From 921096cba7c8565e4395e76942971d521a47d30a Mon Sep 17 00:00:00 2001 From: Pedro Pereira Date: Tue, 18 Aug 2026 14:46:22 +0100 Subject: [PATCH 1/2] test: Refresh stale test fixtures OD-497 Goldens snapshot live Codacy API and Trivy DB data that drifted since March, so CI was red on main before any change. Lizard's unit test now reads a checked-in pattern config instead of fetching defaults, making it independent of the API. Co-Authored-By: Claude Opus 5 (1M context) --- .../tools-configs/languages-config.yaml | 2 +- .../expected/tools-configs/lizard.yaml | 32 +- .../expected/tools-configs/ruleset.xml | 99 +++- .../expected/tools-configs/semgrep.yaml | 238 -------- .../tools-configs/languages-config.yaml | 2 +- .../expected/tools-configs/lizard.yaml | 32 +- .../expected/tools-configs/pylint.rc | 10 +- .../expected/tools-configs/revive.toml | 6 +- .../expected/tools-configs/ruleset.xml | 8 - .../expected/tools-configs/semgrep.yaml | 238 -------- plugins/tools/trivy/test/expected.sarif | 508 ++++++++++++++---- tools/lizard/test/lizard.yaml | 43 ++ 12 files changed, 596 insertions(+), 622 deletions(-) create mode 100644 tools/lizard/test/lizard.yaml diff --git a/integration-tests/config-discover/expected/tools-configs/languages-config.yaml b/integration-tests/config-discover/expected/tools-configs/languages-config.yaml index aab8accb..8af31105 100644 --- a/integration-tests/config-discover/expected/tools-configs/languages-config.yaml +++ b/integration-tests/config-discover/expected/tools-configs/languages-config.yaml @@ -30,4 +30,4 @@ tools: - name: trivy languages: [C, CPP, CSharp, Dart, Dockerfile, Elixir, Go, JSON, Java, Javascript, PHP, Python, Ruby, Rust, Scala, Swift, Terraform, TypeScript, XML, YAML] extensions: [.c, .cc, .cpp, .cs, .cxx, .dart, .dockerfile, .env, .ex, .exs, .gemspec, .go, .h, .hpp, .ino, .java, .jbuilder, .js, .jsm, .json, .jsx, .mjs, .opal, .php, .podspec, .pom, .py, .rake, .rb, .rlib, .rs, .scala, .swift, .tf, .ts, .tsx, .vue, .wsdl, .xml, .xsl, .yaml, .yml] - files: [.deps.json, .env, .env.dev, .env.development, .env.prod, .env.production, .env.staging, Berksfile, Capfile, Cargo.lock, Cheffile, Directory.Packages.props, Dockerfile, Fastfile, Gemfile, Gemfile.lock, Guardfile, Package.resolved, Packages.props, Pipfile.lock, Podfile, Podfile.lock, Rakefile, Thorfile, Vagabondfile, Vagrantfile, build.sbt.lock, composer.lock, conan.lock, config.ru, go.mod, gradle.lockfile, mix.lock, package-lock.json, package.json, packages.config, packages.lock.json, pnpm-lock.yaml, poetry.lock, pom.xml, pubspec.lock, requirements.txt, uv.lock, yarn.lock] + files: [.deps.json, .env, .env.dev, .env.development, .env.prod, .env.production, .env.staging, Berksfile, Capfile, Cargo.lock, Cheffile, Directory.Packages.props, Dockerfile, Fastfile, Gemfile, Gemfile.lock, Guardfile, Package.resolved, Packages.props, Pipfile.lock, Podfile, Podfile.lock, Rakefile, Thorfile, Vagabondfile, Vagrantfile, build.sbt.lock, composer.lock, conan.lock, config.ru, go.mod, go.sum, gradle.lockfile, mix.lock, package-lock.json, package.json, packages.config, packages.lock.json, pnpm-lock.yaml, poetry.lock, pom.xml, pubspec.lock, requirements.txt, uv.lock, yarn.lock] diff --git a/integration-tests/config-discover/expected/tools-configs/lizard.yaml b/integration-tests/config-discover/expected/tools-configs/lizard.yaml index b832c679..3a2c09a5 100644 --- a/integration-tests/config-discover/expected/tools-configs/lizard.yaml +++ b/integration-tests/config-discover/expected/tools-configs/lizard.yaml @@ -1,30 +1,30 @@ patterns: - Lizard_ccn-medium: + Lizard_ccn-minor: category: Complexity - description: Checks if the cyclomatic complexity of a function or logic block exceeds the medium threshold (default is 8). + description: Reports a Minor issue when a function's cyclomatic complexity (the number of independent decision paths through it) reaches the configured threshold, which defaults to 10. This is the earliest warning tier, flagging functions that are beginning to accumulate branching logic. explanation: |- - # Medium Cyclomatic Complexity control + # Minor Cyclomatic Complexity control - Check the Cyclomatic Complexity value of a function or logic block. If the threshold is not met, raise a Medium issue. The default threshold is 7. - id: Lizard_ccn-medium - level: Warning - severityLevel: Warning - threshold: 8 - timeToFix: 10 - title: Enforce Medium Cyclomatic Complexity Threshold + Check the Cyclomatic Complexity value of a function or logic block. If the threshold is exceeded, raise a Minor issue. The default threshold is 10. + id: Lizard_ccn-minor + level: Info + severityLevel: Info + threshold: 10 + timeToFix: 5 + title: Limit Function Cyclomatic Complexity (Minor) Lizard_file-nloc-medium: category: Complexity - description: This rule checks if the number of lines of code (excluding comments) in a file exceeds a medium threshold, typically 500 lines. + description: Reports a Medium issue when a file's number of lines of code (excluding comments) reaches the configured threshold, which defaults to 500. Files this large typically mix several concerns and are noticeably harder to navigate and maintain. explanation: "" id: Lizard_file-nloc-medium level: Warning severityLevel: Warning threshold: 500 timeToFix: 10 - title: Enforce Medium File Length Limit Based on Number of Lines of Code + title: Limit File Length (Medium) Lizard_nloc-medium: category: Complexity - description: Checks if the number of lines of code (excluding comments) in a function exceeds a medium threshold (default 50 lines). + description: Reports a Medium issue when a function's number of lines of code (excluding comments) reaches the configured threshold, which defaults to 50. Functions this long usually handle more than one responsibility and are noticeably harder to follow. explanation: |- # Medium NLOC control - Number of Lines of Code (without comments) @@ -34,10 +34,10 @@ patterns: severityLevel: Warning threshold: 50 timeToFix: 10 - title: Enforce Medium Number of Lines of Code (NLOC) Limit + title: Limit Function Length (Medium) Lizard_parameter-count-medium: category: Complexity - description: This rule checks the number of parameters passed to a function and raises an issue if it exceeds a medium threshold, which by default is 8 parameters. + description: Reports a Medium issue when a function's parameter count reaches the configured threshold, which defaults to 8. A signature this wide is hard to call correctly and usually signals that the function has taken on too many responsibilities. explanation: |- # Medium Parameter count control @@ -47,4 +47,4 @@ patterns: severityLevel: Warning threshold: 8 timeToFix: 10 - title: Enforce Medium Parameter Count Limit + title: Limit Function Parameter Count (Medium) diff --git a/integration-tests/config-discover/expected/tools-configs/ruleset.xml b/integration-tests/config-discover/expected/tools-configs/ruleset.xml index c6263e6a..b408b090 100644 --- a/integration-tests/config-discover/expected/tools-configs/ruleset.xml +++ b/integration-tests/config-discover/expected/tools-configs/ruleset.xml @@ -1,9 +1,25 @@ -Codacy PMD 7 Ruleset + xmlns="https://pmd.github.io/ruleset/2.0.0" + xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" + xsi:schemaLocation="https://pmd.github.io/ruleset/2.0.0 https://pmd.github.io/schemas/pmd-7.0.0.xsd"> + Codacy PMD 7 Ruleset + + + + + + + + + + + + + + + + @@ -14,11 +30,19 @@ xsi:schemaLocation="https://pmd.github.io/ruleset/2.0.0 https://pmd.github.io/sc + + + + + + + + @@ -30,6 +54,8 @@ xsi:schemaLocation="https://pmd.github.io/ruleset/2.0.0 https://pmd.github.io/sc + + @@ -40,26 +66,91 @@ xsi:schemaLocation="https://pmd.github.io/ruleset/2.0.0 https://pmd.github.io/sc + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/integration-tests/config-discover/expected/tools-configs/semgrep.yaml b/integration-tests/config-discover/expected/tools-configs/semgrep.yaml index 5aaf6f95..b5459652 100644 --- a/integration-tests/config-discover/expected/tools-configs/semgrep.yaml +++ b/integration-tests/config-discover/expected/tools-configs/semgrep.yaml @@ -34256,241 +34256,3 @@ rules: ... java.text.Normalizer.normalize($VAR, ...); severity: WARNING - - id: codacy.java.security.hard-coded-password - languages: - - java - message: Hardcoded passwords are a security risk. They can be easily found by attackers and used to gain unauthorized access to the system. - metadata: - category: security - confidence: MEDIUM - description: Hardcoded passwords are a security risk. - impact: HIGH - owasp: - - A3:2017 Sensitive Data Exposure - technology: - - java - patterns: - - pattern-either: - - pattern: String $PASSWORD = "$VALUE"; - - metavariable-regex: - metavariable: $PASSWORD - regex: (?i).*(password|motdepasse|heslo|adgangskode|wachtwoord|salasana|passwort|passord|senha|geslo|clave|losenord|clave|parola|secret|pwd).* - severity: ERROR - - id: codacy.csharp.security.hard-coded-password - languages: - - csharp - message: Hardcoded passwords are a security risk. They can be easily found by attackers and used to gain unauthorized access to the system. - metadata: - category: security - confidence: MEDIUM - description: Hardcoded passwords are a security risk. - impact: HIGH - owasp: - - A3:2017 Sensitive Data Exposure - technology: - - .net - patterns: - - pattern-either: - - pattern: var $PASSWORD = "$VALUE"; - - metavariable-regex: - metavariable: $PASSWORD - regex: (?i).*(password|motdepasse|heslo|adgangskode|wachtwoord|salasana|passwort|passord|senha|geslo|clave|losenord|clave|parola|secret|pwd).* - severity: ERROR - - id: codacy.javascript.security.hard-coded-password - languages: - - javascript - - typescript - message: Hardcoded passwords are a security risk. They can be easily found by attackers and used to gain unauthorized access to the system. - metadata: - category: security - confidence: MEDIUM - description: Hardcoded passwords are a security risk. - impact: HIGH - owasp: - - A3:2017 Sensitive Data Exposure - technology: - - javascript - patterns: - - pattern-either: - - pattern: let $PASSWORD = "$VALUE" - - pattern: const $PASSWORD = "$VALUE" - - pattern: var $PASSWORD = "$VALUE" - - pattern: let $PASSWORD = '$VALUE' - - pattern: const $PASSWORD = '$VALUE' - - pattern: var $PASSWORD = '$VALUE' - - pattern: let $PASSWORD = `$VALUE` - - pattern: const $PASSWORD = `$VALUE` - - pattern: var $PASSWORD = `$VALUE` - - metavariable-regex: - metavariable: $PASSWORD - regex: (?i).*(password|motdepasse|heslo|adgangskode|wachtwoord|salasana|passwort|passord|senha|geslo|clave|losenord|clave|parola|secret|pwd).* - severity: ERROR - - id: codacy.generic.plsql.empty-strings - languages: - - generic - message: Empty strings can lead to unexpected behavior and should be handled carefully. - metadata: - category: security - confidence: MEDIUM - description: Detects empty strings in the code which might cause issues or bugs. - impact: MEDIUM - pattern: $VAR VARCHAR2($LENGTH) := ''; - severity: WARNING - - id: codacy.generic.plsql.find-all-passwords - languages: - - generic - message: | - Hardcoded or exposed passwords are a security risk. They can be easily found by attackers and used to gain unauthorized access to the system. - metadata: - category: security - confidence: MEDIUM - description: Finding all occurrences of passwords in different languages and formats, while avoiding common false positives. - impact: HIGH - owasp: - - A3:2017 Sensitive Data Exposure - options: - generic_ellipsis_max_span: 0 - patterns: - - pattern: | - $PASSWORD VARCHAR2($LENGTH) := $...VALUE; - - metavariable-regex: - metavariable: $PASSWORD - regex: (?i).*(password|motdepasse|heslo|adgangskode|wachtwoord|salasana|passwort|passord|senha|geslo|clave|losenord|clave|parola|secret|pwd).* - severity: ERROR - - id: codacy.generic.plsql.resource-injection - languages: - - generic - message: Resource injection detected. This can lead to unauthorized access or manipulation of resources. - metadata: - category: security - confidence: MEDIUM - description: Detects assignments in PL/SQL involving risky DBMS functions that might cause security issues. - impact: HIGH - owasp: - - A3:2017 Sensitive Data Exposure - options: - generic_ellipsis_max_span: 0 - patterns: - - pattern-either: - - pattern: | - $RESOURCE := DBMS_CUBE.BUILD($...ARGS); - - pattern: | - $RESOURCE := DBMS_FILE_TRANSFER.COPY_FILE($...ARGS); - - pattern: | - $RESOURCE := DBMS_FILE_TRANSFER.GET_FILE($...ARGS); - - pattern: | - $RESOURCE := DBMS_FILE_TRANSFER.PUT_FILE($...ARGS); - - pattern: | - $RESOURCE := DBMS_SCHEDULER.GET_FILE($...ARGS); - - pattern: | - $RESOURCE := DBMS_SCHEDULER.PUT_FILE($...ARGS); - - pattern: | - $RESOURCE := DBMS_SCHEDULER.CREATE_PROGRAM($...ARGS); - - pattern: | - $RESOURCE := DBMS_SERVICE.CREATE_SERVICE($...ARGS); - - pattern: | - $RESOURCE := UTL_TCP.OPEN_CONNECTION($...ARGS); - - pattern: | - $RESOURCE := UTL_SMTP.OPEN_CONNECTION($...ARGS); - - pattern: | - $RESOURCE := WPG_DOCLOAD.DOWNLOAD_FILE($...ARGS); - severity: ERROR - - id: codacy.generic.security.detect-invisible-unicode - languages: - - yaml - - json - message: It's possible to embed malicious secret instructions to AI rules files using unicode characters that are invisible to human reviewers.This can lead to future AI-generated code that has security vulnerabilities or other weaknesses baked in which may not be noticed. - metadata: - category: security - confidence: MEDIUM - description: Detects the invisible unicode characters - technology: - - AI - - Copilot - - Cursor - paths: - include: - - '*.json' - - '*.yaml' - - '*.yml' - pattern-regex: "[​‌‍⁠\uFEFF]" - severity: WARNING - - id: codacy.python.openai.non-guardrails-direct-call - languages: - - python - message: Direct OpenAI SDK call detected. Use Guardrails client (GuardrailsOpenAI/GuardrailsAsyncOpenAI) instead. - metadata: - category: security - confidence: MEDIUM - cwe: 'CWE-20: Improper Input Validation' - justification: | - Guardrails is a drop-in replacement that automatically validates inputs/outputs. Prefer Guardrails clients over raw openai.