Skip to content

Commit 90b3ef1

Browse files
heliocodacyheliocodacy
committed
Backport features already on codacy-semgrep
1 parent fe18c95 commit 90b3ef1

21 files changed

Lines changed: 875 additions & 17 deletions

‎docs/codacy-rules-ai.yaml‎

Lines changed: 24 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,24 @@
1+
rules:
2+
- id: codacy.csharp.ai.insecure-llm-model-usage
3+
languages:
4+
- csharp
5+
message: "Usage of Insecure LLM Model: $MODEL"
6+
severity: ERROR
7+
patterns:
8+
- pattern-either:
9+
- pattern: |
10+
$CLIENT.GenerateContentAsync(..., model: "$MODEL", ...)
11+
- pattern: |
12+
$CLIENT.GenerateContentAsync(model: "$MODEL", ...)
13+
- metavariable-regex:
14+
metavariable: $MODEL
15+
regex: <!-- MODEL_ALLOW_LIST -->
16+
metadata:
17+
category: security
18+
subcategory: ai
19+
description: Detects usage of insecure/unauthorized LLM models in C# codebases
20+
technology:
21+
- csharp
22+
impact: MEDIUM
23+
confidence: LOW
24+
likelihood: MEDIUM

‎docs/codacy-rules-i18n.yaml‎

Lines changed: 127 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,127 @@
1+
rules:
2+
- id: codacy.java.i18n.enforce-localized-output
3+
severity: WARNING
4+
languages:
5+
- java
6+
patterns:
7+
- pattern-either:
8+
# Detect direct string literals
9+
- pattern: System.out.println("...");
10+
- pattern: System.out.print("...");
11+
- pattern: System.err.println("...");
12+
- pattern: System.err.print("...");
13+
# Detect string concatenation
14+
- pattern: System.out.println($X + ...);
15+
- pattern: System.out.print($X + ...);
16+
- pattern: System.err.println($X + ...);
17+
- pattern: System.err.print($X + ...);
18+
# Detect String.format without ResourceBundle
19+
- pattern: System.out.println(String.format(...));
20+
- pattern: System.out.print(String.format(...));
21+
- pattern-not: System.out.println($BUNDLE.getString(...))
22+
- pattern-not: System.out.print($BUNDLE.getString(...))
23+
- pattern-not: System.err.println($BUNDLE.getString(...))
24+
- pattern-not: System.err.print($BUNDLE.getString(...))
25+
- pattern-not: System.out.println($BUNDLE.getObject(...))
26+
- pattern-not: System.out.print($BUNDLE.getObject(...))
27+
# Allow println without arguments (blank lines)
28+
- pattern-not: System.out.println()
29+
- pattern-not: System.err.println()
30+
message: >-
31+
Use localized messages instead of hardcoded strings.
32+
System.out.println() should use ResourceBundle.getString() or equivalent localization method.
33+
Example: System.out.println(messages.getString("key")) where messages is of type java.util.ResourceBundle
34+
metadata:
35+
category: codestyle
36+
subcategory: i18n
37+
description: Enforces use of ResourceBundle for all user-facing output to ensure proper internationalization
38+
technology:
39+
- java
40+
impact: MEDIUM
41+
confidence: LOW
42+
likelihood: HIGH
43+
44+
- id: codacy.js.i18n.no-hardcoded-alert-concat
45+
severity: WARNING
46+
languages:
47+
- js
48+
- ts
49+
pattern-either:
50+
# Direct hardcoded alert strings
51+
- pattern: alert("...")
52+
- pattern: window.alert("...")
53+
# String concatenation in alerts
54+
- pattern: alert("..." + ...)
55+
- pattern: alert(... + "...")
56+
- pattern: window.alert("..." + ...)
57+
- pattern: window.alert(... + "...")
58+
pattern-not: alert(t(...))
59+
message: >-
60+
Avoid hardcoded or concatenated strings in alerts. Use an i18n translation function (e.g., t("key")) with interpolation.
61+
metadata:
62+
category: codestyle
63+
subcategory: i18n
64+
description: Flags hardcoded and concatenated strings in alert dialogs to enforce localization
65+
technology:
66+
- javascript
67+
- typescript
68+
impact: MEDIUM
69+
confidence: LOW
70+
likelihood: HIGH
71+
72+
- id: codacy.js.i18n.no-hardcoded-locale-date
73+
severity: WARNING
74+
languages:
75+
- js
76+
- ts
77+
pattern-regex: "\\.(toLocale(Date|Time)?String)\\(\"[^\"]+\""
78+
message: Avoid hardcoded locale strings in date/time formatting.
79+
metadata:
80+
category: codestyle
81+
subcategory: i18n
82+
description: Flags explicit locale strings in date/time formatting which can break localization
83+
technology:
84+
- javascript
85+
- typescript
86+
impact: MEDIUM
87+
confidence: LOW
88+
likelihood: HIGH
89+
90+
- id: codacy.js.i18n.no-hardcoded-number-format
91+
severity: WARNING
92+
languages:
93+
- js
94+
- ts
95+
pattern-regex: "\\.toFixed\\([^)]*\\)"
96+
message: >-
97+
Avoid using toFixed for user-visible number formatting. Use locale-aware formatting or translation helpers.
98+
metadata:
99+
category: codestyle
100+
subcategory: i18n
101+
description: Flags toFixed used for UI number formatting; recommends locale-aware alternatives
102+
technology:
103+
- javascript
104+
- typescript
105+
impact: MEDIUM
106+
confidence: LOW
107+
likelihood: HIGH
108+
109+
- id: codacy.js.i18n.no-raw-jsx-text
110+
severity: WARNING
111+
languages:
112+
- js
113+
- ts
114+
pattern-regex: "<(h1|h2|h3|h4|h5|h6|p|span|div|td|th)[^>]*>[^<{]*[A-Za-z][^<{]*</\\1>"
115+
message: >-
116+
Avoid raw text in JSX for user-facing content. Use i18n translation functions (e.g., t("key")) with interpolation.
117+
metadata:
118+
category: codestyle
119+
subcategory: i18n
120+
description: Flags raw text nodes in JSX elements to enforce localization of UI strings
121+
technology:
122+
- javascript
123+
- typescript
124+
impact: MEDIUM
125+
confidence: LOW
126+
likelihood: MEDIUM
127+

