diff --git a/analyzers/its/expected/Ember-MM/generic.EmberCore.WebServer-{64D6F035-F186-4193-AF35-D20126B8DA64}-S4818.json b/analyzers/its/expected/Ember-MM/generic.EmberCore.WebServer-{64D6F035-F186-4193-AF35-D20126B8DA64}-S4818.json deleted file mode 100644 index 65b73b54416..00000000000 --- a/analyzers/its/expected/Ember-MM/generic.EmberCore.WebServer-{64D6F035-F186-4193-AF35-D20126B8DA64}-S4818.json +++ /dev/null @@ -1,17 +0,0 @@ -{ -"issues": [ -{ -"id": "S4818", -"message": "Make sure that sockets are used safely here.", -"location": { -"uri": "https://github.com/SonarSource/sonar-dotnet/blob/master/analyzers/its/sources/Ember-MM/Addons/generic.EmberCore.WebServer/Module.WebServer.vb#L163", -"region": { -"startLine": 163, -"startColumn": 28, -"endLine": 163, -"endColumn": 103 -} -} -} -] -} diff --git a/analyzers/its/expected/akka.net/Akka--netstandard2.0-S4818.json b/analyzers/its/expected/akka.net/Akka--netstandard2.0-S4818.json deleted file mode 100644 index 622000ccc39..00000000000 --- a/analyzers/its/expected/akka.net/Akka--netstandard2.0-S4818.json +++ /dev/null @@ -1,82 +0,0 @@ -{ -"issues": [ -{ -"id": "S4818", -"message": "Make sure that sockets are used safely here.", -"location": { -"uri": "https://github.com/SonarSource/sonar-dotnet/blob/master/analyzers/its/sources/akka.net/src/core/Akka/IO/Inet.cs#L80", -"region": { -"startLine": 80, -"startColumn": 24, -"endLine": 80, -"endColumn": 70 -} -} -}, -{ -"id": "S4818", -"message": "Make sure that sockets are used safely here.", -"location": { -"uri": "https://github.com/SonarSource/sonar-dotnet/blob/master/analyzers/its/sources/akka.net/src/core/Akka/IO/TcpListener.cs#L47", -"region": { -"startLine": 47, -"startColumn": 23, -"endLine": 47, -"endColumn": 125 -} -} -}, -{ -"id": "S4818", -"message": "Make sure that sockets are used safely here.", -"location": { -"uri": "https://github.com/SonarSource/sonar-dotnet/blob/master/analyzers/its/sources/akka.net/src/core/Akka/IO/TcpOutgoingConnection.cs#L33", -"region": { -"startLine": 33, -"startColumn": 26, -"endLine": 33, -"endColumn": 122 -} -} -}, -{ -"id": "S4818", -"message": "Make sure that sockets are used safely here.", -"location": { -"uri": "https://github.com/SonarSource/sonar-dotnet/blob/master/analyzers/its/sources/akka.net/src/core/Akka/IO/TcpOutgoingConnection.cs#L34", -"region": { -"startLine": 34, -"startColumn": 26, -"endLine": 34, -"endColumn": 94 -} -} -}, -{ -"id": "S4818", -"message": "Make sure that sockets are used safely here.", -"location": { -"uri": "https://github.com/SonarSource/sonar-dotnet/blob/master/analyzers/its/sources/akka.net/src/core/Akka/IO/UdpConnection.cs#L76", -"region": { -"startLine": 76, -"startColumn": 27, -"endLine": 76, -"endColumn": 94 -} -} -}, -{ -"id": "S4818", -"message": "Make sure that sockets are used safely here.", -"location": { -"uri": "https://github.com/SonarSource/sonar-dotnet/blob/master/analyzers/its/sources/akka.net/src/core/Akka/IO/UdpSender.cs#L39", -"region": { -"startLine": 39, -"startColumn": 30, -"endLine": 39, -"endColumn": 97 -} -} -} -] -} diff --git a/analyzers/its/expected/akka.net/Akka.Streams.TestKit--netstandard2.0-S4818.json b/analyzers/its/expected/akka.net/Akka.Streams.TestKit--netstandard2.0-S4818.json deleted file mode 100644 index 7b62d53ba00..00000000000 --- a/analyzers/its/expected/akka.net/Akka.Streams.TestKit--netstandard2.0-S4818.json +++ /dev/null @@ -1,17 +0,0 @@ -{ -"issues": [ -{ -"id": "S4818", -"message": "Make sure that sockets are used safely here.", -"location": { -"uri": "https://github.com/SonarSource/sonar-dotnet/blob/master/analyzers/its/sources/akka.net/src/core/Akka.Streams.TestKit/TestUtils.cs#L20-L22", -"region": { -"startLine": 20, -"startColumn": 33, -"endLine": 22, -"endColumn": 59 -} -} -} -] -} diff --git a/analyzers/its/expected/akka.net/Akka.Tests.Performance--netcoreapp3.1-S4818.json b/analyzers/its/expected/akka.net/Akka.Tests.Performance--netcoreapp3.1-S4818.json deleted file mode 100644 index 53608db3a11..00000000000 --- a/analyzers/its/expected/akka.net/Akka.Tests.Performance--netcoreapp3.1-S4818.json +++ /dev/null @@ -1,17 +0,0 @@ -{ -"issues": [ -{ -"id": "S4818", -"message": "Make sure that sockets are used safely here.", -"location": { -"uri": "https://github.com/SonarSource/sonar-dotnet/blob/master/analyzers/its/sources/akka.net/src/core/Akka.Tests.Performance/IO/TcpInboundOnlySpec.cs#L90", -"region": { -"startLine": 90, -"startColumn": 28, -"endLine": 90, -"endColumn": 103 -} -} -} -] -} diff --git a/analyzers/rspec/cs/S4818.html b/analyzers/rspec/cs/S4818.html deleted file mode 100644 index b41a3db13bf..00000000000 --- a/analyzers/rspec/cs/S4818.html +++ /dev/null @@ -1,57 +0,0 @@ -

