diff --git a/its/ruling/src/test/java/org/sonar/java/it/JavaRulingTest.java b/its/ruling/src/test/java/org/sonar/java/it/JavaRulingTest.java index 7d0828f01..cb628ace3 100644 --- a/its/ruling/src/test/java/org/sonar/java/it/JavaRulingTest.java +++ b/its/ruling/src/test/java/org/sonar/java/it/JavaRulingTest.java @@ -62,7 +62,7 @@ public class JavaRulingTest { private static final ImmutableSet SUBSET_OF_ENABLED_RULES = ImmutableSet.of( "S2095", "S2189", "S2222", "S2583", "S2589", "S2637", "S2689", "S2755", "S3065", - "S3516", "S3518", "S3546", "S3655", "S3824", "S3958", "S3959", "S4165", "S4449", "S6373", "S6374", "S6376", "S6377"); + "S3516", "S3546", "S3655", "S3824", "S3958", "S3959", "S4165", "S4449", "S6373", "S6374", "S6376", "S6377"); @ClassRule public static TemporaryFolder tmpDumpOldFolder = new TemporaryFolder(); @@ -96,7 +96,7 @@ public static void prepare() throws Exception { List extraNonDefaultRules = List.of("S3546", "S6374"); ProfileGenerator.generate(ORCHESTRATOR, "Sonar Way", ImmutableMap.of(), new HashSet<>(), SUBSET_OF_ENABLED_RULES, result, extraNonDefaultRules); - assertThat(result).hasSize(22); // ALL symbolic-execution rules + assertThat(result).hasSize(21); // ALL symbolic-execution rules Path allRulesFolder = Paths.get("src/test/resources"); effectiveDumpOldFolder = tmpDumpOldFolder.getRoot().toPath().toAbsolutePath(); diff --git a/java-symbolic-execution/java-symbolic-execution-plugin/src/main/java/org/sonar/java/se/plugin/JavaSECheckList.java b/java-symbolic-execution/java-symbolic-execution-plugin/src/main/java/org/sonar/java/se/plugin/JavaSECheckList.java index f79c7b06e..b8a0cd890 100644 --- a/java-symbolic-execution/java-symbolic-execution-plugin/src/main/java/org/sonar/java/se/plugin/JavaSECheckList.java +++ b/java-symbolic-execution/java-symbolic-execution-plugin/src/main/java/org/sonar/java/se/plugin/JavaSECheckList.java @@ -22,7 +22,6 @@ import org.sonar.java.se.checks.ConditionalUnreachableCodeCheck; import org.sonar.java.se.checks.CustomUnclosedResourcesCheck; import org.sonar.java.se.checks.DenialOfServiceXMLCheck; -import org.sonar.java.se.checks.DivisionByZeroCheck; import org.sonar.java.se.checks.InvariantReturnCheck; import org.sonar.java.se.checks.LocksNotUnlockedCheck; import org.sonar.java.se.checks.MapComputeIfAbsentOrPresentCheck; @@ -50,7 +49,6 @@ private JavaSECheckList(){ public static List> getChecks() { return List.of( // SEChecks ordered by ExplodedGraphWalker need - DivisionByZeroCheck.class, UnclosedResourcesCheck.class, LocksNotUnlockedCheck.class, NonNullSetToNullCheck.class, diff --git a/java-symbolic-execution/java-symbolic-execution-plugin/src/main/java/org/sonar/java/se/plugin/RulesList.java b/java-symbolic-execution/java-symbolic-execution-plugin/src/main/java/org/sonar/java/se/plugin/RulesList.java index 7ee8f3541..c86dd54d2 100644 --- a/java-symbolic-execution/java-symbolic-execution-plugin/src/main/java/org/sonar/java/se/plugin/RulesList.java +++ b/java-symbolic-execution/java-symbolic-execution-plugin/src/main/java/org/sonar/java/se/plugin/RulesList.java @@ -36,7 +36,6 @@ public static List getSonarWayRuleKeys() { "S2755", "S3065", "S3516", - "S3518", "S3655", "S3824", "S3958", diff --git a/java-symbolic-execution/java-symbolic-execution-plugin/src/main/resources/org/sonar/l10n/java/rules/javase/S3518.html b/java-symbolic-execution/java-symbolic-execution-plugin/src/main/resources/org/sonar/l10n/java/rules/javase/S3518.html deleted file mode 100644 index be97e50a9..000000000 --- a/java-symbolic-execution/java-symbolic-execution-plugin/src/main/resources/org/sonar/l10n/java/rules/javase/S3518.html +++ /dev/null @@ -1,58 +0,0 @@ -

