Skip to content
Merged
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension


Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
42 changes: 42 additions & 0 deletions CHANGELOG.md
Original file line number Diff line number Diff line change
Expand Up @@ -5,6 +5,48 @@ All notable changes to this project will be documented in this file.
The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).

## [1.2.1] - 2026-06-04

### Added

- Add OpenAPI language support without YAML and JSON conflicts.

### Security

- Update `sslr-yaml-parser` to resolve transitive `guava` vulnerabilities.

### Fixed

- Resolve language suffix conflict between the plugin's custom YAML/JSON support and SonarQube's built-in language detection.

## [1.2.1-beta-2] - 2026-05-28

### Added

- Add OpenAPI language support without YAML and JSON conflicts.

## [1.2.1-beta-1] - 2024-05-22

### Security

- Update `sslr-yaml-parser` to resolve transitive `guava` vulnerabilities.

### Fixed

- Resolve language suffix conflict between the plugin's custom YAML/JSON support and SonarQube's built-in language detection.

## [1.2.0] - 2024-05-05

## Added

### Now, support for OpenAPI 3.2 is included. These are some of the new changes:

- Full implementation of the grammar and parser for the new specification.
- Full coverage for the OpenAPI 3.2 grammar components and API visitors.
- Completed and adjusted pending validation checks to ensure full compatibility for both OpenAPI 3.1 and 3.2.
- Refactored error handling and loading states to improve frontend stability.


## [1.1.2] - 2026-03-06

## Fixed
Expand Down
4 changes: 2 additions & 2 deletions README.md
Original file line number Diff line number Diff line change
@@ -1,5 +1,5 @@

# 🛠️ Sonar OpenApi (plugin) ![Release](https://img.shields.io/badge/release-1.1.2-purple) ![Swagger](https://img.shields.io/badge/-openapi-%23Clojure?style=flat&logo=swagger&logoColor=white) ![Java](https://img.shields.io/badge/java-%23ED8B00.svg?style=flat&logo=openjdk&logoColor=white) [![License: LGPL v3](https://img.shields.io/badge/license-LGPL_v3-blue.svg)](https://www.gnu.org/licenses/lgpl-3.0)
# 🛠️ Sonar OpenApi (plugin) ![Release](https://img.shields.io/badge/release-1.2.1-purple) ![Swagger](https://img.shields.io/badge/-openapi-%23Clojure?style=flat&logo=swagger&logoColor=white) ![Java](https://img.shields.io/badge/java-%23ED8B00.svg?style=flat&logo=openjdk&logoColor=white) [![License: LGPL v3](https://img.shields.io/badge/license-LGPL_v3-blue.svg)](https://www.gnu.org/licenses/lgpl-3.0)

Sonar OpenApi (plugin) is a code analyzer for OpenAPI specifications, is the spiritual successor of [SonarOpenApi](https://github.com/societe-generale/sonar-openapi), carrying on from the point where it left off with support of Apiaddicts community.

Expand Down Expand Up @@ -32,7 +32,7 @@ Feel free to drop by and greet us on our GitHub discussion or Discord chat. You

## ⚙️ Features

* Full compatibility with OpenAPI v2.0, v3.0.0, v3.0.1, v3.0.2, v3.0.3 and v3.1.0
* Full compatibility with OpenAPI v2.0, v3.0.0, v3.0.1, v3.0.2, v3.0.3, v3.1.0 and v3.2.0

![SonarOpenApi in action](sonarqube.jpg)

