SONAR-10985 Add filters for owaspTop10, sans25Top10, cwe (#485)

* Add security standards for Xoo hotspot sensor (when API supports it)

* Re-generate issues/SearchRequest

* Verify security standards in issue search

* Store security standards when registering rules

diff --git a/plugins/sonar-xoo-plugin/src/main/java/org/sonar/xoo/rule/XooRulesDefinition.java b/plugins/sonar-xoo-plugin/src/main/java/org/sonar/xoo/rule/XooRulesDefinition.java
index 303000225cb683217fb19943ef1f82d7a4ffccf7..8991b04bc28a1431b700d0f65f479fc8cf9c9d97 100644 (file)
--- a/plugins/sonar-xoo-plugin/src/main/java/org/sonar/xoo/rule/XooRulesDefinition.java
+++ b/plugins/sonar-xoo-plugin/src/main/java/org/sonar/xoo/rule/XooRulesDefinition.java
@@ -19,11 +19,14 @@
  */
 package org.sonar.xoo.rule;
 
+import javax.annotation.Nullable;
+import org.sonar.api.SonarRuntime;
 import org.sonar.api.rule.RuleScope;
 import org.sonar.api.rules.RuleType;
 import org.sonar.api.server.rule.RuleParamType;
 import org.sonar.api.server.rule.RulesDefinition;
 import org.sonar.api.server.rule.RulesDefinitionAnnotationLoader;
+import org.sonar.api.utils.Version;
 import org.sonar.xoo.Xoo;
 import org.sonar.xoo.Xoo2;
 import org.sonar.xoo.checks.Check;
@@ -39,6 +42,17 @@ public class XooRulesDefinition implements RulesDefinition {
 
   private static final String TEN_MIN = "10min";
 
+  @Nullable
+  private final Version version;
+
+  public XooRulesDefinition() {
+    this(null);
+  }
+
+  public XooRulesDefinition(@Nullable SonarRuntime sonarRuntime) {
+    this.version = sonarRuntime != null ? sonarRuntime.getApiVersion() : null;
+  }
+
   @Override
   public void define(Context context) {
     defineRulesXoo(context);
@@ -128,7 +142,7 @@ public class XooRulesDefinition implements RulesDefinition {
     repo.createRule(MultilineIssuesSensor.RULE_KEY).setName("Creates issues with ranges/multiple locations")
       .setHtmlDescription("Issue with range and multiple locations");
 
-    repo.createRule(OneIssuePerUnknownFileSensor.RULE_KEY).setName("Creates issues on each file with extenstion 'unknown'")
+    repo.createRule(OneIssuePerUnknownFileSensor.RULE_KEY).setName("Creates issues on each file with extension 'unknown'")
       .setHtmlDescription("This issue is generated on each file with extenstion 'unknown'");
 
     NewRule oneBugIssuePerLine = repo.createRule(OneBugIssuePerLineSensor.RULE_KEY).setName("One Bug Issue Per Line")
@@ -159,8 +173,13 @@ public class XooRulesDefinition implements RulesDefinition {
     hotspot
       .setDebtRemediationFunction(hotspot.debtRemediationFunctions().constantPerIssue("2min"));
 
-    repo.done();
+    if (version != null && version.isGreaterThanOrEqual(Version.create(7, 3))) {
+      hotspot
+        .addOwaspTop10(OwaspTop10.A1, OwaspTop10.A3)
+        .addCwe(1, 123, 863);
+    }
 
+    repo.done();
   }
 
   private static void defineRulesXooExternal(Context context) {

diff --git a/plugins/sonar-xoo-plugin/src/test/java/org/sonar/xoo/rule/XooRulesDefinitionTest.java b/plugins/sonar-xoo-plugin/src/test/java/org/sonar/xoo/rule/XooRulesDefinitionTest.java
index 9658ab8e3a4f75b194d1262a6a5c0239b9e93e2d..0ded44031fca5c1eb181205365760877ee8c2210 100644 (file)
--- a/plugins/sonar-xoo-plugin/src/test/java/org/sonar/xoo/rule/XooRulesDefinitionTest.java
+++ b/plugins/sonar-xoo-plugin/src/test/java/org/sonar/xoo/rule/XooRulesDefinitionTest.java
@@ -21,8 +21,12 @@ package org.sonar.xoo.rule;
 
 import org.junit.Before;
 import org.junit.Test;
+import org.sonar.api.SonarProduct;
+import org.sonar.api.SonarQubeSide;
+import org.sonar.api.internal.SonarRuntimeImpl;
 import org.sonar.api.server.debt.DebtRemediationFunction;
 import org.sonar.api.server.rule.RulesDefinition;
+import org.sonar.api.utils.Version;
 
 import static org.assertj.core.api.Assertions.assertThat;
 
