OWASP SonarQube Project - Revision history

VinodA: /* Main */

2018-10-29T23:20:14Z

‎Main

VinodA: /* Main */

2018-10-29T23:19:21Z

‎Main

VinodA: /* Main */ LGPL v3

2018-10-28T21:10:52Z

‎Main: LGPL v3

VinodA at 14:45, 18 September 2018

2018-09-18T14:45:24Z

VinodA at 11:35, 18 August 2017

2017-08-18T11:35:06Z

VinodA at 21:52, 9 August 2017

2017-08-09T21:52:21Z

VinodA at 21:36, 9 August 2017

2017-08-09T21:36:48Z

VinodA at 22:05, 7 August 2017

2017-08-07T22:05:04Z

VinodA at 22:03, 7 August 2017

2017-08-07T22:03:50Z

VinodA at 22:02, 7 August 2017

2017-08-07T22:02:34Z

@@ Line 9: / Line 9: @@
 This project aims to enable more security functionalities to SonarQube and use it as an SAST. This project will use open source sonar plugins, rules, as well as other open source plugins especially FindSecBugs and its security rules. FindSecBugs enables the taint analysis.
-https://hub.docker.com/r/owasp/sonarqube/
+'''Docker:''' https://hub.docker.com/r/owasp/sonarqube/
-https://github.com/OWASP/sonarqube
+'''GitHub:''' https://github.com/OWASP/sonarqube
 ==Licensing==

← Older revision		Revision as of 23:19, 29 October 2018
Line 8:		Line 8:

	This project aims to enable more security functionalities to SonarQube and use it as an SAST. This project will use open source sonar plugins, rules, as well as other open source plugins especially FindSecBugs and its security rules. FindSecBugs enables the taint analysis.		This project aims to enable more security functionalities to SonarQube and use it as an SAST. This project will use open source sonar plugins, rules, as well as other open source plugins especially FindSecBugs and its security rules. FindSecBugs enables the taint analysis.
		+
		+	https://hub.docker.com/r/owasp/sonarqube/
		+
		+	https://github.com/OWASP/sonarqube

	==Licensing==		==Licensing==

@@ Line 4: / Line 4: @@
 {| style="padding: 0;margin:0;margin-top:10px;text-align:left;" |-
-| valign="top"  style="border-right: 1px dotted gray;padding-right:25px;" |
+| valign="top" style="border-right: 1px dotted gray;padding-right:25px;" |
 The OWASP SonarQube project aims to provide open source SAST using the existing open source solutions. SonarQube is one of the world’s most popular continuous code quality tools and it's actively used by many developers and companies.
@@ Line 11: / Line 10: @@
 ==Licensing==
-OWASP SonarQube Project is free to use. It is licensed under the [http://www.apache.org/licenses/LICENSE-2.0 Apache 2.0 license], so you can copy, distribute and transmit the work, and you can adapt it, and use it commercially, but all provided that you attribute the work and if you alter, transform, or build upon this work, you may distribute the resulting work only under the same or similar license to this one.
+OWASP SonarQube Project is free to use. It is licensed under the [http://www.gnu.org/licenses/lgpl-3.0.txt LGPL v3]
-| valign="top"  style="padding-left:25px;width:200px;" |
+| valign="top" style="padding-left:25px;width:200px;" |
 == Project Leader ==
@@ Line 43: / Line 41: @@
     {| width="200" cellpadding="2"
     |-
-    | align="center" valign="top" width="50%" rowspan="2"| [[File:New projects.png|100px|link=https://www.owasp.org/index.php/OWASP_Project_Stages#tab=Incubator_Projects]]
+    | rowspan="2" align="center" valign="top" width="50%" | [[File:New projects.png|100px|link=https://www.owasp.org/index.php/OWASP_Project_Stages#tab=Incubator_Projects]]
-    | align="center" valign="top" width="50%"| [[File:Owasp-builders-small.png|link=]]
+    | align="center" valign="top" width="50%" | [[File:Owasp-builders-small.png|link=]]
     |-
-    | align="center" valign="top" width="50%"| [[File:Owasp-defenders-small.png|link=]]
+    | align="center" valign="top" width="50%" | [[File:Owasp-defenders-small.png|link=]]
     |-
-    | colspan="2" align="center"  | [[File:Cc-button-y-sa-small.png|link=http://creativecommons.org/licenses/by-sa/3.0/]]
+    | colspan="2" align="center" | [[File:Cc-button-y-sa-small.png|link=http://creativecommons.org/licenses/by-sa/3.0/]]
     |-
-    | colspan="2" align="center"  | [[File:Project_Type_Files_CODE.jpg|link=]]
+    | colspan="2" align="center" | [[File:Project_Type_Files_CODE.jpg|link=]]
     |}
@@ Line 78: / Line 76: @@
 __NOTOC__ <headertabs />
-[[Category:OWASP Project]]  [[Category:OWASP_Builders]] [[Category:OWASP_Defenders]]  [[Category:OWASP_Document]]
+[[Category:OWASP Project]]

