{"id":28495929,"url":"https://github.com/sonarsource/sonar-text","last_synced_at":"2025-07-02T15:31:29.157Z","repository":{"id":39707253,"uuid":"433085552","full_name":"SonarSource/sonar-text","owner":"SonarSource","description":"sonar-text","archived":false,"fork":false,"pushed_at":"2025-07-02T10:56:28.000Z","size":2922,"stargazers_count":9,"open_issues_count":0,"forks_count":3,"subscribers_count":12,"default_branch":"master","last_synced_at":"2025-07-02T11:49:01.164Z","etag":null,"topics":[],"latest_commit_sha":null,"homepage":null,"language":"Java","has_issues":false,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"other","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/SonarSource.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":"CONTRIBUTING.md","funding":null,"license":"LICENSE.txt","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":".github/CODEOWNERS","security":"SECURITY.md","support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null,"zenodo":null}},"created_at":"2021-11-29T14:59:04.000Z","updated_at":"2025-07-02T10:56:31.000Z","dependencies_parsed_at":"2023-10-02T09:21:02.790Z","dependency_job_id":"8b0a1b4a-d156-4016-ac96-c94b37f57053","html_url":"https://github.com/SonarSource/sonar-text","commit_stats":null,"previous_names":[],"tags_count":16,"template":false,"template_full_name":null,"purl":"pkg:github/SonarSource/sonar-text","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/SonarSource%2Fsonar-text","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/SonarSource%2Fsonar-text/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/SonarSource%2Fsonar-text/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/SonarSource%2Fsonar-text/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/SonarSource","download_url":"https://codeload.github.com/SonarSource/sonar-text/tar.gz/refs/heads/master","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/SonarSource%2Fsonar-text/sbom","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":263165779,"owners_count":23424006,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":[],"created_at":"2025-06-08T11:38:04.004Z","updated_at":"2025-07-02T15:31:29.125Z","avatar_url":"https://github.com/SonarSource.png","language":"Java","funding_links":[],"categories":[],"sub_categories":[],"readme":"# SonarText: detect BIDI Characters Vulnerabilities and Leaking Secrets\n\n[![Build Status](https://api.cirrus-ci.com/github/SonarSource/sonar-text.svg?branch=master)](https://cirrus-ci.com/github/SonarSource/sonar-text)\n[![Quality Gate Status](https://sonarcloud.io/api/project_badges/measure?project=org.sonarsource.text%3Atext\u0026metric=alert_status)](https://sonarcloud.io/summary/new_code?id=org.sonarsource.text%3Atext)\n[![Coverage](https://sonarcloud.io/api/project_badges/measure?project=org.sonarsource.text%3Atext\u0026metric=coverage)](https://sonarcloud.io/summary/new_code?id=org.sonarsource.text%3Atext)\n\nThis SonarSource project is a static code analyzer made to detect:\n\n* BIDI Characters Vulnerabilities\n* Hidden Text Vulnerabilities\n* Leaking Secrets/Tokens\n\nIt is a component of the\nSonar [Clean Code solution](https://www.sonarsource.com/solutions/clean-code/?utm_medium=referral\u0026utm_source=github\u0026utm_campaign=clean-code\u0026utm_content=sonar-text).\nIt is embedded in SonarLint, SonarQube, and SonarCloud.\nThis component helps you prevent the leakage of secrets even before you push them into your repository thanks to SonarLint.\n\n# Features\n\n* 140+ secret patterns supported and detected by [90+](https://rules.sonarsource.com/secrets/) rules\n* detection of [BIDI characters](https://rules.sonarsource.com/text/) that could lead to attacks\n* detection of Unicode hidden tag blocks that could lead to prompt injection\n* detection of secrets in all files indexed by Sonar products\n\n## Build\n\n*Prerequisite*\n\n- Java 17\n\n### Setup\nTo configure build dependencies, run the following command:\n\n```bash\ngit submodule update --init -- build-logic/common\n```\nTo always get the latest version of the build logic during git operations, set the following configuration:\n\n```\ngit config submodule.recurse true\n```\nFor more information see [README.md](https://github.com/SonarSource/cloud-native-gradle-modules/blob/master/README.md) of cloud-native-gradle-modules.