1.6.0

CHANGELOG.md

@@ -5,6 +5,96 @@ All notable changes to this project will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [1.6.0] - 2026-09-10
+
+Recopilado de `1.6.0-beta-1` a `1.6.0-beta-5`.
+
+### Added
+
+- OAR060 - QueryParametersOptional - New `path-exclusions` rule property (default `/status`): a comma-separated list of exact, case-sensitive paths the rule must not fire on.
+- OAR116 - PathPattern - New rule: every API path must match a configurable regex `pattern` (default `^/`); unanchored match, dynamic message with the configured pattern.
+- OAR085 - Accept `3.0.4`, `3.1.1`, `3.1.2` in the default valid-versions.
+- OAR022 - OrderbyParameter - New `parameterName` rule property (default `$orderby`), previously hardcoded; now configurable like OAR020/021/028.
+- OAR025 - LimitParameter - Same as OAR022: new `parameterName` rule property (default `$limit`), previously hardcoded.
+
+### Changed
+
+- Bump `sonar-openapi` core to `1.3.0-beta-2`: parses `3.0.4`/`3.1.1`/`3.1.2`, and a document declaring an unsupported `openapi`/`swagger` version is now analysed instead of being silently skipped.
+- `JsonNodeUtils` - `isType`/`getPrimaryType` accept array-form `type` (OpenAPI 3.1).
+- OAR082 - Accept array-form `type`; accept `contentEncoding`/`contentMediaType` as byte/binary.
+- OAR029 / OAR070 / OAR074 / OAR075 / OAR108 / OAR115 - Accept array-form `type`.
+- OAR016 / OAR037 / OAR052 / OAR076 - Accept array-form `type` via `AbstractFormatCheck`.
+- OAR075 - StringParameterIntegrityCheck - Default `parameter_integrity` constraints changed from `minLength,maxLength,enum,format` to `minLength,maxLength,pattern,enum`.
+
+### Fixed
+
+- OAR002 - Rewrote to validate the full `x-wso2-scopes` definition (null/empty container and missing/null/blank or empty-array/object `name`/`key`/`roles`) via new `apq-wso2-scopes-valid`; also detects an attribute or container written with no value (`roles:`), the `~`/`Null`/`NULL` spellings of null, and anchors map-form scope defects on the scope key.
+- OAR044 - MediaTypeCheck - Made the media type regex quantifiers possessive to prevent ReDoS with no change to matching.
+- OAR003 - Resolve a `$ref` on `x-wso2-security` and iterate map-form `x-wso2-scopes` (shared `AbstractWso2ScopesCheck`), so referenced and mapping-keyed scopes are detected.
+- OAR029 - StandardResponseSchemaCheck - Fixed crash (`NoSuchElementException`) when `rootProperty: "*"` and the schema has no properties; root-node resolution now returns safely instead of throwing.
+- OAR108 - SchemaValidatorCheck - Example type detection rewritten to use the YAML token type instead of string pattern-matching, fixing misclassification of quoted numbers; `integer`/`number` and `null` are now treated as compatible with their schema type.
+- OAR075 - StringParameterIntegrityCheck - Fixed any-of integrity check that required all configured constraints (`allMatch`) instead of at least one (`anyMatch`).
+
+
+
+## [1.6.0-beta-5] - 2026-09-09
+
+### Added
+
+- OAR022 - OrderbyParameter - New `parameterName` rule property (default `$orderby`), previously hardcoded; now configurable like OAR020/021/028.
+- OAR025 - LimitParameter - Same as OAR022: new `parameterName` rule property (default `$limit`), previously hardcoded.
+
+## [1.6.0-beta-4] - 2026-09-04
+
+### Fixed
+
+- OAR029 - StandardResponseSchemaCheck - Fixed crash (`NoSuchElementException`) when `rootProperty: "*"` and the schema has no properties; root-node resolution now returns safely instead of throwing.
+- OAR108 - SchemaValidatorCheck - Example type detection rewritten to use the YAML token type instead of string pattern-matching, fixing misclassification of quoted numbers; `integer`/`number` and `null` are now treated as compatible with their schema type.
+- OAR075 - StringParameterIntegrityCheck - Fixed any-of integrity check that required all configured constraints (`allMatch`) instead of at least one (`anyMatch`); default constraints changed from `minLength,maxLength,enum,format` to `minLength,maxLength,pattern,enum`.
+
+## [1.6.0-beta-3] - 2026-09-02
+
+### Fixed
+
+- OAR002 - Detect an attribute or container written with no value (`roles:`), the `~`/`Null`/`NULL` spellings of null, and anchor map-form scope defects on the scope key.
+- OAR044 - MediaTypeCheck - Made the media type regex quantifiers possessive to prevent ReDoS with no change to matching.
+- OAR003 - Resolve a `$ref` on `x-wso2-security` and iterate map-form `x-wso2-scopes` (shared `AbstractWso2ScopesCheck`), so referenced and mapping-keyed scopes are detected.
+
+### Added
+
+- OAR060 - QueryParametersOptional - New `path-exclusions` rule property (default `/status`): a comma-separated list of exact, case-sensitive paths the rule must not fire on.
+- OAR116 - PathPattern - New rule: every API path must match a configurable regex `pattern` (default `^/`); unanchored match, dynamic message with the configured pattern.
+
+
+## [1.6.0-beta-2] - 2026-09-01
+
+### Changed
+
+- Bump `sonar-openapi` core to `1.3.0-beta-2`: a document declaring an unsupported `openapi` / `swagger` version is now analysed instead of being silently skipped.
+
+## [1.6.0-beta-1] - 2026-08-28
+
+### Fixed
+
+- OAR002 - Rewrote to validate the full `x-wso2-scopes` definition (null/empty container and missing/null/blank or empty-array/object `name`/`key`/`roles`) via new `apq-wso2-scopes-valid`.
+
+### Added
+
+- OAR085 - Accept `3.0.4`, `3.1.1`, `3.1.2` in the default valid-versions.
+
+### Changed
+
+- Bump `sonar-openapi` core to `1.3.0-beta-1` (parses the new versions).
+- `JsonNodeUtils` - `isType`/`getPrimaryType` accept array-form `type` (OpenAPI 3.1).
+- OAR082 - Accept array-form `type`; accept `contentEncoding`/`contentMediaType` as byte/binary.
+- OAR029 - Accept array-form `type`.
+- OAR070 - Accept array-form `type`.
+- OAR074 - Accept array-form `type`.
+- OAR075 - Accept array-form `type`.
+- OAR108 - Accept array-form `type`.
+- OAR115 - Accept array-form `type`.
+- OAR016 / OAR037 / OAR052 / OAR076 - Accept array-form `type` via `AbstractFormatCheck`.
+
 