If the denominator to an integer division or remainder operation is zero, a ArithmeticException is thrown.

-

This error will crash your program in most cases. To fix it, you need to ensure that the denominator value in all division operations is always -non-zero, or check the value against zero before performing the division.

-

Why is this an issue?

-

A division (/) or remainder operation (%) by zero indicates a bug or logical error. This is because in Java, a division -or remainder operation where the denominator is zero and not a floating point value always results in an ArithmeticException being -thrown.

-

When working with double or float values, no exception will be thrown, but the operation will result in special floating -point values representing either positive infinity, negative infinity, or NaN. Unless these special values are explicitly handled by a -program, zero denominators should be avoided in floating point operations, too. Otherwise, the application might produce unexpected results.

-

What is the potential impact?

-

Issues of this type interrupt the normal execution of a program, causing it to crash or putting it into an inconsistent state. Therefore, this -issue might impact the availability and reliability of your application, or even result in data loss.

-

If the computation of the denominator is tied to user input data, this issue can potentially even be exploited by attackers to disrupt your -application.

-

Noncompliant code example

-
-void test_divide() {
-  int z = 0;
-  if (unknown()) {
-    // ..
-    z = 3;
-  } else {
-    // ..
-  }
-  z = 1 / z; // Noncompliant, possible division by zero
-}
-
-

Compliant solution

-
-void test_divide() {
-  int z = 0;
-  if (unknown()) {
-    // ..
-    z = 3;
-  } else {
-    // ..
-    z = 1;
-  }
-  z = 1 / z;
-}
-
-