This rule is deprecated, and will eventually be removed.

-

Using sockets is security-sensitive. It has led in the past to the following vulnerabilities:

- -

Sockets are vulnerable in multiple ways:

- -

This rules flags code that creates sockets. It matches only the direct use of sockets, not use through frameworks or high-level APIs such as the -use of http connections.

-

Ask Yourself Whether

- -

There is a risk if you answered yes to any of those questions.

-

Recommended Secure Coding Practices

- -

Sensitive Code Example

-
-using System.Net.Sockets;
-
-class TestSocket
-{
-    public static void Run()
-    {
-        // Sensitive
-        Socket socket = new Socket(AddressFamily.InterNetwork, SocketType.Stream, ProtocolType.Tcp);
-
-        // TcpClient and UdpClient simply abstract the details of creating a Socket
-        TcpClient client = new TcpClient("example.com", 80); // Sensitive
-        UdpClient listener = new UdpClient(80); // Sensitive
-    }
-}
-
-

See

- - diff --git a/analyzers/rspec/cs/S4818.json b/analyzers/rspec/cs/S4818.json deleted file mode 100644 index ee901ec953e..00000000000 --- a/analyzers/rspec/cs/S4818.json +++ /dev/null @@ -1,10 +0,0 @@ -{ - "title": "Using Sockets is security-sensitive", - "type": "SECURITY_HOTSPOT", - "status": "deprecated", - "tags": [], - "defaultSeverity": "Critical", - "ruleSpecification": "RSPEC-4818", - "sqKey": "S4818", - "scope": "Main" -} diff --git a/analyzers/rspec/vbnet/S4818.html b/analyzers/rspec/vbnet/S4818.html deleted file mode 100644 index 0ebbaa30582..00000000000 --- a/analyzers/rspec/vbnet/S4818.html +++ /dev/null @@ -1,57 +0,0 @@ -

This rule is deprecated, and will eventually be removed.