Expand Down
2 changes: 1 addition & 1 deletion its/pom.xml
Original file line number Diff line number Diff line change
Expand Up @@ -5,7 +5,7 @@
<parent>
<groupId>org.apiaddicts.apitools.dosonarapi</groupId>
<artifactId>dosonarapi</artifactId>
<version>1.1.2</version>
<version>1.2.1</version>
<relativePath>../pom.xml</relativePath>
</parent>
<modelVersion>4.0.0</modelVersion>
Expand Down
2 changes: 1 addition & 1 deletion openapi-checks/pom.xml
Original file line number Diff line number Diff line change
Expand Up @@ -5,7 +5,7 @@
<parent>
<groupId>org.apiaddicts.apitools.dosonarapi</groupId>
<artifactId>dosonarapi</artifactId>
<version>1.1.2</version>
<version>1.2.1</version>
<relativePath>../pom.xml</relativePath>
</parent>

Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -23,7 +23,12 @@
import java.util.List;

public final class CheckList {
public static final String REPOSITORY_KEY = "openapi";
public static final String YAML_REPOSITORY_KEY = "openapi-yaml";
public static final String JSON_REPOSITORY_KEY = "openapi-json";
public static final String OPENAPI_REPOSITORY_KEY = "openapi";
public static final String YAML_LANGUAGE = "yaml";
public static final String JSON_LANGUAGE = "json";
public static final String OPENAPI_LANGUAGE = "openapi";

private CheckList() {
}
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -26,6 +26,8 @@
import org.apiaddicts.apitools.dosonarapi.api.OpenApiCheck;
import org.apiaddicts.apitools.dosonarapi.api.v2.OpenApi2Grammar;
import org.apiaddicts.apitools.dosonarapi.api.v3.OpenApi3Grammar;
import org.apiaddicts.apitools.dosonarapi.api.v31.OpenApi31Grammar;
import org.apiaddicts.apitools.dosonarapi.api.v32.OpenApi32Grammar;
import org.apiaddicts.apitools.dosonarapi.sslr.yaml.grammar.JsonNode;

import com.google.common.collect.ImmutableSet;
Expand All @@ -39,7 +41,7 @@ public class ContactValidEmailCheck extends OpenApiCheck {

@Override
public Set<AstNodeType> subscribedKinds() {
return ImmutableSet.of(OpenApi2Grammar.CONTACT, OpenApi3Grammar.CONTACT);
return ImmutableSet.of(OpenApi2Grammar.CONTACT, OpenApi3Grammar.CONTACT, OpenApi31Grammar.CONTACT, OpenApi32Grammar.CONTACT);
}

@Override
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -26,6 +26,8 @@
import org.apiaddicts.apitools.dosonarapi.api.OpenApiCheck;
import org.apiaddicts.apitools.dosonarapi.api.v2.OpenApi2Grammar;
import org.apiaddicts.apitools.dosonarapi.api.v3.OpenApi3Grammar;
import org.apiaddicts.apitools.dosonarapi.api.v31.OpenApi31Grammar;
import org.apiaddicts.apitools.dosonarapi.api.v32.OpenApi32Grammar;
import org.apiaddicts.apitools.dosonarapi.sslr.yaml.grammar.JsonNode;

@Rule(key = DeclaredTagCheck.CHECK_KEY)
Expand All @@ -34,7 +36,7 @@ public class DeclaredTagCheck extends OpenApiCheck {

@Override
public Set<AstNodeType> subscribedKinds() {
return Sets.newHashSet(OpenApi2Grammar.OPERATION, OpenApi3Grammar.OPERATION);
return Sets.newHashSet(OpenApi2Grammar.OPERATION, OpenApi3Grammar.OPERATION, OpenApi31Grammar.OPERATION, OpenApi32Grammar.OPERATION);
}

@Override
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -26,6 +26,8 @@
import org.apiaddicts.apitools.dosonarapi.api.OpenApiCheck;
import org.apiaddicts.apitools.dosonarapi.api.v2.OpenApi2Grammar;
import org.apiaddicts.apitools.dosonarapi.api.v3.OpenApi3Grammar;
import org.apiaddicts.apitools.dosonarapi.api.v31.OpenApi31Grammar;
import org.apiaddicts.apitools.dosonarapi.api.v32.OpenApi32Grammar;
import org.apiaddicts.apitools.dosonarapi.sslr.yaml.grammar.impl.MissingNode;
import org.apiaddicts.apitools.dosonarapi.sslr.yaml.grammar.JsonNode;

