Develop

.github/workflows/maven.yml

@@ -26,7 +26,7 @@ jobs:
     - name: SonarCloud Analysis
       env:
         SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}
-      run: mvn sonar:sonar -Dsonar.token=$SONAR_TOKEN
+      run: mvn sonar:sonar -Dsonar.token=$SONAR_TOKEN -Dsonar.host.url=https://sonarcloud.io -Dsonar.organization=apiaddicts -Dsonar.projectKey=apiaddicts_sonaropenapi-rules
 
     # Optional: Uploads the full dependency graph to GitHub to improve the quality of Dependabot alerts this repository can receive
     - name: Update dependency graph

CHANGELOG.md

@@ -5,6 +5,100 @@ All notable changes to this project will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [1.4.1] - 2026-06-04
+
+### Added
+
+- Add OpenAPI language support without YAML and JSON conflicts.
+
+### Changed
+
+- Bump plugin version to `1.4.1`.
+- Update `sonaropenapi.version` to `1.2.1`.
+- Reference `openapi-front-end` and `openapi-test-tools` dependencies via `${sonaropenapi.version}` property instead of hardcoded version.
+
+### Fixed
+
+- OAR004 - ValidWso2ScopesRoles - Fixed false negative where `roles` defined as a YAML/JSON array were not validated element by element. Updated `AbstractPatternWso2ScopesCheck.visitScope()` to iterate array elements via `fieldNode.elements()` and validate each one individually. Added test fixtures for array roles in v2, v3, v31 and v32 formats.
+- OAR014 - ResourceLevelWithinNonSuggestedRange - Removed upper bound threshold: rule now fires for all depths ≥ 4 (previously only fired for depths 4–5), aligning with Spectral behavior. Updated v2 test fixtures to mark depth-6 paths as noncompliant.
+- OAR015 - ResourceLevelMaxAllowed - Updated depth calculation algorithm in `AbstractResourceLevelCheck.matchLevel(String path)` to count only literal segments, explicitly excluding path parameters (e.g. `{customerId}`) and `/me` segments — matching Spectral's algorithm exactly. Previously used a `pathParts − literalParamPairs` formula that produced different results for paths starting with parameters, consecutive parameters, or containing `/me`.
+- OAR020 - ExpandParameterCheck - Fixed false negative where GET operations on non-`/examples` paths (e.g. `/pets`, `/orders`) without a `parameters` block were not reported. Changed default path strategy from include-only `/examples` to exclude-all (empty exclude list), so the rule now applies to all collection GET endpoints. Added `/me` path exclusion and health-check path exclusion (`status`, `health`, `ping`) in `visitNode`, aligning with Spectral's filter. Added `without-parameters` test cases for v2, v3, v31 and v32.
+- OAR021 - ExcludeParameterCheck - Same fix as OAR020 applied for `$exclude` parameter. Changed default path strategy to exclude-all, added `/me` and health-check exclusions, added `without-parameters` test cases.
+- OAR028 - FilterParameterCheck - Rewritten to extend `AbstractQueryParameterCheck`. Fires exactly once per GET operation when `$filter` query parameter is absent; does not fire if `$filter` is present alongside other parameters; resolves `$filter` referenced via `$ref` to components. Covers ALL collection GET endpoints except `/me` paths, terminal `/{id}` paths and health-check paths (`status`, `health`, `ping`).
+- OAR037 - StringFormatCheck - Fixed false negative where string schemas without a `format` field were not reported. Updated `isInvalidString` to also fire when `format == null`.
+- OAR038 - StandardCreateResponseCheck - POST 201 responses must have a schema whose properties are named `data` or `error`, each with at least one sub-property. Fires with a distinct message when the property name is invalid vs. when sub-properties are missing.
+- OAR066 - SnakeCaseNamingConventionCheck - Fixed false positives on industry-standard property name prefixes. Skip properties whose names start with `@` or `x-`.
+- OAR073 - RateLimitCheck - Extended default excluded paths from `/status, /health-check` to `/status, /health, /health-check, /ping, /liveness, /readiness` in `DEFAULT_PATHS`.
+
+## [1.4.1-beta-5] - 2026-06-02
+
+### Fixed
+
+- OAR028 - FilterParameterCheck - Rewritten to extend `AbstractQueryParameterCheck`. Fires exactly once per GET operation when `$filter` query parameter is absent; does not fire if `$filter` is present alongside other parameters; resolves `$filter` referenced via `$ref` to components. Covers ALL collection GET endpoints except `/me` paths, terminal `/{id}` paths and health-check paths (`status`, `health`, `ping`).
+
+## [1.4.1-beta-4] - 2026-05-31
+
+### Fixed
+