-

Using sockets is security-sensitive. It has led in the past to the following vulnerabilities:

- -

Sockets are vulnerable in multiple ways:

- -

This rules flags code that creates sockets. It matches only the direct use of sockets, not use through frameworks or high-level APIs such as the -use of http connections.

-

Ask Yourself Whether

- -

There is a risk if you answered yes to any of those questions.

-

Recommended Secure Coding Practices

- -

Sensitive Code Example

-
-Imports System.Net.Sockets
-
-Public Class Sockets
-
-    Public Shared Sub Run()
-        ' Sensitive
-        Dim socket As Socket = New Socket(AddressFamily.InterNetwork, SocketType.Stream, ProtocolType.Tcp)
-
-        ' TcpClient And UdpClient simply abstract the details of creating a Socket
-        Dim client As TcpClient = New TcpClient("example.com", 80) ' Sensitive
-        Dim listener As UdpClient = New UdpClient(80)   ' Sensitive
-    End Sub
-
-End Class
-
-

See

- - diff --git a/analyzers/rspec/vbnet/S4818.json b/analyzers/rspec/vbnet/S4818.json deleted file mode 100644 index ee901ec953e..00000000000 --- a/analyzers/rspec/vbnet/S4818.json +++ /dev/null @@ -1,10 +0,0 @@ -{ - "title": "Using Sockets is security-sensitive", - "type": "SECURITY_HOTSPOT", - "status": "deprecated", - "tags": [], - "defaultSeverity": "Critical", - "ruleSpecification": "RSPEC-4818", - "sqKey": "S4818", - "scope": "Main" -} diff --git a/analyzers/src/SonarAnalyzer.CSharp/Rules/Hotspots/SocketsCreation.cs b/analyzers/src/SonarAnalyzer.CSharp/Rules/Hotspots/SocketsCreation.cs deleted file mode 100644 index a2554893e75..00000000000 --- a/analyzers/src/SonarAnalyzer.CSharp/Rules/Hotspots/SocketsCreation.cs +++ /dev/null @@ -1,32 +0,0 @@ -/* - * SonarAnalyzer for .NET - * Copyright (C) 2015-2023 SonarSource SA - * mailto: contact AT sonarsource DOT com - * - * This program is free software; you can redistribute it and/or - * modify it under the terms of the GNU Lesser General Public - * License as published by the Free Software Foundation; either - * version 3 of the License, or (at your option) any later version. - * - * This program is distributed in the hope that it will be useful, - * but WITHOUT ANY WARRANTY; without even the implied warranty of - * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU - * Lesser General Public License for more details. - * - * You should have received a copy of the GNU Lesser General Public License - * along with this program; if not, write to the Free Software Foundation, - * Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA. - */ - -namespace SonarAnalyzer.Rules.CSharp -{ - [DiagnosticAnalyzer(LanguageNames.CSharp)] - public sealed class SocketsCreation : SocketsCreationBase - { - protected override ILanguageFacade Language => CSharpFacade.Instance; - - public SocketsCreation() : this(AnalyzerConfiguration.Hotspot) { } - - internal /*for testing*/ SocketsCreation(IAnalyzerConfiguration configuration) : base(configuration) { } - } -} diff --git a/analyzers/src/SonarAnalyzer.Common/Rules/Hotspots/SocketsCreationBase.cs b/analyzers/src/SonarAnalyzer.Common/Rules/Hotspots/SocketsCreationBase.cs deleted file mode 100644 index 2a4353a7cb7..00000000000 --- a/analyzers/src/SonarAnalyzer.Common/Rules/Hotspots/SocketsCreationBase.cs +++ /dev/null @@ -1,41 +0,0 @@ -/* - * SonarAnalyzer for .NET - * Copyright (C) 2015-2023 SonarSource SA - * mailto: contact AT sonarsource DOT com - * - * This program is free software; you