* calls. - references: - - https://openai.github.io/openai-guardrails-python/ - patterns: - - pattern-either: - - pattern: openai.ChatCompletion.create(...) - - pattern: openai.Completion.create(...) - - pattern: openai.chat.completions.create(...) - - pattern: openai.responses.create(...) - - pattern: openai.embeddings.create(...) - - pattern: openai.images.generate(...) - - pattern: openai.audio.transcriptions.create(...) - - pattern: openai.audio.speech.create(...) - severity: WARNING - - id: codacy.python.openai.non-guardrails-client-usage - languages: - - python - message: OpenAI client used without Guardrails. Replace with GuardrailsOpenAI / GuardrailsAsyncOpenAI. - metadata: - category: security - confidence: MEDIUM - cwe: 'CWE-20: Improper Input Validation' - justification: | - Guardrails advises using GuardrailsOpenAI/GuardrailsAsyncOpenAI as a drop-in replacement so validation runs automatically on every API call. - references: - - https://openai.github.io/openai-guardrails-python/ - patterns: - - pattern-either: - - pattern: | - $C = OpenAI(...) - ... - $C.chat.completions.create(...) - - pattern: | - $C = OpenAI(...) - ... - $C.responses.create(...) - - pattern: | - $C = OpenAI(...) - ... - $C.embeddings.create(...) - - pattern: | - $C = AsyncOpenAI(...) - ... - $C.chat.completions.create(...) - - pattern: | - $C = AsyncOpenAI(...) - ... - $C.responses.create(...) - - pattern: | - $C = AsyncOpenAI(...) - ... - $C.embeddings.create(...) - - pattern-not: | - $C = GuardrailsOpenAI(...) - - pattern-not: | - $C = GuardrailsAsyncOpenAI(...) - severity: WARNING - - id: codacy.python.openai.import-without-guardrails - languages: - - python - message: OpenAI SDK imported without Guardrails import. Consider GuardrailsOpenAI / GuardrailsAsyncOpenAI. - metadata: - category: security - confidence: MEDIUM - references: - - https://openai.github.io/openai-guardrails-python/ - pattern: | - import openai - pattern-not: "from guardrails import GuardrailsOpenAI |\nfrom guardrails import GuardrailsAsyncOpenAI \n" - severity: INFO diff --git a/integration-tests/init-without-token/expected/tools-configs/languages-config.yaml b/integration-tests/init-without-token/expected/tools-configs/languages-config.yaml index ca44d896..8af31105 100644 --- a/integration-tests/init-without-token/expected/tools-configs/languages-config.yaml +++ b/integration-tests/init-without-token/expected/tools-configs/languages-config.yaml @@ -30,4 +30,4 @@ tools: - name: trivy languages: [C, CPP, CSharp, Dart, Dockerfile, Elixir, Go, JSON, Java, Javascript, PHP, Python, Ruby, Rust, Scala, Swift, Terraform, TypeScript, XML, YAML] extensions: [.c, .cc, .cpp, .cs, .cxx, .dart, .dockerfile, .env, .ex, .exs, .gemspec, .go, .h, .hpp, .ino, .java, .jbuilder, .js, .jsm, .json, .jsx, .mjs, .opal, .php, .podspec, .pom, .py, .rake, .rb, .rlib, .rs, .scala, .swift, .tf, .ts, .tsx, .vue, .wsdl, .xml, .xsl, .yaml, .yml] - files: [.deps.json, .env, .env.dev, .env.development, .env.prod, .env.production, .env.staging, Berksfile, Capfile, Cargo.lock, Cheffile, Directory.Packages.props, Dockerfile, Fastfile, Gemfile, Gemfile.lock, Guardfile, Package.resolved, Packages.props, Pipfile.lock, Podfile, Podfile.lock, Rakefile, Thorfile, Vagabondfile, Vagrantfile, build.sbt.lock, composer.lock, conan.lock, config.ru, go.mod, gradle.lockfile, mix.lock, package-lock.json, package.json, packages.config, packages.lock.json, pnpm-lock.yaml, poetry.lock, pom.xml, pubspec.lock, requirements.txt, uv.lock, yarn.lock] \ No newline at end of file + files: [.deps.json, .env, .env.dev, .env.development, .env.prod, .env.production, .env.staging, Berksfile, Capfile, Cargo.lock, Cheffile, Directory.Packages.props, Dockerfile, Fastfile, Gemfile, Gemfile.lock, Guardfile, Package.resolved, Packages.props, Pipfile.lock, Podfile, Podfile.lock, Rakefile, Thorfile, Vagabondfile, Vagrantfile, build.sbt.lock, composer.lock, conan.lock, config.ru, go.mod, go.sum, gradle.lockfile, mix.lock, package-lock.json, package.json, packages.config, packages.lock.json, pnpm-lock.yaml, poetry.lock, pom.xml, pubspec.lock, requirements.txt, uv.lock, yarn.lock] diff --git a/integration-tests/init-without-token/expected/tools-configs/lizard.yaml b/integration-tests/init-without-token/expected/tools-configs/lizard.yaml index b832c679..3a2c09a5 100644 --- a/integration-tests/init-without-token/expected/tools-configs/lizard.yaml +++ b/integration-tests/init-without-token/expected/tools-configs/lizard.yaml @@ -1,30 +1,30 @@ patterns: - Lizard_ccn-medium: + Lizard_ccn-minor: category: Complexity - description: Checks if the cyclomatic complexity of a function or logic block exceeds the medium threshold (default is 8). + description: Reports a Minor issue when a function's cyclomatic complexity (the number of independent decision paths through it) reaches the configured threshold, which defaults to 10. This is the earliest warning tier, flagging functions that are beginning to accumulate branching logic. explanation: |- - # Medium Cyclomatic Complexity control + # Minor Cyclomatic Complexity control - Check the Cyclomatic Complexity value of a function or logic block. If the threshold is not met, raise a Medium issue. The default threshold is 7. - id: Lizard_ccn-medium - level: Warning - severityLevel: Warning - threshold: 8 - timeToFix: 10 - title: Enforce Medium Cyclomatic Complexity Threshold + Check the Cyclomatic Complexity value of a function or logic block. If the threshold is exceeded, raise a Minor issue. The default threshold is 10. + id: Lizard_ccn-minor + level: Info + severityLevel: Info + threshold: 10 + timeToFix: 5 + title: Limit Function Cyclomatic Complexity (Minor) Lizard_file-nloc-medium: category: Complexity - description: This rule checks if the number of lines of code (excluding comments) in a file exceeds a medium threshold, typically 500 lines. + description: Reports a Medium issue when a file's number of lines of code (excluding comments) reaches the configured threshold, which defaults to 500. Files this large typically mix several concerns and are noticeably harder to navigate and maintain. explanation: "" id: Lizard_file-nloc-medium level: Warning severityLevel: Warning threshold: 500 timeToFix: 10 - title: Enforce Medium File Length Limit Based on Number of Lines of Code + title: Limit File Length (Medium) Lizard_nloc-medium: category: Complexity - description: Checks if the number of lines of code (excluding comments) in a function exceeds a medium threshold (default 50 lines). + description: Reports a Medium issue when a function's number of lines of code (excluding comments) reaches the configured threshold, which defaults to 50. Functions this long usually handle more than one responsibility and are noticeably harder to follow. explanation: |- # Medium NLOC control - Number of Lines of Code (without comments) @@ -34,10 +34,10 @@ patterns: severityLevel: Warning threshold: 50 timeToFix: 10 - title: Enforce Medium Number of Lines of Code (NLOC) Limit + title: Limit Function Length (Medium) Lizard_parameter-count-medium: category: Complexity - description: This rule checks the number of parameters passed to a function and raises an issue if it exceeds a medium threshold, which by default is 8 parameters. + description: Reports a Medium issue when a function's parameter count reaches the configured threshold, which defaults to 8. A signature this wide is hard to call correctly and usually signals that the function has taken on too many responsibilities. explanation: |- # Medium Parameter count control @@ -47,4 +47,4 @@ patterns: severityLevel: Warning threshold: 8 timeToFix: 10 - title: Enforce Medium Parameter Count Limit + title: Limit Function Parameter Count (Medium) diff --git a/integration-tests/init-without-token/expected/tools-configs/pylint.rc b/integration-tests/init-without-token/expected/tools-configs/pylint.rc index 97185cff..d7694e5c 100644 --- a/integration-tests/init-without-token/expected/tools-configs/pylint.rc +++ b/integration-tests/init-without-token/expected/tools-configs/pylint.rc @@ -1,9 +1,9 @@ - - [MASTER] +ignore=CVS +persistent=yes +load-plugins= + [MESSAGES CONTROL] disable=all enable=C0123,C0200,E0100,E0101,E0102,E0103,E0104,E0105,E0106,E0107,E0108,E0110,E0112,E0113,E0114,E0115,E0117,E0202,E0203,E0211,E0236,E0238,E0239,E0240,E0241,E0301,E0302,E0601,E0603,E0604,E0701,E0702,E0704,E0710,E0711,E0712,E1003,E1102,E1111,E1120,E1121,E1123,E1124,E1125,E1126,E1127,E1132,E1200,E1201,E1205,E1206,E1300,E1301,E1302,E1303,E1304,E1305,E1306,R0202,R0203,W0101,W0102,W0104,W0105,W0106,W0107,W0108,W0109,W0120,W0122,W0124,W0150,W0199,W0221,W0222,W0233,W0404,W0410,W0601,W0602,W0604,W0611,W0612,W0622,W0702,W0705,W0711,W1300,W1301,W1302,W1303,W1305,W1306,W1307 -ignore=CVS -load-plugins= -persistent=yes + diff --git a/integration-tests/init-without-token/expected/tools-configs/revive.toml b/integration-tests/init-without-token/expected/tools-configs/revive.toml index 37186103..438039c5 100644 --- a/integration-tests/init-without-token/expected/tools-configs/revive.toml +++ b/integration-tests/init-without-token/expected/tools-configs/revive.toml @@ -5,7 +5,7 @@ confidence = 0.8 errorCode = 0 warningCode = 0 -rules = ["blank-imports", "context-as-argument", "context-keys-type", "dot-imports", "empty-block", "error-naming", "error-return", "error-strings", "errorf", "exported", "increment-decrement", "indent-error-flow", "package-comments", "range", "receiver-naming", "redefines-builtin-id", "superfluous-else", "time-naming", "unexported-return", "unreachable-code", "unused-parameter", "var-declaration", "var-naming"] +rules = ["blank-imports", "context-as-argument", "context-keys-type", "dot-imports", "empty-block", "errorf", "error-naming", "error-return", "error-strings", "exported", "increment-decrement", "indent-error-flow", "package-comments", "range", "receiver-naming", "redefines-builtin-id", "superfluous-else", "time-naming", "unexported-return", "unreachable-code", "unused-parameter", "var-declaration", "var-naming"] [rule.blank-imports] @@ -17,14 +17,14 @@ rules = ["blank-imports", "context-as-argument", "context-keys-type", "dot-impor [rule.empty-block] +[rule.errorf] + [rule.error-naming] [rule.error-return] [rule.error-strings] -[rule.errorf] - [rule.exported] [rule.increment-decrement] diff --git a/integration-tests/init-without-token/expected/tools-configs/ruleset.xml b/integration-tests/init-without-token/expected/tools-configs/ruleset.xml index 8682ac5c..b408b090 100644 --- a/integration-tests/init-without-token/expected/tools-configs/ruleset.xml +++ b/integration-tests/init-without-token/expected/tools-configs/ruleset.xml @@ -5,7 +5,6 @@ xsi:schemaLocation="https://pmd.github.io/ruleset/2.0.0 https://pmd.github.io/schemas/pmd-7.0.0.xsd"> Codacy PMD 7 Ruleset - @@ -57,7 +56,6 @@ - @@ -117,7 +115,6 @@ - @@ -137,12 +134,7 @@ - - - - - diff --git a/integration-tests/init-without-token/expected/tools-configs/semgrep.yaml b/integration-tests/init-without-token/expected/tools-configs/semgrep.yaml index 5aaf6f95..b5459652 100644 --- a/integration-tests/init-without-token/expected/tools-configs/semgrep.yaml +++ b/integration-tests/init-without-token/expected/tools-configs/semgrep.yaml @@ -34256,241 +34256,3 @@ rules: ... java.text.Normalizer.normalize($VAR, ...); severity: WARNING - - id: codacy.java.security.hard-coded-password - languages: - - java - message: Hardcoded passwords are a security risk. They can be easily found by attackers and used to gain unauthorized access to the system. - metadata: - category: security - confidence: MEDIUM - description: Hardcoded passwords are a security risk. - impact: HIGH - owasp: - - A3:2017 Sensitive Data Exposure - technology: - - java - patterns: - - pattern-either: - - pattern: String $PASSWORD = "$VALUE"; - - metavariable-regex: - metavariable: $PASSWORD - regex: (?i).*(password|motdepasse|heslo|adgangskode|wachtwoord|salasana|passwort|passord|senha|geslo|clave|losenord|clave|parola|secret|pwd).* - severity: ERROR - - id: codacy.csharp.security.hard-coded-password - languages: - - csharp - message: Hardcoded passwords are a security risk. They can be easily found by attackers and used to gain unauthorized access to the system. - metadata: - category: security - confidence: MEDIUM - description: Hardcoded passwords are a security risk. - impact: HIGH - owasp: - - A3:2017 Sensitive Data Exposure - technology: - - .net - patterns: - - pattern-either: - - pattern: var $PASSWORD = "$VALUE"; - - metavariable-regex: - metavariable: $PASSWORD - regex: (?i).*(password|motdepasse|heslo|adgangskode|wachtwoord|salasana|passwort|passord|senha|geslo|clave|losenord|clave|parola|secret|pwd).* - severity: ERROR - - id: codacy.javascript.security.hard-coded-password - languages: - - javascript - - typescript - message: Hardcoded passwords are a security risk. They can be easily found by attackers and used to gain unauthorized access to the system. - metadata: - category: security - confidence: MEDIUM - description: Hardcoded passwords are a security risk. - impact: HIGH - owasp: - - A3:2017 Sensitive Data Exposure - technology: - - javascript - patterns: - - pattern-either: - - pattern: let $PASSWORD = "$VALUE" - - pattern: const $PASSWORD = "$VALUE" - - pattern: var $PASSWORD = "$VALUE" - - pattern: let $PASSWORD = '$VALUE' - - pattern: const $PASSWORD = '$VALUE' - - pattern: var $PASSWORD = '$VALUE' - - pattern: let $PASSWORD = `$VALUE` - - pattern: const $PASSWORD = `$VALUE` - - pattern: var $PASSWORD = `$VALUE` - - metavariable-regex: - metavariable: $PASSWORD - regex: (?i).*(password|motdepasse|heslo|adgangskode|wachtwoord|salasana|passwort|passord|senha|geslo|clave|losenord|clave|parola|secret|pwd).* - severity: ERROR - - id: codacy.generic.plsql.empty-strings - languages: - - generic - message: Empty strings can lead to unexpected behavior and should be handled carefully. - metadata: - category: security - confidence: MEDIUM - description: Detects empty strings in the code which might cause issues or bugs. - impact: MEDIUM - pattern: $VAR VARCHAR2($LENGTH) := ''; - severity: WARNING - - id: codacy.generic.plsql.find-all-passwords - languages: - - generic - message: | - Hardcoded or exposed passwords are a security risk. They can be easily found by attackers and used to gain unauthorized access to the system. - metadata: - category: security - confidence: MEDIUM - description: Finding all occurrences of passwords in different languages and formats, while avoiding common false positives. - impact: HIGH - owasp: - - A3:2017 Sensitive Data Exposure - options: - generic_ellipsis_max_span: 0 - patterns: - - pattern: | - $PASSWORD VARCHAR2($LENGTH) := $...VALUE; - - metavariable-regex: - metavariable: $PASSWORD - regex: (?i).*(password|motdepasse|heslo|adgangskode|wachtwoord|salasana|passwort|passord|senha|geslo|clave|losenord|clave|parola|secret|pwd).