Skip to content

Commit bd79290

Browse files
heliocodacyheliocodacy
authored
Backport latest codacy-semgrep changes and bump opengrep to 1.15.1
2 parents fe18c95 + e1a5813 commit bd79290

23 files changed

Lines changed: 877 additions & 19 deletions

‎.tool_version‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1 +1 @@
1-
1.11.5
1+
1.15.1

‎Dockerfile‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
1-
ARG OPENGREP_VERSION=v1.11.5
1+
ARG OPENGREP_VERSION=v1.15.1
22

33
# Build codacy-opengrep wrapper
44
FROM golang:1.23-alpine3.21 as builder

‎docs/codacy-rules-ai.yaml‎

Lines changed: 24 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,24 @@
1+
rules:
2+
- id: codacy.csharp.ai.insecure-llm-model-usage
3+
languages:
4+
- csharp
5+
message: "Usage of Insecure LLM Model: $MODEL"
6+
severity: ERROR
7+
patterns:
8+
- pattern-either:
9+
- pattern: |
10+
$CLIENT.GenerateContentAsync(..., model: "$MODEL", ...)
11+
- pattern: |
12+
$CLIENT.GenerateContentAsync(model: "$MODEL", ...)
13+
- metavariable-regex:
14+
metavariable: $MODEL
15+
regex: <!-- MODEL_ALLOW_LIST -->
16+
metadata:
17+
category: security
18+
subcategory: ai
19+
description: Detects usage of insecure/unauthorized LLM models in C# codebases
20+
technology:
21+
- csharp
22+
impact: MEDIUM
23+
confidence: LOW
24+
likelihood: MEDIUM

