/SonarSource/sonar-plugin-api/blob/master/CHANGELOG.md)
- [Commits](https://github.com/SonarSource/sonar-plugin-api/compare/13.8.0.4399...13.11.0.4459)
---
updated-dependencies:
- dependency-name: org.sonarsource.api.plugin:sonar-plugin-api
dependency-version: 13.11.0.4459
dependency-type: direct:production
update-type: version-update:semver-minor
- dependency-name: org.sonarsource.api.plugin:sonar-plugin-api-test-fixtures
dependency-version: 13.11.0.4459
dependency-type: direct:development
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com>
docs: fix stale rule info in README, document CBOM filename setting, add Go to CLAUDE.md (#499)
* docs: fix stale rule info in README and document CBOM filename setting
- correct the rule repository name: the plugin registers "Sonar Cryptography"
repositories (sonar-java-crypto, sonar-python-crypto, sonar-go-crypto), not a
"Cbomkit Cryptography Repository"
- replace the "one single rule" claim with a table of the two shipped rules and
the languages each covers
- state that only the Cryptographic Inventory (CBOM) rule writes a cbom.json
(JavaBaseDetectionRule only aggregates nodes when isInventory is true), so
activating just the MD5 rule produces no CBOM
- document the sonar.cryptoScanner.cbom property (default, project scope, -D usage)
The docs/images/rules.png screenshot is still stale (two repositories, one rule)
and needs a fresh capture from a SonarQube instance running the 2.x plugin.
* docs: add Go language module to CLAUDE.md
Go support (crypto stdlib + parts of golang.org/x/crypto) was missing from the
supported-languages list, the module tree, and the per-module test commands.
Also point detection-rule tests at the per-language TestBase/verifier instead of
only the Java ones, and list PERFORMANCE_TESTING.md and the sonar-go-to-slang
package instructions under key documentation.
chore: ignore venv and Claude Code local files
docs: refresh outdated docs and replace diagrams with mermaid (#498)
- LANGUAGE_SUPPORT.md: document the Go language module (module list,
generics table with GoCheck/Tree/Symbol/GoScanContext, requiredForLanguages);
fix stale references (CryptoPlugin -> CryptographyPlugin, rule-metadata
resources path, ExportJavaRulesToJsonTest location, IOutputFileFactory link,
sonar.java.version example); replace architecture.png with a mermaid diagram
that includes all three language modules
- DETECTION_RULE_STRUCTURE.md: align the CFBBlockCipher example with the
actual rule in BcBlockCipher (forConstructor, Map-based CipherContext --
the CipherContext.Kind enum no longer exists); replace translation.png and
reorganization.png with mermaid diagrams
- TROUBLESHOOTING.md: update rule name to "Cryptographic Inventory (CBOM)",
bump release example to 1.6.1, replace the non-working zsh UID tip with
the .env approach
Bump ch.qos.logback:logback-classic from 1.5.26 to 1.5.38 (#489)
Bumps [ch.qos.logback:logback-classic](https://github.com/qos-ch/logback) from 1.5.26 to 1.5.38.
- [Release notes](https://github.com/qos-ch/logback/releases)
- [Commits](https://github.com/qos-ch/logback/compare/v_1.5.26...v_1.5.38)
---
updated-dependencies:
- dependency-name: ch.qos.logback:logback-classic
dependency-version: 1.5.38
dependency-type: direct:development
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com>
Bump org.cyclonedx:cyclonedx-maven-plugin from 2.9.1 to 2.9.2 (#490)
Bumps [org.cyclonedx:cyclonedx-maven-plugin](https://github.com/CycloneDX/cyclonedx-maven-plugin) from 2.9.1 to 2.9.2.
- [Release notes](https://github.com/CycloneDX/cyclonedx-maven-plugin/releases)
- [Commits](https://github.com/CycloneDX/cyclonedx-maven-plugin/compare/cyclonedx-maven-plugin-2.9.1...cyclonedx-maven-plugin-2.9.2)
---
updated-dependencies:
- dependency-name: org.cyclonedx:cyclonedx-maven-plugin
dependency-version: 2.9.2
dependency-type: direct:development
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com>
Bump sonar.plugin.api.version from 13.4.3.4290 to 13.8.0.4399 (#491)
Bumps `sonar.plugin.api.version` from 13.4.3.4290 to 13.8.0.4399.
Updates `org.sonarsource.api.plugin:sonar-plugin-api` from 13.4.3.4290 to 13.8.0.4399
- [Release notes](https://github.com/SonarSource/sonar-plugin-api/releases)
- [Changelog](https://github.com/SonarSource/sonar-plugin-api/blob/master/CHANGELOG.md)
- [Commits](https://github.com/SonarSource/sonar-plugin-api/compare/13.4.3.4290...13.8.0.4399)
Updates `org.sonarsource.api.plugin:sonar-plugin-api-test-fixtures` from 13.4.3.4290 to 13.8.0.4399
- [Release notes](https://github.com/SonarSource/sonar-plugin-api/releases)
- [Changelog](https://github.com/SonarSource/sonar-plugin-api/blob/master/CHANGELOG.md)
- [Commits](https://github.com/SonarSource/sonar-plugin-api/compare/13.4.3.4290...13.8.0.4399)
---
updated-dependencies:
- dependency-name: org.sonarsource.api.plugin:sonar-plugin-api
dependency-version: 13.8.0.4399
dependency-type: direct:production
update-type: version-update:semver-minor
- dependency-name: org.sonarsource.api.plugin:sonar-plugin-api-test-fixtures
dependency-version: 13.8.0.4399
dependency-type: direct:development
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com>
Bump org.sonarsource.sonar-packaging-maven-plugin:sonar-packaging-maven-plugin (#492)
Bumps [org.sonarsource.sonar-packaging-maven-plugin:sonar-packaging-maven-plugin](https://github.com/SonarSource/sonar-packaging-maven-plugin) from 1.23.0.740 to 1.25.1.3002.
- [Release notes](https://github.com/SonarSource/sonar-packaging-maven-plugin/releases)
- [Commits](https://github.com/SonarSource/sonar-packaging-maven-plugin/compare/1.23.0.740...1.25.1.3002)
---
updated-dependencies:
- dependency-name: org.sonarsource.sonar-packaging-maven-plugin:sonar-packaging-maven-plugin
dependency-version: 1.25.1.3002
dependency-type: direct:development
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com>
Add .superpowers to gitignore
Bump the maven group across 11 directories with 1 update (#483)
Bumps the maven group with 1 update in the / directory: [ch.qos.logback:logback-core](https://github.com/qos-ch/logback).
Bumps the maven group with 1 update in the /common directory: [ch.qos.logback:logback-core](https://github.com/qos-ch/logback).
Bumps the maven group with 1 update in the /engine directory: [ch.qos.logback:logback-core](https://github.com/qos-ch/logback).
Bumps the maven group with 1 update in the /enricher directory: [ch.qos.logback:logback-core](https://github.com/qos-ch/logback).
Bumps the maven group with 1 update in the /go directory: [ch.qos.logback:logback-core](https://github.com/qos-ch/logback).
Bumps the maven group with 1 update in the /java directory: [ch.qos.logback:logback-core](https://github.com/qos-ch/logback).
Bumps the maven group with 1 update in the /mapper directory: [ch.qos.logback:logback-core](https://github.com/qos-ch/logback).
Bumps the maven group with 1 update in the /output directory: [ch.qos.logback:logback-core](https://github.com/qos-ch/logback).
Bumps the maven group with 1 update in the /python directory: [ch.qos.logback:logback-core](https://github.com/qos-ch/logback).
Bumps the maven group with 1 update in the /rules directory: [ch.qos.logback:logback-core](https://github.com/qos-ch/logback).
Bumps the maven group with 1 update in the /sonar-cryptography-plugin directory: [ch.qos.logback:logback-core](https://github.com/qos-ch/logback).
Updates `ch.qos.logback:logback-core` from 1.5.33 to 1.5.35
- [Release notes](https://github.com/qos-ch/logback/releases)
- [Commits](https://github.com/qos-ch/logback/compare/v_1.5.33...v_1.5.35)
Updates `ch.qos.logback:logback-core` from 1.5.33 to 1.5.35
- [Release notes](https://github.com/qos-ch/logback/releases)
- [Commits](https://github.com/qos-ch/logback/compare/v_1.5.33...v_1.5.35)
Updates `ch.qos.logback:logback-core` from 1.5.33 to 1.5.35
- [Release notes](https://github.com/qos-ch/logback/releases)
- [Commits](https://github.com/qos-ch/logback/compare/v_1.5.33...v_1.5.35)
Updates `ch.qos.logback:logback-core` from 1.5.33 to 1.5.35
- [Release notes](https://github.com/qos-ch/logback/releases)
- [Commits](https://github.com/qos-ch/logback/compare/v_1.5.33...v_1.5.35)
Updates `ch.qos.logback:logback-core` from 1.5.33 to 1.5.35
- [Release notes](https://github.com/qos-ch/logback/releases)
- [Commits](https://github.com/qos-ch/logback/compare/v_1.5.33...v_1.5.35)
Updates `ch.qos.logback:logback-core` from 1.5.33 to 1.5.35
- [Release notes](https://github.com/qos-ch/logback/releases)
- [Commits](https://github.com/qos-ch/logback/compare/v_1.5.33...v_1.5.35)
Updates `ch.qos.logback:logback-core` from 1.5.33 to 1.5.35
- [Release notes](https://github.com/qos-ch/logback/releases)
- [Commits](https://github.com/qos-ch/logback/compare/v_1.5.33...v_1.5.35)
Updates `ch.qos.logback:logback-core` from 1.5.33 to 1.5.35
- [Release notes](https://github.com/qos-ch/logback/releases)
- [Commits](https://github.com/qos-ch/logback/compare/v_1.5.33...v_1.5.35)
Updates `ch.qos.logback:logback-core` from 1.5.33 to 1.5.35
- [Release notes](https://github.com/qos-ch/logback/releases)
- [Commits](https://github.com/qos-ch/logback/compare/v_1.5.33...v_1.5.35)
Updates `ch.qos.logback:logback-core` from 1.5.33 to 1.5.35
- [Release notes](https://github.com/qos-ch/logback/releases)
- [Commits](https://github.com/qos-ch/logback/compare/v_1.5.33...v_1.5.35)
Updates `ch.qos.logback:logback-core` from 1.5.33 to 1.5.35
- [Release notes](https://github.com/qos-ch/logback/releases)
- [Commits](https://github.com/qos-ch/logback/compare/v_1.5.33...v_1.5.35)
---
updated-dependencies:
- dependency-name: ch.qos.logback:logback-core
dependency-version: 1.5.35
dependency-type: direct:development
dependency-group: maven
- dependency-name: ch.qos.logback:logback-core
dependency-version: 1.5.35
dependency-type: direct:development
dependency-group: maven
- dependency-name: ch.qos.logback:logback-core
dependency-version: 1.5.35
dependency-type: direct:development
dependency-group: maven
- dependency-name: ch.qos.logback:logback-core
dependency-version: 1.5.35
dependency-type: direct:development
dependency-group: maven
- dependency-name: ch.qos.logback:logback-core
dependency-version: 1.5.35
dependency-type: direct:development
dependency-group: maven
- dependency-name: ch.qos.logback:logback-core
dependency-version: 1.5.35
dependency-type: direct:development
dependency-group: maven
- dependency-name: ch.qos.logback:logback-core
dependency-version: 1.5.35
dependency-type: direct:development
dependency-group: maven
- dependency-name: ch.qos.logback:logback-core
dependency-version: 1.5.35
dependency-type: direct:development
dependency-group: maven
- dependency-name: ch.qos.logback:logback-core
dependency-version: 1.5.35
dependency-type: direct:development
dependency-group: maven
- dependency-name: ch.qos.logback:logback-core
dependency-version: 1.5.35
dependency-type: direct:development
dependency-group: maven
- dependency-name: ch.qos.logback:logback-core
dependency-version: 1.5.35
dependency-type: direct:development
dependency-group: maven
...
Signed-off-by: dependabot[bot] <support@github.com>
Bump com.google.guava:guava from 33.5.0-jre to 33.6.0-jre (#484)
Bumps [com.google.guava:guava](https://github.com/google/guava) from 33.5.0-jre to 33.6.0-jre.
- [Release notes](https://github.com/google/guava/releases)
- [Commits](https://github.com/google/guava/commits)
---
updated-dependencies:
- dependency-name: com.google.guava:guava
dependency-version: 33.6.0-jre
dependency-type: direct:development
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com>
Bump org.cyclonedx:cyclonedx-core-java from 12.0.1 to 12.2.0 (#485)
Bumps [org.cyclonedx:cyclonedx-core-java](https://github.com/CycloneDX/cyclonedx-core-java) from 12.0.1 to 12.2.0.
- [Release notes](https://github.com/CycloneDX/cyclonedx-core-java/releases)
- [Changelog](https://github.com/CycloneDX/cyclonedx-core-java/blob/master/CHANGELOG.md)
- [Commits](https://github.com/CycloneDX/cyclonedx-core-java/compare/cyclonedx-core-java-12.0.1...cyclonedx-core-java-12.2.0)
---
updated-dependencies:
- dependency-name: org.cyclonedx:cyclonedx-core-java
dependency-version: 12.2.0
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com>
Bump org.mockito:mockito-core from 5.17.0 to 5.23.0 (#486)
Bumps [org.mockito:mockito-core](https://github.com/mockito/mockito) from 5.17.0 to 5.23.0.
- [Release notes](https://github.com/mockito/mockito/releases)
- [Commits](https://github.com/mockito/mockito/compare/v5.17.0...v5.23.0)
---
updated-dependencies:
- dependency-name: org.mockito:mockito-core
dependency-version: 5.23.0
dependency-type: direct:development
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com>
Bump sonar.python.version from 5.20.0.32295 to 5.25.0.34794 (#487)
Bumps `sonar.python.version` from 5.20.0.32295 to 5.25.0.34794.
Updates `org.sonarsource.python:sonar-python-plugin` from 5.20.0.32295 to 5.25.0.34794
- [Release notes](https://github.com/SonarCommunity/sonar-python/releases)
- [Commits](https://github.com/SonarCommunity/sonar-python/commits)
Updates `org.sonarsource.python:python-checks-testkit` from 5.20.0.32295 to 5.25.0.34794
- [Release notes](https://github.com/SonarSource/sonar-python/releases)
- [Commits](https://github.com/SonarSource/sonar-python/commits)
---
updated-dependencies:
- dependency-name: org.sonarsource.python:sonar-python-plugin
dependency-version: 5.25.0.34794
dependency-type: direct:production
update-type: version-update:semver-minor
- dependency-name: org.sonarsource.python:python-checks-testkit
dependency-version: 5.25.0.34794
dependency-type: direct:development
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com>
Bump org.slf4j:slf4j-api from 2.0.17 to 2.0.18 (#488)
Bumps org.slf4j:slf4j-api from 2.0.17 to 2.0.18.
---
updated-dependencies:
- dependency-name: org.slf4j:slf4j-api
dependency-version: 2.0.18
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com>
Bump sonar.python.version from 5.16.0.29940 to 5.20.0.32295 (#381)
Bumps `sonar.python.version` from 5.16.0.29940 to 5.20.0.32295.
