From 20503891c383d9f0a16ab43c7c24a24690760b80 Mon Sep 17 00:00:00 2001 From: Tomasz Tylenda Date: Fri, 13 Feb 2026 16:29:26 +0100 Subject: [PATCH] Update rule metadata --- .../org/sonar/l10n/java/rules/java/S2068.html | 41 +++++++------------ .../org/sonar/l10n/java/rules/java/S2068.json | 8 ++-- .../org/sonar/l10n/java/rules/java/S6418.html | 40 ++++++------------ .../org/sonar/l10n/java/rules/java/S6418.json | 8 ++-- sonarpedia.json | 4 +- 5 files changed, 38 insertions(+), 63 deletions(-) diff --git a/sonar-java-plugin/src/main/resources/org/sonar/l10n/java/rules/java/S2068.html b/sonar-java-plugin/src/main/resources/org/sonar/l10n/java/rules/java/S2068.html index bf26c4129ae..9b790fd47c5 100644 --- a/sonar-java-plugin/src/main/resources/org/sonar/l10n/java/rules/java/S2068.html +++ b/sonar-java-plugin/src/main/resources/org/sonar/l10n/java/rules/java/S2068.html @@ -1,42 +1,32 @@ -

Because it is easy to extract strings from an application source code or binary, passwords should not be hard-coded. This is particularly true for -applications that are distributed or that are open-source.

+

Why is this an issue?

+

Hard-coding credentials in source code or binaries makes it easy for attackers to extract sensitive information, especially in distributed or +open-source applications. This practice exposes your application to significant security risks.

+

This rule flags instances of hard-coded credentials used in database and LDAP connections. It looks for hard-coded credentials in connection +strings, and for variable names that match any of the patterns from the provided list.

In the past, it has led to the following vulnerabilities:

-

Passwords should be stored outside of the code in a configuration file, a database, or a password management service.

-

This rule flags instances of hard-coded passwords used in database and LDAP connections. It looks for hard-coded passwords in connection strings, -and for variable names that match any of the patterns from the provided list.

-

Ask Yourself Whether

- -

There would be a risk if you answered yes to any of those questions.

-

Recommended Secure Coding Practices

- -

Sensitive Code Example

-
+
How to fix it

+
Credentials should be stored in a configuration file that is not committed to the code repository, in a database, or managed by your cloud
+provider’s secrets management service. If a password is exposed in the source code, it must be changed immediately.

+
Code Examples

+
Noncompliant code example

+
 String username = "steve";
 String password = "blue";
 Connection conn = DriverManager.getConnection("jdbc:mysql://localhost/test?" +
-                  "user=" + username + "&password=" + password); // Sensitive
+                  "user=" + username + "&password=" + password); // Noncompliant
 

-
Compliant Solution

-
+
Compliant solution

+
 String username = getEncryptedUser();
 String password = getEncryptedPassword();
 Connection conn = DriverManager.getConnection("jdbc:mysql://localhost/test?" +
                   "user=" + username + "&password=" + password);
 

-
See

+
Resources

 
 
diff --git a/sonar-java-plugin/src/main/resources/org/sonar/l10n/java/rules/java/S2068.json b/sonar-java-plugin/src/main/resources/org/sonar/l10n/java/rules/java/S2068.json
index 3bd134f5666..407f07813da 100644
--- a/sonar-java-plugin/src/main/resources/org/sonar/l10n/java/rules/java/S2068.json
+++ b/sonar-java-plugin/src/main/resources/org/sonar/l10n/java/rules/java/S2068.json
@@ -1,6 +1,6 @@
 {
-  "title": "Hard-coded passwords are security-sensitive",
-  "type": "SECURITY_HOTSPOT",
+  "title": "Credentials should not be hard-coded",
+  "type": "VULNERABILITY",
   "code": {
     "impacts": {
       "SECURITY": "BLOCKER"
@@ -12,6 +12,7 @@
     "func": "Constant\/Issue",
     "constantCost": "30min"
   },
+  "quickfix": "infeasible",
   "tags": [
     "cwe",
     "cert"
@@ -45,6 +46,5 @@
       "3.5.2",
       "6.4.1"
     ]
-  },
-  "quickfix": "unknown"
+  }
 }
diff --git a/sonar-java-plugin/src/main/resources/org/sonar/l10n/java/rules/java/S6418.html b/sonar-java-plugin/src/main/resources/org/sonar/l10n/java/rules/java/S6418.html
index 3cb3f018e3c..c89c5351cc3 100644
--- a/sonar-java-plugin/src/main/resources/org/sonar/l10n/java/rules/java/S6418.html
+++ b/sonar-java-plugin/src/main/resources/org/sonar/l10n/java/rules/java/S6418.html
@@ -1,38 +1,24 @@
-
Because it is easy to extract strings from an application source code or binary, secrets should not be hard-coded. This is particularly true for
-applications that are distributed or that are open-source.