@@ -31,7 +35,7 @@ public class XooRulesDefinitionTest {
 
   @Before
   public void setUp() {
-    XooRulesDefinition def = new XooRulesDefinition();
+    XooRulesDefinition def = new XooRulesDefinition(SonarRuntimeImpl.forSonarQube(Version.create(7, 3), SonarQubeSide.SCANNER));
     context = new RulesDefinition.Context();
     def.define(context);
   }
@@ -52,6 +56,21 @@ public class XooRulesDefinitionTest {
     assertThat(rule.gapDescription()).isNotEmpty();
   }
   
+  @Test
+  public void define_xoo_hotspot_rule() {
+    RulesDefinition.Repository repo = context.repository("xoo");
+    assertThat(repo).isNotNull();
+    assertThat(repo.name()).isEqualTo("Xoo");
+    assertThat(repo.language()).isEqualTo("xoo");
+    assertThat(repo.rules()).hasSize(19);
+
+    RulesDefinition.Rule rule = repo.rule(HotspotSensor.RULE_KEY);
+    assertThat(rule.name()).isNotEmpty();
+    assertThat(rule.securityStandards())
+      .isNotEmpty()
+      .containsExactlyInAnyOrder("cwe:1", "cwe:123", "cwe:863", "owaspTop10:a1", "owaspTop10:a3");
+  }
+
   @Test
   public void define_xooExternal_rules() {
     RulesDefinition.Repository repo = context.repository("external_xoo");

diff --git a/server/sonar-server-common/src/main/java/org/sonar/server/issue/IssueQueryFactory.java b/server/sonar-server-common/src/main/java/org/sonar/server/issue/IssueQueryFactory.java
index d0b0747a9f6cccd6d51c598e33a6b22c5a814d3f..e28607edc5b0a623cd0c22a19f2701e2f5f18a17 100644 (file)
--- a/server/sonar-server-common/src/main/java/org/sonar/server/issue/IssueQueryFactory.java
+++ b/server/sonar-server-common/src/main/java/org/sonar/server/issue/IssueQueryFactory.java
@@ -106,6 +106,9 @@ public class IssueQueryFactory {
         .languages(request.getLanguages())
         .tags(request.getTags())
         .types(request.getTypes())
+        .owaspTop10(request.getOwaspTop10())
+        .sansTop25(request.getSansTop25())
+        .cwe(request.getCwe())
         .assigned(request.getAssigned())
         .createdAt(parseDateOrDateTime(request.getCreatedAt()))
         .createdBefore(parseEndingDateOrDateTime(request.getCreatedBefore()))

diff --git a/server/sonar-server-common/src/main/java/org/sonar/server/issue/index/IssueIndex.java b/server/sonar-server-common/src/main/java/org/sonar/server/issue/index/IssueIndex.java
index 9f1bc7382e152ffc0cda16a2f2b86ffc3a2e3bb1..27303d4b5085bae7c2b63f3d1e33c8304b5decfb 100644 (file)
--- a/server/sonar-server-common/src/main/java/org/sonar/server/issue/index/IssueIndex.java
+++ b/server/sonar-server-common/src/main/java/org/sonar/server/issue/index/IssueIndex.java
@@ -268,6 +268,9 @@ public class IssueIndex {
     filters.put(IssueIndexDefinition.FIELD_ISSUE_SEVERITY, createTermsFilter(IssueIndexDefinition.FIELD_ISSUE_SEVERITY, query.severities()));
     filters.put(IssueIndexDefinition.FIELD_ISSUE_STATUS, createTermsFilter(IssueIndexDefinition.FIELD_ISSUE_STATUS, query.statuses()));
     filters.put(IssueIndexDefinition.FIELD_ISSUE_ORGANIZATION_UUID, createTermFilter(IssueIndexDefinition.FIELD_ISSUE_ORGANIZATION_UUID, query.organizationUuid()));
+    filters.put(IssueIndexDefinition.FIELD_ISSUE_OWASP_TOP_10, createTermsFilter(IssueIndexDefinition.FIELD_ISSUE_OWASP_TOP_10, query.owaspTop10()));
+    filters.put(IssueIndexDefinition.FIELD_ISSUE_SANS_TOP_25, createTermsFilter(IssueIndexDefinition.FIELD_ISSUE_SANS_TOP_25, query.sansTop25()));
+    filters.put(IssueIndexDefinition.FIELD_ISSUE_CWE, createTermsFilter(IssueIndexDefinition.FIELD_ISSUE_CWE, query.cwe()));
 