Updates `org.sonarsource.python:sonar-python-plugin` from 5.16.0.29940 to 5.20.0.32295
- [Release notes](https://github.com/SonarCommunity/sonar-python/releases)
- [Commits](https://github.com/SonarCommunity/sonar-python/commits)
Updates `org.sonarsource.python:python-checks-testkit` from 5.16.0.29940 to 5.20.0.32295
- [Release notes](https://github.com/SonarSource/sonar-python/releases)
- [Commits](https://github.com/SonarSource/sonar-python/commits)
---
updated-dependencies:
- dependency-name: org.sonarsource.python:sonar-python-plugin
dependency-version: 5.20.0.32295
dependency-type: direct:production
update-type: version-update:semver-minor
- dependency-name: org.sonarsource.python:python-checks-testkit
dependency-version: 5.20.0.32295
dependency-type: direct:development
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com>
Bump org.apache.maven.plugins:maven-compiler-plugin (#382)
Bumps [org.apache.maven.plugins:maven-compiler-plugin](https://github.com/apache/maven-compiler-plugin) from 3.14.0 to 3.15.0.
- [Release notes](https://github.com/apache/maven-compiler-plugin/releases)
- [Commits](https://github.com/apache/maven-compiler-plugin/compare/maven-compiler-plugin-3.14.0...maven-compiler-plugin-3.15.0)
---
updated-dependencies:
- dependency-name: org.apache.maven.plugins:maven-compiler-plugin
dependency-version: 3.15.0
dependency-type: direct:development
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com>
Bump org.apache.maven.plugins:maven-resources-plugin from 3.3.1 to 3.5.0 (#378)
Bumps [org.apache.maven.plugins:maven-resources-plugin](https://github.com/apache/maven-resources-plugin) from 3.3.1 to 3.5.0.
- [Release notes](https://github.com/apache/maven-resources-plugin/releases)
- [Commits](https://github.com/apache/maven-resources-plugin/compare/maven-resources-plugin-3.3.1...maven-resources-plugin-3.5.0)
---
updated-dependencies:
- dependency-name: org.apache.maven.plugins:maven-resources-plugin
dependency-version: 3.5.0
dependency-type: direct:development
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com>
Bump org.apache.maven.plugins:maven-shade-plugin from 3.6.1 to 3.6.2 (#379)
Bumps [org.apache.maven.plugins:maven-shade-plugin](https://github.com/apache/maven-shade-plugin) from 3.6.1 to 3.6.2.
- [Release notes](https://github.com/apache/maven-shade-plugin/releases)
- [Commits](https://github.com/apache/maven-shade-plugin/compare/maven-shade-plugin-3.6.1...maven-shade-plugin-3.6.2)
---
updated-dependencies:
- dependency-name: org.apache.maven.plugins:maven-shade-plugin
dependency-version: 3.6.2
dependency-type: direct:development
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com>
Bump org.junit:junit-bom from 6.0.2 to 6.0.3 (#380)
Bumps [org.junit:junit-bom](https://github.com/junit-team/junit-framework) from 6.0.2 to 6.0.3.
- [Release notes](https://github.com/junit-team/junit-framework/releases)
- [Commits](https://github.com/junit-team/junit-framework/compare/r6.0.2...r6.0.3)
---
updated-dependencies:
- dependency-name: org.junit:junit-bom
dependency-version: 6.0.3
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com>
Bump actions/checkout from 6 to 7 (#473)
Bumps [actions/checkout](https://github.com/actions/checkout) from 6 to 7.
- [Release notes](https://github.com/actions/checkout/releases)
- [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md)
- [Commits](https://github.com/actions/checkout/compare/v6...v7)
---
updated-dependencies:
- dependency-name: actions/checkout
dependency-version: '7'
dependency-type: direct:production
update-type: version-update:semver-major
...
Signed-off-by: dependabot[bot] <support@github.com>
Bump the maven group across 11 directories with 2 updates (#479)
Bumps the maven group with 2 updates in the / directory: [ch.qos.logback:logback-core](https://github.com/qos-ch/logback) and [org.bouncycastle:bcprov-jdk18on](https://github.com/bcgit/bc-java).
Bumps the maven group with 1 update in the /common directory: [ch.qos.logback:logback-core](https://github.com/qos-ch/logback).
Bumps the maven group with 1 update in the /engine directory: [ch.qos.logback:logback-core](https://github.com/qos-ch/logback).
Bumps the maven group with 1 update in the /enricher directory: [ch.qos.logback:logback-core](https://github.com/qos-ch/logback).
Bumps the maven group with 1 update in the /go directory: [ch.qos.logback:logback-core](https://github.com/qos-ch/logback).
Bumps the maven group with 2 updates in the /java directory: [ch.qos.logback:logback-core](https://github.com/qos-ch/logback) and [org.bouncycastle:bcprov-jdk18on](https://github.com/bcgit/bc-java).
Bumps the maven group with 1 update in the /mapper directory: [ch.qos.logback:logback-core](https://github.com/qos-ch/logback).
Bumps the maven group with 1 update in the /output directory: [ch.qos.logback:logback-core](https://github.com/qos-ch/logback).
Bumps the maven group with 1 update in the /python directory: [ch.qos.logback:logback-core](https://github.com/qos-ch/logback).
Bumps the maven group with 1 update in the /rules directory: [ch.qos.logback:logback-core](https://github.com/qos-ch/logback).
Bumps the maven group with 1 update in the /sonar-cryptography-plugin directory: [ch.qos.logback:logback-core](https://github.com/qos-ch/logback).
Updates `ch.qos.logback:logback-core` from 1.5.25 to 1.5.33
- [Release notes](https://github.com/qos-ch/logback/releases)
- [Commits](https://github.com/qos-ch/logback/compare/v_1.5.25...v_1.5.33)
Updates `org.bouncycastle:bcprov-jdk18on` from 1.83 to 1.84
- [Changelog](https://github.com/bcgit/bc-java/blob/main/docs/releasenotes.html)
- [Commits](https://github.com/bcgit/bc-java/commits)
Updates `ch.qos.logback:logback-core` from 1.5.25 to 1.5.33
- [Release notes](https://github.com/qos-ch/logback/releases)
- [Commits](https://github.com/qos-ch/logback/compare/v_1.5.25...v_1.5.33)
Updates `ch.qos.logback:logback-core` from 1.5.25 to 1.5.33
- [Release notes](https://github.com/qos-ch/logback/releases)
- [Commits](https://github.com/qos-ch/logback/compare/v_1.5.25...v_1.5.33)
Updates `ch.qos.logback:logback-core` from 1.5.25 to 1.5.33
- [Release notes](https://github.com/qos-ch/logback/releases)
- [Commits](https://github.com/qos-ch/logback/compare/v_1.5.25...v_1.5.33)
Updates `ch.qos.logback:logback-core` from 1.5.25 to 1.5.33
- [Release notes](https://github.com/qos-ch/logback/releases)
- [Commits](https://github.com/qos-ch/logback/compare/v_1.5.25...v_1.5.33)
Updates `ch.qos.logback:logback-core` from 1.5.25 to 1.5.33
- [Release notes](https://github.com/qos-ch/logback/releases)
- [Commits](https://github.com/qos-ch/logback/compare/v_1.5.25...v_1.5.33)
Updates `org.bouncycastle:bcprov-jdk18on` from 1.83 to 1.84
- [Changelog](https://github.com/bcgit/bc-java/blob/main/docs/releasenotes.html)
- [Commits](https://github.com/bcgit/bc-java/commits)
Updates `ch.qos.logback:logback-core` from 1.5.25 to 1.5.33
- [Release notes](https://github.com/qos-ch/logback/releases)
- [Commits](https://github.com/qos-ch/logback/compare/v_1.5.25...v_1.5.33)
Updates `ch.qos.logback:logback-core` from 1.5.25 to 1.5.33
- [Release notes](https://github.com/qos-ch/logback/releases)
- [Commits](https://github.com/qos-ch/logback/compare/v_1.5.25...v_1.5.33)
Updates `ch.qos.logback:logback-core` from 1.5.25 to 1.5.33
- [Release notes](https://github.com/qos-ch/logback/releases)
- [Commits](https://github.com/qos-ch/logback/compare/v_1.5.25...v_1.5.33)
Updates `ch.qos.logback:logback-core` from 1.5.25 to 1.5.33
- [Release notes](https://github.com/qos-ch/logback/releases)
- [Commits](https://github.com/qos-ch/logback/compare/v_1.5.25...v_1.5.33)
Updates `ch.qos.logback:logback-core` from 1.5.25 to 1.5.33
- [Release notes](https://github.com/qos-ch/logback/releases)
- [Commits](https://github.com/qos-ch/logback/compare/v_1.5.25...v_1.5.33)
---
updated-dependencies:
- dependency-name: ch.qos.logback:logback-core
dependency-version: 1.5.33
dependency-type: direct:development
dependency-group: maven
- dependency-name: org.bouncycastle:bcprov-jdk18on
dependency-version: '1.84'
dependency-type: direct:development
dependency-group: maven
- dependency-name: ch.qos.logback:logback-core
dependency-version: 1.5.33
dependency-type: direct:development
dependency-group: maven
- dependency-name: ch.qos.logback:logback-core
dependency-version: 1.5.33
dependency-type: direct:development
dependency-group: maven
- dependency-name: ch.qos.logback:logback-core
dependency-version: 1.5.33
dependency-type: direct:development
dependency-group: maven
- dependency-name: ch.qos.logback:logback-core
dependency-version: 1.5.33
dependency-type: direct:development
dependency-group: maven
- dependency-name: ch.qos.logback:logback-core
dependency-version: 1.5.33
dependency-type: direct:development
dependency-group: maven
- dependency-name: org.bouncycastle:bcprov-jdk18on
dependency-version: '1.84'
dependency-type: direct:development
dependency-group: maven
- dependency-name: ch.qos.logback:logback-core
dependency-version: 1.5.33
dependency-type: direct:development
dependency-group: maven
- dependency-name: ch.qos.logback:logback-core
dependency-version: 1.5.33
dependency-type: direct:development
dependency-group: maven
- dependency-name: ch.qos.logback:logback-core
dependency-version: 1.5.33
dependency-type: direct:development
dependency-group: maven
- dependency-name: ch.qos.logback:logback-core
dependency-version: 1.5.33
dependency-type: direct:development
dependency-group: maven
- dependency-name: ch.qos.logback:logback-core
dependency-version: 1.5.33
dependency-type: direct:development
dependency-group: maven
...
Signed-off-by: dependabot[bot] <support@github.com>
perf(engine): detach call-stack ASTs at leaveFile + self-contained heap harness (#481)
* docs: design spec for call-stack AST-detach heap reduction
Signed-off-by: Nicklas Körtge <Nicklas.Koertge1@ibm.com>
* docs: use synthetic detached SyntaxToken instead of value-model change
Signed-off-by: Nicklas Körtge <Nicklas.Koertge1@ibm.com>
* docs: task-by-task implementation plan for call-stack AST-detach
Signed-off-by: Nicklas Körtge <Nicklas.Koertge1@ibm.com>
* test: first true cross-file detection guard (compiled-classpath CheckVerifier)
Signed-off-by: Nicklas Körtge <Nicklas.Koertge1@ibm.com>
* test: harden cross-file guard with field-constant (detachable) + array (retained) cases
Signed-off-by: Nicklas Körtge <Nicklas.Koertge1@ibm.com>
* feat(engine): AST-free DetachedSyntaxToken for detached value locations
Signed-off-by: Nicklas Körtge <Nicklas.Koertge1@ibm.com>
* feat(engine): AST-free DetachedScanContext
Signed-off-by: Nicklas Körtge <Nicklas.Koertge1@ibm.com>
* feat(engine): ArgSnapshot + MethodMatcher.matchKeys (tree-free match)
Signed-off-by: Nicklas Körtge <Nicklas.Koertge1@ibm.com>
* feat(engine): isDetachableCall predicate (method invocation without NEW_ARRAY arg)
Signed-off-by: Nicklas Körtge <Nicklas.Koertge1@ibm.com>
* style: spotless formatting on cross-file test
Signed-off-by: Nicklas Körtge <Nicklas.Koertge1@ibm.com>
* refactor(engine): CallContext -> sealed interface with RetainedCall variant
Signed-off-by: Nicklas Körtge <Nicklas.Koertge1@ibm.com>
* feat(engine): DetachedCall variant (tree-free recorded call)
Signed-off-by: Nicklas Körtge <Nicklas.Koertge1@ibm.com>
* feat(engine): detach recorded calls at leaveFile with cross-file replay + reporting
Record calls retained during their file's analysis (same-file hook detections
resolve and report through the live context); at leaveFile, swap each detachable
call for a pre-built tree-free DetachedCall so the file's AST is collected while
cross-file matching continues from the snapshot. Cross-file detached detections
produce CBOM nodes and report SonarQube issues via SonarComponents (no AST pin).
Removes the redundant visitedTreeObjects set (per-bucket dedup instead).
Signed-off-by: Nicklas Körtge <Nicklas.Koertge1@ibm.com>
* perf(engine): key-indexed subscription lookup in onNewHookSubscription
Scan only the call-stack bucket matching a hook's method name instead of every
bucket; fall back to a full scan for ANY/multi-name matchers.
Signed-off-by: Nicklas Körtge <Nicklas.Koertge1@ibm.com>
* docs: rewrite plan as as-built implementation record
Signed-off-by: Nicklas Körtge <Nicklas.Koertge1@ibm.com>
* refactor(engine): reorder imports, suppress field reflection warning
Signed-off-by: Nicklas Körtge <Nicklas.Koertge1@ibm.com>
* docs: design for self-contained call-stack heap/perf harness
Signed-off-by: Nicklas Körtge <Nicklas.Koertge1@ibm.com>
* docs: task-by-task plan for call-stack heap/perf harness
Signed-off-by: Nicklas Körtge <Nicklas.Koertge1@ibm.com>
* feat(engine): CallContextStats accessor for call-stack retention
Signed-off-by: Nicklas Körtge <Nicklas.Koertge1@ibm.com>
* feat(engine): expose callContextStats through Handler/ILanguageSupport
Signed-off-by: Nicklas Körtge <Nicklas.Koertge1@ibm.com>
* test(java): synthetic cross-file crypto corpus generator
Signed-off-by: Nicklas Körtge <Nicklas.Koertge1@ibm.com>
* build: exclude @Tag(performance) tests from default surefire run
Signed-off-by: Nicklas Körtge <Nicklas.Koertge1@ibm.com>
* test(java): manual call-stack heap/perf harness (@Tag performance)
Signed-off-by: Nicklas Körtge <Nicklas.Koertge1@ibm.com>
* docs: performance & heap testing guide (self-contained harness + Keycloak scan)
Signed-off-by: Nicklas Körtge <Nicklas.Koertge1@ibm.com>
* docs: design for call-stack heap attribution & trim (H1+H2)
Signed-off-by: Nicklas Körtge <Nicklas.Koertge1@ibm.com>
* docs: task-by-task plan for call-stack heap attribution (H1)
Signed-off-by: Nicklas Körtge <Nicklas.Koertge1@ibm.com>
* docs: correct H2 eligibility-predicate premise in heap-trim spec
Signed-off-by: Nicklas Körtge <Nicklas.Koertge1@ibm.com>
* feat(plugin): heap-attribution summary record for scan-floor analysis
Signed-off-by: Nicklas Körtge <Nicklas.Koertge1@ibm.com>
* feat(plugin): log heap-attribution populations at end of scan
Signed-off-by: Nicklas Körtge <Nicklas.Koertge1@ibm.com>
* test(java): report detectedNodes count in call-stack perf harness
Signed-off-by: Nicklas Körtge <Nicklas.Koertge1@ibm.com>
* docs: post-detach floor attribution runbook (H1) + H2 decision rule
Signed-off-by: Nicklas Körtge <Nicklas.Koertge1@ibm.com>
* docs: record H1 floor-attribution results (Keycloak) + revised H2 routing
Measured: plugin footprint ~28MB (~1% of ~2.9GB floor); CBOM nodes
negligible (~25KB), call-stack dominates plugin term (15.6MB, linear).