can redistribute it and/or - * modify it under the terms of the GNU Lesser General Public - * License as published by the Free Software Foundation; either - * version 3 of the License, or (at your option) any later version. - * - * This program is distributed in the hope that it will be useful, - * but WITHOUT ANY WARRANTY; without even the implied warranty of - * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU - * Lesser General Public License for more details. - * - * You should have received a copy of the GNU Lesser General Public License - * along with this program; if not, write to the Free Software Foundation, - * Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA. - */ - -namespace SonarAnalyzer.Rules -{ - public abstract class SocketsCreationBase : TrackerHotspotDiagnosticAnalyzer - where TSyntaxKind : struct - { - protected const string DiagnosticId = "S4818"; - private const string MessageFormat = "Make sure that sockets are used safely here."; - - protected SocketsCreationBase(IAnalyzerConfiguration configuration) : base(configuration, DiagnosticId, MessageFormat) { } - - protected override void Initialize(TrackerInput input) - { - var t = Language.Tracker.ObjectCreation; - t.Track(input, - t.MatchConstructor( - KnownType.System_Net_Sockets_Socket, - KnownType.System_Net_Sockets_TcpClient, - KnownType.System_Net_Sockets_UdpClient)); - } - } -} diff --git a/analyzers/src/SonarAnalyzer.VisualBasic/Rules/Hotspots/SocketsCreation.cs b/analyzers/src/SonarAnalyzer.VisualBasic/Rules/Hotspots/SocketsCreation.cs deleted file mode 100644 index 05419fbf7cc..00000000000 --- a/analyzers/src/SonarAnalyzer.VisualBasic/Rules/Hotspots/SocketsCreation.cs +++ /dev/null @@ -1,32 +0,0 @@ -/* - * SonarAnalyzer for .NET - * Copyright (C) 2015-2023 SonarSource SA - * mailto: contact AT sonarsource DOT com - * - * This program is free software; you can redistribute it and/or - * modify it under the terms of the GNU Lesser General Public - * License as published by the Free Software Foundation; either - * version 3 of the License, or (at your option) any later version. - * - * This program is distributed in the hope that it will be useful, - * but WITHOUT ANY WARRANTY; without even the implied warranty of - * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU - * Lesser General Public License for more details. - * - * You should have received a copy of the GNU Lesser General Public License - * along with this program; if not, write to the Free Software Foundation, - * Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA. - */ - -namespace SonarAnalyzer.Rules.VisualBasic -{ - [DiagnosticAnalyzer(LanguageNames.VisualBasic)] - public sealed class SocketsCreation : SocketsCreationBase - { - protected override ILanguageFacade Language => VisualBasicFacade.Instance; - - public SocketsCreation() : this(AnalyzerConfiguration.Hotspot) { } - - internal /*for testing*/ SocketsCreation(IAnalyzerConfiguration configuration) : base(configuration) { } - } -} diff --git a/analyzers/tests/SonarAnalyzer.UnitTest/PackagingTests/RuleTypeMappingCS.cs b/analyzers/tests/SonarAnalyzer.UnitTest/PackagingTests/RuleTypeMappingCS.cs index 1b871d1ffd5..a59f0383d31 100644 --- a/analyzers/tests/SonarAnalyzer.UnitTest/PackagingTests/RuleTypeMappingCS.cs +++ b/analyzers/tests/SonarAnalyzer.UnitTest/PackagingTests/RuleTypeMappingCS.cs @@ -4742,7 +4742,7 @@ internal static class RuleTypeMappingCS // ["S4815"], // ["S4816"], // ["S4817"] = "SECURITY_HOTSPOT", - ["S4818"] = "SECURITY_HOTSPOT", + // ["S4818"], // ["S4819"], // ["S4820"], // ["S4821"], diff --git a/analyzers/tests/SonarAnalyzer.UnitTest/PackagingTests/RuleTypeMappingVB.cs b/analyzers/tests/SonarAnalyzer.UnitTest/PackagingTests/RuleTypeMappingVB.cs index 1ca13bef5b0..d3533f24d37 100644 --- a/analyzers/tests/SonarAnalyzer.UnitTest/PackagingTests/RuleTypeMappingVB.cs +++ b/analyzers/tests/SonarAnalyzer.UnitTest/PackagingTests/RuleTypeMappingVB.cs @@ -4742,7 +4742,7 @@ internal static class RuleTypeMappingVB // ["S4815"], // ["S4816"], // ["S4817"] = "SECURITY_HOTSPOT", - ["S4818"] = "SECURITY_HOTSPOT", + // ["S4818"], // ["S4819"], // ["S4820"], // ["S4821"], diff --git a/analyzers/tests/SonarAnalyzer.UnitTest/PackagingTests/RuleTypeTest.cs b/analyzers/tests/SonarAnalyzer.UnitTest/PackagingTests/RuleTypeTest.cs index 53f5447a76c..2e4ee26dcd5 100644 --- a/analyzers/tests/SonarAnalyzer.UnitTest/PackagingTests/RuleTypeTest.cs +++ b/analyzers/tests/SonarAnalyzer.UnitTest/PackagingTests/RuleTypeTest.cs @@ -28,7 +28,7 @@ public class RuleTypeTest { // Rules that have been deprecated and deleted. // When changing this please do not forget to notify the product teams (SQ, SC, SL). - private static readonly HashSet DeletedRules = new() { "S1145", "S1697", "S2070", "S2255", "S2278", "S2758", "S3693", "S4142", "S4432", "S4787"}; + private static readonly HashSet DeletedRules = new() { "S1145", "S1697", "S2070", "S2255", "S2278", "S2758", "S3693", "S4142", "S4432", "S4787", "S4818"}; [TestMethod] public void DetectRuleTypeChanges_CS() => diff --git a/analyzers/tests/SonarAnalyzer.UnitTest/Rules/Hotspots/SocketsCreationTest.cs b/analyzers/tests/SonarAnalyzer.UnitTest/Rules/Hotspots/SocketsCreationTest.cs deleted file mode 100644 index 69694e99e49..00000000000 --- a/analyzers/tests/SonarAnalyzer.UnitTest/Rules/Hotspots/SocketsCreationTest.cs +++ /dev/null @@ -1,46 +0,0 @@ -/* - * SonarAnalyzer for .NET - * Copyright (C) 2015-2023 SonarSource SA - * mailto: contact AT sonarsource DOT com - * - * This program is free software; you can redistribute it and/or - * modify it under the terms of the GNU Lesser General Public - * License as published by the Free Software Foundation; either - * version 3 of the License, or (at your option) any later version. - * - * This program is distributed in the hope that it will be useful, - * but WITHOUT ANY WARRANTY; without even the implied warranty of - * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU - * Lesser General Public License for more details. - * - * You should have received a copy of the GNU Lesser General Public License - * along with this program; if not, write to the Free Software Foundation, - * Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA. - */ - -using CS = SonarAnalyzer.Rules.CSharp; -using VB = SonarAnalyzer.Rules.VisualBasic; - -namespace SonarAnalyzer.UnitTest.Rules -{ - [TestClass] - public class SocketsCreationTest - { - [TestMethod] - public void SocketsCreation_CS() => - new VerifierBuilder().WithBasePath("Hotspots").AddAnalyzer(() => new CS.SocketsCreation(AnalyzerConfiguration.AlwaysEnabled)) - .AddPaths("SocketsCreation.cs") - .AddReferences(GetAdditionalReferences()) - .Verify(); - - [TestMethod] - public void SocketsCreation_VB() => - new VerifierBuilder().WithBasePath("Hotspots").AddAnalyzer(() => new VB.SocketsCreation(AnalyzerConfiguration.AlwaysEnabled)) - .AddPaths("SocketsCreation.vb") - .AddReferences(GetAdditionalReferences()) - .Verify(); - - private