     addComponentRelatedFilters(query, filters);
 

diff --git a/server/sonar-server/src/main/java/org/sonar/server/rule/RegisterRules.java b/server/sonar-server/src/main/java/org/sonar/server/rule/RegisterRules.java
index 51c5549ba3d0f392c206977e9338a750f55d4f4a..8301738e75e64a44c6ae5f96abe4fd5586b7d39b 100644 (file)
--- a/server/sonar-server/src/main/java/org/sonar/server/rule/RegisterRules.java
+++ b/server/sonar-server/src/main/java/org/sonar/server/rule/RegisterRules.java
@@ -368,6 +368,10 @@ public class RegisterRules implements Startable {
       context.updated(ruleDefinitionDto);
     }
 
+    if (mergeSecurityStandards(ruleDef, ruleDefinitionDto)) {
+      context.updated(ruleDefinitionDto);
+    }
+
     if (context.isUpdated(ruleDefinitionDto) || context.isRenamed(ruleDefinitionDto)) {
       update(session, ruleDefinitionDto);
     } else if (!context.isCreated(ruleDefinitionDto)) {
@@ -390,6 +394,7 @@ public class RegisterRules implements Startable {
       .setStatus(ruleDef.status())
       .setGapDescription(ruleDef.gapDescription())
       .setSystemTags(ruleDef.tags())
+      .setSecurityStandards(ruleDef.securityStandards())
       .setType(RuleType.valueOf(ruleDef.type().name()))
       .setScope(toDtoScope(ruleDef.scope()))
       .setIsExternal(ruleDef.repository().isExternal())
@@ -628,6 +633,20 @@ public class RegisterRules implements Startable {
     return changed;
   }
 
+  private static boolean mergeSecurityStandards(RulesDefinition.Rule ruleDef, RuleDefinitionDto dto) {
+    boolean changed = false;
+
+    if (RuleStatus.REMOVED == ruleDef.status()) {
+      dto.setSecurityStandards(emptySet());
+      changed = true;
+    } else if (dto.getSecurityStandards().size() != ruleDef.securityStandards().size() ||
+      !dto.getSecurityStandards().containsAll(ruleDef.securityStandards())) {
+      dto.setSecurityStandards(ruleDef.securityStandards());
+      changed = true;
+    }
+    return changed;
+  }
+
   private void processRemainingDbRules(RegisterRulesContext recorder, DbSession dbSession) {
     // custom rules check status of template, so they must be processed at the end
     List<RuleDefinitionDto> customRules = newArrayList();

diff --git a/server/sonar-server/src/test/java/org/sonar/server/rule/RegisterRulesTest.java b/server/sonar-server/src/test/java/org/sonar/server/rule/RegisterRulesTest.java
index 2d70a76fa5e5659c40f5cafae3f2416e4726506e..270d5d4e3ae972711df9d755ce9e44eb93ddd49f 100644 (file)
--- a/server/sonar-server/src/test/java/org/sonar/server/rule/RegisterRulesTest.java
+++ b/server/sonar-server/src/test/java/org/sonar/server/rule/RegisterRulesTest.java
@@ -93,10 +93,12 @@ public class RegisterRulesTest {
   private static final Date DATE3 = DateUtils.parseDateTime("2014-03-01T12:10:03+0100");
 
   private static final RuleKey EXTERNAL_RULE_KEY1 = RuleKey.of("external_eslint", "rule1");
+  private static final RuleKey EXTERNAL_HOTSPOT_RULE_KEY = RuleKey.of("external_eslint", "hotspot");
 
   private static final RuleKey RULE_KEY1 = RuleKey.of("fake", "rule1");
   private static final RuleKey RULE_KEY2 = RuleKey.of("fake", "rule2");
   private static final RuleKey RULE_KEY3 = RuleKey.of("fake", "rule3");
+  private static final RuleKey HOTSPOT_RULE_KEY = RuleKey.of("fake", "hotspot");
 
   private System2 system = mock(System2.class);
 