Floor growth is SonarQube/ECJ baseline, not detectedNodes. Heap track
effectively closed; eligibility filter reclassified to CPU/throughput.
Signed-off-by: Nicklas Körtge <Nicklas.Koertge1@ibm.com>
* refactor(java): reorder imports in `JavaDetachedIssueReporter` for consistency
Signed-off-by: Nicklas Körtge <Nicklas.Koertge1@ibm.com>
* fix(engine): match detached call-stack keys with hook-context semantics
buildDetachedCall snapshotted its invoked-object/parameter IType keys with
MatchContext.build(false, rule) (record context), but a DetachedCall is only
ever matched in hook context via MethodMatcher.matchKeys. Under
isHookContext=false the translation selects subtype-permissive matching
(is || isSubtypeOf) instead of the exact is() the live retained-call path uses,
so cross-file matches accepted subtypes the same-file path rejects (false
positives) and the outcome depended on file visitation order. Snapshot with
MatchContext.createForHookContext() so detached matching reproduces the live
retained-call path exactly.
Also:
- gate the heap-attribution debug log behind isDebugEnabled() so the full
CallContextStats.from call-stack traversal does not run on every production
scan when DEBUG is off.
- clarify ILanguageSupport.callContextStats is diagnostics-only and not part of
the detection contract.
Signed-off-by: Nicklas Körtge <Nicklas.Koertge1@ibm.com>
* test(python,go): cross-file guard tests for shared call-stack bucketing
The AST-detach branch narrowed CallStackAgent.onNewHookSubscription to fetch
only the method-name-keyed bucket (bucketsToScan) instead of scanning all
buckets. That narrowing is shared by every language, so document and guard its
safety for Python and Go:
- Python: bucketing is exercised within-file only (within-file wrapper-hook
tests already pass, proving key alignment). No scan-level cross-file symbol
resolution exists, so the narrowing can't drop cross-file detections. Added a
two-file CrossFileHookResolveTest, @Disabled like ResolveImportedStructTest.
- Go: GoDetectionEngine only populates the call stack and never registers hooks,
so onNewHookSubscription/bucketsToScan is unreachable for Go; the GoVerifier
harness is single-file only. Added a @Disabled CrossFileHookDetachTest that
documents both blockers.
Both tests are forward guards: enable them if either language gains cross-file
or hook-based resolution.
---------
Signed-off-by: Nicklas Körtge <Nicklas.Koertge1@ibm.com>
docs: callstack/hooks heap-reduction plan with measured keycloak numbers
perf(java): memoize BouncyCastle rule graph to cut construction heap (#476) (#477)
* docs: design spec for rule-graph memoization (#476)
Signed-off-by: Nicklas Körtge <Nicklas.Koertge1@ibm.com>
* docs: implementation plan for rule-graph memoization (#476)
Signed-off-by: Nicklas Körtge <Nicklas.Koertge1@ibm.com>
* feat(java): add Memoize helper for rule-graph memoization (#476)
Signed-off-by: Nicklas Körtge <Nicklas.Koertge1@ibm.com>
* perf(java): memoize BcBlockCipher/BcBlockCipherEngine rule subtrees (#476)
Signed-off-by: Nicklas Körtge <Nicklas.Koertge1@ibm.com>
* perf(java): memoize BcDigests rule subtree (#476)
Signed-off-by: Nicklas Körtge <Nicklas.Koertge1@ibm.com>
* perf(java): memoize asymmetric block-cipher rule subtrees (#476)
Signed-off-by: Nicklas Körtge <Nicklas.Koertge1@ibm.com>
* perf(java): memoize cipher/AEAD/wrapper rule subtrees (#476)
Signed-off-by: Nicklas Körtge <Nicklas.Koertge1@ibm.com>
* perf(java): memoize MAC/KDF/PBE/agreement rule subtrees (#476)
Signed-off-by: Nicklas Körtge <Nicklas.Koertge1@ibm.com>
* perf(java): memoize cipher-parameter rule subtrees (#476)
Signed-off-by: Nicklas Körtge <Nicklas.Koertge1@ibm.com>
* perf(java): memoize signer/DSA/keypair/other rule subtrees (#476)
Signed-off-by: Nicklas Körtge <Nicklas.Koertge1@ibm.com>
* test(java): guard rule-graph distinct-object footprint (#476), N=2563
Signed-off-by: Nicklas Körtge <Nicklas.Koertge1@ibm.com>
* test: enforce rules() memoization across java/python/go (#476)
Finish the #476 memoization work and make it self-policing for every
future detection rule in all three language modules.
- Memoize the remaining static rules() subtrees: 51 JCA/SSL classes
(java) plus every python (pyca) and go (gocrypto) detection rule, so
shared subtrees are built once and referenced everywhere.
- Add a Memoize helper to the python and go modules, mirroring java.
- Add RuleMemoizationEnforcementTest to each module: it classpath-scans
every com.ibm.plugin.rules.detection class exposing a static no-arg
rules() and asserts rules() == rules() (same identity => memoized).
A new rule that forgets Memoize.of(...) now fails the build, since the
type system cannot police a static method.
Full suite green (java 160, python 49, go 40); RuleGraphMemoizationTest
footprint unchanged at 2563 distinct objects.
Signed-off-by: Nicklas Körtge <Nicklas.Koertge1@ibm.com>
---------
Signed-off-by: Nicklas Körtge <Nicklas.Koertge1@ibm.com>
Update algorithm names to match CycloneDX schema (#362)
* Update algorithm names to match CycloneDX schema
Updates algorithm naming conventions in mapper model to align with the
CycloneDX cryptography-defs.json specification:
- SHA1 → SHA-1, SHA256 → SHA-256, SHA384 → SHA-384, SHA512 → SHA-512
- SHA3-* → SHA-3-* (e.g., SHA3-256 → SHA-3-256)
- ChaCha20Poly1305 → ChaCha20-Poly1305
- RSASSA-PSS → RSA-PSS
- DH → FFDH (Finite Field Diffie-Hellman)
- KDF in Counter Mode → SP800-108-CounterKDF
- KDF in Feedback Mode → SP800-108-FeedbackKDF
- SPHINCS+ → SLH-DSA
Also adds CycloneDX schema JavaDoc references to algorithm classes and
updates test assertions across all language modules (Java, Python, Go).
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
Signed-off-by: Nicklas Körtge <Nicklas.Koertge1@ibm.com>
* Refactor algorithms: update naming conventions, finalize classes, and align packages for consistency
Signed-off-by: Nicklas Körtge <Nicklas.Koertge1@ibm.com>
* Add design spec for CycloneDX algorithm-name migration
Signed-off-by: Nicklas Körtge <Nicklas.Koertge1@ibm.com>
* Add implementation plan and refine spec with per-pattern composition rule
Signed-off-by: Nicklas Körtge <Nicklas.Koertge1@ibm.com>
* Fix pre-existing compile break: add protected MQV constructor for ECMQV
Signed-off-by: Nicklas Körtge <Nicklas.Koertge1@ibm.com>
* Add composeName helper and wire AES; scaffold composition test
Signed-off-by: Nicklas Körtge <Nicklas.Koertge1@ibm.com>
* Correct SHA3 name to match CycloneDX pattern (SHA3-256)
Signed-off-by: Nicklas Körtge <Nicklas.Koertge1@ibm.com>
* Fix DES composition to DES-{keyLength}-{mode} per schema
Signed-off-by: Nicklas Körtge <Nicklas.Koertge1@ibm.com>
* Rename and compose block-cipher names per CycloneDX schema
Signed-off-by: Nicklas Körtge <Nicklas.Koertge1@ibm.com>
* Compose RC4/ElGamal key length and hyphenate ChaCha20-Poly1305
Signed-off-by: Nicklas Körtge <Nicklas.Koertge1@ibm.com>
* Rename Ascon standardized subset to Ascon-AEAD128/-Hash256/-XOF128
Signed-off-by: Nicklas Körtge <Nicklas.Koertge1@ibm.com>
* Rename KDF algorithms to CycloneDX schema names
Signed-off-by: Nicklas Körtge <Nicklas.Koertge1@ibm.com>
* Rename XMSSMT to schema token and pin ML-DSA/ML-KEM composed names
Signed-off-by: Nicklas Körtge <Nicklas.Koertge1@ibm.com>
* Compose BLAKE2b/BLAKE2s digest size per schema
Signed-off-by: Nicklas Körtge <Nicklas.Koertge1@ibm.com>
* Reorder CMAC name to CMAC-{cipher} per schema
Signed-off-by: Nicklas Körtge <Nicklas.Koertge1@ibm.com>
* Rework RSA/DSA name ordering, RSAssaPSS->RSA-PSS, MQV->FFMQV per schema
Signed-off-by: Nicklas Körtge <Nicklas.Koertge1@ibm.com>
* Update mapper and java test assertions to schema algorithm names
Signed-off-by: Nicklas Körtge <Nicklas.Koertge1@ibm.com>
* Update python test assertions to schema algorithm names
Signed-off-by: Nicklas Körtge <Nicklas.Koertge1@ibm.com>
* Update go test assertions to schema algorithm names
Signed-off-by: Nicklas Körtge <Nicklas.Koertge1@ibm.com>
* Update output (CycloneDX) test assertions to schema algorithm names
Signed-off-by: Nicklas Körtge <Nicklas.Koertge1@ibm.com>
* Add CycloneDX schema-regex conformance test for algorithm names
Signed-off-by: Nicklas Körtge <Nicklas.Koertge1@ibm.com>
* Update test assertions to schema algorithm names after merge
Post-merge fixups: main added/auto-merged test files carrying pre-rename
algorithm names, but this branch's mappers now emit CycloneDX schema names.
Aligned the stale expectations with the produced values:
- SHA256withDSA -> DSA-SHA-256, SHA256 -> SHA-256 (BcDSADigestSignerTest)
- SHA256withRSA -> RSA-PKCS1-1.5-SHA-256 (BcRSADigestSignerTestFile)
- HMAC-SHA256 -> HMAC-SHA-256 (PreciseIssueLocationTestFile)
- SHA256 -> SHA-256, HMAC-SHA256 -> HMAC-SHA-256 (Pyca hash/mac tests)
Signed-off-by: Nicklas Körtge <Nicklas.Koertge1@ibm.com>
* Fix stale ChaCha20 AEAD Javadoc and PBES1 TODO typo
Signed-off-by: Nicklas Körtge <Nicklas.Koertge1@ibm.com>
---------
Signed-off-by: Nicklas Körtge <Nicklas.Koertge1@ibm.com>
Enable DuplicateDependingFindingsTest (#468)
* Enable DuplicateDependingFindingsTest
Signed-off-by: somiljain2006 <somil16022006@gmail.com>
* Change test description
Signed-off-by: somiljain2006 <somil16022006@gmail.com>
* Fix formatting
Signed-off-by: somiljain2006 <somil16022006@gmail.com>
---------
Signed-off-by: somiljain2006 <somil16022006@gmail.com>
fix(python): detect standalone PyCA hash constructions (#464)
Signed-off-by: Sachin Kumar <sachinkumar905846@gmail.com>
remove csharp (#467)
Signed-off-by: san-zrl <san@zurich.ibm.com>
Fix asset deduplication logic (#465)
* Fix asset deduplication logic
Signed-off-by: somiljain2006 <somil16022006@gmail.com>
* Revert some lines
Signed-off-by: somiljain2006 <somil16022006@gmail.com>
* Fix block cipher root deduplication
Signed-off-by: somiljain2006 <somil16022006@gmail.com>
---------
Signed-off-by: somiljain2006 <somil16022006@gmail.com>
fix correct method name in ChaCha20Poly1305 ENCRYPT detection rule (#459)
* fix(python): correct method name in ChaCha20Poly1305 ENCRYPT detection rule
Signed-off-by: vishnudathks <vishnudathks5@gmail.com>
* fix(python): remove incorrect Noncompliant comment from ChaCha20 test file
Signed-off-by: vishnudathks <vishnudathks5@gmail.com>
---------
Signed-off-by: vishnudathks <vishnudathks5@gmail.com>
fixes handling of *args and **kwargs (#466)
Signed-off-by: san-zrl <san@zurich.ibm.com>
fix: use withoutParameters() for Ed25519 and Ed448 generate rules to prevent false positives (#429)
Signed-off-by: Arijit429 <arijitdeb1203@gmail.com>
Fix resolution of parameterized dictionary subscriptions (#457)
Signed-off-by: somiljain2006 <somil16022006@gmail.com>
fix detect stream cipher with mode = none (#460)
Signed-off-by: Adam <adamtruty2@gmail.com>
test(java): verify occurrence locations for issue #339 (#430)
* test(java): add regression coverage for detection location (#339)
Signed-off-by: Sachin Kumar <sachinkumar905846@gmail.com>
* test(java): address review feedback for location regression
Signed-off-by: Sachin Kumar <sachinkumar905846@gmail.com>
* test(java): verify occurrence locations for issue #339
Signed-off-by: Sachin Kumar <sachinkumar905846@gmail.com>
* test(java): focus regression on occurrence locations
Signed-off-by: Sachin Kumar <sachinkumar905846@gmail.com>
---------
Signed-off-by: Sachin Kumar <sachinkumar905846@gmail.com>
test(python): verify detection of crypto operations inside custom functions (#394)
- Rename test to PycaMacDetectionInCustomFunctionTest
- Add negative case to prevent false positives
- Improve documentation and assertions
- Clarify behavior for same-file function traversal
Signed-off-by: Sachin Kumar <sachinkumar905846@gmail.com>
improved handling and testing of empty CBOMs (#455)
Signed-off-by: san-zrl <san@zurich.ibm.com>
Fixes issue of empty CBOM creation when no SonarQube rule is activated (#388)
* fixed empty cbom creation
Signed-off-by: medha-14 <medha140904@gmail.com>
* added test
Signed-off-by: medha-14 <medha140904@gmail.com>
---------
Signed-off-by: medha-14 <medha140904@gmail.com>
added c# parser sources (#454)
Signed-off-by: san-zrl <san@zurich.ibm.com>
feat(pbes1): add OID mappings for PBES1 combinations (#389)
* feat(pbes1): add OID mappings
Signed-off-by: Ayush Patel <ayushpatel2731@gmail.com>
* fix: add RC4 null-return comment and PBES1 parameterized regression tests
Signed-off-by: Ayush Patel <ayushpatel2731@gmail.com>
---------
Signed-off-by: Ayush Patel <ayushpatel2731@gmail.com>
test(java): add RSADigestSigner constructor edge-case coverage (#410)
Signed-off-by: Sachin Kumar <sachinkumar905846@gmail.com>
fixed obsotete license staments (#416)
Signed-off-by: san-zrl <san@zurich.ibm.com>
integrate csharp scanner with cbomkit-lib (#405)
Signed-off-by: san-zrl <san@zurich.ibm.com>
test(java): add regression test for MD5 detection in JCA MessageDigest (#393)
Signed-off-by: Sachin Kumar <sachinkumar905846@gmail.com>
Bump actions/upload-artifact from 5 to 7 (#375)
Bumps [actions/upload-artifact](https://github.com/actions/upload-artifact) from 5 to 7.