 ## [1.5.1] - 2026-08-25
 
@@ -36,7 +126,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 - OAR025 - The shared `apq-collection-query-param-required` function now also validates the parameter type for OAR025, keyed by rule code; when `$limit` is present but its type is not `integer`, a distinct type message is emitted.
 
 
-## [1.5.1-beta-3] - 2026-08-14
+# [1.5.1-beta-3] - 2026-08-14
 
 ### Changed
 

pom.xml

@@ -3,7 +3,7 @@
   <modelVersion>4.0.0</modelVersion>
   <groupId>org.apiaddicts.apitools.dosonarapi</groupId>
   <artifactId>sonaropenapi-rules-community</artifactId>
-  <version>1.5.1</version>
+  <version>1.6.0</version>
   <packaging>sonar-plugin</packaging>
 
   <name>SonarQube OpenAPI Community Rules</name>
@@ -64,7 +64,7 @@
 
     <sonar.version>8.7.0.41497</sonar.version>
     <sonarQubeMinVersion>6.7</sonarQubeMinVersion>
-    <sonaropenapi.version>1.2.1</sonaropenapi.version>
+    <sonaropenapi.version>1.3.0</sonaropenapi.version>
     <sonaranalyzer.version>1.22.0.848</sonaranalyzer.version>
     <orgjson.version>20231013</orgjson.version>
     <junit.version>4.13.2</junit.version>

src/main/java/apiaddicts/sonar/openapi/checks/RulesLists.java

@@ -52,7 +52,8 @@ public static List<Class<?>> getFormatChecks() {
             OAR110LicenseInformationCheck.class,
             OAR111ContactInformationCheck.class,
             OAR113CustomFieldCheck.class,
-            OAR115VerifyRequiredFields.class
+            OAR115VerifyRequiredFields.class,
+            OAR116PathPatternCheck.class
         );
     }
 

src/main/java/apiaddicts/sonar/openapi/checks/apim/wso2/AbstractWso2ScopesCheck.java

