新增规则：用户输入口令时应对口令域进行掩饰，用户输入的每一个字符都应该以星号形式回显

10 months ago · 3421f76628
parent 883256a330
commit 3421f76628
5 changed files with 109 additions and 0 deletions
--- a/sonar-keyware-plugins-java/src/main/java/com/keyware/sonar/java/rules/checkers/PasswordInputTagChecker.java
+++ b/sonar-keyware-plugins-java/src/main/java/com/keyware/sonar/java/rules/checkers/PasswordInputTagChecker.java
@ -0,0 +1,38 @@
+/*
+ * Copyright (c) 2023 - 2024. KeyWare.Co.Ltd All rights reserved.
+ * 项目名称：信息安全性设计准则检查插件
+ * 项目描述：用于检查源代码的安全性设计准则的Sonarqube插件
+ * 版权说明：本软件属北京关键科技股份有限公司所有，在未获得北京关键科技股份有限公司正式授权情况下，任何企业和个人，不能获取、阅读、安装、传播本软件涉及的任何受知识产权保护的内容。
+ */
+
+package com.keyware.sonar.java.rules.checkers;
+
+import org.sonar.check.Rule;
+import org.sonar.plugins.html.checks.AbstractPageCheck;
+import org.sonar.plugins.html.node.TagNode;
+import org.sonar.plugins.java.api.JavaCheck;
+
+/**
+ * <p>规则：用户输入口令时应对口令域进行掩饰。用户输入的每一个字符都应该以星号形式回显。</p>
+ * 验证逻辑：当input标签的name或者id包含password时，如果type不是password时，则报告问题
+ *
+ * @author GuoXin
+ * @date 2024/1/20
+ */
+@Rule(key = "PasswordInputTagChecker")
+public class PasswordInputTagChecker extends AbstractPageCheck implements JavaCheck {
+    @Override
+    public void startElement(TagNode node) {
+        if ("input".equalsIgnoreCase(node.getNodeName())) {
+            var id = node.getAttribute("id");
+            var name = node.getAttribute("name");
+            var type = node.getAttribute("type");
+            // 当name或者id包含password时，如果type不是password时，则报告问题
+            if ((id != null && id.contains("password")) || (name != null && name.contains("password"))) {
+                if (!"password".equalsIgnoreCase(type)) {
+                    createViolation(node, "密码输入框的type属性不为password");
+                }
+            }
+        }
+    }
+}
--- a/sonar-keyware-plugins-java/src/main/resources/org/sonar/l10n/java/rules/java/PasswordInputTagChecker.html
+++ b/sonar-keyware-plugins-java/src/main/resources/org/sonar/l10n/java/rules/java/PasswordInputTagChecker.html
@ -0,0 +1,9 @@
+<h2>用户输入口令时应对口令域进行掩饰，用户输入的每一个字符都应该以星号形式回显。</h2>
+<p>用户输入口令时应对口令域进行掩饰，用户输入的每一个字符都应该以星号形式回显。</p>
+<pre>
+
+</pre>
+<h2>合规解决方案</h2>
+<pre>
+
+</pre>
--- a/sonar-keyware-plugins-java/src/main/resources/org/sonar/l10n/java/rules/java/PasswordInputTagChecker.json
+++ b/sonar-keyware-plugins-java/src/main/resources/org/sonar/l10n/java/rules/java/PasswordInputTagChecker.json
@ -0,0 +1,13 @@
+{
+  "title": "用户输入口令时应对口令域进行掩饰。用户输入的每一个字符都应该以星号形式回显",
+  "type": "CODE_SMELL",
+  "status": "ready",
+  "remediation": {
+    "func": "Constant\/Issue",
+    "constantCost": "15min"
+  },
+  "tags": [
+    "28suo"
+  ],
+  "defaultSeverity": "Major"
+}
--- a/sonar-keyware-plugins-java/src/test/files/PasswordInputTagChecker.html
+++ b/sonar-keyware-plugins-java/src/test/files/PasswordInputTagChecker.html
@ -0,0 +1,14 @@
+<html>
+<head><title>Test for PasswordInputTagChecker</title></head>
+<body>
+<h1>Test for PasswordInputTagChecker</h1>
+<h2>Test 1 - FAIL</h2>
+<p>
+<form action="test.html" method="post">
+    <input type="password" name="password" value=""/>
+    <input type="text" name="password" value=""/>
+    <input type="submit" value="Submit"/>
+</form>
+</p>
+</body>
+</html>
--- a/sonar-keyware-plugins-java/src/test/java/com/keyware/sonar/java/rules/checkers/PasswordInputTagCheckerTest.java
+++ b/sonar-keyware-plugins-java/src/test/java/com/keyware/sonar/java/rules/checkers/PasswordInputTagCheckerTest.java
@ -0,0 +1,35 @@
+/*
+ * Copyright (c) 2023 - 2024. KeyWare.Co.Ltd All rights reserved.
+ * 项目名称：信息安全性设计准则检查插件
+ * 项目描述：用于检查源代码的安全性设计准则的Sonarqube插件
+ * 版权说明：本软件属北京关键科技股份有限公司所有，在未获得北京关键科技股份有限公司正式授权情况下，任何企业和个人，不能获取、阅读、安装、传播本软件涉及的任何受知识产权保护的内容。
+ */
+
+package com.keyware.sonar.java.rules.checkers;
+
+import com.keyware.sonar.java.utils.HtmlCheckMessagesVerifierRule;
+import com.keyware.sonar.java.utils.HtmlTestHelper;
+import org.junit.jupiter.api.Test;
+import org.junit.jupiter.api.extension.RegisterExtension;
+import org.sonar.plugins.html.visitor.HtmlSourceCode;
+
+import java.io.File;
+
+/**
+ * 测试规则：用户输入口令时应对口令域进行掩饰。用户输入的每一个字符都应该以星号形式回显
+ *
+ * @author GuoXin
+ * @date 2024/1/20
+ */
+public class PasswordInputTagCheckerTest {
+    @RegisterExtension
+    public HtmlCheckMessagesVerifierRule checkMessagesVerifier = new HtmlCheckMessagesVerifierRule();
+
+    @Test
+    public void detected() throws Exception {
+        HtmlSourceCode sourceCode = HtmlTestHelper.scan(new File("src/test/files/PasswordInputTagChecker.html"), new PasswordInputTagChecker());
+
+        checkMessagesVerifier.verify(sourceCode.getIssues())
+                .next().atLine(16);
+    }
+}