Expand All @@ -36,7 +38,7 @@ public class DefaultResponseCheck extends OpenApiCheck {

@Override
public Set<AstNodeType> subscribedKinds() {
return Sets.newHashSet(OpenApi2Grammar.RESPONSES, OpenApi3Grammar.RESPONSES);
return Sets.newHashSet(OpenApi2Grammar.RESPONSES, OpenApi3Grammar.RESPONSES, OpenApi31Grammar.RESPONSES, OpenApi32Grammar.RESPONSES);
}

@Override
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -29,6 +29,8 @@
import org.apiaddicts.apitools.dosonarapi.api.OpenApiCheck;
import org.apiaddicts.apitools.dosonarapi.api.v2.OpenApi2Grammar;
import org.apiaddicts.apitools.dosonarapi.api.v3.OpenApi3Grammar;
import org.apiaddicts.apitools.dosonarapi.api.v31.OpenApi31Grammar;
import org.apiaddicts.apitools.dosonarapi.api.v32.OpenApi32Grammar;
import org.apiaddicts.apitools.dosonarapi.sslr.yaml.grammar.JsonNode;

@Rule(key = DefinedResponseCheck.CHECK_KEY)
Expand All @@ -40,7 +42,7 @@ public class DefinedResponseCheck extends OpenApiCheck {
@Override
public Set<AstNodeType> subscribedKinds() {
return Sets.newHashSet(
OpenApi2Grammar.RESPONSES, OpenApi3Grammar.RESPONSES);
OpenApi2Grammar.RESPONSES, OpenApi3Grammar.RESPONSES, OpenApi31Grammar.RESPONSES, OpenApi32Grammar.RESPONSES);
}

@Override
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -26,6 +26,8 @@
import org.apiaddicts.apitools.dosonarapi.api.OpenApiCheck;
import org.apiaddicts.apitools.dosonarapi.api.v2.OpenApi2Grammar;
import org.apiaddicts.apitools.dosonarapi.api.v3.OpenApi3Grammar;
import org.apiaddicts.apitools.dosonarapi.api.v31.OpenApi31Grammar;
import org.apiaddicts.apitools.dosonarapi.api.v32.OpenApi32Grammar;
import org.apiaddicts.apitools.dosonarapi.sslr.yaml.grammar.JsonNode;

@Rule(key = DescriptionDiffersSummaryCheck.CHECK_KEY)
Expand All @@ -34,7 +36,7 @@ public class DescriptionDiffersSummaryCheck extends OpenApiCheck {

@Override
public Set<AstNodeType> subscribedKinds() {
return Sets.newHashSet(OpenApi2Grammar.OPERATION, OpenApi3Grammar.OPERATION);
return Sets.newHashSet(OpenApi2Grammar.OPERATION, OpenApi3Grammar.OPERATION, OpenApi31Grammar.OPERATION, OpenApi32Grammar.OPERATION);
}

@Override
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -29,6 +29,8 @@
import org.apiaddicts.apitools.dosonarapi.api.PreciseIssue;
import org.apiaddicts.apitools.dosonarapi.api.v2.OpenApi2Grammar;
import org.apiaddicts.apitools.dosonarapi.api.v3.OpenApi3Grammar;
import org.apiaddicts.apitools.dosonarapi.api.v31.OpenApi31Grammar;
import org.apiaddicts.apitools.dosonarapi.api.v32.OpenApi32Grammar;
import org.apiaddicts.apitools.dosonarapi.sslr.yaml.grammar.JsonNode;
import org.apiaddicts.apitools.dosonarapi.sslr.yaml.grammar.impl.MissingNode;

Expand All @@ -39,7 +41,7 @@ public class DocumentedTagCheck extends OpenApiCheck {