+- OAR020 - ExpandParameterCheck - Fixed false negative where GET operations on non-`/examples` paths (e.g. `/pets`, `/orders`) without a `parameters` block were not reported. Changed default path strategy from include-only `/examples` to exclude-all (empty exclude list), so the rule now applies to all collection GET endpoints. Added `/me` path exclusion and health-check path exclusion (`status`, `health`, `ping`) in `visitNode`, aligning with Spectral's filter. Added `without-parameters` test cases for v2, v3, v31 and v32.
+- OAR021 - ExcludeParameterCheck - Same fix as OAR020 applied for `$exclude` parameter. Changed default path strategy to exclude-all, added `/me` and health-check exclusions, added `without-parameters` test cases.
+- OAR037 - StringFormatCheck - Fixed false negative where string schemas without a `format` field were not reported. Updated `isInvalidString` to also fire when `format == null`.
+- OAR038 - StandardCreateResponseCheck - POST 201 responses must have a schema whose properties are named `data` or `error`, each with at least one sub-property. Fires with a distinct message when the property name is invalid vs. when sub-properties are missing.
+- OAR066 - SnakeCaseNamingConventionCheck - Fixed false positives on industry-standard property name prefixes. Skip properties whose names start with `@` or `x-`.
+- OAR073 - RateLimitCheck - Extended default excluded paths from `/status, /health-check` to `/status, /health, /health-check, /ping, /liveness, /readiness` in `DEFAULT_PATHS`.
+
+## [1.4.1-beta-3] - 2026-05-29
+
+### Fixed
+
+- OAR004 - ValidWso2ScopesRoles - Fixed false negative where `roles` defined as a YAML/JSON array were not validated element by element. Updated `AbstractPatternWso2ScopesCheck.visitScope()` to iterate array elements via `fieldNode.elements()` and validate each one individually. Added test fixtures for array roles in v2, v3, v31 and v32 formats.
+- OAR014 - ResourceLevelWithinNonSuggestedRange - Removed upper bound threshold: rule now fires for all depths ≥ 4 (previously only fired for depths 4–5), aligning with Spectral behavior. Updated v2 test fixtures to mark depth-6 paths as noncompliant.
+- OAR015 - ResourceLevelMaxAllowed - Updated depth calculation algorithm in `AbstractResourceLevelCheck.matchLevel(String path)` to count only literal segments, explicitly excluding path parameters (e.g. `{customerId}`) and `/me` segments — matching Spectral's algorithm exactly. Previously used a `pathParts − literalParamPairs` formula that produced different results for paths starting with parameters, consecutive parameters, or containing `/me`.
+
+## [1.4.1-beta-2] - 2026-05-28
+
+### Added
+
+- Add OpenAPI language support without YAML and JSON conflicts.
+
+## [1.4.1-beta-1] - 2026-05-26
+
+### Changed
+
+- Bump plugin version to `1.4.1-beta-1`.
+- Update `sonaropenapi.version` to `1.2.1-beta-1`.
+- Reference `openapi-front-end` and `openapi-test-tools` dependencies via `${sonaropenapi.version}` property instead of hardcoded version.
+
+## [1.4.0] - 2026-05-22
+
+### Security
+
+- Upgrade `org.json:json` to `20231013` to fix CVE vulnerabilities
+- Upgrade `jackson-dataformat-yaml` from 2.13.3 to 2.18.6 to fix CVE alerts.
+- Upgrade `assertj-core` from 3.22.0 to 3.27.7 to fix XXE vulnerability.
+
+### Changed
+
+- Move sonar organization config to github action
+
+### Added
+
+#### Now, support for OpenAPI 3.2 is included. These are some of the new changes:
+
+- All existing rules (OAR001 - OAR115) have been updated and validated for compatibility with the OpenAPI 3.2 specification.
+- Added a comprehensive set of test cases for every rule to ensure correct behavior and validation under OpenAPI 3.2 schemas.
+- Enhanced the engine to support new 3.2 structural changes, including updated reference handling and metadata fields.
+
+### Fixed
+
+- Resolve language suffix conflict between the plugin's custom YAML/JSON support and SonarQube's built-in language detection.
+- OAR020 - ExpandParameterCheck: rule now explicitly requires `$expand` (with `$` prefix) as the query parameter name, rejecting `expand` without prefix, aligning with Spectral behavior.
+- OAR021 - ExcludeParameterCheck: rule now explicitly requires `$exclude` (with `$` prefix) as the query parameter name, rejecting `exclude` without prefix, aligning with Spectral behavior.
+- OAR028 - FilterParameterCheck: rule now only evaluates `query` parameters; header, path and cookie parameters are ignored, aligning with Spectral behavior.
+- OAR051 - DescriptionDiffersSummaryCheck: rule now evaluates all HTTP methods (GET, POST, PUT, PATCH, DELETE), not only GET, aligning with Spectral behavior.
+- OAR066 - SnakeCaseNamingConventionCheck: rule now recursively validates nested schema property names at all depth levels, aligning with Spectral behavior.
+
+
 ## [1.3.7] - 2026-05-18
 