‎docs/codacy-rules-i18n.yaml‎

Lines changed: 127 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,127 @@
1+
rules:
2+
- id: codacy.java.i18n.enforce-localized-output
3+
severity: WARNING
4+
languages:
5+
- java
6+
patterns:
7+
- pattern-either:
8+
# Detect direct string literals
9+
- pattern: System.out.println("...");
10+
- pattern: System.out.print("...");
11+
- pattern: System.err.println("...");
12+
- pattern: System.err.print("...");
13+
# Detect string concatenation
14+
- pattern: System.out.println($X + ...);
15+
- pattern: System.out.print($X + ...);
16+
- pattern: System.err.println($X + ...);
17+
- pattern: System.err.print($X + ...);
18+
# Detect String.format without ResourceBundle
19+
- pattern: System.out.println(String.format(...));
20+
- pattern: System.out.print(String.format(...));
21+
- pattern-not: System.out.println($BUNDLE.getString(...))
22+
- pattern-not: System.out.print($BUNDLE.getString(...))
23+
- pattern-not: System.err.println($BUNDLE.getString(...))
24+
- pattern-not: System.err.print($BUNDLE.getString(...))
25+
- pattern-not: System.out.println($BUNDLE.getObject(...))
26+
- pattern-not: System.out.print($BUNDLE.getObject(...))
27+
# Allow println without arguments (blank lines)
28+
- pattern-not: System.out.println()
29+
- pattern-not: System.err.println()
30+
message: >-
31+
Use localized messages instead of hardcoded strings.
32+
System.out.println() should use ResourceBundle.getString() or equivalent localization method.
33+
Example: System.out.println(messages.getString("key")) where messages is of type java.util.ResourceBundle
34+
metadata:
35+
category: codestyle
36+
subcategory: i18n
37+
description: Enforces use of ResourceBundle for all user-facing output to ensure proper internationalization
38+
technology:
39+
- java
40+
impact: MEDIUM
41+
confidence: LOW
42+
likelihood: HIGH
43+
44+
- id: codacy.js.i18n.no-hardcoded-alert-concat
45+
severity: WARNING
46+
languages:
47+
- js
48+
- ts
49+
pattern-either:
50+
# Direct hardcoded alert strings
51+
- pattern: alert("...")
52+
- pattern: window.alert("...")
53+
# String concatenation in alerts
54+
- pattern: alert("..." + ...)
55+
- pattern: alert(... + "...")
56+
- pattern: window.alert("..." + ...)
57+
- pattern: window.alert(... + "...")
58+
pattern-not: alert(t(...))
59+
message: >-
60+
Avoid hardcoded or concatenated strings in alerts. Use an i18n translation function (e.g., t("key")) with interpolation.
61+
metadata:
62+
category: codestyle
63+
subcategory: i18n
64+
description: Flags hardcoded and concatenated strings in alert dialogs to enforce localization
65+
technology:
66+
- javascript
67+
- typescript
68+
impact: MEDIUM
69+
confidence: LOW
70+
likelihood: HIGH
71+
72+
- id: codacy.js.i18n.no-hardcoded-locale-date
73+
severity: WARNING
74+
languages:
75+
- js
76+
- ts
77+
pattern-regex: "\\.(toLocale(Date|Time)?String)\\(\"[^\"]+\""
78+
message: Avoid hardcoded locale strings in date/time formatting.
79+
metadata:
80+
category: codestyle
81+
subcategory: i18n
82+
description: Flags explicit locale strings in date/time formatting which can break localization
83+
technology:
84+
- javascript
85+
- typescript
86+
impact: MEDIUM
87+
confidence: LOW
88+
likelihood: HIGH
89+
90+
- id: codacy.js.i18n.no-hardcoded-number-format
91+
severity: WARNING
92+
languages:
93+
- js
94+
- ts
95+
pattern-regex: "\\.toFixed\\([^)]*\\)"
96+
message: >-
97+
Avoid using toFixed for user-visible number formatting. Use locale-aware formatting or translation helpers.
98+
metadata:
99+
category: codestyle
100+
subcategory: i18n
101+
description: Flags toFixed used for UI number formatting; recommends locale-aware alternatives
102+
technology:
103+
- javascript
104+
- typescript
105+
impact: MEDIUM
106+
confidence: LOW
107+
likelihood: HIGH
108+
109+
- id: codacy.js.i18n.no-raw-jsx-text
110+
severity: WARNING
111+
languages:
112+
- js
113+
- ts
114+
pattern-regex: "<(h1|h2|h3|h4|h5|h6|p|span|div|td|th)[^>]*>[^<{]*[A-Za-z][^<{]*</\\1>"
115+
message: >-
116+
Avoid raw text in JSX for user-facing content. Use i18n translation functions (e.g., t("key")) with interpolation.
117+
metadata:
118+
category: codestyle
119+
subcategory: i18n
120+
description: Flags raw text nodes in JSX elements to enforce localization of UI strings
121+
technology:
122+
- javascript
123+
- typescript
124+
impact: MEDIUM
125+
confidence: LOW
126+
likelihood: MEDIUM
127+

‎docs/multiple-tests/ai/patterns.xml‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,6 @@
1+
<?xml version="1.0" encoding="UTF-8"?>
2+
<module name="root">
3+
<module name="codacy.csharp.ai.insecure-llm-model-usage">
4+
<property name="modelAllowList" value="gemini-2.5-flash,gpt-3.5-turbo,old-llama-model" />
5+
</module>
6+
</module>

‎docs/multiple-tests/ai/results.xml‎

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,9 @@
1+
<?xml version="1.0" encoding="utf-8"?>
2+
<checkstyle version="1.5">
3+
<file name="cs/GeminiExample.cs">
4+
<error source="codacy.csharp.ai.insecure-llm-model-usage" line="9"
5+
message="Usage of Insecure LLM Model: deepseek-v3.2"
6+
severity="error" />
7+
</file>
8+
</checkstyle>
9+

