From 6f6c31272190acb041d97a9fc8b6193c5f7d82da Mon Sep 17 00:00:00 2001 From: Mathieu Suen Date: Fri, 8 Jul 2022 11:23:32 +0200 Subject: SONAR-16598 Rename generic concept to education principles --- .../src/main/js/api/mocks/IssuesServiceMock.ts | 2 +- server/sonar-web/src/main/js/app/theme.js | 2 +- .../apps/coding-rules/components/RuleTabViewer.tsx | 4 +- .../main/js/apps/issues/__tests__/IssueApp-it.tsx | 2 +- .../js/apps/issues/components/IssueTabViewer.tsx | 4 +- .../components/rules/MoreInfoRuleDescription.tsx | 23 +++++----- .../rules/educationPrinciples/DefenseInDepth.tsx | 48 +++++++++++++++++++++ .../educationPrinciples/LeastTrustPrinciple.tsx | 50 ++++++++++++++++++++++ .../rules/genericConcepts/DefenseInDepth.tsx | 48 --------------------- .../rules/genericConcepts/LeastTrustPrinciple.tsx | 50 ---------------------- .../src/main/js/components/rules/style.css | 4 +- server/sonar-web/src/main/js/types/types.ts | 2 +- 12 files changed, 121 insertions(+), 118 deletions(-) create mode 100644 server/sonar-web/src/main/js/components/rules/educationPrinciples/DefenseInDepth.tsx create mode 100644 server/sonar-web/src/main/js/components/rules/educationPrinciples/LeastTrustPrinciple.tsx delete mode 100644 server/sonar-web/src/main/js/components/rules/genericConcepts/DefenseInDepth.tsx delete mode 100644 server/sonar-web/src/main/js/components/rules/genericConcepts/LeastTrustPrinciple.tsx (limited to 'server/sonar-web/src/main') diff --git a/server/sonar-web/src/main/js/api/mocks/IssuesServiceMock.ts b/server/sonar-web/src/main/js/api/mocks/IssuesServiceMock.ts index 054ca7cde59..0e1fe610143 100644 --- a/server/sonar-web/src/main/js/api/mocks/IssuesServiceMock.ts +++ b/server/sonar-web/src/main/js/api/mocks/IssuesServiceMock.ts @@ -245,7 +245,7 @@ export default class IssuesServiceMock { rule: mockRuleDetails({ key: parameters.key, name: 'Advanced rule', - genericConcepts: ['defense_in_depth'], + educationPrinciples: ['defense_in_depth'], descriptionSections: [ { key: RuleDescriptionSections.INTRODUCTION, content: '

Into

' }, { key: RuleDescriptionSections.ROOT_CAUSE, content: '