- [Release notes](https://github.com/actions/upload-artifact/releases)
- [Commits](https://github.com/actions/upload-artifact/compare/v5...v7)
---
updated-dependencies:
- dependency-name: actions/upload-artifact
dependency-version: '7'
dependency-type: direct:production
update-type: version-update:semver-major
...
Signed-off-by: dependabot[bot] <support@github.com>
Bump cbomkit/cbomkit-action from 2.1.2 to 2.2.0 (#373)
Bumps [cbomkit/cbomkit-action](https://github.com/cbomkit/cbomkit-action) from 2.1.2 to 2.2.0.
- [Release notes](https://github.com/cbomkit/cbomkit-action/releases)
- [Commits](https://github.com/cbomkit/cbomkit-action/compare/v2.1.2...v2.2.0)
---
updated-dependencies:
- dependency-name: cbomkit/cbomkit-action
dependency-version: 2.2.0
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com>
Bump the maven group across 11 directories with 1 update (#370)
Bumps the maven group with 1 update in the / directory: [org.assertj:assertj-core](https://github.com/assertj/assertj).
Bumps the maven group with 1 update in the /common directory: [org.assertj:assertj-core](https://github.com/assertj/assertj).
Bumps the maven group with 1 update in the /engine directory: [org.assertj:assertj-core](https://github.com/assertj/assertj).
Bumps the maven group with 1 update in the /enricher directory: [org.assertj:assertj-core](https://github.com/assertj/assertj).
Bumps the maven group with 1 update in the /go directory: [org.assertj:assertj-core](https://github.com/assertj/assertj).
Bumps the maven group with 1 update in the /java directory: [org.assertj:assertj-core](https://github.com/assertj/assertj).
Bumps the maven group with 1 update in the /mapper directory: [org.assertj:assertj-core](https://github.com/assertj/assertj).
Bumps the maven group with 1 update in the /output directory: [org.assertj:assertj-core](https://github.com/assertj/assertj).
Bumps the maven group with 1 update in the /python directory: [org.assertj:assertj-core](https://github.com/assertj/assertj).
Bumps the maven group with 1 update in the /rules directory: [org.assertj:assertj-core](https://github.com/assertj/assertj).
Bumps the maven group with 1 update in the /sonar-cryptography-plugin directory: [org.assertj:assertj-core](https://github.com/assertj/assertj).
Updates `org.assertj:assertj-core` from 3.27.4 to 3.27.7
- [Release notes](https://github.com/assertj/assertj/releases)
- [Commits](https://github.com/assertj/assertj/compare/assertj-build-3.27.4...assertj-build-3.27.7)
Updates `org.assertj:assertj-core` from 3.27.4 to 3.27.7
- [Release notes](https://github.com/assertj/assertj/releases)
- [Commits](https://github.com/assertj/assertj/compare/assertj-build-3.27.4...assertj-build-3.27.7)
Updates `org.assertj:assertj-core` from 3.27.4 to 3.27.7
- [Release notes](https://github.com/assertj/assertj/releases)
- [Commits](https://github.com/assertj/assertj/compare/assertj-build-3.27.4...assertj-build-3.27.7)
Updates `org.assertj:assertj-core` from 3.27.4 to 3.27.7
- [Release notes](https://github.com/assertj/assertj/releases)
- [Commits](https://github.com/assertj/assertj/compare/assertj-build-3.27.4...assertj-build-3.27.7)
Updates `org.assertj:assertj-core` from 3.27.4 to 3.27.7
- [Release notes](https://github.com/assertj/assertj/releases)
- [Commits](https://github.com/assertj/assertj/compare/assertj-build-3.27.4...assertj-build-3.27.7)
Updates `org.assertj:assertj-core` from 3.27.4 to 3.27.7
- [Release notes](https://github.com/assertj/assertj/releases)
- [Commits](https://github.com/assertj/assertj/compare/assertj-build-3.27.4...assertj-build-3.27.7)
Updates `org.assertj:assertj-core` from 3.27.4 to 3.27.7
- [Release notes](https://github.com/assertj/assertj/releases)
- [Commits](https://github.com/assertj/assertj/compare/assertj-build-3.27.4...assertj-build-3.27.7)
Updates `org.assertj:assertj-core` from 3.27.4 to 3.27.7
- [Release notes](https://github.com/assertj/assertj/releases)
- [Commits](https://github.com/assertj/assertj/compare/assertj-build-3.27.4...assertj-build-3.27.7)
Updates `org.assertj:assertj-core` from 3.27.4 to 3.27.7
- [Release notes](https://github.com/assertj/assertj/releases)
- [Commits](https://github.com/assertj/assertj/compare/assertj-build-3.27.4...assertj-build-3.27.7)
Updates `org.assertj:assertj-core` from 3.27.4 to 3.27.7
- [Release notes](https://github.com/assertj/assertj/releases)
- [Commits](https://github.com/assertj/assertj/compare/assertj-build-3.27.4...assertj-build-3.27.7)
Updates `org.assertj:assertj-core` from 3.27.4 to 3.27.7
- [Release notes](https://github.com/assertj/assertj/releases)
- [Commits](https://github.com/assertj/assertj/compare/assertj-build-3.27.4...assertj-build-3.27.7)
---
updated-dependencies:
- dependency-name: org.assertj:assertj-core
dependency-version: 3.27.7
dependency-type: direct:development
dependency-group: maven
- dependency-name: org.assertj:assertj-core
dependency-version: 3.27.7
dependency-type: direct:development
dependency-group: maven
- dependency-name: org.assertj:assertj-core
dependency-version: 3.27.7
dependency-type: direct:development
dependency-group: maven
- dependency-name: org.assertj:assertj-core
dependency-version: 3.27.7
dependency-type: direct:development
dependency-group: maven
- dependency-name: org.assertj:assertj-core
dependency-version: 3.27.7
dependency-type: direct:development
dependency-group: maven
- dependency-name: org.assertj:assertj-core
dependency-version: 3.27.7
dependency-type: direct:development
dependency-group: maven
- dependency-name: org.assertj:assertj-core
dependency-version: 3.27.7
dependency-type: direct:development
dependency-group: maven
- dependency-name: org.assertj:assertj-core
dependency-version: 3.27.7
dependency-type: direct:development
dependency-group: maven
- dependency-name: org.assertj:assertj-core
dependency-version: 3.27.7
dependency-type: direct:development
dependency-group: maven
- dependency-name: org.assertj:assertj-core
dependency-version: 3.27.7
dependency-type: direct:development
dependency-group: maven
- dependency-name: org.assertj:assertj-core
dependency-version: 3.27.7
dependency-type: direct:development
dependency-group: maven
...
Signed-off-by: dependabot[bot] <support@github.com>
Bump org.assertj:assertj-core from 3.27.4 to 3.27.7 (#369)
Bumps [org.assertj:assertj…
sachin9058
added a commit
to sachin9058/sonar-cryptography
that referenced
this pull request
Sep 13, 2026
- Add AlgorithmProperties17 with algorithmFamily and ellipticCurve fields; hide deprecated curve via @JsonIgnore
- Add ProtocolProperties17 with relatedCryptographicAssets; hide deprecated cryptoRefArray via @JsonIgnore
- Add CertificateProperties17 with certificateFileExtension, serialNumber, fingerprint; hide deprecated certificateExtension via @JsonIgnore
- Update AlgorithmComponentBuilder to use AlgorithmProperties17, map algorithmFamily, emit namespaced ellipticCurve values (e.g. nist/P-256), add KeyWrap primitive support
- Update ProtocolComponentBuilder to use ProtocolProperties17, add relatedCryptographicAssets support
- Update CBOMOutputFile to set specVersion 1.7 via reflection, use ProtocolProperties17 natively, add relatedCryptographicAssets from dependency refs
- Update IAlgorithmComponentBuilder with algorithmFamily method
- Update IProtocolComponentBuilder with relatedCryptographicAssets method
- Update AlgorithmTest and ProtocolTest to validate 1.7 schema compliance
- Update README.md example output to specVersion 1.7
- Update TestBase and Utils for 1.7 specVersion support
Signed-off-by: Sachin Kumar <sachinkumar905846@gmail.com>
chore(deps-dev): bump com.diffplug.spotless:spotless-maven-plugin (#536)
Bumps [com.diffplug.spotless:spotless-maven-plugin](https://github.com/diffplug/spotless) from 3.10.0 to 3.10.1.
- [Release notes](https://github.com/diffplug/spotless/releases)
- [Changelog](https://github.com/diffplug/spotless/blob/main/CHANGES.md)
- [Commits](https://github.com/diffplug/spotless/compare/maven/3.10.0...maven/3.10.1)
---
updated-dependencies:
- dependency-name: com.diffplug.spotless:spotless-maven-plugin
dependency-version: 3.10.1
dependency-type: direct:development
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com>
chore(deps-dev): bump ch.qos.logback:logback-classic (#535)
Bumps [ch.qos.logback:logback-classic](https://github.com/qos-ch/logback) from 1.5.38 to 1.6.3.
- [Release notes](https://github.com/qos-ch/logback/releases)
- [Commits](https://github.com/qos-ch/logback/compare/v_1.5.38...v_1.6.3)
---
updated-dependencies:
- dependency-name: ch.qos.logback:logback-classic
dependency-version: 1.6.3
dependency-type: direct:development
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com>
chore(deps): bump actions/setup-java from 5 to 6 (#528)
Bumps [actions/setup-java](https://github.com/actions/setup-java) from 5 to 6.
- [Release notes](https://github.com/actions/setup-java/releases)
- [Commits](https://github.com/actions/setup-java/compare/v5...v6)
---
updated-dependencies:
- dependency-name: actions/setup-java
dependency-version: '6'
dependency-type: direct:production
update-type: version-update:semver-major
...
Signed-off-by: dependabot[bot] <support@github.com>
chore(deps-dev): bump com.diffplug.spotless:spotless-maven-plugin (#524)
Bumps [com.diffplug.spotless:spotless-maven-plugin](https://github.com/diffplug/spotless) from 3.9.0 to 3.10.0.
- [Release notes](https://github.com/diffplug/spotless/releases)
- [Changelog](https://github.com/diffplug/spotless/blob/main/CHANGES.md)
- [Commits](https://github.com/diffplug/spotless/compare/maven/3.9.0...maven/3.10.0)
---
updated-dependencies:
- dependency-name: com.diffplug.spotless:spotless-maven-plugin
dependency-version: 3.10.0
dependency-type: direct:development
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com>
chore(deps): bump actions/setup-python from 6 to 7 (#523)
Bumps [actions/setup-python](https://github.com/actions/setup-python) from 6 to 7.
- [Release notes](https://github.com/actions/setup-python/releases)
- [Commits](https://github.com/actions/setup-python/compare/v6...v7)
---
updated-dependencies:
- dependency-name: actions/setup-python
dependency-version: '7'
dependency-type: direct:production
update-type: version-update:semver-major
...
Signed-off-by: dependabot[bot] <support@github.com>
chore(deps): bump org.antlr:antlr4-runtime from 4.13.1 to 4.13.2 (#522)
Bumps [org.antlr:antlr4-runtime](https://github.com/antlr/antlr4) from 4.13.1 to 4.13.2.
- [Release notes](https://github.com/antlr/antlr4/releases)
- [Changelog](https://github.com/antlr/antlr4/blob/dev/CHANGES.txt)
- [Commits](https://github.com/antlr/antlr4/compare/4.13.1...4.13.2)
---
updated-dependencies:
- dependency-name: org.antlr:antlr4-runtime
dependency-version: 4.13.2
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com>
format (#533)
Signed-off-by: san-zrl <san@zurich.ibm.com>
CBOM generation disabled (#532)
Signed-off-by: san-zrl <san@zurich.ibm.com>
fix: stop endless recursion in resolveValues on assignment cycles (#530)
Fixes #525.
resolveValues follows a variable's assignments and its initializer to
find its value. It had no cycle check. Code like
String algorithm = "AES";
String copy = algorithm;
...
algorithm = copy;
made it recurse forever and crash the scan with a StackOverflowError.
The existing selections.size() > 15 guard never fires here, because
identifier-to-identifier hops do not grow the selections list.
The bug is old, but 1.6.1 exposed it: since e1fdab3b the engine
resolves the arguments of every method call (for detached call
records), not only the arguments of matched crypto calls. So a cycle
anywhere in the scanned code now reaches resolveValues.
The fix moves the variable branch into resolveVariableValues and
tracks which variables are being resolved on the current path. A
variable that is already on the path is not followed again. The
variable is released again when its resolution is done, so two
sibling branches may still resolve through the same variable.
A new red-green test reproduces the exact alternating stack trace
from the issue and checks that the value still resolves through the
cycle to the constant initializer.
fix: demote log msg for constructors with more than one argument to trace (#531)
Signed-off-by: san-zrl <san@zurich.ibm.com>
feat(csharp): add C# ChaCha20Poly1305 detection rules (#506)
* added chacha20poly1305 detection rules
Signed-off-by: Kaldesyvon <martinnovysedlak99@gmail.com>
* added chacha20poly1305 detection rules
Signed-off-by: Kaldesyvon <martinnovysedlak99@gmail.com>
* resolving comments in detection rules
Signed-off-by: Kaldesyvon <martinnovysedlak99@gmail.com>
* fixing detection rules and adding tests
Signed-off-by: Kaldesyvon <martinnovysedlak99@gmail.com>
* minor changes in .cs test file
Signed-off-by: Kaldesyvon <martinnovysedlak99@gmail.com>
* replacing encrypt/decrypt values with CipherAction
Signed-off-by: Kaldesyvon <martinnovysedlak99@gmail.com>
* removing unused imports
Signed-off-by: Kaldesyvon <martinnovysedlak99@gmail.com>
* adding more test cases
Signed-off-by: Kaldesyvon <martinnovysedlak99@gmail.com>
* added cipheraction and improved tests to that
Signed-off-by: Kaldesyvon <martinnovysedlak99@gmail.com>
---------
Signed-off-by: Kaldesyvon <martinnovysedlak99@gmail.com>
Signed-off-by: fynnth <42970655+fynnth@users.noreply.github.com>
Csharp first comprehensive rules (#520)
feat(csharp): Covers System.Security.Cryptography and captures constructors, primary methods and property setters. Complete parameter capturing and variable tracking are not yet supported.
Signed-off-by: Fynn Thierling <fynnth@outlook.de>
chore(deps-dev): bump com.google.guava:guava (#512)
Bumps [com.google.guava:guava](https://github.com/google/guava) from 33.6.0-jre to 33.7.1-jre.