@@ -133,7 +135,7 @@ public class RegisterRulesTest {
     execute(new FakeRepositoryV1());
 
     // verify db
-    assertThat(dbClient.ruleDao().selectAllDefinitions(dbTester.getSession())).hasSize(2);
+    assertThat(dbClient.ruleDao().selectAllDefinitions(dbTester.getSession())).hasSize(3);
     RuleDto rule1 = dbClient.ruleDao().selectOrFailByKey(dbTester.getSession(), dbTester.getDefaultOrganization(), RULE_KEY1);
     assertThat(rule1.getName()).isEqualTo("One");
     assertThat(rule1.getDescription()).isEqualTo("Description of One");
@@ -152,6 +154,14 @@ public class RegisterRulesTest {
     assertThat(rule1.getPluginKey()).isEqualTo(FAKE_PLUGIN_KEY);
     assertThat(rule1.isExternal()).isFalse();
 
+    RuleDto hotspotRule = dbClient.ruleDao().selectOrFailByKey(dbTester.getSession(), dbTester.getDefaultOrganization(), HOTSPOT_RULE_KEY);
+    assertThat(hotspotRule.getName()).isEqualTo("Hotspot");
+    assertThat(hotspotRule.getDescription()).isEqualTo("Minimal hotspot");
+    assertThat(hotspotRule.getCreatedAt()).isEqualTo(DATE1.getTime());
+    assertThat(hotspotRule.getUpdatedAt()).isEqualTo(DATE1.getTime());
+    assertThat(hotspotRule.getType()).isEqualTo(RuleType.SECURITY_HOTSPOT.getDbConstant());
+    assertThat(hotspotRule.getSecurityStandards()).containsExactly("cwe:1", "cwe:123", "cwe:863", "owaspTop10:a1", "owaspTop10:a3");
+
     List<RuleParamDto> params = dbClient.ruleDao().selectRuleParamsByRuleKey(dbTester.getSession(), RULE_KEY1);
     assertThat(params).hasSize(2);
     RuleParamDto param = getParam(params, "param1");
@@ -160,7 +170,7 @@ public class RegisterRulesTest {
 
     // verify index
     RuleDto rule2 = dbClient.ruleDao().selectOrFailByKey(dbTester.getSession(), dbTester.getDefaultOrganization(), RULE_KEY2);
-    assertThat(ruleIndex.search(new RuleQuery(), new SearchOptions()).getIds()).containsOnly(rule1.getId(), rule2.getId());
+    assertThat(ruleIndex.search(new RuleQuery(), new SearchOptions()).getIds()).containsOnly(rule1.getId(), rule2.getId(), hotspotRule.getId());
 
     // verify repositories
     assertThat(dbClient.ruleRepositoryDao().selectAll(dbTester.getSession())).extracting(RuleRepositoryDto::getKey).containsOnly("fake");
@@ -171,7 +181,7 @@ public class RegisterRulesTest {
     execute(new ExternalRuleRepository());
 
     // verify db
-    assertThat(dbClient.ruleDao().selectAllDefinitions(dbTester.getSession())).hasSize(1);
+    assertThat(dbClient.ruleDao().selectAllDefinitions(dbTester.getSession())).hasSize(2);
     RuleDto rule1 = dbClient.ruleDao().selectOrFailByKey(dbTester.getSession(), dbTester.getDefaultOrganization(), EXTERNAL_RULE_KEY1);
     assertThat(rule1.getName()).isEqualTo("One");
     assertThat(rule1.getDescription()).isEqualTo("Description of One");
@@ -189,6 +199,14 @@ public class RegisterRulesTest {
     assertThat(rule1.getType()).isEqualTo(RuleType.CODE_SMELL.getDbConstant());
     assertThat(rule1.getPluginKey()).isEqualTo(FAKE_PLUGIN_KEY);
     assertThat(rule1.isExternal()).isTrue();
+
+    RuleDto hotspotRule = dbClient.ruleDao().selectOrFailByKey(dbTester.getSession(), dbTester.getDefaultOrganization(), EXTERNAL_HOTSPOT_RULE_KEY);
+    assertThat(hotspotRule.getName()).isEqualTo("Hotspot");
+    assertThat(hotspotRule.getDescription()).isEqualTo("Minimal hotspot");
+    assertThat(hotspotRule.getCreatedAt()).isEqualTo(DATE1.getTime());
+    assertThat(hotspotRule.getUpdatedAt()).isEqualTo(DATE1.getTime());
+    assertThat(hotspotRule.getType()).isEqualTo(RuleType.SECURITY_HOTSPOT.getDbConstant());
+    assertThat(hotspotRule.getSecurityStandards()).containsExactly("cwe:1", "cwe:123", "cwe:863", "owaspTop10:a1", "owaspTop10:a3");
   }
 