Because

' }, diff --git a/server/sonar-web/src/main/js/app/theme.js b/server/sonar-web/src/main/js/app/theme.js index d4119df1c66..b8f4ef1bbbb 100644 --- a/server/sonar-web/src/main/js/app/theme.js +++ b/server/sonar-web/src/main/js/app/theme.js @@ -58,7 +58,7 @@ module.exports = { globalNavBarBg: '#262626', - genericConceptBgColor: '#F4F6FF', + educationPrinciplesBgColor: '#F4F6FF', // table rowHoverHighlight: '#ecf6fe', diff --git a/server/sonar-web/src/main/js/apps/coding-rules/components/RuleTabViewer.tsx b/server/sonar-web/src/main/js/apps/coding-rules/components/RuleTabViewer.tsx index 3422bce50d5..cebd8c1d4d8 100644 --- a/server/sonar-web/src/main/js/apps/coding-rules/components/RuleTabViewer.tsx +++ b/server/sonar-web/src/main/js/apps/coding-rules/components/RuleTabViewer.tsx @@ -108,10 +108,10 @@ export default class RuleViewerTabs extends React.PureComponent { { key: RuleTabKeys.MoreInfo, label: translate('coding_rules.description_section.title', RuleTabKeys.MoreInfo), - content: (ruleDetails.genericConcepts || + content: (ruleDetails.educationPrinciples || descriptionSectionsByKey[RuleDescriptionSections.RESOURCES]) && ( ) diff --git a/server/sonar-web/src/main/js/apps/issues/__tests__/IssueApp-it.tsx b/server/sonar-web/src/main/js/apps/issues/__tests__/IssueApp-it.tsx index 40e6a7092fb..8e0a0c3aaee 100644 --- a/server/sonar-web/src/main/js/apps/issues/__tests__/IssueApp-it.tsx +++ b/server/sonar-web/src/main/js/apps/issues/__tests__/IssueApp-it.tsx @@ -38,7 +38,7 @@ beforeEach(() => { handler = new IssuesServiceMock(); }); -it('should show generic concpet', async () => { +it('should show education principles', async () => { const user = userEvent.setup(); renderProjectIssuesApp('project/issues?issues=issue2&open=issue2&id=myproject'); await user.click(await screen.findByRole('button', { name: `issue.tabs.more_info` })); diff --git a/server/sonar-web/src/main/js/apps/issues/components/IssueTabViewer.tsx b/server/sonar-web/src/main/js/apps/issues/components/IssueTabViewer.tsx index cfd70022e55..005b6fdbe82 100644 --- a/server/sonar-web/src/main/js/apps/issues/components/IssueTabViewer.tsx +++ b/server/sonar-web/src/main/js/apps/issues/components/IssueTabViewer.tsx @@ -142,10 +142,10 @@ export default class IssueViewerTabs extends React.PureComponent { { key: IssueTabKeys.MoreInfo, label: translate('issue.tabs', IssueTabKeys.MoreInfo), - content: (ruleDetails.genericConcepts || + content: (ruleDetails.educationPrinciples || descriptionSectionsByKey[RuleDescriptionSections.RESOURCES]) && ( ) diff --git a/server/sonar-web/src/main/js/components/rules/MoreInfoRuleDescription.tsx b/server/sonar-web/src/main/js/components/rules/MoreInfoRuleDescription.tsx index 7e51817a4f4..d083f47d3a4 100644 --- a/server/sonar-web/src/main/js/components/rules/MoreInfoRuleDescription.tsx +++ b/server/sonar-web/src/main/js/components/rules/MoreInfoRuleDescription.tsx @@ -21,22 +21,25 @@ import * as React from 'react'; import { RuleDescriptionSection } from '../../apps/coding-rules/rule'; import { translate } from '../../helpers/l10n'; import { Dict } from '../../types/types'; -import DefenseInDepth from './genericConcepts/DefenseInDepth'; -import LeastTrustPrinciple from './genericConcepts/LeastTrustPrinciple'; +import DefenseInDepth from './educationPrinciples/DefenseInDepth'; +import LeastTrustPrinciple from './educationPrinciples/LeastTrustPrinciple'; import RuleDescription from './RuleDescription'; import './style.css'; interface Props { sections?: RuleDescriptionSection[]; - genericConcepts?: string[]; + educationPrinciples?: string[]; } -const GENERIC_CONCPET_MAP: Dict = { +const EDUCATION_PRINCIPLES_MAP: Dict = { defense_in_depth: DefenseInDepth, least_trust_principle: LeastTrustPrinciple }; -export default function MoreInfoRuleDescription({ sections = [], genericConcepts = [] }: Props) { +export default function MoreInfoRuleDescription({ + sections = [], + educationPrinciples = [] +}: Props) { return ( <> {sections.length > 0 && ( @@ -50,20 +53,20 @@ export default function MoreInfoRuleDescription({ sections = [], genericConcepts )} - {genericConcepts.length > 0 && ( + {educationPrinciples.length > 0 && ( <>

- {translate('coding_rules.more_info.generic_concept.title')} + {translate('coding_rules.more_info.education_principles.title')}