- [Release notes](https://github.com/google/guava/releases)
- [Commits](https://github.com/google/guava/commits)
---
updated-dependencies:
- dependency-name: com.google.guava:guava
dependency-version: 33.7.1-jre
dependency-type: direct:development
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com>
chore(deps): manage sonar-analyzer-test-commons in the parent pom (#519)
The version of sonar-analyzer-test-commons was hardcoded in two module
poms. Dependabot had to patch both files for every bump (#513).
Move the version into a property and a dependencyManagement entry in the
parent pom, and bump it to 2.30.0.5193. The go module keeps the
dependency but without a version.
Drop the dependency from the csharp module. No C# test imports anything
from org.sonarsource.analyzer.commons. The RuleMetadataLoader used in
CSharpScannerRuleDefinition comes from the sonar-analyzer-commons
artifact, which is a different, compile-scoped, transitive dependency.
Because this uses dependencyManagement, no other module gains a new
dependency.
Closes #513
Signed-off-by: Nicklas Körtge <Nicklas.Koertge1@ibm.com>
ci: run the dependency graph submission before the CBOM step (#518)
The first run on main failed:
Error: EACCES: permission denied, scandir
'/home/runner/work/sonar-cryptography/sonar-cryptography/76d3.../1508...'
The CBOM step is a Docker action. It runs as root with the workspace
mounted, and the Sonar Java analyzer inside it leaves temp folders in the
workspace. Those folders belong to root and the runner user cannot read
them. The dependency submission action walks the whole workspace to find
its depgraph files, hits such a folder, and stops.
Running it before the CBOM step means it walks a clean workspace. Nothing
else depends on the order. It still runs after the clean-tree check, and
it only writes into target/, which is ignored.
fix: stop the build from rewriting the cipher-suite source files (#516)
* fix: stop the build from rewriting the cipher-suite source files
The mapper module bound exec-maven-plugin to the compile phase to run
download-cipher-suites.sh. That script downloaded ciphersuites.json from
ciphersuite.info over the checked-in copy, then regenerated
JsonCipherSuites.java in the source tree. So every `mvn compile` left both
files modified in the working tree.
This was blamed on Spotless truncating the file. It was not truncation.
The generator writes one Map.entry per line and no license header, which
gives a 363-line file. Spotless runs later, at the package phase, and
expands it back to 3861 lines with the header. Stop at compile, or skip
Spotless, and you are left with the short header-less version. All 348
entries were always there.
The data also drifts: the API returns 351 entries today against 348 in
the repo, so even a full `mvn package` left the tree dirty. And the
shipped cipher-suite data depended on what the API said at build time.
Changes:
- Remove exec-maven-plugin from mapper/pom.xml. The two generated files
stay in git and the build just compiles them.
- Add a scheduled `Update cipher suites` workflow that runs the refresh
monthly and opens a pull request, so data changes get reviewed.
- Harden download-cipher-suites.sh: set -eu, curl --fail, download to a
temp file, and refuse to write if the entry count drops by more than
10%. A failed or shrunken response can no longer clobber good data.
- Add a CI step that fails if the build modified any tracked file.
- Fix the stale explanation in docs/PERFORMANCE_TESTING.md and document
the refresh in CLAUDE.md.
* chore: drop the explanatory comment in mapper/pom.xml and the note in PERFORMANCE_TESTING.md
ci: submit the real Maven dependency graph to GitHub (#515)
GitHub builds the dependency graph by parsing the pom.xml files itself.
Its copy is stale: it lists sonar-java-plugin 8.18.0 and
sonar-python-plugin 5.16.0 while main uses 8.22.0 and 5.29.0, and it has
no entry for the csharp module. So it carries the old transitive Jackson
and Spring versions and raises Dependabot alerts for versions we never
build with.
All 167 open alerts are false positives. The versions we resolve are
already patched: jackson 2.22.1, spring 6.2.11, logback-core 1.5.35,
assertj 3.27.7, bcprov 1.84.
This enables the dependency submission action, which was already in the
workflow but commented out. It uploads the resolved tree after each build
on main, so Dependabot can close the stale alerts.
chore(deps-dev): bump org.bouncycastle:bcprov-jdk18on (#503)
Bumps [org.bouncycastle:bcprov-jdk18on](https://github.com/bcgit/bc-java) from 1.84 to 1.85.2.
- [Changelog](https://github.com/bcgit/bc-java/blob/main/docs/releasenotes.html)
- [Commits](https://github.com/bcgit/bc-java/commits)
---
updated-dependencies:
- dependency-name: org.bouncycastle:bcprov-jdk18on
dependency-version: 1.85.2
dependency-type: direct:development
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com>
chore(deps-dev): bump org.apache.maven.plugins:maven-surefire-plugin (#507)
Bumps [org.apache.maven.plugins:maven-surefire-plugin](https://github.com/apache/maven-surefire) from 3.5.4 to 3.5.6.
- [Release notes](https://github.com/apache/maven-surefire/releases)
- [Commits](https://github.com/apache/maven-surefire/compare/surefire-3.5.4...surefire-3.5.6)
---
updated-dependencies:
- dependency-name: org.apache.maven.plugins:maven-surefire-plugin
dependency-version: 3.5.6
dependency-type: direct:development
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com>
chore(deps-dev): bump com.diffplug.spotless:spotless-maven-plugin (#508)
Bumps [com.diffplug.spotless:spotless-maven-plugin](https://github.com/diffplug/spotless) from 3.2.0 to 3.9.0.
- [Release notes](https://github.com/diffplug/spotless/releases)
- [Changelog](https://github.com/diffplug/spotless/blob/main/CHANGES.md)
- [Commits](https://github.com/diffplug/spotless/compare/lib/3.2.0...maven/3.9.0)
---
updated-dependencies:
- dependency-name: com.diffplug.spotless:spotless-maven-plugin
dependency-version: 3.9.0
dependency-type: direct:development
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com>
Loads Parser/Lexer as dependency (#496)
* Re-created csharp files
Signed-off-by: san-zrl <san@zurich.ibm.com>
Signed-off-by: Fynn Thierling <fynnth@outlook.de>
* load csharp parser as dependency
Signed-off-by: Fynn Thierling <fynnth@outlook.de>
---------
Signed-off-by: san-zrl <san@zurich.ibm.com>
Signed-off-by: Fynn Thierling <fynnth@outlook.de>
chore(deps): bump sonar.python.version from 5.25.0.34794 to 5.29.0.35837 (#500)
Bumps `sonar.python.version` from 5.25.0.34794 to 5.29.0.35837.
Updates `org.sonarsource.python:sonar-python-plugin` from 5.25.0.34794 to 5.29.0.35837
- [Release notes](https://github.com/SonarCommunity/sonar-python/releases)
- [Commits](https://github.com/SonarCommunity/sonar-python/commits)
Updates `org.sonarsource.python:python-checks-testkit` from 5.25.0.34794 to 5.29.0.35837
- [Release notes](https://github.com/SonarSource/sonar-python/releases)
- [Commits](https://github.com/SonarSource/sonar-python/commits)
---
updated-dependencies:
- dependency-name: org.sonarsource.python:sonar-python-plugin
dependency-version: 5.29.0.35837
dependency-type: direct:production
update-type: version-update:semver-minor
- dependency-name: org.sonarsource.python:python-checks-testkit
dependency-version: 5.29.0.35837
dependency-type: direct:development
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com>
chore(deps): bump sonar.plugin.api.version (#502)
Bumps `sonar.plugin.api.version` from 13.8.0.4399 to 13.11.0.4459.
Updates `org.sonarsource.api.plugin:sonar-plugin-api` from 13.8.0.4399 to 13.11.0.4459
- [Release notes](https://github.com/SonarSource/sonar-plugin-api/releases)
- [Changelog](https://github.com/SonarSource/sonar-plugin-api/blob/master/CHANGELOG.md)
- [Commits](https://github.com/SonarSource/sonar-plugin-api/compare/13.8.0.4399...13.11.0.4459)
Updates `org.sonarsource.api.plugin:sonar-plugin-api-test-fixtures` from 13.8.0.4399 to 13.11.0.4459
- [Release notes](https://github.com/SonarSource/sonar-plugin-api/releases)
- [Changelog](https://github.com/SonarSource/sonar-plugin-api/blob/master/CHANGELOG.md)
- [Commits](https://github.com/SonarSource/sonar-plugin-api/compare/13.8.0.4399...13.11.0.4459)
---
updated-dependencies:
- dependency-name: org.sonarsource.api.plugin:sonar-plugin-api
dependency-version: 13.11.0.4459
dependency-type: direct:production
update-type: version-update:semver-minor
- dependency-name: org.sonarsource.api.plugin:sonar-plugin-api-test-fixtures
dependency-version: 13.11.0.4459
dependency-type: direct:development
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com>
docs: fix stale rule info in README, document CBOM filename setting, add Go to CLAUDE.md (#499)
* docs: fix stale rule info in README and document CBOM filename setting
- correct the rule repository name: the plugin registers "Sonar Cryptography"
repositories (sonar-java-crypto, sonar-python-crypto, sonar-go-crypto), not a
"Cbomkit Cryptography Repository"
- replace the "one single rule" claim with a table of the two shipped rules and
the languages each covers
- state that only the Cryptographic Inventory (CBOM) rule writes a cbom.json
(JavaBaseDetectionRule only aggregates nodes when isInventory is true), so
activating just the MD5 rule produces no CBOM
- document the sonar.cryptoScanner.cbom property (default, project scope, -D usage)
The docs/images/rules.png screenshot is still stale (two repositories, one rule)
and needs a fresh capture from a SonarQube instance running the 2.x plugin.
* docs: add Go language module to CLAUDE.md
Go support (crypto stdlib + parts of golang.org/x/crypto) was missing from the
supported-languages list, the module tree, and the per-module test commands.
Also point detection-rule tests at the per-language TestBase/verifier instead of
only the Java ones, and list PERFORMANCE_TESTING.md and the sonar-go-to-slang
package instructions under key documentation.
chore: ignore venv and Claude Code local files
docs: refresh outdated docs and replace diagrams with mermaid (#498)
- LANGUAGE_SUPPORT.md: document the Go language module (module list,
generics table with GoCheck/Tree/Symbol/GoScanContext, requiredForLanguages);
fix stale references (CryptoPlugin -> CryptographyPlugin, rule-metadata
resources path, ExportJavaRulesToJsonTest location, IOutputFileFactory link,
sonar.java.version example); replace architecture.png with a mermaid diagram
that includes all three language modules
- DETECTION_RULE_STRUCTURE.md: align the CFBBlockCipher example with the
actual rule in BcBlockCipher (forConstructor, Map-based CipherContext --
the CipherContext.Kind enum no longer exists); replace translation.png and
reorganization.png with mermaid diagrams
- TROUBLESHOOTING.md: update rule name to "Cryptographic Inventory (CBOM)",
bump release example to 1.6.1, replace the non-working zsh UID tip with
the .env approach
Bump ch.qos.logback:logback-classic from 1.5.26 to 1.5.38 (#489)
Bumps [ch.qos.logback:logback-classic](https://github.com/qos-ch/logback) from 1.5.26 to 1.5.38.
- [Release notes](https://github.com/qos-ch/logback/releases)
- [Commits](https://github.com/qos-ch/logback/compare/v_1.5.26...v_1.5.38)
---
updated-dependencies:
- dependency-name: ch.qos.logback:logback-classic
dependency-version: 1.5.38
dependency-type: direct:development
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com>
Bump org.cyclonedx:cyclonedx-maven-plugin from 2.9.1 to 2.9.2 (#490)
Bumps [org.cyclonedx:cyclonedx-maven-plugin](https://github.com/CycloneDX/cyclonedx-maven-plugin) from 2.9.1 to 2.9.2.
- [Release notes](https://github.com/CycloneDX/cyclonedx-maven-plugin/releases)
- [Commits](https://github.com/CycloneDX/cyclonedx-maven-plugin/compare/cyclonedx-maven-plugin-2.9.1...cyclonedx-maven-plugin-2.9.2)
---
updated-dependencies:
- dependency-name: org.cyclonedx:cyclonedx-maven-plugin
dependency-version: 2.9.2
dependency-type: direct:development
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com>
Bump sonar.plugin.api.version from 13.4.3.4290 to 13.8.0.4399 (#491)
Bumps `sonar.plugin.api.version` from 13.4.3.4290 to 13.8.0.4399.
Updates `org.sonarsource.api.plugin:sonar-plugin-api` from 13.4.3.4290 to 13.8.0.4399
- [Release notes](https://github.com/SonarSource/sonar-plugin-api/releases)
- [Changelog](https://github.com/SonarSource/sonar-plugin-api/blob/master/CHANGELOG.md)
- [Commits](https://github.com/SonarSource/sonar-plugin-api/compare/13.4.3.4290...13.8.0.4399)
Updates `org.sonarsource.api.plugin:sonar-plugin-api-test-fixtures` from 13.4.3.4290 to 13.8.0.4399
- [Release notes](https://github.com/SonarSource/sonar-plugin-api/releases)
- [Changelog](https://github.com/SonarSource/sonar-plugin-api/blob/master/CHANGELOG.md)
- [Commits](https://github.com/SonarSource/sonar-plugin-api/compare/13.4.3.4290...13.8.0.4399)
---
updated-dependencies:
- dependency-name: org.sonarsource.api.plugin:sonar-plugin-api
dependency-version: 13.8.0.4399
dependency-type: direct:production
update-type: version-update:semver-minor
- dependency-name: org.sonarsource.api.plugin:sonar-plugin-api-test-fixtures
dependency-version: 13.8.0.4399
dependency-type: direct:development
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com>
Bump org.sonarsource.sonar-packaging-maven-plugin:sonar-packaging-maven-plugin (#492)
Bumps [org.sonarsource.sonar-packaging-maven-plugin:sonar-packaging-maven-plugin](https://github.com/SonarSource/sonar-packaging-maven-plugin) from 1.23.0.740 to 1.25.1.3002.
- [Release notes](https://github.com/SonarSource/sonar-packaging-maven-plugin/releases)
- [Commits](https://github.com/SonarSource/sonar-packaging-maven-plugin/compare/1.23.0.740...1.25.1.3002)
---
updated-dependencies:
- dependency-name: org.sonarsource.sonar-packaging-maven-plugin:sonar-packaging-maven-plugin
dependency-version: 1.25.1.3002
dependency-type: direct:development
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com>
Add .superpowers to gitignore
Bump the maven group across 11 directories with 1 update (#483)
Bumps the maven group with 1 update in the / directory: [ch.qos.logback:logback-core](https://github.com/qos-ch/logback).
Bumps the maven group with 1 update in the /common directory: [ch.qos.logback:logback-core](https://github.com/qos-ch/logback).
Bumps the maven group with 1 update in the /engine directory: [ch.qos.logback:logback-core](https://github.com/qos-ch/logback).
Bumps the maven group with 1 update in the /enricher directory: [ch.qos.logback:logback-core](https://github.com/qos-ch/logback).
Bumps the maven group with 1 update in the /go directory: [ch.qos.logback:logback-core](https://github.com/qos-ch/logback).
Bumps the maven group with 1 update in the /java directory: [ch.qos.logback:logback-core](https://github.com/qos-ch/logback).
Bumps the maven group with 1 update in the /mapper directory: [ch.qos.logback:logback-core](https://github.com/qos-ch/logback).
Bumps the maven group with 1 update in the /output directory: [ch.qos.logback:logback-core](https://github.com/qos-ch/logback).