@Override
public Set<AstNodeType> subscribedKinds() {
return Sets.newHashSet(OpenApi2Grammar.TAG, OpenApi2Grammar.OPERATION, OpenApi3Grammar.TAG, OpenApi3Grammar.OPERATION);
return Sets.newHashSet(OpenApi2Grammar.TAG, OpenApi2Grammar.OPERATION, OpenApi3Grammar.TAG, OpenApi3Grammar.OPERATION, OpenApi31Grammar.TAG, OpenApi31Grammar.OPERATION, OpenApi32Grammar.TAG, OpenApi32Grammar.OPERATION);
}

@Override
Expand All @@ -61,7 +63,7 @@ public void visitFile(JsonNode root) {
@Override
protected void visitNode(JsonNode node) {
AstNodeType nodeType = node.getType();
if (nodeType == OpenApi2Grammar.TAG || nodeType == OpenApi3Grammar.TAG) {
if (nodeType == OpenApi2Grammar.TAG || nodeType == OpenApi3Grammar.TAG || nodeType == OpenApi31Grammar.TAG || nodeType == OpenApi32Grammar.TAG) {
visitTag(node);
} else {
visitOperation(node);
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -29,6 +29,8 @@
import org.apiaddicts.apitools.dosonarapi.api.OpenApiCheck;
import org.apiaddicts.apitools.dosonarapi.api.v2.OpenApi2Grammar;
import org.apiaddicts.apitools.dosonarapi.api.v3.OpenApi3Grammar;
import org.apiaddicts.apitools.dosonarapi.api.v31.OpenApi31Grammar;
import org.apiaddicts.apitools.dosonarapi.api.v32.OpenApi32Grammar;
import org.apiaddicts.apitools.dosonarapi.sslr.yaml.grammar.JsonNode;

@Rule(key = MediaTypeCheck.CHECK_KEY)
Expand All @@ -44,7 +46,7 @@ public class MediaTypeCheck extends OpenApiCheck {

@Override
public Set<AstNodeType> subscribedKinds() {
return Sets.newHashSet(OpenApi2Grammar.ROOT, OpenApi2Grammar.OPERATION, OpenApi3Grammar.RESPONSE, OpenApi3Grammar.REQUEST_BODY, OpenApi3Grammar.PARAMETER);
return Sets.newHashSet(OpenApi2Grammar.ROOT, OpenApi2Grammar.OPERATION, OpenApi3Grammar.RESPONSE, OpenApi3Grammar.REQUEST_BODY, OpenApi3Grammar.PARAMETER, OpenApi31Grammar.RESPONSE, OpenApi31Grammar.REQUEST_BODY, OpenApi31Grammar.PARAMETER, OpenApi32Grammar.RESPONSE, OpenApi32Grammar.REQUEST_BODY, OpenApi32Grammar.PARAMETER);
}

@Override
Expand All @@ -70,7 +72,8 @@ private void verifyMimeTypeArray(JsonNode node) {
}

private void visitOpenApi3(JsonNode node) {
if (node.getType() == OpenApi3Grammar.PARAMETER) {
AstNodeType type = node.getType();
if (type == OpenApi3Grammar.PARAMETER || type == OpenApi31Grammar.PARAMETER || type == OpenApi32Grammar.PARAMETER) {
verifyParameterContent(node);
} else {
verifyContent(node);
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -27,6 +27,8 @@
import org.apiaddicts.apitools.dosonarapi.api.OpenApiCheck;
import org.apiaddicts.apitools.dosonarapi.api.v2.OpenApi2Grammar;
import org.apiaddicts.apitools.dosonarapi.api.v3.OpenApi3Grammar;
import org.apiaddicts.apitools.dosonarapi.api.v31.OpenApi31Grammar;
import org.apiaddicts.apitools.dosonarapi.api.v32.OpenApi32Grammar;
import org.apiaddicts.apitools.dosonarapi.sslr.yaml.grammar.JsonNode;