- {genericConcepts.map(key => { - const Concept = GENERIC_CONCPET_MAP[key]; + {educationPrinciples.map(key => { + const Concept = EDUCATION_PRINCIPLES_MAP[key]; if (Concept === undefined) { return null; } return ( -
+
); diff --git a/server/sonar-web/src/main/js/components/rules/educationPrinciples/DefenseInDepth.tsx b/server/sonar-web/src/main/js/components/rules/educationPrinciples/DefenseInDepth.tsx new file mode 100644 index 00000000000..e338d15b045 --- /dev/null +++ b/server/sonar-web/src/main/js/components/rules/educationPrinciples/DefenseInDepth.tsx @@ -0,0 +1,48 @@ +/* + * SonarQube + * Copyright (C) 2009-2022 SonarSource SA + * mailto:info AT sonarsource DOT com + * + * This program is free software; you can redistribute it and/or + * modify it under the terms of the GNU Lesser General Public + * License as published by the Free Software Foundation; either + * version 3 of the License, or (at your option) any later version. + * + * This program is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU + * Lesser General Public License for more details. + * + * You should have received a copy of the GNU Lesser General Public License + * along with this program; if not, write to the Free Software Foundation, + * Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA. + */ +import * as React from 'react'; + +export default function DefenseInDepth() { + return ( + <> +

Defense-In-Depth

+

+ Applications and infrastructure benefit greatly from relying on multiple security mechanisms + layered on top of each other. If one security mechanism fails, there is a high probability + that the subsequent layer of security will successfully defend against the attack. +

+ +

A non-exhaustive list of these code protection ramparts includes the following:

+
    +
  • Minimizing the attack surface of the code
    • +
  • Application of the principle of least privilege
    • +
  • Validation and sanitization of data
    • +
  • Encrypting incoming, outgoing, or stored data with secure cryptography
    • +
  • Ensuring that internal errors cannot disrupt the overall runtime
    • +
  • Separation of tasks and access to information
    • +
+ +

+ Note that these layers must be simple enough to use in an everyday workflow. Harsh security + measures can lead to users bypassing them. +

+ + ); +} diff --git a/server/sonar-web/src/main/js/components/rules/educationPrinciples/LeastTrustPrinciple.tsx b/server/sonar-web/src/main/js/components/rules/educationPrinciples/LeastTrustPrinciple.tsx new file mode 100644 index 00000000000..5c2f8fb132c --- /dev/null +++ b/server/sonar-web/src/main/js/components/rules/educationPrinciples/LeastTrustPrinciple.tsx @@ -0,0 +1,50 @@ +/* + * SonarQube + * Copyright (C) 2009-2022 SonarSource SA + * mailto:info AT sonarsource DOT com + * + * This program is free software; you can redistribute it and/or + * modify it under the terms of the GNU Lesser General Public + * License as published by the Free Software Foundation; either + * version 3 of the License, or (at your option) any later version. + * + * This program is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU + * Lesser General Public License for more details. + * + * You should have received a copy of the GNU Lesser General Public License + * along with this program; if not, write to the Free Software Foundation, + * Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA. + */ +import * as React from 'react'; + +export default function LeastTrustPrinciple() { + return ( + <> +

Least Trust Principle

+

Applications must treat all third-party data as attacker-controlled data.

+

+ First, the application must determine where the third-party data originates and treat that + data source as an attack vector. +

+ +

+ Then, the application must validate the attacker-controlled data against predefined formats, + such as: +

+
    +
  • Character sets
    • +
  • Sizes
    • +
  • Types
    • +
  • Or any strict schema
    • +
+ +

+ Next, the code must sanitize the data before performing mission-critical operations on the + attacker-controlled data. The code must know in which contexts the intercepted data is used + and act accordingly (section "How to fix it?"). +

+ + ); +} diff --git a/server/sonar-web/src/main/js/components/rules/genericConcepts/DefenseInDepth.tsx b/server/sonar-web/src/main/js/components/rules/genericConcepts/DefenseInDepth.tsx deleted file mode 100644 index e338d15b045..00000000000 --- a/server/sonar-web/src/main/js/components/rules/genericConcepts/DefenseInDepth.tsx +++ /dev/null @@ -1,48 +0,0 @@ -/* - * SonarQube - * Copyright (C) 2009-2022 SonarSource SA - * mailto:info AT sonarsource DOT com - * - * This program is free software; you can redistribute it and/or - * modify it under the terms of the GNU Lesser General Public - * License as published by the Free Software Foundation; either - * version 3 of the License, or (at your option) any later version. - * - * This program is distributed in the hope that it will be useful, - * but WITHOUT ANY WARRANTY; without even the implied warranty of - * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU - * Lesser General Public License for more details. - * - * You should have received a copy of the GNU Lesser General Public License - * along with this program; if not, write to the Free Software Foundation, - * Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA. - */ -import * as React from 'react'; - -export default function DefenseInDepth() { - return ( - <> -