   @Test
@@ -289,10 +307,11 @@ public class RegisterRulesTest {
   @Test
   public void update_and_remove_rules_on_changes() {
     execute(new FakeRepositoryV1());
-    assertThat(dbClient.ruleDao().selectAllDefinitions(dbTester.getSession())).hasSize(2);
+    assertThat(dbClient.ruleDao().selectAllDefinitions(dbTester.getSession())).hasSize(3);
     RuleDto rule1 = dbClient.ruleDao().selectOrFailByKey(dbTester.getSession(), defaultOrganization, RULE_KEY1);
     RuleDto rule2 = dbClient.ruleDao().selectOrFailByKey(dbTester.getSession(), defaultOrganization, RULE_KEY2);
-    assertThat(es.getIds(RuleIndexDefinition.INDEX_TYPE_RULE)).containsOnly(valueOf(rule1.getId()), valueOf(rule2.getId()));
+    RuleDto hotspotRule = dbClient.ruleDao().selectOrFailByKey(dbTester.getSession(), defaultOrganization, HOTSPOT_RULE_KEY);
+    assertThat(es.getIds(RuleIndexDefinition.INDEX_TYPE_RULE)).containsOnly(valueOf(rule1.getId()), valueOf(rule2.getId()), valueOf(hotspotRule.getId()));
 
     // user adds tags and sets markdown note
     rule1.setTags(newHashSet("usertag1", "usertag2"));
@@ -371,6 +390,36 @@ public class RegisterRulesTest {
     assertThat(rule.getSystemTags()).containsOnly("tag1", "tag2");
   }
 
+  @Test
+  public void add_new_security_standards() {
+    execute((RulesDefinition) context -> {
+      NewRepository repo = context.createRepository("fake", "java");
+      repo.createRule("rule1")
+        .setName("Rule One")
+        .setHtmlDescription("Description of Rule One")
+        .addOwaspTop10(RulesDefinition.OwaspTop10.A1)
+        .addCwe(123);
+      repo.done();
+    });
+
+    OrganizationDto defaultOrganization = dbTester.getDefaultOrganization();
+    RuleDto rule = dbClient.ruleDao().selectOrFailByKey(dbTester.getSession(), defaultOrganization, RULE_KEY1);
+    assertThat(rule.getSecurityStandards()).containsOnly("cwe:123", "owaspTop10:a1");
+
+    execute((RulesDefinition) context -> {
+      NewRepository repo = context.createRepository("fake", "java");
+      repo.createRule("rule1")
+        .setName("Rule One")
+        .setHtmlDescription("Description of Rule One")
+        .addOwaspTop10(RulesDefinition.OwaspTop10.A1, RulesDefinition.OwaspTop10.A3)
+        .addCwe(1, 123, 863);
+      repo.done();
+    });
+
+    rule = dbClient.ruleDao().selectOrFailByKey(dbTester.getSession(), defaultOrganization, RULE_KEY1);
+    assertThat(rule.getSecurityStandards()).containsOnly("cwe:1", "cwe:123", "cwe:863", "owaspTop10:a1", "owaspTop10:a3");
+  }
+
   @Test
   public void update_only_rule_name() {
     when(system.now()).thenReturn(DATE1.getTime());
@@ -626,7 +675,7 @@ public class RegisterRulesTest {
   @Test
   public void do_not_update_rules_when_no_changes() {
     execute(new FakeRepositoryV1());
-    assertThat(dbClient.ruleDao().selectAllDefinitions(dbTester.getSession())).hasSize(2);
+    assertThat(dbClient.ruleDao().selectAllDefinitions(dbTester.getSession())).hasSize(3);
 
     when(system.now()).thenReturn(DATE2.getTime());
     execute(new FakeRepositoryV1());
@@ -639,11 +688,12 @@ public class RegisterRulesTest {
   @Test
   public void do_not_update_already_removed_rules() {
     execute(new FakeRepositoryV1());
-    assertThat(dbClient.ruleDao().selectAllDefinitions(dbTester.getSession())).hasSize(2);
+    assertThat(dbClient.ruleDao().selectAllDefinitions(dbTester.getSession())).hasSize(3);
 
