ACOMMONS-237 Export the S5332 identifier URL inventory through the shared npm package

commons/src/main/java/org/sonarsource/analyzer/commons/appsec/CleartextProtocolFilter.java

@@ -223,6 +223,44 @@ public final class CleartextProtocolFilter {
   private static final Pattern CLEARTEXT_AUTHORITY = Pattern.compile(
     "^(?:" + String.join("|", CLEARTEXT_SCHEMES) + ")://(?:[^@\\s/?#]++@)?(?<rest>[^\\s/?#]++)", Pattern.CASE_INSENSITIVE);
 
+  // JS-2698: exact authorities and case-sensitive path + query + fragment patterns.
+  // Matching an identifier is separate from deciding whether an actual connection is safe.
+  private static final Map<String, Pattern> IDENTIFIER_URLS = Map.of();
+
+  private static final Pattern IDENTIFIER_URL = Pattern.compile(
+    "^http://([^\\s/?#\\\\]+)([/?#][^\\s\\\\]*)?$", Pattern.CASE_INSENSITIVE);
+
+  /**
+   * Recognizes the namespace, schema, vocabulary and protocol identifier inventory shared with SonarJS.
+   * The analyzer must verify the identifier role in its AST before suppressing an issue. A matching
+   * URL used as a network destination still requires transport analysis.
+   *
+   * <p>Authorities match exactly, including any explicit port; path, query and fragment retain their
+   * case and spelling. An empty path is represented by {@code /}.
+   */
+  public static boolean isKnownIdentifier(String url) {
+    var matcher = IDENTIFIER_URL.matcher(url.strip());
+    if (!matcher.matches()) {
+      return false;
+    }
+    var pattern = IDENTIFIER_URLS.get(matcher.group(1).toLowerCase(Locale.ROOT));
+    var remainder = matcher.group(2);
+    var suffix = remainder == null ? "/" : remainder;
+    if (!suffix.startsWith("/")) {
+      suffix = "/" + suffix;
+    }
+    return pattern != null && pattern.matcher(suffix).find();
+  }
+
+  /**
+   * Returns the identifier inventory as an immutable authority-to-regex map for non-JVM analyzers.
+   * Regex strings retain the case-sensitive matching semantics of {@link #isKnownIdentifier(String)}.
+   */
+  public static Map<String, String> exportIdentifierUrls() {
+    return IDENTIFIER_URLS.entrySet().stream()
+      .collect(Collectors.toUnmodifiableMap(Map.Entry::getKey, entry -> entry.getValue().pattern()));
+  }
+
   private CleartextProtocolFilter() {
   }
 

commons/src/test/java/org/sonarsource/analyzer/commons/appsec/CleartextProtocolFilterTest.java

@@ -27,6 +27,19 @@
 
 class CleartextProtocolFilterTest {
 
+  @Test
+  void emptyIdentifierInventoryDoesNotMatchUrls() {
+    assertThat(CleartextProtocolFilter.exportIdentifierUrls()).isEmpty();
+    assertThat(CleartextProtocolFilter.isKnownIdentifier("http://identifier.invalid/schema")).isFalse();
+  }
+
+  @Test
+  void exportedIdentifierUrlsAreUnmodifiable() {
+    var urls = CleartextProtocolFilter.exportIdentifierUrls();
+    assertThatExceptionOfType(UnsupportedOperationException.class)
+      .isThrownBy(() -> urls.put("identifier.invalid", "^/"));
+  }
+
   @Test
   void getCleartextProtocolsIsUnmodifiable() {
     var protocols = CleartextProtocolFilter.getCleartextProtocols();

sonar-analyzer-commons-configurations/pom.xml

@@ -12,15 +12,17 @@
   <artifactId>sonar-analyzer-commons-configurations</artifactId>
   <name>SonarSource Analyzers Commons Configurations</name>
   <description>Machine-readable export (JSON, .nupkg, npm .tgz) of shared analyzer configuration generated from
-    sonar-analyzer-commons, so non-JVM analyzers can consume the same secret-exclusion patterns - and the corpus that
-    validates them against their own regex engine - without drift</description>
+    sonar-analyzer-commons, so non-JVM analyzers can consume the same secret-exclusion patterns, validation corpus,
+    and identifier URL inventory without drift</description>
 