@Rule(key = NoContentIn204Check.CHECK_KEY)
Expand All @@ -35,7 +37,7 @@ public class NoContentIn204Check extends OpenApiCheck {

@Override
public Set<AstNodeType> subscribedKinds() {
return Sets.newHashSet(OpenApi2Grammar.OPERATION, OpenApi3Grammar.OPERATION);
return Sets.newHashSet(OpenApi2Grammar.OPERATION, OpenApi3Grammar.OPERATION, OpenApi31Grammar.OPERATION, OpenApi32Grammar.OPERATION);
}

@Override
Expand All @@ -57,7 +59,8 @@ private void checkNoContent(JsonNode response) {
}

private static boolean hasContent(JsonNode effective) {
return effective.getType() instanceof OpenApi2Grammar && !effective.get("schema").isMissing()
|| effective.getType() instanceof OpenApi3Grammar && ! effective.get("content").isMissing();
AstNodeType type = effective.getType();
return type instanceof OpenApi2Grammar && !effective.get("schema").isMissing()
|| (type instanceof OpenApi3Grammar || type instanceof OpenApi31Grammar || type instanceof OpenApi32Grammar) && !effective.get("content").isMissing();
}
}
Original file line number Diff line number Diff line change
Expand Up @@ -34,6 +34,8 @@
import org.apiaddicts.apitools.dosonarapi.api.OpenApiCheck;
import org.apiaddicts.apitools.dosonarapi.api.v2.OpenApi2Grammar;
import org.apiaddicts.apitools.dosonarapi.api.v3.OpenApi3Grammar;
import org.apiaddicts.apitools.dosonarapi.api.v31.OpenApi31Grammar;
import org.apiaddicts.apitools.dosonarapi.api.v32.OpenApi32Grammar;
import org.apiaddicts.apitools.dosonarapi.sslr.yaml.grammar.JsonNode;
import org.apiaddicts.apitools.dosonarapi.sslr.yaml.grammar.Utils;
import org.apiaddicts.apitools.dosonarapi.sslr.yaml.grammar.impl.MissingNode;
Expand All @@ -46,7 +48,7 @@ public class NoUnusedDefinitionCheck extends OpenApiCheck {

@Override
public Set<AstNodeType> subscribedKinds() {
return Sets.newHashSet(OpenApi2Grammar.OPERATION, OpenApi3Grammar.OPERATION);
return Sets.newHashSet(OpenApi2Grammar.OPERATION, OpenApi3Grammar.OPERATION, OpenApi31Grammar.OPERATION, OpenApi32Grammar.OPERATION);
}

@Override
Expand Down Expand Up @@ -165,7 +167,11 @@ private static Set<JsonPointer> usedReferences(JsonNode node, Function<JsonNode,

private static List<JsonPointer> getReference(JsonNode node) {
if (node.isRef()) {
return Collections.singletonList(JsonPointer.compile(node.at("/$ref").getTokenValue().substring(1)));
String refValue = node.at("/$ref").getTokenValue();
if (!refValue.startsWith("#")) {
return Collections.emptyList();
}
return Collections.singletonList(JsonPointer.compile(refValue.substring(1)));
} else {
return Collections.emptyList();
}
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -32,6 +32,8 @@
import org.apiaddicts.apitools.dosonarapi.api.PreciseIssue;
import org.apiaddicts.apitools.dosonarapi.api.v2.OpenApi2Grammar;
import org.apiaddicts.apitools.dosonarapi.api.v3.OpenApi3Grammar;
import org.apiaddicts.apitools.dosonarapi.api.v31.OpenApi31Grammar;
import org.apiaddicts.apitools.dosonarapi.api.v32.OpenApi32Grammar;
import org.apiaddicts.apitools.dosonarapi.sslr.yaml.grammar.JsonNode;

import static org.apiaddicts.apitools.dosonarapi.checks.PathMaskeradingCheck.ConflictMode.AMBIGUOUS;
Expand Down Expand Up @@ -78,7 +80,7 @@ private static void ensureSize(List<List<Bucket>> list, int size) {