Bumps the maven group with 1 update in the /python directory: [ch.qos.logback:logback-core](https://github.com/qos-ch/logback).
Bumps the maven group with 1 update in the /rules directory: [ch.qos.logback:logback-core](https://github.com/qos-ch/logback).
Bumps the maven group with 1 update in the /sonar-cryptography-plugin directory: [ch.qos.logback:logback-core](https://github.com/qos-ch/logback).
Updates `ch.qos.logback:logback-core` from 1.5.33 to 1.5.35
- [Release notes](https://github.com/qos-ch/logback/releases)
- [Commits](https://github.com/qos-ch/logback/compare/v_1.5.33...v_1.5.35)
Updates `ch.qos.logback:logback-core` from 1.5.33 to 1.5.35
- [Release notes](https://github.com/qos-ch/logback/releases)
- [Commits](https://github.com/qos-ch/logback/compare/v_1.5.33...v_1.5.35)
Updates `ch.qos.logback:logback-core` from 1.5.33 to 1.5.35
- [Release notes](https://github.com/qos-ch/logback/releases)
- [Commits](https://github.com/qos-ch/logback/compare/v_1.5.33...v_1.5.35)
Updates `ch.qos.logback:logback-core` from 1.5.33 to 1.5.35
- [Release notes](https://github.com/qos-ch/logback/releases)
- [Commits](https://github.com/qos-ch/logback/compare/v_1.5.33...v_1.5.35)
Updates `ch.qos.logback:logback-core` from 1.5.33 to 1.5.35
- [Release notes](https://github.com/qos-ch/logback/releases)
- [Commits](https://github.com/qos-ch/logback/compare/v_1.5.33...v_1.5.35)
Updates `ch.qos.logback:logback-core` from 1.5.33 to 1.5.35
- [Release notes](https://github.com/qos-ch/logback/releases)
- [Commits](https://github.com/qos-ch/logback/compare/v_1.5.33...v_1.5.35)
Updates `ch.qos.logback:logback-core` from 1.5.33 to 1.5.35
- [Release notes](https://github.com/qos-ch/logback/releases)
- [Commits](https://github.com/qos-ch/logback/compare/v_1.5.33...v_1.5.35)
Updates `ch.qos.logback:logback-core` from 1.5.33 to 1.5.35
- [Release notes](https://github.com/qos-ch/logback/releases)
- [Commits](https://github.com/qos-ch/logback/compare/v_1.5.33...v_1.5.35)
Updates `ch.qos.logback:logback-core` from 1.5.33 to 1.5.35
- [Release notes](https://github.com/qos-ch/logback/releases)
- [Commits](https://github.com/qos-ch/logback/compare/v_1.5.33...v_1.5.35)
Updates `ch.qos.logback:logback-core` from 1.5.33 to 1.5.35
- [Release notes](https://github.com/qos-ch/logback/releases)
- [Commits](https://github.com/qos-ch/logback/compare/v_1.5.33...v_1.5.35)
Updates `ch.qos.logback:logback-core` from 1.5.33 to 1.5.35
- [Release notes](https://github.com/qos-ch/logback/releases)
- [Commits](https://github.com/qos-ch/logback/compare/v_1.5.33...v_1.5.35)
---
updated-dependencies:
- dependency-name: ch.qos.logback:logback-core
dependency-version: 1.5.35
dependency-type: direct:development
dependency-group: maven
- dependency-name: ch.qos.logback:logback-core
dependency-version: 1.5.35
dependency-type: direct:development
dependency-group: maven
- dependency-name: ch.qos.logback:logback-core
dependency-version: 1.5.35
dependency-type: direct:development
dependency-group: maven
- dependency-name: ch.qos.logback:logback-core
dependency-version: 1.5.35
dependency-type: direct:development
dependency-group: maven
- dependency-name: ch.qos.logback:logback-core
dependency-version: 1.5.35
dependency-type: direct:development
dependency-group: maven
- dependency-name: ch.qos.logback:logback-core
dependency-version: 1.5.35
dependency-type: direct:development
dependency-group: maven
- dependency-name: ch.qos.logback:logback-core
dependency-version: 1.5.35
dependency-type: direct:development
dependency-group: maven
- dependency-name: ch.qos.logback:logback-core
dependency-version: 1.5.35
dependency-type: direct:development
dependency-group: maven
- dependency-name: ch.qos.logback:logback-core
dependency-version: 1.5.35
dependency-type: direct:development
dependency-group: maven
- dependency-name: ch.qos.logback:logback-core
dependency-version: 1.5.35
dependency-type: direct:development
dependency-group: maven
- dependency-name: ch.qos.logback:logback-core
dependency-version: 1.5.35
dependency-type: direct:development
dependency-group: maven
...
Signed-off-by: dependabot[bot] <support@github.com>
Bump com.google.guava:guava from 33.5.0-jre to 33.6.0-jre (#484)
Bumps [com.google.guava:guava](https://github.com/google/guava) from 33.5.0-jre to 33.6.0-jre.
- [Release notes](https://github.com/google/guava/releases)
- [Commits](https://github.com/google/guava/commits)
---
updated-dependencies:
- dependency-name: com.google.guava:guava
dependency-version: 33.6.0-jre
dependency-type: direct:development
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com>
Bump org.cyclonedx:cyclonedx-core-java from 12.0.1 to 12.2.0 (#485)
Bumps [org.cyclonedx:cyclonedx-core-java](https://github.com/CycloneDX/cyclonedx-core-java) from 12.0.1 to 12.2.0.
- [Release notes](https://github.com/CycloneDX/cyclonedx-core-java/releases)
- [Changelog](https://github.com/CycloneDX/cyclonedx-core-java/blob/master/CHANGELOG.md)
- [Commits](https://github.com/CycloneDX/cyclonedx-core-java/compare/cyclonedx-core-java-12.0.1...cyclonedx-core-java-12.2.0)
---
updated-dependencies:
- dependency-name: org.cyclonedx:cyclonedx-core-java
dependency-version: 12.2.0
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com>
Bump org.mockito:mockito-core from 5.17.0 to 5.23.0 (#486)
Bumps [org.mockito:mockito-core](https://github.com/mockito/mockito) from 5.17.0 to 5.23.0.
- [Release notes](https://github.com/mockito/mockito/releases)
- [Commits](https://github.com/mockito/mockito/compare/v5.17.0...v5.23.0)
---
updated-dependencies:
- dependency-name: org.mockito:mockito-core
dependency-version: 5.23.0
dependency-type: direct:development
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com>
Bump sonar.python.version from 5.20.0.32295 to 5.25.0.34794 (#487)
Bumps `sonar.python.version` from 5.20.0.32295 to 5.25.0.34794.
Updates `org.sonarsource.python:sonar-python-plugin` from 5.20.0.32295 to 5.25.0.34794
- [Release notes](https://github.com/SonarCommunity/sonar-python/releases)
- [Commits](https://github.com/SonarCommunity/sonar-python/commits)
Updates `org.sonarsource.python:python-checks-testkit` from 5.20.0.32295 to 5.25.0.34794
- [Release notes](https://github.com/SonarSource/sonar-python/releases)
- [Commits](https://github.com/SonarSource/sonar-python/commits)
---
updated-dependencies:
- dependency-name: org.sonarsource.python:sonar-python-plugin
dependency-version: 5.25.0.34794
dependency-type: direct:production
update-type: version-update:semver-minor
- dependency-name: org.sonarsource.python:python-checks-testkit
dependency-version: 5.25.0.34794
dependency-type: direct:development
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com>
Bump org.slf4j:slf4j-api from 2.0.17 to 2.0.18 (#488)
Bumps org.slf4j:slf4j-api from 2.0.17 to 2.0.18.
---
updated-dependencies:
- dependency-name: org.slf4j:slf4j-api
dependency-version: 2.0.18
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com>
Bump sonar.python.version from 5.16.0.29940 to 5.20.0.32295 (#381)
Bumps `sonar.python.version` from 5.16.0.29940 to 5.20.0.32295.
Updates `org.sonarsource.python:sonar-python-plugin` from 5.16.0.29940 to 5.20.0.32295
- [Release notes](https://github.com/SonarCommunity/sonar-python/releases)
- [Commits](https://github.com/SonarCommunity/sonar-python/commits)
Updates `org.sonarsource.python:python-checks-testkit` from 5.16.0.29940 to 5.20.0.32295
- [Release notes](https://github.com/SonarSource/sonar-python/releases)
- [Commits](https://github.com/SonarSource/sonar-python/commits)
---
updated-dependencies:
- dependency-name: org.sonarsource.python:sonar-python-plugin
dependency-version: 5.20.0.32295
dependency-type: direct:production
update-type: version-update:semver-minor
- dependency-name: org.sonarsource.python:python-checks-testkit
dependency-version: 5.20.0.32295
dependency-type: direct:development
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com>
Bump org.apache.maven.plugins:maven-compiler-plugin (#382)
Bumps [org.apache.maven.plugins:maven-compiler-plugin](https://github.com/apache/maven-compiler-plugin) from 3.14.0 to 3.15.0.
- [Release notes](https://github.com/apache/maven-compiler-plugin/releases)
- [Commits](https://github.com/apache/maven-compiler-plugin/compare/maven-compiler-plugin-3.14.0...maven-compiler-plugin-3.15.0)
---
updated-dependencies:
- dependency-name: org.apache.maven.plugins:maven-compiler-plugin
dependency-version: 3.15.0
dependency-type: direct:development
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com>
Bump org.apache.maven.plugins:maven-resources-plugin from 3.3.1 to 3.5.0 (#378)
Bumps [org.apache.maven.plugins:maven-resources-plugin](https://github.com/apache/maven-resources-plugin) from 3.3.1 to 3.5.0.
- [Release notes](https://github.com/apache/maven-resources-plugin/releases)
- [Commits](https://github.com/apache/maven-resources-plugin/compare/maven-resources-plugin-3.3.1...maven-resources-plugin-3.5.0)
---
updated-dependencies:
- dependency-name: org.apache.maven.plugins:maven-resources-plugin
dependency-version: 3.5.0
dependency-type: direct:development
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com>
Bump org.apache.maven.plugins:maven-shade-plugin from 3.6.1 to 3.6.2 (#379)
Bumps [org.apache.maven.plugins:maven-shade-plugin](https://github.com/apache/maven-shade-plugin) from 3.6.1 to 3.6.2.
- [Release notes](https://github.com/apache/maven-shade-plugin/releases)
- [Commits](https://github.com/apache/maven-shade-plugin/compare/maven-shade-plugin-3.6.1...maven-shade-plugin-3.6.2)
---
updated-dependencies:
- dependency-name: org.apache.maven.plugins:maven-shade-plugin
dependency-version: 3.6.2
dependency-type: direct:development
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com>
Bump org.junit:junit-bom from 6.0.2 to 6.0.3 (#380)
Bumps [org.junit:junit-bom](https://github.com/junit-team/junit-framework) from 6.0.2 to 6.0.3.
- [Release notes](https://github.com/junit-team/junit-framework/releases)
- [Commits](https://github.com/junit-team/junit-framework/compare/r6.0.2...r6.0.3)
---
updated-dependencies:
- dependency-name: org.junit:junit-bom
dependency-version: 6.0.3
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com>
Bump actions/checkout from 6 to 7 (#473)
Bumps [actions/checkout](https://github.com/actions/checkout) from 6 to 7.
- [Release notes](https://github.com/actions/checkout/releases)
- [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md)
- [Commits](https://github.com/actions/checkout/compare/v6...v7)
---
updated-dependencies:
- dependency-name: actions/checkout
dependency-version: '7'
dependency-type: direct:production
update-type: version-update:semver-major
...
Signed-off-by: dependabot[bot] <support@github.com>
Bump the maven group across 11 directories with 2 updates (#479)
Bumps the maven group with 2 updates in the / directory: [ch.qos.logback:logback-core](https://github.com/qos-ch/logback) and [org.bouncycastle:bcprov-jdk18on](https://github.com/bcgit/bc-java).
Bumps the maven group with 1 update in the /common directory: [ch.qos.logback:logback-core](https://github.com/qos-ch/logback).
Bumps the maven group with 1 update in the /engine directory: [ch.qos.logback:logback-core](https://github.com/qos-ch/logback).
Bumps the maven group with 1 update in the /enricher directory: [ch.qos.logback:logback-core](https://github.com/qos-ch/logback).
Bumps the maven group with 1 update in the /go directory: [ch.qos.logback:logback-core](https://github.com/qos-ch/logback).
Bumps the maven group with 2 updates in the /java directory: [ch.qos.logback:logback-core](https://github.com/qos-ch/logback) and [org.bouncycastle:bcprov-jdk18on](https://github.com/bcgit/bc-java).
Bumps the maven group with 1 update in the /mapper directory: [ch.qos.logback:logback-core](https://github.com/qos-ch/logback).
Bumps the maven group with 1 update in the /output directory: [ch.qos.logback:logback-core](https://github.com/qos-ch/logback).
Bumps the maven group with 1 update in the /python directory: [ch.qos.logback:logback-core](https://github.com/qos-ch/logback).
Bumps the maven group with 1 update in the /rules directory: [ch.qos.logback:logback-core](https://github.com/qos-ch/logback).
Bumps the maven group with 1 update in the /sonar-cryptography-plugin directory: [ch.qos.logback:logback-core](https://github.com/qos-ch/logback).