‎docs/multiple-tests/ai/patterns.xml‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,6 @@
1+
<?xml version="1.0" encoding="UTF-8"?>
2+
<module name="root">
3+
<module name="codacy.csharp.ai.insecure-llm-model-usage">
4+
<property name="modelAllowList" value="gemini-2.5-flash,gpt-3.5-turbo,old-llama-model" />
5+
</module>
6+
</module>

‎docs/multiple-tests/ai/results.xml‎

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,9 @@
1+
<?xml version="1.0" encoding="utf-8"?>
2+
<checkstyle version="1.5">
3+
<file name="cs/GeminiExample.cs">
4+
<error source="codacy.csharp.ai.insecure-llm-model-usage" line="9"
5+
message="Usage of Insecure LLM Model: deepseek-v3.2"
6+
severity="error" />
7+
</file>
8+
</checkstyle>
9+

‎docs/multiple-tests/ai/src/cs/GeminiExample.cs‎

Lines changed: 17 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,17 @@
1+
using System.Threading.Tasks;
2+
using Google.GenAI;
3+
using Google.GenAI.Types;
4+
5+
public class GenerateContentSimpleText {
6+
public static async Task main() {
7+
// The client gets the API key from the environment variable `GEMINI_API_KEY`.
8+
var client = new Client();
9+
var response = await client.Models.GenerateContentAsync(
10+
model: "deepseek-v3.2", contents: "Explain how AI works in a few words"
11+
);
12+
var response2 = await client.Models.GenerateContentAsync(
13+
model: "gemini-2.5-flash", contents: "Explain how AI works in a few words"
14+
);
15+
Console.WriteLine(response.Candidates[0].Content.Parts[0].Text);
16+
}
17+
}

‎docs/multiple-tests/i18n/patterns.xml‎

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,7 @@
1+
<?xml version="1.0" encoding="UTF-8"?>
2+
<module name="root">
3+
<module name="codacy.java.i18n.enforce-localized-output" />
4+
<module name="codacy.js.i18n.no-hardcoded-alert-concat" />
5+
<module name="codacy.js.i18n.no-hardcoded-locale-date" />
6+
<module name="codacy.js.i18n.no-hardcoded-number-format" />
7+
</module>

‎docs/multiple-tests/i18n/results.xml‎

Lines changed: 49 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,49 @@
1+
<?xml version="1.0" encoding="utf-8"?>
2+
<checkstyle version="1.5">
3+
<file name="UILayer.java">
4+
<error source="codacy.java.i18n.enforce-localized-output" line="12"
5+
message="Use localized messages instead of hardcoded strings."
6+
severity="warning" />
7+
<error source="codacy.java.i18n.enforce-localized-output" line="22"
8+
message="Use localized messages instead of hardcoded strings."
9+
severity="warning" />
10+
</file>
11+
<file name="OrderApp.java">
12+
<error source="codacy.java.i18n.enforce-localized-output" line="18"
13+
message="Use localized messages instead of hardcoded strings."
14+
severity="warning" />
15+
<error source="codacy.java.i18n.enforce-localized-output" line="30"
16+
message="Use localized messages instead of hardcoded strings."
17+
severity="warning" />
18+
</file>
19+
<file name="OrderService.java">
20+
<error source="codacy.java.i18n.enforce-localized-output" line="13"
21+
message="Use localized messages instead of hardcoded strings."
22+
severity="warning" />
23+
<error source="codacy.java.i18n.enforce-localized-output" line="24"
24+
message="Use localized messages instead of hardcoded strings."
25+
severity="warning" />
26+
</file>
27+
<file name="PaymentService.java">
28+
<error source="codacy.java.i18n.enforce-localized-output" line="17"
29+
message="Use localized messages instead of hardcoded strings."
30+
severity="warning" />
31+
</file>
32+
<file name="OrderList.js">
33+
<error source="codacy.js.i18n.no-hardcoded-alert-concat" line="19"
34+
message="Avoid hardcoded or concatenated strings in alerts."
35+
severity="warning" />
36+
</file>
37+
<file name="Orderlist.jsx">
38+
<error source="codacy.js.i18n.no-hardcoded-alert-concat" line="15"
39+
message="Avoid hardcoded or concatenated strings in alerts."
40+
severity="warning" />
41+
<error source="codacy.js.i18n.no-hardcoded-locale-date" line="46"
42+
message="Avoid hardcoded locale strings in date/time formatting."
43+
severity="warning" />
44+
<error source="codacy.js.i18n.no-hardcoded-number-format" line="52"
45+
message="Avoid using toFixed for user-visible number formatting."
46+
severity="warning" />
47+
</file>
48+
</checkstyle>
49+