 ### Fixed

pom.xml

@@ -3,7 +3,7 @@
   <modelVersion>4.0.0</modelVersion>
   <groupId>org.apiaddicts.apitools.dosonarapi</groupId>
   <artifactId>sonaropenapi-rules-community</artifactId>
-  <version>1.3.7</version>
+  <version>1.4.1</version>
   <packaging>sonar-plugin</packaging>
 
   <name>SonarQube OpenAPI Community Rules</name>
@@ -64,19 +64,16 @@
 
     <sonar.version>8.7.0.41497</sonar.version>
     <sonarQubeMinVersion>6.7</sonarQubeMinVersion>
-    <sonaropenapi.version>1.1.1</sonaropenapi.version>
+    <sonaropenapi.version>1.2.1</sonaropenapi.version>
     <sonaranalyzer.version>1.22.0.848</sonaranalyzer.version>
-    <orgjson.version>20220320</orgjson.version>
+    <orgjson.version>20231013</orgjson.version>
     <junit.version>4.13.2</junit.version>
-    <assertj.version>3.22.0</assertj.version>
+    <assertj.version>3.27.7</assertj.version>
 
     <jacoco.maven.plugin.version>0.8.6</jacoco.maven.plugin.version>
     <sonar.maven.plugin.version>5.5.0.6356</sonar.maven.plugin.version>
     <sonar.java.coveragePlugin>jacoco</sonar.java.coveragePlugin>
     <sonar.coverage.jacoco.xmlReportPaths>${project.basedir}/target/site/jacoco/jacoco.xml</sonar.coverage.jacoco.xmlReportPaths>
-    <sonar.host.url>https://sonarcloud.io</sonar.host.url>
-    <sonar.organization>apiaddicts</sonar.organization>
-    <sonar.projectKey>apiaddicts_sonaropenapi-rules</sonar.projectKey>
     <sonar.language>java</sonar.language>
     <sonar.exclusions>**/*.html,**/*.json</sonar.exclusions>
     <sonar.cpd.exclusions>**/*.html,**/*.json</sonar.cpd.exclusions>
@@ -94,7 +91,13 @@
     <dependency>
       <groupId>org.apiaddicts.apitools.dosonarapi</groupId>
       <artifactId>openapi-front-end</artifactId>
-      <version>1.1.1</version>
+      <version>${sonaropenapi.version}</version>
+    </dependency>
+    <dependency>
+      <groupId>org.apiaddicts.apitools.dosonarapi</groupId>
+      <artifactId>openapi-checks</artifactId>
+      <version>${sonaropenapi.version}</version>
+      <scope>provided</scope>
     </dependency>
     <dependency>
       <groupId>org.sonarsource.sonarqube</groupId>
@@ -105,7 +108,7 @@
     <dependency>
       <groupId>com.fasterxml.jackson.dataformat</groupId>
       <artifactId>jackson-dataformat-yaml</artifactId>
-      <version>2.13.3</version>
+      <version>2.18.6</version>
     </dependency>
     <dependency>
       <groupId>org.sonarsource.analyzer-commons</groupId>
@@ -128,7 +131,7 @@
     <dependency>
       <groupId>org.apiaddicts.apitools.dosonarapi</groupId>
       <artifactId>openapi-test-tools</artifactId>
-      <version>1.1.1</version>
+      <version>${sonaropenapi.version}</version>
     </dependency>
     <dependency>
       <groupId>junit</groupId>