@@ -7,13 +7,17 @@
 import org.apiaddicts.apitools.dosonarapi.api.v31.OpenApi31Grammar;
 import org.apiaddicts.apitools.dosonarapi.api.v32.OpenApi32Grammar;
 import apiaddicts.sonar.openapi.checks.BaseCheck;
+import apiaddicts.sonar.openapi.utils.JsonNodeUtils;
 import org.apiaddicts.apitools.dosonarapi.sslr.yaml.grammar.JsonNode;
 
+import java.util.ArrayList;
 import java.util.List;
 import java.util.Set;
 
 public abstract class AbstractWso2ScopesCheck extends BaseCheck {
 
+	private JsonNode scopesKeyNode;
+
 	@Override
 	public Set<AstNodeType> subscribedKinds() {
 		return ImmutableSet.of(OpenApi2Grammar.ROOT, OpenApi3Grammar.ROOT, OpenApi31Grammar.ROOT, OpenApi32Grammar.ROOT);
@@ -24,11 +28,25 @@ public void visitNode(JsonNode node) {
 		visitV2NV3Node(node);
 	}
 
+	protected JsonNode scopesKeyNode() {
+		return scopesKeyNode;
+	}
+
 	private void visitV2NV3Node(JsonNode node) {
-		JsonNode scopesNode = node.get("x-wso2-security").get("apim").get("x-wso2-scopes");
+		JsonNode securityNode = node.get("x-wso2-security");
+		if (!securityNode.isMissing()) securityNode = JsonNodeUtils.resolve(securityNode);
+		JsonNode apimNode = securityNode.get("apim");
+		JsonNode scopesNode = apimNode.get("x-wso2-scopes");
+		scopesKeyNode = JsonNodeUtils.propertyKey(apimNode, "x-wso2-scopes");
 		visitScopesNode(scopesNode);
 		if (scopesNode.isMissing() || scopesNode.isNull()) return;
-		List<JsonNode> scopes = scopesNode.elements();
+		List<JsonNode> rawScopes = scopesNode.isObject()
+			? new ArrayList<>(scopesNode.propertyMap().values())
+			: scopesNode.elements();
+		List<JsonNode> scopes = new ArrayList<>(rawScopes.size());
+		for (JsonNode scope : rawScopes) {
+			scopes.add(JsonNodeUtils.resolve(scope));
+		}
 		visitScopes(scopes);
 		scopes.forEach(this::visitScope);
 	}

src/main/java/apiaddicts/sonar/openapi/checks/apim/wso2/OAR002ValidWso2ScopesCheck.java

@@ -1,23 +1,32 @@
 package apiaddicts.sonar.openapi.checks.apim.wso2;
 
+import com.google.common.collect.ImmutableSet;
+import com.sonar.sslr.api.Token;
 import org.sonar.check.Rule;
+import apiaddicts.sonar.openapi.utils.JsonNodeUtils;
 import org.apiaddicts.apitools.dosonarapi.sslr.yaml.grammar.JsonNode;
 
 import java.util.List;
 import java.util.Map;
+import java.util.Set;
 
 @Rule(key = OAR002ValidWso2ScopesCheck.KEY)
 public class OAR002ValidWso2ScopesCheck extends AbstractWso2ScopesCheck {
 
 	public static final String KEY = "OAR002";
 	private static final String MESSAGE = "OAR002.error";
 	private static final String MESSAGE_PROP = "OAR002.error-property";
+	private static final Set<String> NULL_SPELLINGS = ImmutableSet.of("~", "Null", "NULL");
 
 	private JsonNode scopesNode;
 
 	@Override
 	protected void visitScopesNode(JsonNode scopesNode) {
-		if (scopesNode.isNull()) addIssue(KEY, translate(MESSAGE), scopesNode.key());
+		if (scopesNode.isNull()) {
+			addIssue(KEY, translate(MESSAGE), scopesNode.key());
+		} else if (scopesNode.isMissing() && scopesKeyNode() != null) {
+			addIssue(KEY, translate(MESSAGE), scopesKeyNode());
+		}
 		this.scopesNode = scopesNode;
 	}
 
