sonarqube-remediation

SonarQube SAST Remediation

Overview

Fix SonarQube SAST alerts by applying rule-specific and CWE-based code transforms. Each fix pattern targets the root cause identified by SonarQube's analysis.

Fix Patterns by SonarQube Rule

SQL Injection (S2077 — Java, S3649 — Python)

• CWE: CWE-89
• Detection: String concatenation in SQL queries without parameterization
• Fix Pattern:
  • Java: Replace Statement with PreparedStatement

    // Bad
    Statement stmt = connection.createStatement();
    stmt.executeQuery("SELECT * FROM users WHERE id = " + userId);
    
    // Good
    PreparedStatement pstmt = connection.prepareStatement("SELECT * FROM users WHERE id = ?");
    pstmt.setInt(1, userId);
    pstmt.executeQuery();
    

  • Python: Use parameterized queries with %s

    # Bad
    cursor.execute(f"SELECT * FROM users WHERE id = {user_id}")
    
    # Good
    cursor.execute("SELECT * FROM users WHERE id = %s", (user_id,))
    

Cross-Site Scripting (S5131)

• CWE: CWE-79
• Detection: User input rendered to HTML/JavaScript without encoding
• Fix Pattern:
  • Apply context-appropriate encoding:
    • HTML context: <, >, &, ", '
    • JavaScript context: Escape quotes, newlines; prefer JSON.stringify
    • URL context: URL-encode special characters
  • Use framework auto-escaping (React JSX auto-escapes, Jinja2 autoescape, etc.)
  • Example (JavaScript):

    // Bad
    const html = `<div>${userInput}</div>`;
    
    // Good (React)
    const html = <div>{userInput}</div>;  // Auto-escaped
    
    // Good (vanilla)
    const div = document.createElement('div');
    div.textContent = userInput;
    

Weak Cryptography (S4426, S5547)

• CWE: CWE-327 (Broken or Risky Cryptographic Algorithm)
• Detection: Use of MD5, SHA1, DES, or weak random number generation
• Fix Pattern:
  • Password hashing: Use bcrypt, scrypt, or argon2 (never MD5/SHA1)
  • Encryption: Use AES-256-GCM (never AES-ECB)
  • Hashing: Use SHA-256 or better (never MD5/SHA1)
  • Random number generation: Use SecureRandom (Java), secrets (Python), crypto.randomBytes (Node.js)
  • Example (Java):

    // Bad
    MessageDigest md = MessageDigest.getInstance("MD5");
    
    // Good
    MessageDigest md = MessageDigest.getInstance("SHA-256");
    
    // Password Hashing (Good)
    BCryptPasswordEncoder encoder = new BCryptPasswordEncoder();
    String hash = encoder.encode(password);
    

Hardcoded Credentials (S6437)

• CWE: CWE-798 (Use of Hard-Coded Credentials)
• Detection: API keys, passwords, tokens in source code
• Fix Pattern:
  • Remove from source code immediately
  • Move to environment variables: os.environ['API_KEY'] (Python), process.env.API_KEY (Node.js)
  • Use secrets manager: AWS Secrets Manager, Azure Key Vault, HashiCorp Vault
  • Example:

    # Bad
    API_KEY = "sk-1234567890abcdef"
    
    # Good
    API_KEY = os.environ.get('API_KEY')
    if not API_KEY:
        raise ValueError("API_KEY environment variable not set")
    

Process

1. Fetch details: Get SonarQube alert: rule ID, CWE, file path, line number, message
2. Map to fix pattern: Find the rule ID in the patterns above
3. Apply fix: Implement the code change in the affected file
4. Write test: Create a security regression test validating the fix (e.g., test that parameterized query no longer has SQL injection)
5. Verify resolution: Re-run SonarQube scan or transition issue via API

CWE Cross-Reference

Rule	CWE	Category
S2077, S3649	CWE-89	SQL Injection
S5131	CWE-79	Cross-Site Scripting
S4426, S5547	CWE-327	Weak Cryptography
S6437	CWE-798	Hard-Coded Credentials