\n\nSimple build skipping integration tests.\n\n### Build and run unit tests:\n```shell\n./gradlew build\n```\n\n### Build without running unit tests:\n\n```shell\n./gradlew build -x test\n```\n\n### Fix code formatting issues\n\nDuring the Gradle build, a spotless formatting check is executed.\nThis check can also be triggered manually with `./gradlew spotlessCheck`.\nIt checks if the code is correctly formatted using standard Sonar rules.\nIf your build failed, you can fix the formatting just by running:\n\n```shell\n./gradlew spotlessApply\n```\n\n### Update rule description\n\nUpdate all rule descriptions.\n\n```shell\n./gradlew ruleApiUpdate\n```\n\nThere are also tasks: `ruleApiUpdateSecrets`, `ruleApiUpdateText` and `ruleApiUpdateDeveloperSecrets`, `ruleApiUpdateEnterpriseSecrets` `ruleApiUpdateEnterpriseText` \nfor updating Secrets, Text, Developer Secrets and Enterprise Text and Secrets rule descriptions.\n\n### Generate new rule description\n\nTo fetch static files for a rule SXXXX from RSPEC, execute the one of following commands:\n\n```shell\n./gradlew ruleApiGenerateRuleSecrets -Prule=SXXXX\n./gradlew ruleApiGenerateRuleText -Prule=SXXXX\n./gradlew ruleApiGenerateRuleDeveloperSecrets -Prule=SXXXX\n./gradlew ruleApiGenerateRuleEnterpriseSecrets -Prule=SXXXX\n./gradlew ruleApiGenerateRuleEnterpriseText -Prule=SXXXX\n```\n\n### Generate files to include new secrets\n\nAfter the change, addition or removal of secret specifications, this script can be run to generate the Java classes that are needed\nfor the inclusion or deletion of these secrets and to update static RSPEC files.\n\nAs we use the enforcer plugin to define the file size of the build, this can lead to test failures after adding new secret specifications.\nThe `\u003cminsize\u003e` and `\u003cmaxsize\u003e` can be changed in `sonar-text-plugin/build.gradle.kts` (search for `enforceJarSize`).\n\nIf the static RSPEC files are currently not merged on master, it is possible to specify a branch to fetch the files from.\nThis can be done by adding the name of the branch as an argument to the script, like shown below.\nUse this feature with caution, due to a limitation of the underlying library in the rule api, not all branch names are supported, and it's\nnot clear which ones do work.\n\n```shell\n./secretSpecificationInclusionGenerator.sh\n./secretSpecificationInclusionGenerator.sh branchName\n```\n\n### Verify Regexes\n\nThe Regular Expressions provided in the secrets specification should be verified to avoid catastrophic backtracking and other issues.\nCurrently, the Sonar products don't scan YAML files for Regex problems.\nTo avoid potential problems the [SecretsRegexTest](sonar-text-plugin/src/test/java/org/sonar/plugins/secrets/utils/SecretsRegexTest.java)\nwas prepared for validating regexes.\nThere is a simple way to validate all specification files and a single one.\nCurrently, tests are disabled, as the issues need to be reviewed first.\n\nThere is also a way of running this check from the command line.\n\n```shell\n./gradlew --rerun-tasks :sonar-text-plugin:test --console plain --tests SecretsRegexTest.shouldValidateSingleFile -Dfilename=google-oauth2.yaml\n```\n\n# License\n\nCopyright 2021-2025 SonarSource.\n\nSonarQube analyzers released after November 29, 2024, including patch fixes for prior versions, \nare published under the [Sonar Source-Available License Version 1 (SSALv1)](LICENSE.txt).\n\nSee individual files for details that specify the license applicable to each file. \nFiles subject to the SSALv1 will be noted in their headers.\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fsonarsource%2Fsonar-text","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fsonarsource%2Fsonar-text","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fsonarsource%2Fsonar-text/lists"}