@@ Line 31: / Line 31: @@
 * [https://github.com/SonarSource/sonarqube SonarQube]
 * [https://github.com/find-sec-bugs/find-sec-bugs FindSecBugs]
-* [https://github.com/SonarSource/sonar-java Java]
+* [https://github.com/spotbugs/sonar-findbugs SonarFindBugs]
-* [https://github.com/SonarCommunity/sonar-javascript JavaScript]
+* [https://github.com/VinodAnandan/sonar-pitest SonarPitest]
-* [https://github.com/SonarCommunity/sonar-php PHP]
+* [https://github.com/SonarSource/sonar-java SonarJava]
@@ Line 67: / Line 69: @@
 {{:Projects/OWASP_SonarQube_Page}}
 __NOTOC__ <headertabs />
 [[Category:OWASP Project]]  [[Category:OWASP_Builders]] [[Category:OWASP_Defenders]]  [[Category:OWASP_Document]]

@@ Line 66: / Line 66: @@
 =Project About=
 __NOTOC__ <headertabs />
 [[Category:OWASP Project]]  [[Category:OWASP_Builders]] [[Category:OWASP_Defenders]]  [[Category:OWASP_Document]]

@@ Line 6: / Line 6: @@
 | valign="top"  style="border-right: 1px dotted gray;padding-right:25px;" |
-'''NOTE:''' If you are interested in contributing to open source static vulnerability analysis for Java, OWASP recommends you contribute to the [http://find-sec-bugs.github.io/ Find Security Bugs Project] run by Philippe Arteau. FindSecBugs is a FindBugs plugin. Philippe also runs the [https://github.com/SonarQubeCommunity/sonar-findbugs SonarQube FindBugs Plugin Project], which bundles both FindBugs and FindSecBugs into a plugin that can be used with SonarQube and in fact comes bundled with SonarQube by default. So, by contributing to the Find Security Bugs project, you are helping both the Find Bugs and SonarQube user communities at the same time.
+The OWASP SonarQube project aims to provide open source SAST using the existing open source solutions. SonarQube is one of the world’s most popular Continuous Code Quality tools and it's actively used by many developers and companies.
+This project aims to enable more security functionalities to SonarQube and use it as an SAST. This project will use open source sonar plugins, rules, as well as other open source plugins especially FindSecBugs and its security rules. FindSecBugs enables the taint analysis.
 ==Licensing==
@@ Line 33: / Line 28: @@
 == Repository ==
-Here are the repositories for the open source plugins related to this project. Most of them provide security-related rules:
+Here are the repositories for the open source plugins related to this project.
 * [https://github.com/SonarSource/sonar-java Java]
 * [https://github.com/SonarCommunity/sonar-javascript JavaScript]
 * [https://github.com/SonarCommunity/sonar-php PHP]
-* [https://github.com/SonarSource/sonar-dotnet-codeanalysis C#]

← Older revision		Revision as of 22:05, 7 August 2017
Line 10:		Line 10:

	----		----
−
−
−	~~The "News" is updated as soon as :~~
−	* A check specification is created
−	* A SonarQube analysers containing some stuff relating to this OWASP SonarQube project is released.

	==About SonarQube==		==About SonarQube==

← Older revision		Revision as of 22:02, 7 August 2017
Line 10:		Line 10:

	----		----
−
−	~~Historical Info:~~
−
−	~~....~~
−
−	~~Any contributor is highly welcome to participate to this community effort and participating is pretty easy:~~
−	* Each idea of a new potential valuable check should be sent to this [https://groups.google.com/forum/#!forum/sonarqube project mailing list].
−	* Then some discussions might start to challenge the idea
−	* At the end of discussions, a specification of the check is created in the following JIRA project by one of the leader of this project : [http://jira.sonarsource.com/issues/?jql=project%20%3D%20RSPEC%20AND%20issuetype%20%3D%20Specification%20AND%20labels%20%3D%20owasp-top10 http://jira.sonarsource.com/browse/RSPEC].
−	* To suggest a rule, send as much as possible from the following list:
−	** description - What should be done/not done, and why
−	** noncompliant code example in the language of your choice
−	** remediation action - This can be as simple as "Don't do X."