Updates `ch.qos.logback:logback-core` from 1.5.25 to 1.5.33
- [Release notes](https://github.com/qos-ch/logback/releases)
- [Commits](https://github.com/qos-ch/logback/compare/v_1.5.25...v_1.5.33)
Updates `org.bouncycastle:bcprov-jdk18on` from 1.83 to 1.84
- [Changelog](https://github.com/bcgit/bc-java/blob/main/docs/releasenotes.html)
- [Commits](https://github.com/bcgit/bc-java/commits)
Updates `ch.qos.logback:logback-core` from 1.5.25 to 1.5.33
- [Release notes](https://github.com/qos-ch/logback/releases)
- [Commits](https://github.com/qos-ch/logback/compare/v_1.5.25...v_1.5.33)
Updates `ch.qos.logback:logback-core` from 1.5.25 to 1.5.33
- [Release notes](https://github.com/qos-ch/logback/releases)
- [Commits](https://github.com/qos-ch/logback/compare/v_1.5.25...v_1.5.33)
Updates `ch.qos.logback:logback-core` from 1.5.25 to 1.5.33
- [Release notes](https://github.com/qos-ch/logback/releases)
- [Commits](https://github.com/qos-ch/logback/compare/v_1.5.25...v_1.5.33)
Updates `ch.qos.logback:logback-core` from 1.5.25 to 1.5.33
- [Release notes](https://github.com/qos-ch/logback/releases)
- [Commits](https://github.com/qos-ch/logback/compare/v_1.5.25...v_1.5.33)
Updates `ch.qos.logback:logback-core` from 1.5.25 to 1.5.33
- [Release notes](https://github.com/qos-ch/logback/releases)
- [Commits](https://github.com/qos-ch/logback/compare/v_1.5.25...v_1.5.33)
Updates `org.bouncycastle:bcprov-jdk18on` from 1.83 to 1.84
- [Changelog](https://github.com/bcgit/bc-java/blob/main/docs/releasenotes.html)
- [Commits](https://github.com/bcgit/bc-java/commits)
Updates `ch.qos.logback:logback-core` from 1.5.25 to 1.5.33
- [Release notes](https://github.com/qos-ch/logback/releases)
- [Commits](https://github.com/qos-ch/logback/compare/v_1.5.25...v_1.5.33)
Updates `ch.qos.logback:logback-core` from 1.5.25 to 1.5.33
- [Release notes](https://github.com/qos-ch/logback/releases)
- [Commits](https://github.com/qos-ch/logback/compare/v_1.5.25...v_1.5.33)
Updates `ch.qos.logback:logback-core` from 1.5.25 to 1.5.33
- [Release notes](https://github.com/qos-ch/logback/releases)
- [Commits](https://github.com/qos-ch/logback/compare/v_1.5.25...v_1.5.33)
Updates `ch.qos.logback:logback-core` from 1.5.25 to 1.5.33
- [Release notes](https://github.com/qos-ch/logback/releases)
- [Commits](https://github.com/qos-ch/logback/compare/v_1.5.25...v_1.5.33)
Updates `ch.qos.logback:logback-core` from 1.5.25 to 1.5.33
- [Release notes](https://github.com/qos-ch/logback/releases)
- [Commits](https://github.com/qos-ch/logback/compare/v_1.5.25...v_1.5.33)
---
updated-dependencies:
- dependency-name: ch.qos.logback:logback-core
dependency-version: 1.5.33
dependency-type: direct:development
dependency-group: maven
- dependency-name: org.bouncycastle:bcprov-jdk18on
dependency-version: '1.84'
dependency-type: direct:development
dependency-group: maven
- dependency-name: ch.qos.logback:logback-core
dependency-version: 1.5.33
dependency-type: direct:development
dependency-group: maven
- dependency-name: ch.qos.logback:logback-core
dependency-version: 1.5.33
dependency-type: direct:development
dependency-group: maven
- dependency-name: ch.qos.logback:logback-core
dependency-version: 1.5.33
dependency-type: direct:development
dependency-group: maven
- dependency-name: ch.qos.logback:logback-core
dependency-version: 1.5.33
dependency-type: direct:development
dependency-group: maven
- dependency-name: ch.qos.logback:logback-core
dependency-version: 1.5.33
dependency-type: direct:development
dependency-group: maven
- dependency-name: org.bouncycastle:bcprov-jdk18on
dependency-version: '1.84'
dependency-type: direct:development
dependency-group: maven
- dependency-name: ch.qos.logback:logback-core
dependency-version: 1.5.33
dependency-type: direct:development
dependency-group: maven
- dependency-name: ch.qos.logback:logback-core
dependency-version: 1.5.33
dependency-type: direct:development
dependency-group: maven
- dependency-name: ch.qos.logback:logback-core
dependency-version: 1.5.33
dependency-type: direct:development
dependency-group: maven
- dependency-name: ch.qos.logback:logback-core
dependency-version: 1.5.33
dependency-type: direct:development
dependency-group: maven
- dependency-name: ch.qos.logback:logback-core
dependency-version: 1.5.33
dependency-type: direct:development
dependency-group: maven
...
Signed-off-by: dependabot[bot] <support@github.com>
perf(engine): detach call-stack ASTs at leaveFile + self-contained heap harness (#481)
* docs: design spec for call-stack AST-detach heap reduction
Signed-off-by: Nicklas Körtge <Nicklas.Koertge1@ibm.com>
* docs: use synthetic detached SyntaxToken instead of value-model change
Signed-off-by: Nicklas Körtge <Nicklas.Koertge1@ibm.com>
* docs: task-by-task implementation plan for call-stack AST-detach
Signed-off-by: Nicklas Körtge <Nicklas.Koertge1@ibm.com>
* test: first true cross-file detection guard (compiled-classpath CheckVerifier)
Signed-off-by: Nicklas Körtge <Nicklas.Koertge1@ibm.com>
* test: harden cross-file guard with field-constant (detachable) + array (retained) cases
Signed-off-by: Nicklas Körtge <Nicklas.Koertge1@ibm.com>
* feat(engine): AST-free DetachedSyntaxToken for detached value locations
Signed-off-by: Nicklas Körtge <Nicklas.Koertge1@ibm.com>
* feat(engine): AST-free DetachedScanContext
Signed-off-by: Nicklas Körtge <Nicklas.Koertge1@ibm.com>
* feat(engine): ArgSnapshot + MethodMatcher.matchKeys (tree-free match)
Signed-off-by: Nicklas Körtge <Nicklas.Koertge1@ibm.com>
* feat(engine): isDetachableCall predicate (method invocation without NEW_ARRAY arg)
Signed-off-by: Nicklas Körtge <Nicklas.Koertge1@ibm.com>
* style: spotless formatting on cross-file test
Signed-off-by: Nicklas Körtge <Nicklas.Koertge1@ibm.com>
* refactor(engine): CallContext -> sealed interface with RetainedCall variant
Signed-off-by: Nicklas Körtge <Nicklas.Koertge1@ibm.com>
* feat(engine): DetachedCall variant (tree-free recorded call)
Signed-off-by: Nicklas Körtge <Nicklas.Koertge1@ibm.com>
* feat(engine): detach recorded calls at leaveFile with cross-file replay + reporting
Record calls retained during their file's analysis (same-file hook detections
resolve and report through the live context); at leaveFile, swap each detachable
call for a pre-built tree-free DetachedCall so the file's AST is collected while
cross-file matching continues from the snapshot. Cross-file detached detections
produce CBOM nodes and report SonarQube issues via SonarComponents (no AST pin).
Removes the redundant visitedTreeObjects set (per-bucket dedup instead).
Signed-off-by: Nicklas Körtge <Nicklas.Koertge1@ibm.com>
* perf(engine): key-indexed subscription lookup in onNewHookSubscription
Scan only the call-stack bucket matching a hook's method name instead of every
bucket; fall back to a full scan for ANY/multi-name matchers.
Signed-off-by: Nicklas Körtge <Nicklas.Koertge1@ibm.com>
* docs: rewrite plan as as-built implementation record
Signed-off-by: Nicklas Körtge <Nicklas.Koertge1@ibm.com>
* refactor(engine): reorder imports, suppress field reflection warning
Signed-off-by: Nicklas Körtge <Nicklas.Koertge1@ibm.com>
* docs: design for self-contained call-stack heap/perf harness
Signed-off-by: Nicklas Körtge <Nicklas.Koertge1@ibm.com>
* docs: task-by-task plan for call-stack heap/perf harness
Signed-off-by: Nicklas Körtge <Nicklas.Koertge1@ibm.com>
* feat(engine): CallContextStats accessor for call-stack retention
Signed-off-by: Nicklas Körtge <Nicklas.Koertge1@ibm.com>
* feat(engine): expose callContextStats through Handler/ILanguageSupport
Signed-off-by: Nicklas Körtge <Nicklas.Koertge1@ibm.com>
* test(java): synthetic cross-file crypto corpus generator
Signed-off-by: Nicklas Körtge <Nicklas.Koertge1@ibm.com>
* build: exclude @Tag(performance) tests from default surefire run
Signed-off-by: Nicklas Körtge <Nicklas.Koertge1@ibm.com>
* test(java): manual call-stack heap/perf harness (@Tag performance)
Signed-off-by: Nicklas Körtge <Nicklas.Koertge1@ibm.com>
* docs: performance & heap testing guide (self-contained harness + Keycloak scan)
Signed-off-by: Nicklas Körtge <Nicklas.Koertge1@ibm.com>
* docs: design for call-stack heap attribution & trim (H1+H2)
Signed-off-by: Nicklas Körtge <Nicklas.Koertge1@ibm.com>
* docs: task-by-task plan for call-stack heap attribution (H1)
Signed-off-by: Nicklas Körtge <Nicklas.Koertge1@ibm.com>
* docs: correct H2 eligibility-predicate premise in heap-trim spec
Signed-off-by: Nicklas Körtge <Nicklas.Koertge1@ibm.com>
* feat(plugin): heap-attribution summary record for scan-floor analysis
Signed-off-by: Nicklas Körtge <Nicklas.Koertge1@ibm.com>
* feat(plugin): log heap-attribution populations at end of scan
Signed-off-by: Nicklas Körtge <Nicklas.Koertge1@ibm.com>
* test(java): report detectedNodes count in call-stack perf harness
Signed-off-by: Nicklas Körtge <Nicklas.Koertge1@ibm.com>
* docs: post-detach floor attribution runbook (H1) + H2 decision rule
Signed-off-by: Nicklas Körtge <Nicklas.Koertge1@ibm.com>
* docs: record H1 floor-attribution results (Keycloak) + revised H2 routing
Measured: plugin footprint ~28MB (~1% of ~2.9GB floor); CBOM nodes
negligible (~25KB), call-stack dominates plugin term (15.6MB, linear).
Floor growth is SonarQube/ECJ baseline, not detectedNodes. Heap track
effectively closed; eligibility filter reclassified to CPU/throughput.
Signed-off-by: Nicklas Körtge <Nicklas.Koertge1@ibm.com>
* refactor(java): reorder imports in `JavaDetachedIssueReporter` for consistency
Signed-off-by: Nicklas Körtge <Nicklas.Koertge1@ibm.com>
* fix(engine): match detached call-stack keys with hook-context semantics
buildDetachedCall snapshotted its invoked-object/parameter IType keys with
MatchContext.build(false, rule) (record context), but a DetachedCall is only
ever matched in hook context via MethodMatcher.matchKeys. Under
isHookContext=false the translation selects subtype-permissive matching
(is || isSubtypeOf) instead of the exact is() the live retained-call path uses,
so cross-file matches accepted subtypes the same-file path rejects (false
positives) and the outcome depended on file visitation order. Snapshot with
MatchContext.createForHookContext() so detached matching reproduces the live
retained-call path exactly.
Also:
- gate the heap-attribution debug log behind isDebugEnabled() so the full
CallContextStats.from call-stack traversal does not run on every production
scan when DEBUG is off.
- clarify ILanguageSupport.callContextStats is diagnostics-only and not part of
the detection contract.
Signed-off-by: Nicklas Körtge <Nicklas.Koertge1@ibm.com>
* test(python,go): cross-file guard tests for shared call-stack bucketing
The AST-detach branch narrowed CallStackAgent.onNewHookSubscription to fetch
only the method-name-keyed bucket (bucketsToScan) instead of scanning all
buckets. That narrowing is shared by every language, so document and guard its
safety for Python and Go:
- Python: bucketing is exercised within-file only (within-file wrapper-hook
tests already pass, proving key alignment). No scan-level cross-file symbol
resolution exists, so the narrowing can't drop cross-file detections. Added a
two-file CrossFileHookResolveTest, @Disabled like ResolveImportedStructTest.
- Go: GoDetectionEngine only populates the call stack and never registers hooks,
so onNewHookSubscription/bucketsToScan is unreachable for Go; the GoVerifier
harness is single-file only. Added a @Disabled CrossFileHookDetachTest that
documents both blockers.
Both tests are forward guards: enable them if either language gains cross-file
or hook-based resolution.
---------
Signed-off-by: Nicklas Körtge <Nicklas.Koertge1@ibm.com>
docs: callstack/hooks heap-reduction plan with measured keycloak numbers
perf(java): memoize BouncyCastle rule graph to cut construction heap (#476) (#477)
* docs: design spec for rule-graph memoization (#476)
Signed-off-by: Nicklas Körtge <Nicklas.Koertge1@ibm.com>
* docs: implementation plan for rule-graph memoization (#476)
Signed-off-by: Nicklas Körtge <Nicklas.Koertge1@ibm.com>
* feat(java): add Memoize helper for rule-graph memoization (#476)
Signed-off-by: Nicklas Körtge <Nicklas.Koertge1@ibm.com>
* perf(java): memoize BcBlockCipher/BcBlockCipherEngine rule subtrees (#476)
Signed-off-by: Nicklas Körtge <Nicklas.Koertge1@ibm.com>
* perf(java): memoize BcDigests rule subtree (#476)
Signed-off-by: Nicklas Körtge <Nicklas.Koertge1@ibm.com>
* perf(java): memoize asymmetric block-cipher rule subtrees (#476)
Signed-off-by: Nicklas Körtge <Nicklas.Koertge1@ibm.com>
* perf(java): memoize cipher/AEAD/wrapper rule subtrees (#476)
Signed-off-by: Nicklas Körtge <Nicklas.Koertge1@ibm.com>
* perf(java): memoize MAC/KDF/PBE/agreement rule subtrees (#476)
Signed-off-by: Nicklas Körtge <Nicklas.Koertge1@ibm.com>
* perf(java): memoize cipher-parameter rule subtrees (#476)
Signed-off-by: Nicklas Körtge <Nicklas.Koertge1@ibm.com>
* perf(java): memoize signer/DSA/keypair/other rule subtrees (#476)
Signed-off-by: Nicklas Körtge <Nicklas.Koertge1@ibm.com>
* test(java): guard rule-graph distinct-object footprint (#476), N=2563
Signed-off-by: Nicklas Körtge <Nicklas.Koertge1@ibm.com>
* test: enforce rules() memoization across java/python/go (#476)
Finish the #476 memoization work and make it self-policing for every
future detection rule in all three language modules.
- Memoize the remaining static rules() subtrees: 51 JCA/SSL classes
(java) plus every python (pyca) and go (gocrypto) detection rule, so
shared subtrees are built once and referenced everywhere.
- Add a Memoize helper to the python and go modules, mirroring java.
- Add RuleMemoizationEnforcementTest to each module: it classpath-scans
every com.ibm.plugin.rules.detection class exposing a static no-arg
rules() and asserts rules() == rules() (same identity => memoized).
A new rule that forgets Memoize.of(...) now fails the build, since the
type system cannot police a static method.
Full suite green (java 160, python 49, go 40); RuleGraphMemoizationTest
footprint unchanged at 2563 distinct objects.
Signed-off-by: Nicklas Körtge <Nicklas.Koertge1@ibm.com>
---------
Signed-off-by: Nicklas Körtge <Nicklas.Koertge1@ibm.com>
Update algorithm names to match CycloneDX schema (#362)
* Update algorithm names to match CycloneDX schema
Updates algorithm naming conventions in mapper model to align with the
CycloneDX cryptography-defs.json specification:
- SHA1 → SHA-1, SHA256 → SHA-256, SHA384 → SHA-384, SHA512 → SHA-512
- SHA3-* → SHA-3-* (e.g., SHA3-256 → SHA-3-256)
- ChaCha20Poly1305 → ChaCha20-Poly1305
- RSASSA-PSS → RSA-PSS
- DH → FFDH (Finite Field Diffie-Hellman)
- KDF in Counter Mode → SP800-108-CounterKDF
- KDF in Feedback Mode → SP800-108-FeedbackKDF
- SPHINCS+ → SLH-DSA
Also adds CycloneDX schema JavaDoc references to algorithm classes and
updates test assertions across all language modules (Java, Python, Go).