   <properties>
     <exporter.mainClass>org.sonarsource.analyzer.commons.appsec.export.SecretPatternsExporter</exporter.mainClass>
     <corpus.exporter.mainClass>org.sonarsource.analyzer.commons.appsec.export.SecretExclusionCorpusExporter</corpus.exporter.mainClass>
-    <!-- Written by the exporters, then packaged as the raw JSON artifacts and bundled into the nupkg/npm archives. -->
+    <identifier.exporter.mainClass>org.sonarsource.analyzer.commons.appsec.export.IdentifierUrlsExporter</identifier.exporter.mainClass>
+    <!-- Written by the exporters, then included in the corresponding distribution packages. -->
     <generated.json>${project.build.directory}/generated-resources/secret-patterns.json</generated.json>
     <generated.corpus.json>${project.build.directory}/generated-resources/secret-exclusion-corpus.json</generated.corpus.json>
+    <generated.identifiers.json>${project.build.directory}/generated-resources/identifier-urls.json</generated.identifiers.json>
     <version.exec.plugin>3.6.4</version.exec.plugin>
     <version.build-helper.plugin>3.6.2</version.build-helper.plugin>
   </properties>
@@ -82,6 +84,19 @@
               </arguments>
             </configuration>
           </execution>
+          <execution>
+            <id>generate-identifier-urls-json</id>
+            <phase>prepare-package</phase>
+            <goals>
+              <goal>java</goal>
+            </goals>
+            <configuration>
+              <mainClass>${identifier.exporter.mainClass}</mainClass>
+              <arguments>
+                <argument>${generated.identifiers.json}</argument>
+              </arguments>
+            </configuration>
+          </execution>
           <execution>
             <id>generate-secret-exclusion-corpus-json</id>
             <phase>prepare-package</phase>

sonar-analyzer-commons-configurations/src/main/assembly/npm.xml

@@ -30,5 +30,10 @@
       <outputDirectory>package</outputDirectory>
       <destName>secret-exclusion-corpus.json</destName>
     </file>
+    <file>
+      <source>${project.build.directory}/generated-resources/identifier-urls.json</source>
+      <outputDirectory>package</outputDirectory>
+      <destName>identifier-urls.json</destName>
+    </file>
   </files>
 </assembly>

sonar-analyzer-commons-configurations/src/main/java/org/sonarsource/analyzer/commons/appsec/export/IdentifierUrlsExporter.java

@@ -0,0 +1,52 @@
+/*
+ * SonarSource Analyzers Commons Configurations
+ * Copyright (C) SonarSource Sàrl
+ * mailto:info AT sonarsource DOT com
+ *
+ * You can redistribute and/or modify this program under the terms of
+ * the Sonar Source-Available License Version 1, as published by SonarSource Sàrl.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.
+ * See the Sonar Source-Available License for more details.
+ *
+ * You should have received a copy of the Sonar Source-Available License
+ * along with this program; if not, see https://sonarsource.com/license/ssal/
+ */
+package org.sonarsource.analyzer.commons.appsec.export;
+
+import com.google.gson.JsonObject;
+import java.util.TreeMap;
+import org.sonarsource.analyzer.commons.appsec.CleartextProtocolFilter;
+
+/**
+ * Generates the identifier URL inventory shared with non-JVM analyzers.
+ */
+public final class IdentifierUrlsExporter {
+
+  private IdentifierUrlsExporter() {
+  }
+
+  public static void main(String[] args) {
+    if (args.length < 1) {
+      throw new IllegalArgumentException("Usage: IdentifierUrlsExporter <output-json-path>");
+    }
+    JsonExports.write(args[0], toJson());
+  }
+
+  /**
+   * Converts the Java identifier inventory to JSON text, with entries sorted by domain.
+   * Example output for an empty inventory:
+   * <pre>{@code
+   * {
+   * }
+   * }</pre>
+   * The caller writes the returned text to {@code identifier-urls.json}.
+   */
+  public static String toJson() {
+    JsonObject root = new JsonObject();
+    new TreeMap<>(CleartextProtocolFilter.exportIdentifierUrls()).forEach(root::addProperty);
+    return JsonExports.render(root);
+  }
+}

sonar-analyzer-commons-configurations/src/main/packaging/npm/README.md

@@ -1,9 +1,10 @@
 # @sonarsource/analyzer-commons-configurations
 
-Shared analyzer configuration data (secret-exclusion regexes) generated from the sonar-analyzer-commons
-SecretClassifier, for use by non-JVM SonarSource analyzers.
+Shared analyzer configuration data generated from sonar-analyzer-commons for non-JVM SonarSource analyzers.
 
-The payload is `secret-patterns.json`.
+## Secret exclusions
+
+The secret-exclusion patterns generated from SecretClassifier are in `secret-patterns.json`.
 
 `secret-exclusion-corpus.json` is the matching validation corpus. Every `knownNonSecrets` value must be suppressed by
 `secret-patterns.json` in your regex engine - either matched by a `patternGroups` regex or equal to an
@@ -12,4 +13,32 @@ be. Assert both in your own test suite, so a pattern that fails to compile or be
 caught here rather than becoming a missed or a noisy secret finding. A sample's `category` is informational and should
 not be asserted on.
 
