Update rule metadata#1695
Conversation
SummaryThis PR updates metadata for 2 PHP rules (S2077, S4507) by replacing their tag classifications with a single "former-hotspot" tag. S2077 (SQL injection detection) loses "cwe", "bad-practice", "sql" tags. S4507 (debug logging detection) loses "cwe", "error-handling", "debug", "user-experience" tags. The sonarpedia.json sync timestamp is also updated. These are metadata-only changes with no impact to rule logic or severity. What reviewers should knowWhat changed: Two rule JSON files received tag updates, and the metadata sync timestamp was incremented. Files to review:
Context: This is an automated metadata update. Per the author's description, 245 rules were scanned but only these 2 required changes. The tag changes appear intentional (shifting from multi-tag classifications to the "former-hotspot" category), suggesting these rules may have been reclassified in SonarSource's rule taxonomy.
|
![sonar-review-alpha[bot]](https://avatars.githubusercontent.com/in/3025063?s=60&v=4){kind=small}
This comment was marked as outdated.
This comment was marked as outdated.
Sorry, something went wrong.
github-actions
Bot
force-pushed
the
bot/update-rule-metadata
branch
from
1960ca4 to
cf67144
Compare
There was a problem hiding this comment.
The change is straightforward metadata-only update — no code logic is touched. One thing worth confirming before approving: other rules in this repo that carry the former-hotspot tag retain their original categorical tags alongside it (e.g. ["cwe", "former-hotspot", "privacy"]), whereas S2077 and S4507 have their previous tags (cwe, bad-practice, sql, error-handling, debug, user-experience) completely removed and replaced with only ["former-hotspot"]. Please confirm this complete replacement is the intended output of the Rule API v2.20.0.5857 sync and not an inadvertent loss of categorisation metadata.
| "constantCost": "20min" | ||
| }, | ||
| "tags": [ |
There was a problem hiding this comment.
Other former-hotspot rules in this repo (e.g. S2092, S5042) keep their original categorical tags alongside former-hotspot — e.g. ["cwe", "former-hotspot", "privacy"]. Here all three prior tags (cwe, bad-practice, sql) are dropped entirely, leaving only ["former-hotspot"].
Is this complete replacement the intended output of the Rule API v2.20.0.5857 sync, or should cwe (at minimum) be retained? Removing cwe in particular affects how SonarQube maps this vulnerability rule to CWE entries in security dashboards.
- Mark as noise
This comment was marked as outdated.
This comment was marked as outdated.
Sorry, something went wrong.
github-actions
Bot
force-pushed
the
bot/update-rule-metadata
branch
from
cf67144 to
e9c0629
Compare
This comment was marked as outdated.
This comment was marked as outdated.
Sorry, something went wrong.
github-actions
Bot
force-pushed
the
bot/update-rule-metadata
branch
from
e9c0629 to
1de4fdf
Compare
This comment was marked as outdated.
This comment was marked as outdated.
Sorry, something went wrong.
There was a problem hiding this comment.
The prior question about S2077's complete tag replacement is still open, and S4507 has the identical issue. Every other former-hotspot rule in the repo — S2092, S5042, S5122, S2068, S5328, and more — retains at least "cwe" alongside "former-hotspot". Both rules in this PR strip all original tags entirely, leaving only ["former-hotspot"].
Note that CWE dashboard mapping is preserved in both rules via the securityStandards.CWE array, so security tooling is not technically broken. The open question is whether the complete tag replacement is an intentional behavioral change in Rule API v2.21.0.5887 (vs. v2.20.0.5857 used for the older former-hotspot rules), or whether "cwe" should be retained for consistency.
| "tags": [ | ||
| "cwe", | ||
| "error-handling", | ||
| "debug", | ||
| "user-experience" | ||
| "former-hotspot" | ||
| ], |
There was a problem hiding this comment.
Same complete tag replacement as S2077 — all original tags (cwe, error-handling, debug, user-experience) are dropped, leaving only former-hotspot. Every other pre-existing former-hotspot rule in the repo (e.g. S2092, S5042, S5122, S2068, S5328) keeps "cwe" alongside "former-hotspot".
If the Rule API v2.21 intentionally strips all original tags, this is fine — but please confirm, since it deviates from the established pattern.
| "tags": [ | |
| "cwe", | |
| "error-handling", | |
| "debug", | |
| "user-experience" | |
| "former-hotspot" | |
| ], | |
| "cwe", | |
| "former-hotspot" |
- Mark as noise
|
1 participant
Rule Metadata Update Summary
./sonarpedia.jsonRule API Version: 2.21.0.5887
This PR was automatically generated to update rule metadata across all supported languages.