Defense-In-Depth

-

- Applications and infrastructure benefit greatly from relying on multiple security mechanisms - layered on top of each other. If one security mechanism fails, there is a high probability - that the subsequent layer of security will successfully defend against the attack. -

- -

A non-exhaustive list of these code protection ramparts includes the following:

-
    -
  • Minimizing the attack surface of the code
    • -
  • Application of the principle of least privilege
    • -
  • Validation and sanitization of data
    • -
  • Encrypting incoming, outgoing, or stored data with secure cryptography
    • -
  • Ensuring that internal errors cannot disrupt the overall runtime
    • -
  • Separation of tasks and access to information
    • -
- -

- Note that these layers must be simple enough to use in an everyday workflow. Harsh security - measures can lead to users bypassing them. -

- - ); -} diff --git a/server/sonar-web/src/main/js/components/rules/genericConcepts/LeastTrustPrinciple.tsx b/server/sonar-web/src/main/js/components/rules/genericConcepts/LeastTrustPrinciple.tsx deleted file mode 100644 index 5c2f8fb132c..00000000000 --- a/server/sonar-web/src/main/js/components/rules/genericConcepts/LeastTrustPrinciple.tsx +++ /dev/null @@ -1,50 +0,0 @@ -/* - * SonarQube - * Copyright (C) 2009-2022 SonarSource SA - * mailto:info AT sonarsource DOT com - * - * This program is free software; you can redistribute it and/or - * modify it under the terms of the GNU Lesser General Public - * License as published by the Free Software Foundation; either - * version 3 of the License, or (at your option) any later version. - * - * This program is distributed in the hope that it will be useful, - * but WITHOUT ANY WARRANTY; without even the implied warranty of - * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU - * Lesser General Public License for more details. - * - * You should have received a copy of the GNU Lesser General Public License - * along with this program; if not, write to the Free Software Foundation, - * Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA. - */ -import * as React from 'react'; - -export default function LeastTrustPrinciple() { - return ( - <> -

Least Trust Principle

-

Applications must treat all third-party data as attacker-controlled data.

-

- First, the application must determine where the third-party data originates and treat that - data source as an attack vector. -

- -

- Then, the application must validate the attacker-controlled data against predefined formats, - such as: -

-
    -
  • Character sets
    • -
  • Sizes
    • -
  • Types
    • -
  • Or any strict schema
    • -
- -

- Next, the code must sanitize the data before performing mission-critical operations on the - attacker-controlled data. The code must know in which contexts the intercepted data is used - and act accordingly (section "How to fix it?"). -

- - ); -} diff --git a/server/sonar-web/src/main/js/components/rules/style.css b/server/sonar-web/src/main/js/components/rules/style.css index de8c16594e0..e0c36bff985 100644 --- a/server/sonar-web/src/main/js/components/rules/style.css +++ b/server/sonar-web/src/main/js/components/rules/style.css @@ -18,8 +18,8 @@ * Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA. */ -.generic-concept { - background-color: var(--genericConceptBgColor); +.education-principles { + background-color: var(--educationPrinciplesBgColor); border-radius: 2px; display: inline-block; margin-left: 16px; diff --git a/server/sonar-web/src/main/js/types/types.ts b/server/sonar-web/src/main/js/types/types.ts index ba2717c72de..0e0b576c97f 100644 --- a/server/sonar-web/src/main/js/types/types.ts +++ b/server/sonar-web/src/main/js/types/types.ts @@ -589,7 +589,7 @@ export interface RuleDetails extends Rule { defaultRemFnBaseEffort?: string; defaultRemFnType?: string; descriptionSections?: RuleDescriptionSection[]; - genericConcepts?: string[]; + educationPrinciples?: string[]; effortToFixDescription?: string; htmlDesc?: string; htmlNote?: string; -- cgit v1.2.3