* - severity: ERROR - - id: codacy.generic.plsql.resource-injection - languages: - - generic - message: Resource injection detected. This can lead to unauthorized access or manipulation of resources. - metadata: - category: security - confidence: MEDIUM - description: Detects assignments in PL/SQL involving risky DBMS functions that might cause security issues. - impact: HIGH - owasp: - - A3:2017 Sensitive Data Exposure - options: - generic_ellipsis_max_span: 0 - patterns: - - pattern-either: - - pattern: | - $RESOURCE := DBMS_CUBE.BUILD($...ARGS); - - pattern: | - $RESOURCE := DBMS_FILE_TRANSFER.COPY_FILE($...ARGS); - - pattern: | - $RESOURCE := DBMS_FILE_TRANSFER.GET_FILE($...ARGS); - - pattern: | - $RESOURCE := DBMS_FILE_TRANSFER.PUT_FILE($...ARGS); - - pattern: | - $RESOURCE := DBMS_SCHEDULER.GET_FILE($...ARGS); - - pattern: | - $RESOURCE := DBMS_SCHEDULER.PUT_FILE($...ARGS); - - pattern: | - $RESOURCE := DBMS_SCHEDULER.CREATE_PROGRAM($...ARGS); - - pattern: | - $RESOURCE := DBMS_SERVICE.CREATE_SERVICE($...ARGS); - - pattern: | - $RESOURCE := UTL_TCP.OPEN_CONNECTION($...ARGS); - - pattern: | - $RESOURCE := UTL_SMTP.OPEN_CONNECTION($...ARGS); - - pattern: | - $RESOURCE := WPG_DOCLOAD.DOWNLOAD_FILE($...ARGS); - severity: ERROR - - id: codacy.generic.security.detect-invisible-unicode - languages: - - yaml - - json - message: It's possible to embed malicious secret instructions to AI rules files using unicode characters that are invisible to human reviewers.This can lead to future AI-generated code that has security vulnerabilities or other weaknesses baked in which may not be noticed. - metadata: - category: security - confidence: MEDIUM - description: Detects the invisible unicode characters - technology: - - AI - - Copilot - - Cursor - paths: - include: - - '*.json' - - '*.yaml' - - '*.yml' - pattern-regex: "[​‌‍⁠\uFEFF]" - severity: WARNING - - id: codacy.python.openai.non-guardrails-direct-call - languages: - - python - message: Direct OpenAI SDK call detected. Use Guardrails client (GuardrailsOpenAI/GuardrailsAsyncOpenAI) instead. - metadata: - category: security - confidence: MEDIUM - cwe: 'CWE-20: Improper Input Validation' - justification: | - Guardrails is a drop-in replacement that automatically validates inputs/outputs. Prefer Guardrails clients over raw openai.* calls. - references: - - https://openai.github.io/openai-guardrails-python/ - patterns: - - pattern-either: - - pattern: openai.ChatCompletion.create(...) - - pattern: openai.Completion.create(...) - - pattern: openai.chat.completions.create(...) - - pattern: openai.responses.create(...) - - pattern: openai.embeddings.create(...) - - pattern: openai.images.generate(...) - - pattern: openai.audio.transcriptions.create(...) - - pattern: openai.audio.speech.create(...) - severity: WARNING - - id: codacy.python.openai.non-guardrails-client-usage - languages: - - python - message: OpenAI client used without Guardrails. Replace with GuardrailsOpenAI / GuardrailsAsyncOpenAI. - metadata: - category: security - confidence: MEDIUM - cwe: 'CWE-20: Improper Input Validation' - justification: | - Guardrails advises using GuardrailsOpenAI/GuardrailsAsyncOpenAI as a drop-in replacement so validation runs automatically on every API call. - references: - - https://openai.github.io/openai-guardrails-python/ - patterns: - - pattern-either: - - pattern: | - $C = OpenAI(...) - ... - $C.chat.completions.create(...) - - pattern: | - $C = OpenAI(...) - ... - $C.responses.create(...) - - pattern: | - $C = OpenAI(...) - ... - $C.embeddings.create(...) - - pattern: | - $C = AsyncOpenAI(...) - ... - $C.chat.completions.create(...) - - pattern: | - $C = AsyncOpenAI(...) - ... - $C.responses.create(...) - - pattern: | - $C = AsyncOpenAI(...) - ... - $C.embeddings.create(...) - - pattern-not: | - $C = GuardrailsOpenAI(...) - - pattern-not: | - $C = GuardrailsAsyncOpenAI(...) - severity: WARNING - - id: codacy.python.openai.import-without-guardrails - languages: - - python - message: OpenAI SDK imported without Guardrails import. Consider GuardrailsOpenAI / GuardrailsAsyncOpenAI. - metadata: - category: security - confidence: MEDIUM - references: - - https://openai.github.io/openai-guardrails-python/ - pattern: | - import openai - pattern-not: "from guardrails import GuardrailsOpenAI |\nfrom guardrails import GuardrailsAsyncOpenAI \n" - severity: INFO diff --git a/plugins/tools/trivy/test/expected.sarif b/plugins/tools/trivy/test/expected.sarif index 264569c0..3bbeeb63 100644 --- a/plugins/tools/trivy/test/expected.sarif +++ b/plugins/tools/trivy/test/expected.sarif @@ -14,61 +14,61 @@ "locations": [ { "message": { - "text": "requirements.txt: django@1.11.29" + "text": "package-lock.json: ajv@6.12.6" }, "physicalLocation": { "artifactLocation": { - "uri": "requirements.txt", + "uri": "package-lock.json", "uriBaseId": "ROOTPATH" }, "region": { "endColumn": 1, - "endLine": 1, + "endLine": 316, "startColumn": 1, - "startLine": 1 + "startLine": 302 } } } ], "message": { - "text": "Package: django\nInstalled Version: 1.11.29\nVulnerability CVE-2021-33203\nSeverity: MEDIUM\nFixed Version: 2.2.24, 3.1.12, 3.2.4\nLink: [CVE-2021-33203](https://avd.aquasec.com/nvd/cve-2021-33203)" + "text": "Package: ajv\nInstalled Version: 6.12.6\nVulnerability CVE-2025-69873\nSeverity: MEDIUM\nFixed Version: 8.18.0, 6.14.0\nLink: [CVE-2025-69873](https://avd.aquasec.com/nvd/cve-2025-69873)" }, - "ruleId": "CVE-2021-33203", - "ruleIndex": 14 + "ruleId": "CVE-2025-69873", + "ruleIndex": 0 }, { "level": "error", "locations": [ { "message": { - "text": "requirements.txt: django@1.11.29" + "text": "package-lock.json: brace-expansion@1.1.11" }, "physicalLocation": { "artifactLocation": { - "uri": "requirements.txt", + "uri": "package-lock.json", "uriBaseId": "ROOTPATH" }, "region": { "endColumn": 1, - "endLine": 1, + "endLine": 357, "startColumn": 1, - "startLine": 1 + "startLine": 349 } } } ], "message": { - "text": "Package: django\nInstalled Version: 1.11.29\nVulnerability CVE-2022-36359\nSeverity: HIGH\nFixed Version: 3.2.15, 4.0.7\nLink: [CVE-2022-36359](https://avd.aquasec.com/nvd/cve-2022-36359)" + "text": "Package: brace-expansion\nInstalled Version: 1.1.11\nVulnerability CVE-2026-13149\nSeverity: HIGH\nFixed Version: 5.0.7, 1.1.16, 2.1.2\nLink: [CVE-2026-13149](https://avd.aquasec.com/nvd/cve-2026-13149)" }, - "ruleId": "CVE-2022-36359", - "ruleIndex": 11 + "ruleId": "CVE-2026-13149", + "ruleIndex": 1 }, { "level": "error", "locations": [ { "message": { - "text": "package-lock.json: cross-spawn@7.0.3" + "text": "package-lock.json: brace-expansion@1.1.11" }, "physicalLocation": { "artifactLocation": { @@ -77,17 +77,44 @@ }, "region": { "endColumn": 1, - "endLine": 527, + "endLine": 357, "startColumn": 1, - "startLine": 515 + "startLine": 349 } } } ], "message": { - "text": "Package: cross-spawn\nInstalled Version: 7.0.3\nVulnerability CVE-2024-21538\nSeverity: HIGH\nFixed Version: 7.0.5, 6.0.6\nLink: [CVE-2024-21538](https://avd.aquasec.com/nvd/cve-2024-21538)" + "text": "Package: brace-expansion\nInstalled Version: 1.1.11\nVulnerability CVE-2026-14257\nSeverity: HIGH\nFixed Version: 5.0.8, 3.0.3, 2.1.3, 1.1.17\nLink: [CVE-2026-14257](https://avd.aquasec.com/nvd/cve-2026-14257)" }, - "ruleId": "CVE-2024-21538", + "ruleId": "CVE-2026-14257", + "ruleIndex": 2 + }, + { + "level": "error", + "locations": [ + { + "message": { + "text": "package-lock.json: brace-expansion@1.1.11" + }, + "physicalLocation": { + "artifactLocation": { + "uri": "package-lock.json", + "uriBaseId": "ROOTPATH" + }, + "region": { + "endColumn": 1, + "endLine": 357, + "startColumn": 1, + "startLine": 349 + } + } + } + ], + "message": { + "text": "Package: brace-expansion\nInstalled Version: 1.1.11\nVulnerability CVE-2026-69152\nSeverity: HIGH\nFixed Version: 1.1.18, 2.1.4, 3.0.6, 5.0.9\nLink: [CVE-2026-69152](https://avd.aquasec.com/nvd/cve-2026-69152)" + }, + "ruleId": "CVE-2026-69152", "ruleIndex": 3 }, { @@ -95,88 +122,88 @@ "locations": [ { "message": { - "text": "requirements.txt: django@1.11.29" + "text": "package-lock.json: brace-expansion@1.1.11" }, "physicalLocation": { "artifactLocation": { - "uri": "requirements.txt", + "uri": "package-lock.json", "uriBaseId": "ROOTPATH" }, "region": { "endColumn": 1, - "endLine": 1, + "endLine": 357, "startColumn": 1, - "startLine": 1 + "startLine": 349 } } } ], "message": { - "text": "Package: django\nInstalled Version: 1.11.29\nVulnerability CVE-2024-45231\nSeverity: MEDIUM\nFixed Version: 5.1.1, 5.0.9, 4.2.16\nLink: [CVE-2024-45231](https://avd.aquasec.com/nvd/cve-2024-45231)" + "text": "Package: brace-expansion\nInstalled Version: 1.1.11\nVulnerability CVE-2026-33750\nSeverity: MEDIUM\nFixed Version: 5.0.5, 3.0.2, 2.0.3, 1.1.13\nLink: [CVE-2026-33750](https://avd.aquasec.com/nvd/cve-2026-33750)" }, - "ruleId": "CVE-2024-45231", - "ruleIndex": 15 + "ruleId": "CVE-2026-33750", + "ruleIndex": 4 }, { - "level": "warning", + "level": "note", "locations": [ { "message": { - "text": "requirements.txt: django@1.11.29" + "text": "package-lock.json: brace-expansion@1.1.11" }, "physicalLocation": { "artifactLocation": { - "uri": "requirements.txt", + "uri": "package-lock.json", "uriBaseId": "ROOTPATH" }, "region": { "endColumn": 1, - "endLine": 1, + "endLine": 357, "startColumn": 1, - "startLine": 1 + "startLine": 349 } } } ], "message": { - "text": "Package: django\nInstalled Version: 1.11.29\nVulnerability CVE-2025-48432\nSeverity: MEDIUM\nFixed Version: 5.2.2, 5.1.10, 4.2.22\nLink: [CVE-2025-48432](https://avd.aquasec.com/nvd/cve-2025-48432)" + "text": "Package: brace-expansion\nInstalled Version: 1.1.11\nVulnerability CVE-2025-5889\nSeverity: LOW\nFixed Version: 2.0.2, 1.1.12, 3.0.1, 4.0.1\nLink: [CVE-2025-5889](https://avd.aquasec.com/nvd/cve-2025-5889)" }, - "ruleId": "CVE-2025-48432", - "ruleIndex": 16 + "ruleId": "CVE-2025-5889", + "ruleIndex": 5 }, { "level": "error", "locations": [ { "message": { - "text": "requirements.txt: django@1.11.29" + "text": "package-lock.json: cross-spawn@7.0.3" }, "physicalLocation": { "artifactLocation": { - "uri": "requirements.txt", + "uri": "package-lock.json", "uriBaseId": "ROOTPATH" }, "region": { "endColumn": 1, - "endLine": 1, + "endLine": 527, "startColumn": 1, - "startLine": 1 + "startLine": 515 } } } ], "message": { - "text": "Package: django\nInstalled Version: 1.11.29\nVulnerability CVE-2025-57833\nSeverity: HIGH\nFixed Version: 4.2.24, 5.1.12, 5.2.6\nLink: [CVE-2025-57833](https://avd.aquasec.com/nvd/cve-2025-57833)" + "text": "Package: cross-spawn\nInstalled Version: 7.0.3\nVulnerability CVE-2024-21538\nSeverity: HIGH\nFixed Version: 7.0.5, 6.0.6\nLink: [CVE-2024-21538](https://avd.aquasec.com/nvd/cve-2024-21538)" }, - "ruleId": "CVE-2025-57833", - "ruleIndex": 12 + "ruleId": "CVE-2024-21538", + "ruleIndex": 6 }, { - "level": "note", + "level": "error", "locations": [ { "message": { - "text": "package-lock.json: brace-expansion@1.1.11" + "text": "package-lock.json: flatted@3.3.1" }, "physicalLocation": { "artifactLocation": { @@ -185,71 +212,98 @@ }, "region": { "endColumn": 1, - "endLine": 357, + "endLine": 823, "startColumn": 1, - "startLine": 349 + "startLine": 819 } } } ], "message": { - "text": "Package: brace-expansion\nInstalled Version: 1.1.11\nVulnerability CVE-2025-5889\nSeverity: LOW\nFixed Version: 2.0.2, 1.1.12, 3.0.1, 4.0.1\nLink: [CVE-2025-5889](https://avd.aquasec.com/nvd/cve-2025-5889)" + "text": "Package: flatted\nInstalled Version: 3.3.1\nVulnerability CVE-2026-32141\nSeverity: HIGH\nFixed Version: 3.4.0\nLink: [CVE-2026-32141](https://avd.aquasec.com/nvd/cve-2026-32141)" }, - "ruleId": "CVE-2025-5889", - "ruleIndex": 2 + "ruleId": "CVE-2026-32141", + "ruleIndex": 7 }, { "level": "error", "locations": [ { "message": { - "text": "requirements.txt: django@1.11.29" + "text": "package-lock.json: flatted@3.3.1" }, "physicalLocation": { "artifactLocation": { - "uri": "requirements.txt", + "uri": "package-lock.json", "uriBaseId": "ROOTPATH" }, "region": { "endColumn": 1, - "endLine": 1, + "endLine": 823, "startColumn": 1, - "startLine": 1 + "startLine": 819 } } } ], "message": { - "text": "Package: django\nInstalled Version: 1.11.29\nVulnerability CVE-2025-64458\nSeverity: HIGH\nFixed Version: 5.2.8, 5.1.14, 4.2.26\nLink: [CVE-2025-64458](https://avd.aquasec.com/nvd/cve-2025-64458)" + "text": "Package: flatted\nInstalled Version: 3.3.1\nVulnerability CVE-2026-33228\nSeverity: HIGH\nFixed Version: 3.4.2\nLink: [CVE-2026-33228](https://avd.aquasec.com/nvd/cve-2026-33228)" }, - "ruleId": "CVE-2025-64458", - "ruleIndex": 13 + "ruleId": "CVE-2026-33228", + "ruleIndex": 8 }, { "level": "error", "locations": [ { "message": { - "text": "requirements.txt: django@1.11.29" + "text": "package-lock.json: js-yaml@4.1.0" }, "physicalLocation": { "artifactLocation": { - "uri": "requirements.txt", + "uri": "package-lock.json", "uriBaseId": "ROOTPATH" }, "region": { "endColumn": 1, - "endLine": 1, + "endLine": 1003, "startColumn": 1, - "startLine": 1 + "startLine": 993 } } } ], "message": { - "text": "Package: django\nInstalled Version: 1.11.29\nVulnerability CVE-2025-64459\nSeverity: CRITICAL\nFixed Version: 5.2.8, 5.1.14, 4.2.26\nLink: [CVE-2025-64459](https://avd.aquasec.com/nvd/cve-2025-64459)" + "text": "Package: js-yaml\nInstalled Version: 4.1.0\nVulnerability CVE-2026-59869\nSeverity: HIGH\nFixed Version: 3.15.0, 4.3.0\nLink: [CVE-2026-59869](https://avd.aquasec.com/nvd/cve-2026-59869)" }, - "ruleId": "CVE-2025-64459", + "ruleId": "CVE-2026-59869", + "ruleIndex": 9 + }, + { + "level": "error", + "locations": [ + { + "message": { + "text": "package-lock.json: js-yaml@4.1.0" + }, + "physicalLocation": { + "artifactLocation": { + "uri": "package-lock.json", + "uriBaseId": "ROOTPATH" + }, + "region": { + "endColumn": 1, + "endLine": 1003, + "startColumn": 1, + "startLine": 993 + } + } + } + ], + "message": { + "text": "Package: js-yaml\nInstalled Version: 4.1.0\nVulnerability GHSA-5p4m-2wfm-xmqj\nSeverity: HIGH\nFixed Version: 4.3.1, 3.15.1\nLink: [GHSA-5p4m-2wfm-xmqj](https://github.com/advisories/GHSA-5p4m-2wfm-xmqj)" + }, + "ruleId": "GHSA-5p4m-2wfm-xmqj", "ruleIndex": 10 }, { @@ -277,14 +331,14 @@ "text": "Package: js-yaml\nInstalled Version: 4.1.0\nVulnerability CVE-2025-64718\nSeverity: MEDIUM\nFixed Version: 4.1.1, 3.14.2\nLink: [CVE-2025-64718](https://avd.aquasec.com/nvd/cve-2025-64718)" }, "ruleId": "CVE-2025-64718", - "ruleIndex": 6 + "ruleIndex": 11 }, { "level": "warning", "locations": [ { "message": { - "text": "package-lock.json: ajv@6.12.6" + "text": "package-lock.json: js-yaml@4.1.0" }, "physicalLocation": { "artifactLocation": { @@ -293,18 +347,18 @@ }, "region": { "endColumn": 1, - "endLine": 316, + "endLine": 1003, "startColumn": 1, - "startLine": 302 + "startLine": 993 } } } ], "message": { - "text": "Package: ajv\nInstalled Version: 6.12.6\nVulnerability CVE-2025-69873\nSeverity: MEDIUM\nFixed Version: 8.18.0, 6.14.0\nLink: [CVE-2025-69873](https://avd.aquasec.com/nvd/cve-2025-69873)" + "text": "Package: js-yaml\nInstalled Version: 4.1.0\nVulnerability CVE-2026-53550\nSeverity: MEDIUM\nFixed Version: 4.2.0, 3.15.0\nLink: [CVE-2026-53550](https://avd.aquasec.com/nvd/cve-2026-53550)" }, - "ruleId": "CVE-2025-69873", - "ruleIndex": 0 + "ruleId": "CVE-2026-53550", + "ruleIndex": 12 }, { "level": "error", @@ -331,7 +385,7 @@ "text": "Package: minimatch\nInstalled Version: 3.1.2\nVulnerability CVE-2026-26996\nSeverity: HIGH\nFixed Version: 10.2.1, 9.0.6, 8.0.5, 7.4.7, 6.2.1, 5.1.7, 4.2.4, 3.1.3\nLink: [CVE-2026-26996](https://avd.aquasec.com/nvd/cve-2026-26996)" }, "ruleId": "CVE-2026-26996", - "ruleIndex": 7 + "ruleIndex": 13 }, { "level": "error", @@ -358,7 +412,7 @@ "text": "Package: minimatch\nInstalled Version: 3.1.2\nVulnerability CVE-2026-27903\nSeverity: HIGH\nFixed Version: 10.2.3, 9.0.7, 8.0.6, 7.4.8, 6.2.2, 5.1.8, 4.2.5, 3.1.3\nLink: [CVE-2026-27903](https://avd.aquasec.com/nvd/cve-2026-27903)" }, "ruleId": "CVE-2026-27903", - "ruleIndex": 8 + "ruleIndex": 14 }, { "level": "error", @@ -385,88 +439,358 @@ "text": "Package: minimatch\nInstalled Version: 3.1.2\nVulnerability CVE-2026-27904\nSeverity: HIGH\nFixed Version: 10.2.3, 9.0.7, 8.0.6, 7.4.8, 6.2.2, 5.1.8, 4.2.5, 3.1.4\nLink: [CVE-2026-27904](https://avd.aquasec.com/nvd/cve-2026-27904)" }, "ruleId": "CVE-2026-27904", - "ruleIndex": 9 + "ruleIndex": 15 }, { "level": "error", "locations": [ { "message": { - "text": "package-lock.json: flatted@3.3.1" + "text": "requirements.txt: django@1.11.29" }, "physicalLocation": { "artifactLocation": { - "uri": "package-lock.json", + "uri": "requirements.txt", "uriBaseId": "ROOTPATH" }, "region": { "endColumn": 1, - "endLine": 823, + "endLine": 1, "startColumn": 1, - "startLine": 819 + "startLine": 1 } } } ], "message": { - "text": "Package: flatted\nInstalled Version: 3.3.1\nVulnerability CVE-2026-32141\nSeverity: HIGH\nFixed Version: 3.4.0\nLink: [CVE-2026-32141](https://avd.aquasec.com/nvd/cve-2026-32141)" + "text": "Package: django\nInstalled Version: 1.11.29\nVulnerability CVE-2025-64459\nSeverity: CRITICAL\nFixed Version: 5.2.8, 5.1.14, 4.2.26\nLink: [CVE-2025-64459](https://avd.aquasec.com/nvd/cve-2025-64459)" }, - "ruleId": "CVE-2026-32141", - "ruleIndex": 4 + "ruleId": "CVE-2025-64459", + "ruleIndex": 16 }, { "level": "error", "locations": [ { "message": { - "text": "package-lock.json: flatted@3.3.1" + "text": "requirements.txt: django@1.11.29" }, "physicalLocation": { "artifactLocation": { - "uri": "package-lock.json", + "uri": "requirements.txt", "uriBaseId": "ROOTPATH" }, "region": { "endColumn": 1, - "endLine": 823, + "endLine": 1, "startColumn": 1, - "startLine": 819 + "startLine": 1 } } } ], "message": { - "text": "Package: flatted\nInstalled Version: 3.3.1\nVulnerability CVE-2026-33228\nSeverity: HIGH\nFixed Version: 3.4.2\nLink: [CVE-2026-33228](https://avd.aquasec.com/nvd/cve-2026-33228)" + "text": "Package: django\nInstalled Version: 1.11.29\nVulnerability CVE-2022-36359\nSeverity: HIGH\nFixed Version: 3.2.15, 4.0.7\nLink: [CVE-2022-36359](https://avd.aquasec.com/nvd/cve-2022-36359)" }, - "ruleId": "CVE-2026-33228", - "ruleIndex": 5 + "ruleId": "CVE-2022-36359", + "ruleIndex": 17 + }, + { + "level": "error", + "locations": [ + { + "message": { + "text": "requirements.txt: django@1.11.29" + }, + "physicalLocation": { + "artifactLocation": { + "uri": "requirements.txt", + "uriBaseId": "ROOTPATH" + }, + "region": { + "endColumn": 1, + "endLine": 1, + "startColumn": 1, + "startLine": 1 + } + } + } + ], + "message": { + "text": "Package: django\nInstalled Version: 1.11.29\nVulnerability CVE-2025-57833\nSeverity: HIGH\nFixed Version: 4.2.24, 5.1.12, 5.2.6\nLink: [CVE-2025-57833](https://avd.aquasec.com/nvd/cve-2025-57833)" + }, + "ruleId": "CVE-2025-57833", + "ruleIndex": 18 + }, + { + "level": "error", + "locations": [ + { + "message": { + "text": "requirements.txt: django@1.11.29" + }, + "physicalLocation": { + "artifactLocation": { + "uri": "requirements.txt", + "uriBaseId": "ROOTPATH" + }, + "region": { + "endColumn": 1, + "endLine": 1, + "startColumn": 1, + "startLine": 1 + } + } + } + ], + "message": { + "text": "Package: django\nInstalled Version: 1.11.29\nVulnerability CVE-2025-64458\nSeverity: HIGH\nFixed Version: 5.2.8, 5.1.14, 4.2.26\nLink: [CVE-2025-64458](https://avd.aquasec.com/nvd/cve-2025-64458)" + }, + "ruleId": "CVE-2025-64458", + "ruleIndex": 19 }, { "level": "warning", "locations": [ { "message": { - "text": "package-lock.json: brace-expansion@1.1.11" + "text": "requirements.txt: django@1.11.29" }, "physicalLocation": { "artifactLocation": { - "uri": "package-lock.json", + "uri": "requirements.txt", "uriBaseId": "ROOTPATH" }, "region": { "endColumn": 1, - "endLine": 357, + "endLine": 1, "startColumn": 1, - "startLine": 349 + "startLine": 1 } } } ], "message": { - "text": "Package: brace-expansion\nInstalled Version: 1.1.11\nVulnerability CVE-2026-33750\nSeverity: MEDIUM\nFixed Version: 5.0.5, 3.0.2, 2.0.3, 1.1.13\nLink: [CVE-2026-33750](https://avd.aquasec.com/nvd/cve-2026-33750)" + "text": "Package: django\nInstalled Version: 1.11.29\nVulnerability CVE-2021-33203\nSeverity: MEDIUM\nFixed Version: 2.2.24, 3.1.12, 3.2.4\nLink: [CVE-2021-33203](https://avd.aquasec.com/nvd/cve-2021-33203)" }, - "ruleId": "CVE-2026-33750", - "ruleIndex": 1 + "ruleId": "CVE-2021-33203", + "ruleIndex": 20 + }, + { + "level": "warning", + "locations": [ + { + "message": { + "text": "requirements.txt: django@1.11.29" + }, + "physicalLocation": { + "artifactLocation": { + "uri": "requirements.txt", + "uriBaseId": "ROOTPATH" + }, + "region": { + "endColumn": 1, + "endLine": 1, + "startColumn": 1, + "startLine": 1 + } + } + } + ], + "message": { + "text": "Package: django\nInstalled Version: 1.11.29\nVulnerability CVE-2024-45231\nSeverity: MEDIUM\nFixed Version: 5.1.1, 5.0.9, 4.2.16\nLink: [CVE-2024-45231](https://avd.aquasec.com/nvd/cve-2024-45231)" + }, + "ruleId": "CVE-2024-45231", + "ruleIndex": 21 + }, + { + "level": "warning", + "locations": [ + { + "message": { + "text": "requirements.txt: django@1.11.29" + }, + "physicalLocation": { + "artifactLocation": { + "uri": "requirements.txt", + "uriBaseId": "ROOTPATH" + }, + "region": { + "endColumn": 1, + "endLine": 1, + "startColumn": 1, + "startLine": 1 + } + } + } + ], + "message": { + "text": "Package: django\nInstalled Version: 1.11.29\nVulnerability CVE-2025-48432\nSeverity: MEDIUM\nFixed Version: 5.2.2, 5.1.10, 4.2.22\nLink: [CVE-2025-48432](https://avd.aquasec.com/nvd/cve-2025-48432)" + }, + "ruleId": "CVE-2025-48432", + "ruleIndex": 22 + }, + { + "level": "warning", + "locations": [ + { + "message": { + "text": "requirements.txt: django@1.11.29" + }, + "physicalLocation": { + "artifactLocation": { + "uri": "requirements.txt", + "uriBaseId": "ROOTPATH" + }, + "region": { + "endColumn": 1, + "endLine": 1, + "startColumn": 1, + "startLine": 1 + } + } + } + ], + "message": { + "text": "Package: django\nInstalled Version: 1.11.29\nVulnerability CVE-2026-53877\nSeverity: MEDIUM\nFixed Version: 5.2.16, 6.0.7\nLink: [CVE-2026-53877](https://avd.aquasec.com/nvd/cve-2026-53877)" + }, + "ruleId": "CVE-2026-53877", + "ruleIndex": 23 + }, + { + "level": "warning", + "locations": [ + { + "message": { + "text": "requirements.txt: django@1.11.29" + }, + "physicalLocation": { + "artifactLocation": { + "uri": "requirements.txt", + "uriBaseId": "ROOTPATH" + }, + "region": { + "endColumn": 1, + "endLine": 1, + "startColumn": 1, + "startLine": 1 + } + } + } + ], + "message": { + "text": "Package: django\nInstalled Version: 1.11.29\nVulnerability CVE-2026-53878\nSeverity: MEDIUM\nFixed Version: 5.2.16, 6.0.7\nLink: [CVE-2026-53878](https://avd.aquasec.com/nvd/cve-2026-53878)" + }, + "ruleId": "CVE-2026-53878", + "ruleIndex": 24 + }, + { + "level": "note", + "locations": [ + { + "message": { + "text": "requirements.txt: django@1.11.29" + }, + "physicalLocation": { + "artifactLocation": { + "uri": "requirements.txt", + "uriBaseId": "ROOTPATH" + }, + "region": { + "endColumn": 