@Override
public Set<AstNodeType> subscribedKinds() {
return ImmutableSet.of(OpenApi2Grammar.PATHS, OpenApi3Grammar.PATHS);
return ImmutableSet.of(OpenApi2Grammar.PATHS, OpenApi3Grammar.PATHS, OpenApi31Grammar.PATHS, OpenApi32Grammar.PATHS);
}

@Override
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -26,6 +26,8 @@
import org.apiaddicts.apitools.dosonarapi.api.OpenApiCheck;
import org.apiaddicts.apitools.dosonarapi.api.v2.OpenApi2Grammar;
import org.apiaddicts.apitools.dosonarapi.api.v3.OpenApi3Grammar;
import org.apiaddicts.apitools.dosonarapi.api.v31.OpenApi31Grammar;
import org.apiaddicts.apitools.dosonarapi.api.v32.OpenApi32Grammar;
import org.apiaddicts.apitools.dosonarapi.sslr.yaml.grammar.JsonNode;

@Rule(key = ProvideOpSummaryCheck.CHECK_KEY)
Expand All @@ -34,7 +36,7 @@ public class ProvideOpSummaryCheck extends OpenApiCheck {

@Override
public Set<AstNodeType> subscribedKinds() {
return Sets.newHashSet(OpenApi2Grammar.OPERATION, OpenApi3Grammar.OPERATION);
return Sets.newHashSet(OpenApi2Grammar.OPERATION, OpenApi3Grammar.OPERATION, OpenApi31Grammar.OPERATION, OpenApi32Grammar.OPERATION);
}

@Override
Expand Down
Original file line number Diff line number Diff line change
@@ -0,0 +1,56 @@
/*
* doSonarAPI: SonarQube OpenAPI Plugin
* Copyright (C) 2021-2022 Apiaddicts
* contacta AT apiaddicts DOT org
*
* This program is free software; you can redistribute it and/or
* modify it under the terms of the GNU Lesser General Public
* License as published by the Free Software Foundation; either
* version 3 of the License, or (at your option) any later version.
*
* This program is distributed in the hope that it will be useful,
* but WITHOUT ANY WARRANTY; without even the implied warranty of
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
* Lesser General Public License for more details.
*
* You should have received a copy of the GNU Lesser General Public License
* along with this program; if not, write to the Free Software Foundation,
* Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA.
*/
package org.apiaddicts.apitools.dosonarapi.checks;

import java.util.List;
import org.junit.Test;

import static org.assertj.core.api.Assertions.assertThat;

public class CheckListTest {

@Test
public void returns_all_check_classes() {
List<Class<?>> checks = CheckList.getChecks();
assertThat(checks).isNotEmpty().contains(
PathMaskeradingCheck.class,
MediaTypeCheck.class,
ParsingErrorCheck.class,
DefaultResponseCheck.class,
DefinedResponseCheck.class,
DeclaredTagCheck.class,
DocumentedTagCheck.class,
AtMostOneBodyParameterCheck.class,
NoUnusedDefinitionCheck.class,
NoContentIn204Check.class,
ProvideOpSummaryCheck.class,
ContactValidEmailCheck.class,
DescriptionDiffersSummaryCheck.class
);
}

@Test
public void constants_have_expected_values() {
assertThat(CheckList.YAML_REPOSITORY_KEY).isEqualTo("openapi-yaml");
assertThat(CheckList.JSON_REPOSITORY_KEY).isEqualTo("openapi-json");
assertThat(CheckList.YAML_LANGUAGE).isEqualTo("yaml");
assertThat(CheckList.JSON_LANGUAGE).isEqualTo("json");
}
}
Loading
Loading