‎docs/multiple-tests/i18n/src/Messages_en.properties‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,6 @@
1+
app.start=Welcome to the Internationalized Order System
2+
order.processing=Processing order for {0} with {1} items.
3+
order.success=Order placed successfully for {0}!
4+
payment.success=Payment of {1} processed for customer {0}.
5+
error.payment=Payment could not be processed. Please try again.
6+
button.cancel=Cancel

‎docs/multiple-tests/i18n/src/Messages_fr.properties‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,6 @@
1+
app.start=Bienvenue dans le système de commande internationalisé
2+
order.processing=Traitement de la commande pour {0} avec {1} articles.
3+
order.success=Commande passée avec succès pour {0}!
4+
payment.success=Paiement de {1} traité pour le client {0}.
5+
error.payment=Le paiement n'a pas pu être traité. Veuillez réessayer.
6+
button.cancel=Annuler

‎docs/multiple-tests/i18n/src/Order.cpp‎

Lines changed: 92 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,92 @@
1+
#include <iostream>
2+
#include <string>
3+
#include <vector>
4+
#include <ctime>
5+
#include <iomanip> // for number formatting
6+
7+
struct Order {
8+
int id;
9+
std::string customer;
10+
int quantity;
11+
std::string status;
12+
double price;
13+
};
14+
15+
class OrderManager {
16+
std::vector<Order> orders;
17+
int nextId = 1;
18+
19+
public:
20+
void createOrder(const std::string& customer, int qty, double price) {
21+
Order o{nextId++, customer, qty, "NEW", price};
22+
orders.push_back(o);
23+
24+
// ❌ Hardcoded success message
25+
std::cout << "Order created successfully for customer: "
26+
<< customer << " with quantity " << qty
27+
<< " and price " << price << std::endl;
28+
}
29+
30+
void listOrders() {
31+
std::cout << "------ Order List ------" << std::endl; // ❌ Hardcoded label
32+
33+
for (auto& o : orders) {
34+
std::cout << "Order ID: " << o.id << ", "
35+
<< "Customer: " << o.customer << ", "
36+
<< "Qty: " << o.quantity << ", "
37+
// ❌ Hardcoded status mapping
38+
<< "Status: " << (o.status == "NEW" ? "New Order" : o.status) << ", "
39+
// ❌ Locale-unaware currency formatting
40+
<< "Price: $" << std::fixed << std::setprecision(2) << o.price
41+
<< std::endl;
42+
}
43+
44+
std::cout << "------ End of Orders ------" << std::endl; // ❌ Hardcoded footer
45+
}
46+
47+
void deleteOrder(int id) {
48+
for (auto it = orders.begin(); it != orders.end(); ++it) {
49+
if (it->id == id) {
50+
orders.erase(it);
51+
// ❌ Hardcoded delete confirmation
52+
std::cout << "Order deleted successfully!" << std::endl;
53+
return;
54+
}
55+
}
56+
// ❌ Hardcoded error message
57+
std::cout << "Error: Order not found." << std::endl;
58+
}
59+
60+
void printReport() {
61+
// ❌ Locale-unaware date formatting (fixed US-style format)
62+
std::time_t now = std::time(nullptr);
63+
char buffer[80];
64+
std::strftime(buffer, sizeof(buffer), "%m/%d/%Y %H:%M:%S", std::localtime(&now));
65+
std::cout << "Report generated at: " << buffer << std::endl;
66+
67+
// ❌ Hardcoded label + locale-unaware number formatting
68+
double revenue = 0;
69+
for (auto& o : orders) {
70+
revenue += o.price * o.quantity;
71+
}
72+
73+
std::cout << "Total Orders: " << orders.size() << std::endl;
74+
std::cout << "Total Revenue: " << revenue << std::endl; // ❌ Missing locale formatting
75+
}
76+
};
77+
78+
int main() {
79+
OrderManager manager;
80+
81+
manager.createOrder("Alice", 3, 1234.56);
82+
manager.createOrder("Bob", 5, 98765.43);
83+
84+
manager.listOrders();
85+
86+
manager.deleteOrder(2);
87+
manager.deleteOrder(10); // should print error
88+
89+
manager.printReport();
90+
91+
return 0;
92+
}

0 commit comments

Comments
 (0)