     RuleDto rule1 = dbClient.ruleDao().selectOrFailByKey(dbTester.getSession(), defaultOrganization, RULE_KEY1);
     RuleDto rule2 = dbClient.ruleDao().selectOrFailByKey(dbTester.getSession(), defaultOrganization, RULE_KEY2);
-    assertThat(es.getIds(RuleIndexDefinition.INDEX_TYPE_RULE)).containsOnly(valueOf(rule1.getId()), valueOf(rule2.getId()));
+    RuleDto hotspotRule = dbClient.ruleDao().selectOrFailByKey(dbTester.getSession(), defaultOrganization, HOTSPOT_RULE_KEY);
+    assertThat(es.getIds(RuleIndexDefinition.INDEX_TYPE_RULE)).containsOnly(valueOf(rule1.getId()), valueOf(rule2.getId()), valueOf(hotspotRule.getId()));
 
     assertThat(rule2.getStatus()).isEqualTo(RuleStatus.READY);
 
@@ -981,6 +1031,13 @@ public class RegisterRulesTest {
       rule1.createParam("param1").setDescription("parameter one").setDefaultValue("default1");
       rule1.createParam("param2").setDescription("parameter two").setDefaultValue("default2");
 
+      repo.createRule(HOTSPOT_RULE_KEY.rule())
+        .setName("Hotspot")
+        .setHtmlDescription("Minimal hotspot")
+        .setType(RuleType.SECURITY_HOTSPOT)
+        .addOwaspTop10(OwaspTop10.A1, OwaspTop10.A3)
+        .addCwe(1, 123, 863);
+
       repo.createRule(RULE_KEY2.rule())
         .setName("Two")
         .setHtmlDescription("Minimal rule");
@@ -1015,6 +1072,7 @@ public class RegisterRulesTest {
       repo.createRule(RULE_KEY3.rule())
         .setName("Three")
         .setHtmlDescription("Rule Three");
+
       repo.done();
     }
   }
@@ -1032,6 +1090,14 @@ public class RegisterRulesTest {
         .setScope(RuleScope.ALL)
         .setType(RuleType.CODE_SMELL)
         .setStatus(RuleStatus.BETA);
+
+      repo.createRule(EXTERNAL_HOTSPOT_RULE_KEY.rule())
+        .setName("Hotspot")
+        .setHtmlDescription("Minimal hotspot")
+        .setType(RuleType.SECURITY_HOTSPOT)
+        .addOwaspTop10(OwaspTop10.A1, OwaspTop10.A3)
+        .addCwe(1, 123, 863);
+
       repo.done();
     }
   }

diff --git a/sonar-ws/src/main/java/org/sonarqube/ws/client/issues/IssuesService.java b/sonar-ws/src/main/java/org/sonarqube/ws/client/issues/IssuesService.java
index 75918c48fad51f96cceea6607479db77aa1a084f..d80a8bba836261fdd04285ca6d4e6dd7ed182f9b 100644 (file)
--- a/sonar-ws/src/main/java/org/sonarqube/ws/client/issues/IssuesService.java
+++ b/sonar-ws/src/main/java/org/sonarqube/ws/client/issues/IssuesService.java
@@ -241,7 +241,11 @@ public class IssuesService extends BaseService {
         .setParam("sinceLeakPeriod", request.getSinceLeakPeriod())
         .setParam("statuses", request.getStatuses() == null ? null : request.getStatuses().stream().collect(Collectors.joining(",")))
         .setParam("tags", request.getTags() == null ? null : request.getTags().stream().collect(Collectors.joining(",")))
-        .setParam("types", request.getTypes() == null ? null : request.getTypes().stream().collect(Collectors.joining(","))),
+        .setParam("types", request.getTypes() == null ? null : request.getTypes().stream().collect(Collectors.joining(",")))
+        .setParam("owaspTop10", request.getOwaspTop10() == null ? null : request.getOwaspTop10().stream().collect(Collectors.joining(",")))
+        .setParam("sansTop25", request.getSansTop25() == null ? null : request.getSansTop25().stream().collect(Collectors.joining(",")))
+        .setParam("cwe", request.getCwe() == null ? null : request.getCwe().stream().collect(Collectors.joining(",")))
+      ,
       SearchWsResponse.parser());
   }
 