-
In the past, it has led to the following vulnerabilities:

-
-
Secrets should be stored outside of the source code in a configuration file or a management service for secrets.

+
Why is this an issue?

+
Hard-coding secrets in source code or binaries makes it easy for attackers to extract sensitive information, especially in distributed or
+open-source applications. This practice exposes credentials and tokens, increasing the risk of unauthorized access and data breaches.

 
This rule detects variables/fields having a name matching a list of words (secret, token, credential, auth, api[_.-]?key) being assigned a
 pseudorandom hard-coded value. The pseudorandomness of the hard-coded value is based on its entropy and the probability to be human-readable. The
 randomness sensibility can be adjusted if needed. Lower values will detect less random values, raising potentially more false positives.

-
Ask Yourself Whether

-
    
-  
  •  The secret allows access to a sensitive component like a database, a file storage, an API, or a service. 
    • 
-  
  •  The secret is used in a production environment. 
    • 
-  
  •  Application re-distribution is required before updating the secret. 
    • 
-

-
There would be a risk if you answered yes to any of those questions.

-
Recommended Secure Coding Practices

-
    
-  
  •  Store the secret in a configuration file that is not pushed to the code repository. 
    • 
-  
  •  Use your cloud provider’s service for managing secrets. 
    • 
-  
  •  If a secret has been disclosed through the source code: revoke it and create a new one. 
    • 
-

-
Sensitive Code Example

-
+
How to fix it

+
Secrets should be stored in a configuration file that is not committed to the code repository, in a database, or managed by your cloud provider’s
+secrets management service. If a secret is exposed in the source code, it must be rotated immediately.

+
Code Examples

+
Noncompliant code example

+
 private static final String MY_SECRET = "47828a8dd77ee1eb9dde2d5e93cb221ce8c32b37";
 
 public static void main(String[] args) {
   MyClass.callMyService(MY_SECRET);
 }
 

-
Compliant Solution

+
Compliant solution

 
Using AWS Secrets Manager:

-
+
 import software.amazon.awssdk.services.secretsmanager.model.GetSecretValueRequest;
 import software.amazon.awssdk.services.secretsmanager.model.GetSecretValueResponse;
 
@@ -80,15 +66,15 @@ 
Compliant Solution

   MyClass.callMyService(secret);
 }
 

-
See

+
Resources

 
 
diff --git a/sonar-java-plugin/src/main/resources/org/sonar/l10n/java/rules/java/S6418.json b/sonar-java-plugin/src/main/resources/org/sonar/l10n/java/rules/java/S6418.json
index af037c90442..99c7c5b6f3f 100644
--- a/sonar-java-plugin/src/main/resources/org/sonar/l10n/java/rules/java/S6418.json
+++ b/sonar-java-plugin/src/main/resources/org/sonar/l10n/java/rules/java/S6418.json
@@ -1,6 +1,6 @@
 {
-  "title": "Hard-coded secrets are security-sensitive",
-  "type": "SECURITY_HOTSPOT",
+  "title": "Secrets should not be hard-coded",
+  "type": "VULNERABILITY",
   "code": {
     "impacts": {
       "SECURITY": "BLOCKER"
@@ -12,6 +12,7 @@
     "func": "Constant\/Issue",
     "constantCost": "30min"
   },
+  "quickfix": "infeasible",
   "tags": [
     "cwe",
     "cert"
@@ -47,6 +48,5 @@
       "3.5.2",
       "6.4.1"
     ]
-  },
-  "quickfix": "unknown"
+  }
 }
diff --git a/sonarpedia.json b/sonarpedia.json
index 323b874aace..18919fea5cd 100644
--- a/sonarpedia.json
+++ b/sonarpedia.json
@@ -3,9 +3,9 @@
   "languages": [
     "JAVA"
   ],
-  "latest-update": "2026-02-10T09:09:57.194517400Z",
+  "latest-update": "2026-02-13T15:26:51.447713Z",
   "options": {
     "no-language-in-filenames": true,
     "preserve-filenames": false
   }
-}
+}
\ No newline at end of file