mirror of
https://github.com/Radarr/Radarr
synced 2026-01-26 09:23:39 +01:00
4cf5f1d576
Backend: - Add regex timeout to prevent ReDoS (S6444): - SkyHookProxy.cs: ImdbUrlRegex, TmdbUrlRegex - PushsaferSettings.cs: HexColorRegex - Parser.cs: ImdbIdRegex Frontend: - Fix sorting without localeCompare (S2871): - MovieIndex.tsx, Collection.js, DiscoverMovie.js Config: - Add sonar-project.properties with documented false positive suppressions: - S8135: TMDB public API token (not a secret) - S6680: Directory depth iteration (naturally bounded) - S6674: NLog structured logging placeholder syntax - S4662: PostCSS mixin directives - S5145: Sanitized log data
101 lines
5.3 KiB
Properties
101 lines
5.3 KiB
Properties
# SonarCloud Configuration for Aletheia
|
|
|
|
# Project identification
|
|
sonar.projectKey=cheir-mneme_aletheia
|
|
sonar.organization=cheir-mneme
|
|
|
|
# Source configuration
|
|
sonar.sources=src,frontend/src
|
|
sonar.tests=src/**/*.Test,src/**/*.Tests
|
|
sonar.exclusions=**/node_modules/**,**/obj/**,**/bin/**,**/*.Designer.cs,**/Migrations/**
|
|
|
|
# Language-specific settings
|
|
sonar.cs.opencover.reportsPaths=**/coverage.opencover.xml
|
|
|
|
# =============================================================================
|
|
# FALSE POSITIVE SUPPRESSIONS
|
|
# =============================================================================
|
|
# These rules are suppressed with documented justifications. Each suppression
|
|
# has been reviewed and determined to be either a false positive or acceptable
|
|
# given the application's threat model.
|
|
|
|
# Multi-criteria suppression configuration
|
|
sonar.issue.ignore.multicriteria=e1,e2,e3,e4,e5
|
|
|
|
# -----------------------------------------------------------------------------
|
|
# E1: S8135 - JWT Token (secrets:S8135)
|
|
# Location: RadarrCloudRequestBuilder.cs
|
|
# Justification: This is the TMDB public read-only API token. It is intentionally
|
|
# hardcoded as it's a public API key shared across all Radarr/Aletheia instances.
|
|
# The token has read-only scope ("api_read") and is not a secret.
|
|
# Reference: https://developers.themoviedb.org/3/getting-started/authentication
|
|
# -----------------------------------------------------------------------------
|
|
sonar.issue.ignore.multicriteria.e1.ruleKey=secrets:S8135
|
|
sonar.issue.ignore.multicriteria.e1.resourceKey=**/RadarrCloudRequestBuilder.cs
|
|
|
|
# -----------------------------------------------------------------------------
|
|
# E2: S6680 - User-controlled loop bounds
|
|
# Location: PathExtensions.cs
|
|
# Justification: The loop iterates through parent directories (directoryInfo.Parent).
|
|
# The iteration count is bounded by filesystem directory depth, not user input length.
|
|
# Modern filesystems have practical limits (MAX_PATH ~260 chars on Windows, ~4096 on Linux).
|
|
# This is a false positive - directory traversal depth is naturally bounded.
|
|
# -----------------------------------------------------------------------------
|
|
sonar.issue.ignore.multicriteria.e2.ruleKey=roslyn.sonaranalyzer.security.cs:S6680
|
|
sonar.issue.ignore.multicriteria.e2.resourceKey=**/PathExtensions.cs
|
|
|
|
# -----------------------------------------------------------------------------
|
|
# E3: S6674 - Empty log message placeholder
|
|
# Location: CommandExecutor.cs
|
|
# Justification: The pattern _logger.Info("Starting {} threads", value) uses
|
|
# NLog/Serilog structured logging syntax where {} is the correct placeholder format.
|
|
# This is a false positive - the analyzer doesn't recognize this logging convention.
|
|
# -----------------------------------------------------------------------------
|
|
sonar.issue.ignore.multicriteria.e3.ruleKey=csharpsquid:S6674
|
|
sonar.issue.ignore.multicriteria.e3.resourceKey=**/CommandExecutor.cs
|
|
|
|
# -----------------------------------------------------------------------------
|
|
# E4: css:S4662 - Unknown CSS at-rules (@add-mixin, @define-mixin)
|
|
# Location: All CSS files
|
|
# Justification: The project uses PostCSS with postcss-mixins plugin which provides
|
|
# @define-mixin and @add-mixin directives. SonarCloud's CSS analyzer doesn't
|
|
# recognize PostCSS-specific syntax. This is a false positive.
|
|
# -----------------------------------------------------------------------------
|
|
sonar.issue.ignore.multicriteria.e4.ruleKey=css:S4662
|
|
sonar.issue.ignore.multicriteria.e4.resourceKey=**/*.css
|
|
|
|
# -----------------------------------------------------------------------------
|
|
# E5: S5145 - Log injection
|
|
# Location: Various files
|
|
# Justification: User-controlled data logged in these files is sanitized using
|
|
# the SanitizeForLog() extension method. SonarCloud doesn't recognize custom
|
|
# sanitization methods. The application logs are internal (not exposed to users).
|
|
# -----------------------------------------------------------------------------
|
|
sonar.issue.ignore.multicriteria.e5.ruleKey=roslyn.sonaranalyzer.security.cs:S5145
|
|
sonar.issue.ignore.multicriteria.e5.resourceKey=**/*.cs
|
|
|
|
# =============================================================================
|
|
# PATH TRAVERSAL NOTES (S2083, S6549) - NOT SUPPRESSED
|
|
# =============================================================================
|
|
# Path traversal issues (27 instances) are NOT suppressed because:
|
|
#
|
|
# 1. Aletheia is a media management application designed to access user-specified
|
|
# paths across the filesystem. This is core functionality, not a vulnerability.
|
|
#
|
|
# 2. The threat model considers:
|
|
# - The "user" is the system administrator who runs the application
|
|
# - API access requires authentication
|
|
# - Path settings are stored in the database by the admin
|
|
# - Validation occurs at the API boundary using IsValidPath()
|
|
#
|
|
# 3. While these findings are contextually acceptable, they remain visible in
|
|
# SonarCloud as a reminder to:
|
|
# - Ensure all API endpoints validate paths
|
|
# - Consider adding path containment checks in future versions
|
|
# - Document the trust model for security audits
|
|
#
|
|
# If you need to suppress these for a clean dashboard, uncomment the following:
|
|
# sonar.issue.ignore.multicriteria.e6.ruleKey=roslyn.sonaranalyzer.security.cs:S2083
|
|
# sonar.issue.ignore.multicriteria.e6.resourceKey=**/*.cs
|
|
# sonar.issue.ignore.multicriteria.e7.ruleKey=roslyn.sonaranalyzer.security.cs:S6549
|
|
# sonar.issue.ignore.multicriteria.e7.resourceKey=**/*.cs
|