diff --git a/sonar-ws/src/main/java/org/sonarqube/ws/client/issues/SearchRequest.java b/sonar-ws/src/main/java/org/sonarqube/ws/client/issues/SearchRequest.java
index 74096bdde5888cd176a489d9e19508baa1b1a008..cc9d9900d3308f169212be548027b6c5fd699c4e 100644 (file)
--- a/sonar-ws/src/main/java/org/sonarqube/ws/client/issues/SearchRequest.java
+++ b/sonar-ws/src/main/java/org/sonarqube/ws/client/issues/SearchRequest.java
@@ -46,6 +46,7 @@ public class SearchRequest {
   private String createdAt;
   private String createdBefore;
   private String createdInLast;
+  private List<String> cwe;
   private List<String> directories;
   private String facetMode;
   private List<String> facets;
@@ -55,6 +56,7 @@ public class SearchRequest {
   private List<String> moduleUuids;
   private String onComponentOnly;
   private String organization;
+  private List<String> owaspTop10;
   private String p;
   private List<String> projectUuids;
   private List<String> projects;
@@ -64,6 +66,7 @@ public class SearchRequest {
   private String resolved;
   private List<String> rules;
   private String s;
+  private List<String> sansTop25;
   private List<String> severities;
   private String sinceLeakPeriod;
   private List<String> statuses;
@@ -278,6 +281,18 @@ public class SearchRequest {
     return createdInLast;
   }
 
+  /**
+   * Example value: "12,125,unknown"
+   */
+  public SearchRequest setCwe(List<String> cwe) {
+    this.cwe = cwe;
+    return this;
+  }
+
+  public List<String> getCwe() {
+    return cwe;
+  }
+
   /**
    * This is part of the internal API.
    * Example value: "src/main/java/org/sonar/server/"
@@ -327,6 +342,9 @@ public class SearchRequest {
    *   <li>"languages"</li>
    *   <li>"tags"</li>
    *   <li>"types"</li>
+   *   <li>"owaspTop10"</li>
+   *   <li>"sansTop25"</li>
+   *   <li>"cwe"</li>
    *   <li>"createdAt"</li>
    * </ul>
    */
@@ -420,6 +438,31 @@ public class SearchRequest {
     return organization;
   }
 
+  /**
+   * Possible values:
+   * <ul>
+   *   <li>"a1"</li>
+   *   <li>"a2"</li>
+   *   <li>"a3"</li>
+   *   <li>"a4"</li>
+   *   <li>"a5"</li>
+   *   <li>"a6"</li>
+   *   <li>"a7"</li>
+   *   <li>"a8"</li>
+   *   <li>"a9"</li>
+   *   <li>"a10"</li>
+   *   <li>"unknown"</li>
+   * </ul>
+   */
+  public SearchRequest setOwaspTop10(List<String> owaspTop10) {
+    this.owaspTop10 = owaspTop10;
+    return this;
+  }
+
+  public List<String> getOwaspTop10() {
+    return owaspTop10;
+  }
+
   /**
    * Example value: "42"
    */
@@ -553,6 +596,23 @@ public class SearchRequest {
     return s;
   }
 
+  /**
+   * Possible values:
+   * <ul>
+   *   <li>"insecure-interaction"</li>
+   *   <li>"risky-resource"</li>
+   *   <li>"porous-defenses"</li>
+   * </ul>
+   */
+  public SearchRequest setSansTop25(List<String> sansTop25) {
+    this.sansTop25 = sansTop25;
+    return this;
+  }
+
+  public List<String> getSansTop25() {
+    return sansTop25;
+  }
+
   /**
    * Example value: "BLOCKER,CRITICAL"
    * Possible values:
@@ -630,6 +690,7 @@ public class SearchRequest {
    *   <li>"CODE_SMELL"</li>
    *   <li>"BUG"</li>
    *   <li>"VULNERABILITY"</li>
+   *   <li>"SECURITY_HOTSPOT"</li>
    * </ul>
    */
   public SearchRequest setTypes(List<String> types) {