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
Signed-off-by: Nicklas Körtge <Nicklas.Koertge1@ibm.com>
* Refactor algorithms: update naming conventions, finalize classes, and align packages for consistency
Signed-off-by: Nicklas Körtge <Nicklas.Koertge1@ibm.com>
* Add design spec for CycloneDX algorithm-name migration
Signed-off-by: Nicklas Körtge <Nicklas.Koertge1@ibm.com>
* Add implementation plan and refine spec with per-pattern composition rule
Signed-off-by: Nicklas Körtge <Nicklas.Koertge1@ibm.com>
* Fix pre-existing compile break: add protected MQV constructor for ECMQV
Signed-off-by: Nicklas Körtge <Nicklas.Koertge1@ibm.com>
* Add composeName helper and wire AES; scaffold composition test
Signed-off-by: Nicklas Körtge <Nicklas.Koertge1@ibm.com>
* Correct SHA3 name to match CycloneDX pattern (SHA3-256)
Signed-off-by: Nicklas Körtge <Nicklas.Koertge1@ibm.com>
* Fix DES composition to DES-{keyLength}-{mode} per schema
Signed-off-by: Nicklas Körtge <Nicklas.Koertge1@ibm.com>
* Rename and compose block-cipher names per CycloneDX schema
Signed-off-by: Nicklas Körtge <Nicklas.Koertge1@ibm.com>
* Compose RC4/ElGamal key length and hyphenate ChaCha20-Poly1305
Signed-off-by: Nicklas Körtge <Nicklas.Koertge1@ibm.com>
* Rename Ascon standardized subset to Ascon-AEAD128/-Hash256/-XOF128
Signed-off-by: Nicklas Körtge <Nicklas.Koertge1@ibm.com>
* Rename KDF algorithms to CycloneDX schema names
Signed-off-by: Nicklas Körtge <Nicklas.Koertge1@ibm.com>
* Rename XMSSMT to schema token and pin ML-DSA/ML-KEM composed names
Signed-off-by: Nicklas Körtge <Nicklas.Koertge1@ibm.com>
* Compose BLAKE2b/BLAKE2s digest size per schema
Signed-off-by: Nicklas Körtge <Nicklas.Koertge1@ibm.com>
* Reorder CMAC name to CMAC-{cipher} per schema
Signed-off-by: Nicklas Körtge <Nicklas.Koertge1@ibm.com>
* Rework RSA/DSA name ordering, RSAssaPSS->RSA-PSS, MQV->FFMQV per schema
Signed-off-by: Nicklas Körtge <Nicklas.Koertge1@ibm.com>
* Update mapper and java test assertions to schema algorithm names
Signed-off-by: Nicklas Körtge <Nicklas.Koertge1@ibm.com>
* Update python test assertions to schema algorithm names
Signed-off-by: Nicklas Körtge <Nicklas.Koertge1@ibm.com>
* Update go test assertions to schema algorithm names
Signed-off-by: Nicklas Körtge <Nicklas.Koertge1@ibm.com>
* Update output (CycloneDX) test assertions to schema algorithm names
Signed-off-by: Nicklas Körtge <Nicklas.Koertge1@ibm.com>
* Add CycloneDX schema-regex conformance test for algorithm names
Signed-off-by: Nicklas Körtge <Nicklas.Koertge1@ibm.com>
* Update test assertions to schema algorithm names after merge
Post-merge fixups: main added/auto-merged test files carrying pre-rename
algorithm names, but this branch's mappers now emit CycloneDX schema names.
Aligned the stale expectations with the produced values:
- SHA256withDSA -> DSA-SHA-256, SHA256 -> SHA-256 (BcDSADigestSignerTest)
- SHA256withRSA -> RSA-PKCS1-1.5-SHA-256 (BcRSADigestSignerTestFile)
- HMAC-SHA256 -> HMAC-SHA-256 (PreciseIssueLocationTestFile)
- SHA256 -> SHA-256, HMAC-SHA256 -> HMAC-SHA-256 (Pyca hash/mac tests)
Signed-off-by: Nicklas Körtge <Nicklas.Koertge1@ibm.com>
* Fix stale ChaCha20 AEAD Javadoc and PBES1 TODO typo
Signed-off-by: Nicklas Körtge <Nicklas.Koertge1@ibm.com>
---------
Signed-off-by: Nicklas Körtge <Nicklas.Koertge1@ibm.com>
Enable DuplicateDependingFindingsTest (#468)
* Enable DuplicateDependingFindingsTest
Signed-off-by: somiljain2006 <somil16022006@gmail.com>
* Change test description
Signed-off-by: somiljain2006 <somil16022006@gmail.com>
* Fix formatting
Signed-off-by: somiljain2006 <somil16022006@gmail.com>
---------
Signed-off-by: somiljain2006 <somil16022006@gmail.com>
fix(python): detect standalone PyCA hash constructions (#464)
Signed-off-by: Sachin Kumar <sachinkumar905846@gmail.com>
remove csharp (#467)
Signed-off-by: san-zrl <san@zurich.ibm.com>
Fix asset deduplication logic (#465)
* Fix asset deduplication logic
Signed-off-by: somiljain2006 <somil16022006@gmail.com>
* Revert some lines
Signed-off-by: somiljain2006 <somil16022006@gmail.com>
* Fix block cipher root deduplication
Signed-off-by: somiljain2006 <somil16022006@gmail.com>
---------
Signed-off-by: somiljain2006 <somil16022006@gmail.com>
fix correct method name in ChaCha20Poly1305 ENCRYPT detection rule (#459)
* fix(python): correct method name in ChaCha20Poly1305 ENCRYPT detection rule
Signed-off-by: vishnudathks <vishnudathks5@gmail.com>
* fix(python): remove incorrect Noncompliant comment from ChaCha20 test file
Signed-off-by: vishnudathks <vishnudathks5@gmail.com>
---------
Signed-off-by: vishnudathks <vishnudathks5@gmail.com>
fixes handling of *args and **kwargs (#466)
Signed-off-by: san-zrl <san@zurich.ibm.com>
fix: use withoutParameters() for Ed25519 and Ed448 generate rules to prevent false positives (#429)
Signed-off-by: Arijit429 <arijitdeb1203@gmail.com>
Fix resolution of parameterized dictionary subscriptions (#457)
Signed-off-by: somiljain2006 <somil16022006@gmail.com>
fix detect stream cipher with mode = none (#460)
Signed-off-by: Adam <adamtruty2@gmail.com>
test(java): verify occurrence locations for issue #339 (#430)
* test(java): add regression coverage for detection location (#339)
Signed-off-by: Sachin Kumar <sachinkumar905846@gmail.com>
* test(java): address review feedback for location regression
Signed-off-by: Sachin Kumar <sachinkumar905846@gmail.com>
* test(java): verify occurrence locations for issue #339
Signed-off-by: Sachin Kumar <sachinkumar905846@gmail.com>
* test(java): focus regression on occurrence locations
Signed-off-by: Sachin Kumar <sachinkumar905846@gmail.com>
---------
Signed-off-by: Sachin Kumar <sachinkumar905846@gmail.com>
test(python): verify detection of crypto operations inside custom functions (#394)
- Rename test to PycaMacDetectionInCustomFunctionTest
- Add negative case to prevent false positives
- Improve documentation and assertions
- Clarify behavior for same-file function traversal
Signed-off-by: Sachin Kumar <sachinkumar905846@gmail.com>
improved handling and testing of empty CBOMs (#455)
Signed-off-by: san-zrl <san@zurich.ibm.com>
Fixes issue of empty CBOM creation when no SonarQube rule is activated (#388)
* fixed empty cbom creation
Signed-off-by: medha-14 <medha140904@gmail.com>
* added test
Signed-off-by: medha-14 <medha140904@gmail.com>
---------
Signed-off-by: medha-14 <medha140904@gmail.com>
added c# parser sources (#454)
Signed-off-by: san-zrl <san@zurich.ibm.com>
feat(pbes1): add OID mappings for PBES1 combinations (#389)
* feat(pbes1): add OID mappings
Signed-off-by: Ayush Patel <ayushpatel2731@gmail.com>
* fix: add RC4 null-return comment and PBES1 parameterized regression tests
Signed-off-by: Ayush Patel <ayushpatel2731@gmail.com>
---------
Signed-off-by: Ayush Patel <ayushpatel2731@gmail.com>
test(java): add RSADigestSigner constructor edge-case coverage (#410)
Signed-off-by: Sachin Kumar <sachinkumar905846@gmail.com>
fixed obsotete license staments (#416)
Signed-off-by: san-zrl <san@zurich.ibm.com>
integrate csharp scanner with cbomkit-lib (#405)
Signed-off-by: san-zrl <san@zurich.ibm.com>
test(java): add regression test for MD5 detection in JCA MessageDigest (#393)
Signed-off-by: Sachin Kumar <sachinkumar905846@gmail.com>
Bump actions/upload-artifact from 5 to 7 (#375)
Bumps [actions/upload-artifact](https://github.com/actions/upload-artifact) from 5 to 7.
- [Release notes](https://github.com/actions/upload-artifact/releases)
- [Commits](https://github.com/actions/upload-artifact/compare/v5...v7)
---
updated-dependencies:
- dependency-name: actions/upload-artifact
dependency-version: '7'
dependency-type: direct:production
update-type: version-update:semver-major
...
Signed-off-by: dependabot[bot] <support@github.com>
Bump cbomkit/cbomkit-action from 2.1.2 to 2.2.0 (#373)
Bumps [cbomkit/cbomkit-action](https://github.com/cbomkit/cbomkit-action) from 2.1.2 to 2.2.0.
- [Release notes](https://github.com/cbomkit/cbomkit-action/releases)
- [Commits](https://github.com/cbomkit/cbomkit-action/compare/v2.1.2...v2.2.0)
---
updated-dependencies:
- dependency-name: cbomkit/cbomkit-action
dependency-version: 2.2.0
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com>
Bump the maven group across 11 directories with 1 update (#370)
Bumps the maven group with 1 update in the / directory: [org.assertj:assertj-core](https://github.com/assertj/assertj).
Bumps the maven group with 1 update in the /common directory: [org.assertj:assertj-core](https://github.com/assertj/assertj).
Bumps the maven group with 1 update in the /engine directory: [org.assertj:assertj-core](https://github.com/assertj/assertj).
Bumps the maven group with 1 update in the /enricher directory: [org.assertj:assertj-core](https://github.com/assertj/assertj).
Bumps the maven group with 1 update in the /go directory: [org.assertj:assertj-core](https://github.com/assertj/assertj).
Bumps the maven group with 1 update in the /java directory: [org.assertj:assertj-core](https://github.com/assertj/assertj).
Bumps the maven group with 1 update in the /mapper directory: [org.assertj:assertj-core](https://github.com/assertj/assertj).
Bumps the maven group with 1 update in the /output directory: [org.assertj:assertj-core](https://github.com/assertj/assertj).
Bumps the maven group with 1 update in the /python directory: [org.assertj:assertj-core](https://github.com/assertj/assertj).
Bumps the maven group with 1 update in the /rules directory: [org.assertj:assertj-core](https://github.com/assertj/assertj).
Bumps the maven group with 1 update in the /sonar-cryptography-plugin directory: [org.assertj:assertj-core](https://github.com/assertj/assertj).
Updates `org.assertj:assertj-core` from 3.27.4 to 3.27.7
- [Release notes](https://github.com/assertj/assertj/releases)
- [Commits](https://github.com/assertj/assertj/compare/assertj-build-3.27.4...assertj-build-3.27.7)
Updates `org.assertj:assertj-core` from 3.27.4 to 3.27.7
- [Release notes](https://github.com/assertj/assertj/releases)
- [Commits](https://github.com/assertj/assertj/compare/assertj-build-3.27.4...assertj-build-3.27.7)
Updates `org.assertj:assertj-core` from 3.27.4 to 3.27.7
- [Release notes](https://github.com/assertj/assertj/releases)
- [Commits](https://github.com/assertj/assertj/compare/assertj-build-3.27.4...assertj-build-3.27.7)
Updates `org.assertj:assertj-core` from 3.27.4 to 3.27.7
- [Release notes](https://github.com/assertj/assertj/releases)
- [Commits](https://github.com/assertj/assertj/compare/assertj-build-3.27.4...assertj-build-3.27.7)
Updates `org.assertj:assertj-core` from 3.27.4 to 3.27.7
- [Release notes](https://github.com/assertj/assertj/releases)
- [Commits](https://github.com/assertj/assertj/compare/assertj-build-3.27.4...assertj-build-3.27.7)
Updates `org.assertj:assertj-core` from 3.27.4 to 3.27.7
- [Release notes](https://github.com/assertj/assertj/releases)
- [Commits](https://github.com/assertj/assertj/compare/assertj-build-3.27.4...assertj-build-3.27.7)
Updates `org.assertj:assertj-core` from 3.27.4 to 3.27.7
- [Release notes](https://github.com/assertj/assertj/releases)
- [Commits](https://github.com/assertj/assertj/compare/assertj-build-3.27.4...assertj-build-3.27.7)
Updates `org.assertj:assertj-core` from 3.27.4 to 3.27.7
- [Release notes](https://github.com/assertj/assertj/releases)
- [Commits](https://github.com/assertj/assertj/compare/assertj-build-3.27.4...assertj-build-3.27.7)
Updates `org.assertj:assertj-core` from 3.27.4 to 3.27.7
- [Release notes](https://github.com/assertj/assertj/releases)
- [Commits](https://github.com/assertj/assertj/compare/assertj-build-3.27.4...assertj-build-3.27.7)
Updates `org.assertj:assertj-core` from 3.27.4 to 3.27.7
- [Release notes](https://github.com/assertj/assertj/releases)
- [Commits](https://github.com/assertj/assertj/compare/assertj-build-3.27.4...assertj-build-3.27.7)
Updates `org.assertj:assertj-core` from 3.27.4 to 3.27.7
- [Release notes](https://github.com/assertj/assertj/releases)
- [Commits](https://github.com/assertj/assertj/compare/assertj-build-3.27.4...assertj-build-3.27.7)
---
updated-dependencies:
- dependency-name: org.assertj:assertj-core
dependency-version: 3.27.7
dependency-type: direct:development
dependency-group: maven
- dependency-name: org.assertj:assertj-core
dependency-version: 3.27.7
dependency-type: direct:development
dependency-group: maven
- dependency-name: org.assertj:assertj-core
dependency-version: 3.27.7
dependency-type: direct:development
dependency-group: maven
- dependency-name: org.assertj:assertj-core
dependency-version: 3.27.7
dependency-type: direct:development
dependency-group: maven
- dependency-name: org.assertj:assertj-core
dependency-version: 3.27.7
dependency-type: direct:development
dependency-group: maven
- dependency-name: org.assertj:assertj-core
dependency-version: 3.27.7
dependency-type: direct:development
dependency-group: maven
- dependency-name: org.assertj:assertj-core
dependency-version: 3.27.7
dependency-type: direct:development
dependency-group: maven
- dependency-name: org.assertj:assertj-core
dependency-version: 3.27.7
dependency-type: direct:development
dependency-group: maven
- dependency-name: org.assertj:assertj-core
dependency-version: 3.27.7
dependency-type: direct:development
dependency-group: maven
- dependency-name: org.assertj:assertj-core
dependency-version: 3.27.7
dependency-type: direct:development
dependency-group: maven
- dependency-name: org.assertj:assertj-core
dependency-version: 3.27.7
dependency-type: direct:development
dependency-group: maven
...
Signed-off-by: dependabot[bot] <support@github.com>
Bump org.assertj:assertj-core from 3.27.4 to 3.27.7 (#369)
Bumps [org.assertj:assertj…
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
No description provided.