src/main/java/apiaddicts/sonar/openapi/OpenAPICustomJsonRuleRepository.java

@@ -0,0 +1,26 @@
+package apiaddicts.sonar.openapi;
+
+import org.sonar.api.ExtensionPoint;
+import org.sonar.api.scanner.ScannerSide;
+import org.apiaddicts.apitools.dosonarapi.api.OpenApiCustomRuleRepository;
+import apiaddicts.sonar.openapi.checks.RulesLists;
+import org.sonarsource.api.sonarlint.SonarLintSide;
+
+import java.util.List;
+
+import static apiaddicts.sonar.openapi.OpenAPICustomRulesDefinition.JSON_REPOSITORY_KEY;
+
+@SonarLintSide
+@ScannerSide
+@ExtensionPoint
+public class OpenAPICustomJsonRuleRepository implements OpenApiCustomRuleRepository {
+    @Override
+    public String repositoryKey() {
+        return JSON_REPOSITORY_KEY;
+    }
+
+    @Override
+    public List<Class<?>> checkClasses() {
+        return RulesLists.getAllChecks();
+    }
+}

src/main/java/apiaddicts/sonar/openapi/OpenAPICustomOpenApiRuleRepository.java

@@ -0,0 +1,26 @@
+package apiaddicts.sonar.openapi;
+
+import org.sonar.api.ExtensionPoint;
+import org.sonar.api.scanner.ScannerSide;
+import org.apiaddicts.apitools.dosonarapi.api.OpenApiCustomRuleRepository;
+import apiaddicts.sonar.openapi.checks.RulesLists;
+import org.sonarsource.api.sonarlint.SonarLintSide;
+
+import java.util.List;
+
+import static apiaddicts.sonar.openapi.OpenAPICustomRulesDefinition.OPENAPI_REPOSITORY_KEY;
+
+@SonarLintSide
+@ScannerSide
+@ExtensionPoint
+public class OpenAPICustomOpenApiRuleRepository implements OpenApiCustomRuleRepository {
+    @Override
+    public String repositoryKey() {
+        return OPENAPI_REPOSITORY_KEY;
+    }
+
+    @Override
+    public List<Class<?>> checkClasses() {
+        return RulesLists.getAllChecks();
+    }
+}

src/main/java/apiaddicts/sonar/openapi/OpenAPICustomPlugin.java

@@ -14,7 +14,9 @@ public void define(Context context) {
 				OpenAPICustomProfileDefinition.class,
 				OpenAPICustomRulesDefinition.class,
 				// batch extensions -> objects are instantiated during code analysis
-				OpenAPICustomRuleRepository.class
+				OpenAPICustomRuleRepository.class,
+				OpenAPICustomJsonRuleRepository.class,
+				OpenAPICustomOpenApiRuleRepository.class
 		);
 	}
 

src/main/java/apiaddicts/sonar/openapi/OpenAPICustomProfileDefinition.java

@@ -1,6 +1,7 @@
 package apiaddicts.sonar.openapi;
 
 import org.apiaddicts.apitools.dosonarapi.api.OpenApiCustomRuleRepository;
+import org.apiaddicts.apitools.dosonarapi.checks.CheckList;
 import org.sonar.api.server.profile.BuiltInQualityProfilesDefinition;
 import org.sonar.api.utils.AnnotationUtils;
 import org.sonar.check.Rule;
@@ -9,28 +10,40 @@
 import javax.annotation.Nullable;
 import java.util.List;
 
-/**
- * Declare a new quality profile that comprises all the custom rules, plus the SonarOpenApi standard rules.
- * <p>
- * This allows to create a built-in profile that extends the Sonar Way profile, and that includes your rules.
- * This profile will automatically inherit any new rule brought in by the core plugin.
- */
 public class OpenAPICustomProfileDefinition implements BuiltInQualityProfilesDefinition {
-	public static final String MY_COMPANY_WAY = "Custom";
+	public static final String OPENAPI_WAY = "OpenAPI";
 
 	public OpenAPICustomProfileDefinition() {
 		this(null);
 	}
 
 	public OpenAPICustomProfileDefinition(@Nullable OpenApiCustomRuleRepository[] repositories) {
-    // Intentional blank
+		// Intentional blank
 	}
 