1, + "endLine": 1, + "startColumn": 1, + "startLine": 1 + } + } + } + ], + "message": { + "text": "Package: django\nInstalled Version: 1.11.29\nVulnerability CVE-2026-48587\nSeverity: LOW\nFixed Version: 5.2.15, 6.0.6\nLink: [CVE-2026-48587](https://avd.aquasec.com/nvd/cve-2026-48587)" + }, + "ruleId": "CVE-2026-48587", + "ruleIndex": 25 + }, + { + "level": "note", + "locations": [ + { + "message": { + "text": "requirements.txt: django@1.11.29" + }, + "physicalLocation": { + "artifactLocation": { + "uri": "requirements.txt", + "uriBaseId": "ROOTPATH" + }, + "region": { + "endColumn": 1, + "endLine": 1, + "startColumn": 1, + "startLine": 1 + } + } + } + ], + "message": { + "text": "Package: django\nInstalled Version: 1.11.29\nVulnerability CVE-2026-48588\nSeverity: LOW\nFixed Version: 5.2.16, 6.0.7\nLink: [CVE-2026-48588](https://avd.aquasec.com/nvd/cve-2026-48588)" + }, + "ruleId": "CVE-2026-48588", + "ruleIndex": 26 + }, + { + "level": "note", + "locations": [ + { + "message": { + "text": "requirements.txt: django@1.11.29" + }, + "physicalLocation": { + "artifactLocation": { + "uri": "requirements.txt", + "uriBaseId": "ROOTPATH" + }, + "region": { + "endColumn": 1, + "endLine": 1, + "startColumn": 1, + "startLine": 1 + } + } + } + ], + "message": { + "text": "Package: django\nInstalled Version: 1.11.29\nVulnerability CVE-2026-6873\nSeverity: LOW\nFixed Version: 5.2.15, 6.0.6\nLink: [CVE-2026-6873](https://avd.aquasec.com/nvd/cve-2026-6873)" + }, + "ruleId": "CVE-2026-6873", + "ruleIndex": 27 + }, + { + "level": "note", + "locations": [ + { + "message": { + "text": "requirements.txt: django@1.11.29" + }, + "physicalLocation": { + "artifactLocation": { + "uri": "requirements.txt", + "uriBaseId": "ROOTPATH" + }, + "region": { + "endColumn": 1, + "endLine": 1, + "startColumn": 1, + "startLine": 1 + } + } + } + ], + "message": { + "text": "Package: django\nInstalled Version: 1.11.29\nVulnerability CVE-2026-8404\nSeverity: LOW\nFixed Version: 5.2.15, 6.0.6\nLink: [CVE-2026-8404](https://avd.aquasec.com/nvd/cve-2026-8404)" + }, + "ruleId": "CVE-2026-8404", + "ruleIndex": 28 } ], "tool": { diff --git a/tools/lizard/test/lizard.yaml b/tools/lizard/test/lizard.yaml new file mode 100644 index 00000000..ff761c40 --- /dev/null +++ b/tools/lizard/test/lizard.yaml @@ -0,0 +1,43 @@ +# Test input, not a snapshot of Codacy's current Lizard patterns: it pins the pattern +# set so the SARIF assertion doesn't depend on the live API returning the same patterns. +patterns: + Lizard_ccn-medium: + id: Lizard_ccn-medium + category: CodeStyle + level: Warning + severityLevel: Warning + title: Cyclomatic complexity + description: Checks if the cyclomatic complexity of a function or logic block exceeds the medium threshold (default is 8). + explanation: Functions with a high cyclomatic complexity are harder to test and maintain. + timeToFix: 5 + threshold: 8 + Lizard_file-nloc-medium: + id: Lizard_file-nloc-medium + category: CodeStyle + level: Warning + severityLevel: Warning + title: File lines of code + description: This rule checks if the number of lines of code (excluding comments) in a file exceeds a medium threshold, typically 500 lines. + explanation: Large files usually mix several concerns and are harder to navigate. + timeToFix: 5 + threshold: 500 + Lizard_nloc-medium: + id: Lizard_nloc-medium + category: CodeStyle + level: Warning + severityLevel: Warning + title: Method lines of code + description: Checks if the number of lines of code (excluding comments) in a function exceeds a medium threshold (default 50 lines). + explanation: Long functions usually handle more than one responsibility. + timeToFix: 5 + threshold: 50 + Lizard_parameter-count-medium: + id: Lizard_parameter-count-medium + category: CodeStyle + level: Warning + severityLevel: Warning + title: Parameter count + description: This rule checks the number of parameters passed to a function and raises an issue if it exceeds a medium threshold, which by default is 8 parameters. + explanation: A wide signature is hard to call correctly. + timeToFix: 5 + threshold: 8 From 77e24593c8dbd75d855e2aaff58de6853457a336 Mon Sep 17 00:00:00 2001 From: Pedro Pereira Date: Tue, 18 Aug 2026 15:56:43 +0100 Subject: [PATCH 2/2] test: Refresh init-with-token Lizard fixture OD-497 Same upstream pattern drift as the other fixtures; regenerating this one needs a Codacy API token, so it was rebuilt from the CI diff. Co-Authored-By: Claude Opus 5 (1M context) --- .../expected/tools-configs/lizard.yaml | 16 ++++++++-------- 1 file changed, 8 insertions(+), 8 deletions(-) diff --git a/integration-tests/init-with-token/expected/tools-configs/lizard.yaml b/integration-tests/init-with-token/expected/tools-configs/lizard.yaml index ed6e6434..8ac2201d 100644 --- a/integration-tests/init-with-token/expected/tools-configs/lizard.yaml +++ b/integration-tests/init-with-token/expected/tools-configs/lizard.yaml @@ -1,20 +1,20 @@ patterns: Lizard_ccn-minor: category: Complexity - description: Checks that the cyclomatic complexity of functions or logic blocks does not exceed a minor threshold, defaulting to 5. + description: Reports a Minor issue when a function's cyclomatic complexity (the number of independent decision paths through it) reaches the configured threshold, which defaults to 10. This is the earliest warning tier, flagging functions that are beginning to accumulate branching logic. explanation: |- # Minor Cyclomatic Complexity control - Check the Cyclomatic Complexity value of a function or logic block. If the threshold is not met, raise a Minor issue. The default threshold is 4. + Check the Cyclomatic Complexity value of a function or logic block. If the threshold is exceeded, raise a Minor issue. The default threshold is 10. id: Lizard_ccn-minor level: Info severityLevel: Info - threshold: 5 + threshold: 10 timeToFix: 5 - title: Enforce Minor Cyclomatic Complexity Threshold + title: Limit Function Cyclomatic Complexity (Minor) Lizard_nloc-critical: category: Complexity - description: Checks if functions or logic blocks exceed a set maximum number of lines of code (excluding comments), defaulting to 100 lines. + description: Reports a Critical issue when a function's number of lines of code (excluding comments) reaches the configured threshold, which defaults to 100. A function this large almost certainly bundles many responsibilities and is very hard to understand, test, and change safely. explanation: |- # Critical NLOC control - Number of Lines of Code (without comments) @@ -24,10 +24,10 @@ patterns: severityLevel: Error threshold: 100 timeToFix: 15 - title: Enforce Maximum Number of Lines of Code in Functions + title: Limit Function Length (Critical) Lizard_nloc-medium: category: Complexity - description: Checks if the number of lines of code (excluding comments) in a function exceeds a medium threshold (default 50 lines). + description: Reports a Medium issue when a function's number of lines of code (excluding comments) reaches the configured threshold, which defaults to 50. Functions this long usually handle more than one responsibility and are noticeably harder to follow. explanation: |- # Medium NLOC control - Number of Lines of Code (without comments) @@ -37,4 +37,4 @@ patterns: severityLevel: Warning threshold: 50 timeToFix: 10 - title: Enforce Medium Number of Lines of Code (NLOC) Limit + title: Limit Function Length (Medium)