Resources

-

Documentation

- -

Standards

- - diff --git a/java-symbolic-execution/java-symbolic-execution-plugin/src/main/resources/org/sonar/l10n/java/rules/javase/S3518.json b/java-symbolic-execution/java-symbolic-execution-plugin/src/main/resources/org/sonar/l10n/java/rules/javase/S3518.json deleted file mode 100644 index 705cd5420..000000000 --- a/java-symbolic-execution/java-symbolic-execution-plugin/src/main/resources/org/sonar/l10n/java/rules/javase/S3518.json +++ /dev/null @@ -1,38 +0,0 @@ -{ - "title": "Zero should not be a possible denominator", - "type": "BUG", - "code": { - "impacts": { - "RELIABILITY": "HIGH" - }, - "attribute": "LOGICAL" - }, - "status": "ready", - "remediation": { - "func": "Constant\/Issue", - "constantCost": "5 min" - }, - "tags": [ - "cwe", - "denial-of-service", - "cert", - "symbolic-execution" - ], - "defaultSeverity": "Critical", - "ruleSpecification": "RSPEC-3518", - "sqKey": "S3518", - "scope": "All", - "securityStandards": { - "CERT": [ - "NUM02-J.", - "INT33-C." - ], - "CWE": [ - 369 - ], - "STIG ASD_V5R3": [ - "V-222612" - ] - }, - "quickfix": "infeasible" -} diff --git a/java-symbolic-execution/java-symbolic-execution-plugin/src/main/resources/org/sonar/l10n/java/rules/javase/Sonar_way_profile.json b/java-symbolic-execution/java-symbolic-execution-plugin/src/main/resources/org/sonar/l10n/java/rules/javase/Sonar_way_profile.json index 6c131982b..e0e946862 100644 --- a/java-symbolic-execution/java-symbolic-execution-plugin/src/main/resources/org/sonar/l10n/java/rules/javase/Sonar_way_profile.json +++ b/java-symbolic-execution/java-symbolic-execution-plugin/src/main/resources/org/sonar/l10n/java/rules/javase/Sonar_way_profile.json @@ -11,7 +11,6 @@ "S2755", "S3065", "S3516", - "S3518", "S3655", "S3824", "S3958", diff --git a/java-symbolic-execution/java-symbolic-execution-plugin/src/test/java/org/sonar/java/se/plugin/JavaSECheckListTest.java b/java-symbolic-execution/java-symbolic-execution-plugin/src/test/java/org/sonar/java/se/plugin/JavaSECheckListTest.java index 7175571bf..c6d222f5a 100644 --- a/java-symbolic-execution/java-symbolic-execution-plugin/src/test/java/org/sonar/java/se/plugin/JavaSECheckListTest.java +++ b/java-symbolic-execution/java-symbolic-execution-plugin/src/test/java/org/sonar/java/se/plugin/JavaSECheckListTest.java @@ -24,7 +24,7 @@ class JavaSECheckListTest { @Test void getChecks() { - assertThat(JavaSECheckList.getChecks()).isNotNull().hasSize(22); + assertThat(JavaSECheckList.getChecks()).isNotNull().hasSize(21); } } diff --git a/java-symbolic-execution/java-symbolic-execution-plugin/src/test/java/org/sonar/java/se/plugin/JavaSECheckRegistrarTest.java b/java-symbolic-execution/java-symbolic-execution-plugin/src/test/java/org/sonar/java/se/plugin/JavaSECheckRegistrarTest.java index 29be9e8ae..76046471c 100644 --- a/java-symbolic-execution/java-symbolic-execution-plugin/src/test/java/org/sonar/java/se/plugin/JavaSECheckRegistrarTest.java +++ b/java-symbolic-execution/java-symbolic-execution-plugin/src/test/java/org/sonar/java/se/plugin/JavaSECheckRegistrarTest.java @@ -44,10 +44,8 @@ class JavaSECheckRegistrarTest { private static final ActiveRules activeRules = activeRules(getRuleKeysWithRepo()); private static final List rulesNotActiveByDefault = List.of( - "S2259", "S2583", "S2589", - "S3518", "S3546", "S3655", "S3959", @@ -85,7 +83,7 @@ void rules_definition() { assertThat(repository.name()).isEqualTo("Sonar"); assertThat(repository.language()).isEqualTo("java"); List rules = repository.rules(); - assertThat(rules).hasSize(22); + assertThat(rules).hasSize(21); var activeByDefault = rules.stream() .filter(k -> !rulesNotActiveByDefault.contains(k.key())) diff --git a/java-symbolic-execution/java-symbolic-execution-plugin/src/test/java/org/sonar/java/se/plugin/JavaSEProfileRegistrarTest.java b/java-symbolic-execution/java-symbolic-execution-plugin/src/test/java/org/sonar/java/se/plugin/JavaSEProfileRegistrarTest.java index 6b27d0bd0..95f086add 100644 --- a/java-symbolic-execution/java-symbolic-execution-plugin/src/test/java/org/sonar/java/se/plugin/JavaSEProfileRegistrarTest.java +++ b/java-symbolic-execution/java-symbolic-execution-plugin/src/test/java/org/sonar/java/se/plugin/JavaSEProfileRegistrarTest.java @@ -28,7 +28,7 @@ void constructor() { JavaSEProfileRegistrar registrar = new JavaSEProfileRegistrar(); TestProfileRegistrarContext context = new TestProfileRegistrarContext(); registrar.register(context); - assertThat(context.defaultQualityProfileRules).hasSize(20); // 2 are not in the default profile + assertThat(context.defaultQualityProfileRules).hasSize(19); } }