 	@Override
 	public void define(Context context) {
-		NewBuiltInQualityProfile profile = context.createBuiltInQualityProfile(MY_COMPANY_WAY, "openapi");
-		addRepositoryRules(profile, OpenAPICustomRulesDefinition.REPOSITORY_KEY, RulesLists.getAllChecks());
-		profile.done();
+		NewBuiltInQualityProfile yamlProfile = context.createBuiltInQualityProfile(OPENAPI_WAY, "yaml");
+		addBaseRules(yamlProfile, CheckList.YAML_REPOSITORY_KEY);
+		addRepositoryRules(yamlProfile, OpenAPICustomRulesDefinition.YAML_REPOSITORY_KEY, RulesLists.getAllChecks());
+		yamlProfile.done();
+
+		NewBuiltInQualityProfile jsonProfile = context.createBuiltInQualityProfile(OPENAPI_WAY, "json");
+		addBaseRules(jsonProfile, CheckList.JSON_REPOSITORY_KEY);
+		addRepositoryRules(jsonProfile, OpenAPICustomRulesDefinition.JSON_REPOSITORY_KEY, RulesLists.getAllChecks());
+		jsonProfile.done();
+
+		NewBuiltInQualityProfile openapiProfile = context.createBuiltInQualityProfile(OPENAPI_WAY, CheckList.OPENAPI_LANGUAGE);
+		addBaseRules(openapiProfile, CheckList.OPENAPI_REPOSITORY_KEY);
+		addRepositoryRules(openapiProfile, OpenAPICustomRulesDefinition.OPENAPI_REPOSITORY_KEY, RulesLists.getAllChecks());
+		openapiProfile.done();
+	}
+
+	private void addBaseRules(NewBuiltInQualityProfile profile, String repositoryKey) {
+		for (Class<?> check : CheckList.getChecks()) {
+			Rule annotation = AnnotationUtils.getAnnotation(check, Rule.class);
+			profile.activateRule(repositoryKey, annotation.key());
+		}
 	}
 
 	private void addRepositoryRules(NewBuiltInQualityProfile profile, String key, List<Class<?>> checks) {
@@ -41,8 +54,8 @@ private void addRepositoryRules(NewBuiltInQualityProfile profile, String key, Li
 			}
 		}
 	}
-	
+
 	private boolean isTemplateRule(String ruleKey) {
-		return "OAR112".equals(ruleKey); 
+		return "OAR112".equals(ruleKey);
 	}
 }

src/main/java/apiaddicts/sonar/openapi/OpenAPICustomRuleRepository.java

@@ -8,7 +8,7 @@
 
 import java.util.List;
 
-import static apiaddicts.sonar.openapi.OpenAPICustomRulesDefinition.REPOSITORY_KEY;
+import static apiaddicts.sonar.openapi.OpenAPICustomRulesDefinition.YAML_REPOSITORY_KEY;
 
 /**
  * Makes the rules visible to the OpenAPI scanner sensor,
@@ -22,7 +22,7 @@
 public class OpenAPICustomRuleRepository implements OpenApiCustomRuleRepository {
 	@Override
 	public String repositoryKey() {
-		return REPOSITORY_KEY;
+		return YAML_REPOSITORY_KEY;
 	}
 
 	@Override

src/main/java/apiaddicts/sonar/openapi/OpenAPICustomRulesDefinition.java

@@ -15,7 +15,9 @@
 @ScannerSide
 @ExtensionPoint
 public class OpenAPICustomRulesDefinition implements RulesDefinition {
-    public static final String REPOSITORY_KEY = "openapi-custom";
+    public static final String YAML_REPOSITORY_KEY = "openapi-custom-yaml";
+    public static final String JSON_REPOSITORY_KEY = "openapi-custom-json";
+    public static final String OPENAPI_REPOSITORY_KEY = "openapi-custom";
     private static final String REPOSITORY_NAME = "OpenAPI Custom";
     private static final String ROOT_RESOURCE_FOLDER = "org/sonar/l10n/openapi/rules/openapi/";
     private static final String SECURITY_GROUP = "security";
@@ -31,11 +33,16 @@ public class OpenAPICustomRulesDefinition implements RulesDefinition {
     @Override
     public void define(Context context) {
         I18nContext.initializeFromUserLanguage();
+        populateRepository(context, YAML_REPOSITORY_KEY, "yaml");
+        populateRepository(context, JSON_REPOSITORY_KEY, "json");
+        populateRepository(context, OPENAPI_REPOSITORY_KEY, "openapi");
+    }
+
+    private void populateRepository(Context context, String key, String language) {
         NewRepository repository = context
-                .createRepository(REPOSITORY_KEY, "openapi")
+                .createRepository(key, language)
                 .setName(REPOSITORY_NAME);
 
-        // Carga de reglas para cada grupo
         new RuleMetadataLoader(getPath(SECURITY_GROUP)).addRulesByAnnotatedClass(repository, RulesLists.getSecurityChecks());
         new RuleMetadataLoader(getPath(FORMAT_GROUP)).addRulesByAnnotatedClass(repository, RulesLists.getFormatChecks());
         new RuleMetadataLoader(getPath(SCHEMAS_GROUP)).addRulesByAnnotatedClass(repository, RulesLists.getSchemasChecks());