SONARJAVA-6494 Implement new rule S8914 [TEST]#5709
Conversation
Detects when security annotations (@authenticated, @RolesAllowed) are placed on individual WebSocket callback methods instead of on the WebSocket endpoint class itself. According to Quarkus documentation, only class-level security annotations secure the HTTP upgrade handshake.
![gitar-bot[bot]](https://avatars.githubusercontent.com/in/827041?s=60&v=4){kind=small}
| <p>=== Documentation | ||
|
|
||
| * Quarkus WebSockets Next - Security - https://quarkus.io/guides/websockets-next-reference#websocket-next-security[Official Quarkus documentation on securing WebSocket endpoints, explaining HTTP upgrade security] | ||
|
|
||
| * Quarkus WebSockets Next - Secure HTTP Upgrade - https://quarkus.io/guides/websockets-next-reference#secure-http-upgrade[Detailed guidance on securing the HTTP upgrade handshake with security annotations] | ||
|
|
||
|
|
||
| === What is the potential impact? | ||
|
|
||
| ==== Unauthorized Access | ||
|
|
||
| Unauthorized clients can establish WebSocket connections to endpoints that lack proper authentication during the HTTP upgrade handshake. While individual message-handling callback methods may implement their own authorization checks, the connection remains open, potentially allowing: | ||
|
|
||
| * Access to sensitive real-time data streams | ||
| * Information disclosure through connection metadata |
There was a problem hiding this comment.
⚠️ Quality: Rule description S8914.html is AsciiDoc, not HTML
S8914.html is the user-facing rule description rendered in SonarQube/IDE. Unlike every other rule file in this directory (e.g. S8700.html, S8714.html) which use proper HTML tags (<h2>, <p>, <ul>, <li>, <pre>), this file dumps raw AsciiDoc markup wrapped in a single <p> tag:
- Headings use
===/====/==instead of<h2>/<h3>. - Bullet lists use
*instead of<ul><li>. - Inline emphasis uses
*...*/**...**instead of<strong>/<em>. - Links use AsciiDoc
url[text]syntax instead of<a href>.
None of this will render correctly; users will see literal === and * characters. The section ordering is also jumbled: "Documentation", "What is the potential impact?", and "Standards" appear before "Why is this an issue?", whereas the standard structure is "Why is this an issue?" → "What is the potential impact?" → "How to fix it?" → "Resources". Convert the content to valid HTML matching the convention used by neighboring rule files, and reorder the sections. The file also lacks a trailing newline.
Was this helpful? React with 👍 / 👎
| private static final List<String> SECURITY_ANNOTATIONS = List.of( | ||
| AUTHENTICATED_ANNOTATION, | ||
| ROLES_ALLOWED_ANNOTATION | ||
| ); |
There was a problem hiding this comment.
💡 Edge Case: Check ignores @DenyAll/@permitAll security annotations
SECURITY_ANNOTATIONS only contains io.quarkus.security.Authenticated and jakarta.annotation.security.RolesAllowed. Quarkus/Jakarta also recognize jakarta.annotation.security.PermitAll and jakarta.annotation.security.DenyAll as access-control annotations on WebSocket callbacks. If the intent is to flag any security annotation placed on a callback method instead of the endpoint class, these are missed (false negatives). If the omission is intentional (these two convey access decisions differently), consider documenting the rationale. Verify the intended annotation set against the RSPEC and add the missing annotations to SECURITY_ANNOTATIONS if appropriate.
Was this helpful? React with 👍 / 👎
CI failed: The 'Autoscan Tests' job failed because the new rule S8914 caused an unexpected change in scan output, leading to a mismatch with existing regression test expectations.Overview1 test failure occurred in the 'Autoscan Tests' job due to a discrepancy between the expected and actual autoscan output. The build successfully compiled, but the regression testing infrastructure detected a diff resulting from the implementation of rule S8914. FailuresAutoscan Regression Mismatch (confidence: high)
Summary
Code Review
|
| Auto-apply | Compact | Unblock |
|
|
|
Was this helpful? React with 👍 / 👎 | Gitar
romainbrenguier
changed the title
romainbrenguier
changed the title
|
1 participant
Do not review or merge. This is a vulnerability. This was just for testing the nigel new rule workflow.
Summary by Gitar
S8914to detect security annotations (@Authenticated,@RolesAllowed) placed onQuarkusWebSocket callback methods.QuarkusWebSocketSecurityAnnotationCheckTestand corresponding sample code to verify rule compliance.pom.xmlto includequarkus-websockets-nextandquarkus-securitydependencies for test sources.S8914in both theSonar wayandSonar agentic AIprofiles.This will update automatically on new commits.