+## Identifier URLs
+
+`identifier-urls.json` is generated from the inventory used by `CleartextProtocolFilter.isKnownIdentifier`.
+It maps exact authorities to regex strings; do not edit the generated file by hand.
+
+```js
+import identifierUrls from '@sonarsource/analyzer-commons-configurations/identifier-urls.json' with { type: 'json' };
+
+const patterns = new Map(
+  Object.entries(identifierUrls).map(([authority, regex]) => [authority, new RegExp(regex)]),
+);
+```
+
+Consumers must follow the Java matcher's semantics:
+
+- Strip surrounding whitespace and accept only `http://`, case-insensitively. Reject the URL if ASCII whitespace
+  or a backslash (`\`) remains anywhere in it.
+- The authority is everything after `http://` up to the first `/`, `?` or `#`, or the end of the string.
+  The remaining text, including that separator if present, is the suffix.
+- Look up the complete authority case-insensitively, including any explicit port. Do not remove ports:
+  `example.invalid:80` does not match `example.invalid`. Subdomains and user information do not match either.
+- Apply the regex case-sensitively with search semantics (`RegExp.test`) to the original path + query + fragment.
+  Use `/` for an empty suffix, and prepend `/` when the suffix starts with `?` or `#`.
+  Do not normalize the path or decode escapes.
+
+A match recognizes an identifier; it does not make an HTTP connection safe. Each analyzer must check the
+language-specific context before suppressing a finding.
+
 See [SonarSource/sonar-analyzer-commons](https://github.com/SonarSource/sonar-analyzer-commons) for details.

sonar-analyzer-commons-configurations/src/main/packaging/npm/package.json

@@ -1,12 +1,13 @@
 {
   "name": "@sonarsource/analyzer-commons-configurations",
   "version": "${npm.package.version}",
-  "description": "Shared analyzer configuration data (secret-exclusion regexes) generated from the sonar-analyzer-commons SecretClassifier, for use by non-JVM SonarSource analyzers. The payload is secret-patterns.json, with the sample values those patterns must reproduce in secret-exclusion-corpus.json.",
+  "description": "Shared secret-exclusion patterns, validation corpus, and identifier URL inventory generated from sonar-analyzer-commons for non-JVM SonarSource analyzers.",
   "license": "LGPL-3.0-only",
   "files": [
     "README.md",
     "secret-patterns.json",
-    "secret-exclusion-corpus.json"
+    "secret-exclusion-corpus.json",
+    "identifier-urls.json"
   ],
   "repository": {
     "type": "git",

sonar-analyzer-commons-configurations/src/test/java/org/sonarsource/analyzer/commons/appsec/export/IdentifierUrlsExporterTest.java

@@ -0,0 +1,56 @@
+/*
+ * SonarSource Analyzers Commons Configurations
+ * Copyright (C) SonarSource Sàrl
+ * mailto:info AT sonarsource DOT com
+ *
+ * You can redistribute and/or modify this program under the terms of
+ * the Sonar Source-Available License Version 1, as published by SonarSource Sàrl.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.
+ * See the Sonar Source-Available License for more details.
+ *
+ * You should have received a copy of the Sonar Source-Available License
+ * along with this program; if not, see https://sonarsource.com/license/ssal/
+ */
+package org.sonarsource.analyzer.commons.appsec.export;
+
+import com.google.gson.JsonObject;
+import com.google.gson.JsonParser;
+import java.io.IOException;
+import java.nio.file.Files;
+import java.nio.file.Path;
+import org.junit.jupiter.api.Test;
+import org.junit.jupiter.api.io.TempDir;
+import org.sonarsource.analyzer.commons.appsec.CleartextProtocolFilter;
+
+import static org.assertj.core.api.Assertions.assertThat;
+import static org.assertj.core.api.Assertions.assertThatThrownBy;
+
+class IdentifierUrlsExporterTest {
+
+  @Test
+  void jsonShouldMatchTheEmptyInventory() {
+    JsonObject inventory = JsonParser.parseString(IdentifierUrlsExporter.toJson()).getAsJsonObject();
+
+    assertThat(inventory.keySet()).isEmpty();
+    assertThat(CleartextProtocolFilter.exportIdentifierUrls()).isEmpty();
+  }
+
+  @Test
+  void mainShouldWriteJsonToTheGivenPath(@TempDir Path tempDir) throws IOException {
+    Path output = tempDir.resolve("generated-resources").resolve("identifier-urls.json");
+
+    IdentifierUrlsExporter.main(new String[] {output.toString()});
+
+    assertThat(Files.readString(output)).isEqualTo(IdentifierUrlsExporter.toJson());
+  }
+
+  @Test
+  void mainShouldFailWhenNoOutputPathIsGiven() {
+    assertThatThrownBy(() -> IdentifierUrlsExporter.main(new String[0]))
+      .isInstanceOf(IllegalArgumentException.class)
+      .hasMessageContaining("Usage");
+  }
+}