static IEnumerable GetAdditionalReferences() => - MetadataReferenceFacade.SystemNetSockets.Concat(MetadataReferenceFacade.SystemNetPrimitives); - } -} diff --git a/analyzers/tests/SonarAnalyzer.UnitTest/TestCases/Hotspots/SocketsCreation.cs b/analyzers/tests/SonarAnalyzer.UnitTest/TestCases/Hotspots/SocketsCreation.cs deleted file mode 100644 index a8f98a9b8ab..00000000000 --- a/analyzers/tests/SonarAnalyzer.UnitTest/TestCases/Hotspots/SocketsCreation.cs +++ /dev/null @@ -1,42 +0,0 @@ -namespace Tests.Diagnostics -{ - using System.Net.Sockets; - - public class TestSocket - { - // RSpec example: https://jira.sonarsource.com/browse/RSPEC-4944 - public static void Run() - { - Socket socket = new Socket(AddressFamily.InterNetwork, SocketType.Stream, ProtocolType.Tcp); -// ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ {{Make sure that sockets are used safely here.}} - - // TcpClient and UdpClient simply abstract the details of creating a Socket - TcpClient client = new TcpClient("example.com", 80); -// ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ {{Make sure that sockets are used safely here.}} - - UdpClient listener = new UdpClient(80); -// ^^^^^^^^^^^^^^^^^ {{Make sure that sockets are used safely here.}} - } - - - public void Tests(Socket socket, TcpClient tcp, UdpClient udp) - { - // Ok to call other methods and properties - socket.Accept(); - var isAvailable = tcp.Available; - udp.DontFragment = true; - - // Creating of subclasses is not checked - new MySocket(); - new MyTcpClient(); - new MyUdpClient(); - } - } - - public class MySocket : Socket - { - public MySocket() : base(new SocketInformation()) { } - } - public class MyTcpClient : TcpClient { } - public class MyUdpClient : UdpClient { } -} diff --git a/analyzers/tests/SonarAnalyzer.UnitTest/TestCases/Hotspots/SocketsCreation.vb b/analyzers/tests/SonarAnalyzer.UnitTest/TestCases/Hotspots/SocketsCreation.vb deleted file mode 100644 index ff66e51133c..00000000000 --- a/analyzers/tests/SonarAnalyzer.UnitTest/TestCases/Hotspots/SocketsCreation.vb +++ /dev/null @@ -1,47 +0,0 @@ -Imports System.Net.Sockets - -Namespace Tests.TestCases - Public Class Sockets - - ' RSpec example: https://jira.sonarsource.com/browse/RSPEC-4996 - Public Shared Sub Run() - Dim socket As Socket = New Socket(AddressFamily.InterNetwork, SocketType.Stream, ProtocolType.Tcp) -' ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ {{Make sure that sockets are used safely here.}} - - ' TcpClient And UdpClient simply abstract the details of creating a Socket - Dim client As TcpClient = New TcpClient("example.com", 80) -' ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ {{Make sure that sockets are used safely here.}} - - Dim listener As UdpClient = New UdpClient(80) -' ^^^^^^^^^^^^^^^^^ {{Make sure that sockets are used safely here.}} - End Sub - - Public Sub Tests(socket As Socket, tcp As TcpClient, udp As UdpClient) - ' Ok to call other methods And properties - socket.Accept() - Dim isAvailable = tcp.Available - udp.DontFragment = True - - 'Creating of subclasses ís not checked - Dim x As Object = New MySocket() - x = New MyTcpClient() - x = New MyUdpClient() - End Sub - End Class - - Public Class MySocket - Inherits Socket - Sub New() - MyBase.New(CType(Nothing, SocketInformation)) - End Sub - End Class - - Friend Class MyTcpClient - Inherits TcpClient - End Class - - Public Class MyUdpClient - Inherits UdpClient - End Class - -End Namespace