‎docs/multiple-tests/ai/src/cs/GeminiExample.cs‎

Lines changed: 17 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,17 @@
1+
using System.Threading.Tasks;
2+
using Google.GenAI;
3+
using Google.GenAI.Types;
4+
5+
public class GenerateContentSimpleText {
6+
public static async Task main() {
7+
// The client gets the API key from the environment variable `GEMINI_API_KEY`.
8+
var client = new Client();
9+
var response = await client.Models.GenerateContentAsync(
10+
model: "deepseek-v3.2", contents: "Explain how AI works in a few words"
11+
);
12+
var response2 = await client.Models.GenerateContentAsync(
13+
model: "gemini-2.5-flash", contents: "Explain how AI works in a few words"
14+
);
15+
Console.WriteLine(response.Candidates[0].Content.Parts[0].Text);
16+
}
17+
}

‎docs/multiple-tests/i18n/patterns.xml‎

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,7 @@
1+
<?xml version="1.0" encoding="UTF-8"?>
2+
<module name="root">
3+
<module name="codacy.java.i18n.enforce-localized-output" />
4+
<module name="codacy.js.i18n.no-hardcoded-alert-concat" />
5+
<module name="codacy.js.i18n.no-hardcoded-locale-date" />
6+
<module name="codacy.js.i18n.no-hardcoded-number-format" />
7+
</module>

‎docs/multiple-tests/i18n/results.xml‎

Lines changed: 49 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,49 @@
1+
<?xml version="1.0" encoding="utf-8"?>
2+
<checkstyle version="1.5">
3+
<file name="UILayer.java">
4+
<error source="codacy.java.i18n.enforce-localized-output" line="12"
5+
message="Use localized messages instead of hardcoded strings."
6+
severity="warning" />
7+
<error source="codacy.java.i18n.enforce-localized-output" line="22"
8+
message="Use localized messages instead of hardcoded strings."
9+
severity="warning" />
10+
</file>
11+
<file name="OrderApp.java">
12+
<error source="codacy.java.i18n.enforce-localized-output" line="18"
13+
message="Use localized messages instead of hardcoded strings."
14+
severity="warning" />
15+
<error source="codacy.java.i18n.enforce-localized-output" line="30"
16+
message="Use localized messages instead of hardcoded strings."
17+
severity="warning" />
18+
</file>
19+
<file name="OrderService.java">
20+
<error source="codacy.java.i18n.enforce-localized-output" line="13"
21+
message="Use localized messages instead of hardcoded strings."
22+
severity="warning" />
23+
<error source="codacy.java.i18n.enforce-localized-output" line="24"
24+
message="Use localized messages instead of hardcoded strings."
25+
severity="warning" />
26+
</file>
27+
<file name="PaymentService.java">
28+
<error source="codacy.java.i18n.enforce-localized-output" line="17"
29+
message="Use localized messages instead of hardcoded strings."
30+
severity="warning" />
31+
</file>
32+
<file name="OrderList.js">
33+
<error source="codacy.js.i18n.no-hardcoded-alert-concat" line="19"
34+
message="Avoid hardcoded or concatenated strings in alerts."
35+
severity="warning" />
36+
</file>
37+
<file name="Orderlist.jsx">
38+
<error source="codacy.js.i18n.no-hardcoded-alert-concat" line="15"
39+
message="Avoid hardcoded or concatenated strings in alerts."
40+
severity="warning" />
41+
<error source="codacy.js.i18n.no-hardcoded-locale-date" line="46"
42+
message="Avoid hardcoded locale strings in date/time formatting."
43+
severity="warning" />
44+
<error source="codacy.js.i18n.no-hardcoded-number-format" line="52"
45+
message="Avoid using toFixed for user-visible number formatting."
46+
severity="warning" />
47+
</file>
48+
</checkstyle>
49+

‎docs/multiple-tests/i18n/src/Messages_en.properties‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,6 @@
1+
app.start=Welcome to the Internationalized Order System
2+
order.processing=Processing order for {0} with {1} items.
3+
order.success=Order placed successfully for {0}!
4+
payment.success=Payment of {1} processed for customer {0}.
5+
error.payment=Payment could not be processed. Please try again.
6+
button.cancel=Cancel

0 commit comments

Comments
 (0)