@@ -36,10 +45,33 @@ protected void visitScope(JsonNode scope) {
 
 	private void validateProperty(Map<String, JsonNode> properties, String propertyName, JsonNode scope) {
 		JsonNode property = properties.get(propertyName);
-		if (!properties.containsKey(propertyName)) {
-			addIssue(KEY, translate(MESSAGE_PROP, propertyName), scope);
-		} else if(property.isNull() || property.getTokenValue().trim().equals("")) {
+		if (property == null) {
+			addIssue(KEY, translate(MESSAGE_PROP, propertyName), scopeLocation(scope));
+			return;
+		}
+		if (property.isMissing()) {
+			JsonNode key = JsonNodeUtils.propertyKey(scope, propertyName);
+			addIssue(KEY, translate(MESSAGE_PROP, propertyName), key != null ? key : scopeLocation(scope));
+		} else if (isEmpty(property)) {
 			addIssue(KEY, translate(MESSAGE_PROP, propertyName), property.key());
 		}
 	}
+
+	private JsonNode scopeLocation(JsonNode scope) {
+		JsonNode key = scope.key();
+		return key.isMissing() ? scope : key;
+	}
+
+	private boolean isEmpty(JsonNode property) {
+		if (isNullScalar(property)) return true;
+		if (property.isArray()) return property.elements().isEmpty();
+		if (property.isObject()) return property.propertyMap().isEmpty();
+		return property.getTokenValue().trim().equals("");
+	}
+
+	private boolean isNullScalar(JsonNode property) {
+		if (property.isNull()) return true;
+		Token token = property.getToken();
+		return token != null && NULL_SPELLINGS.contains(token.getOriginalValue());
+	}
 }

src/main/java/apiaddicts/sonar/openapi/checks/format/AbstractFormatCheck.java

@@ -7,6 +7,7 @@
 import org.apiaddicts.apitools.dosonarapi.api.v31.OpenApi31Grammar;
 import org.apiaddicts.apitools.dosonarapi.api.v32.OpenApi32Grammar;
 import apiaddicts.sonar.openapi.checks.BaseCheck;
+import apiaddicts.sonar.openapi.utils.JsonNodeUtils;
 import org.apiaddicts.apitools.dosonarapi.sslr.yaml.grammar.JsonNode;
 
 import java.util.Set;
@@ -25,7 +26,7 @@ public void visitNode(JsonNode node) {
 
     private void visitV2Node(JsonNode node) {
         JsonNode typeNode = node.get("type");
-        String type = typeNode.getTokenValue();
+        String type = JsonNodeUtils.getPrimaryType(typeNode);
         JsonNode formatNode = node.get("format");
         if (formatNode.isMissing()) {
             validate(type, null, typeNode, node);

src/main/java/apiaddicts/sonar/openapi/checks/format/OAR044MediaTypeCheck.java

@@ -45,11 +45,11 @@ public class OAR044MediaTypeCheck extends BaseCheck {
   private final ExternalRefHandler handleExternalRef = new ExternalRefHandler();
 
   private static final String RESTRICTED_NAME = "[a-zA-Z0-9][a-zA-Z0-9.!#$&^_+\\-]*";
-  private static final String OWS = "[ \\t]*";
-  private static final String TOKEN = "[a-zA-Z0-9!#$%&'*+\\-.^_`|~]+";
-  private static final String QUOTED_STRING = "\"(?:[^\"\\\\]|\\\\.)*\"";
+  private static final String OWS = "[ \\t]*+";
+  private static final String TCHARS = "[a-zA-Z0-9!#$%&'*+\\-.^_`|~]++";
+  private static final String QUOTED_STRING = "\"(?:[^\"\\\\]|\\\\.)*+\"";
   private static final String PARAMETERS =
-      "(?:" + OWS + ";" + OWS + TOKEN + "=(?:" + TOKEN + "|" + QUOTED_STRING + "))*";
+      "(?:" + OWS + ";" + OWS + TCHARS + "=(?:" + TCHARS + "|" + QUOTED_STRING + "))*+";
 
   @VisibleForTesting
   static final Pattern MIME_TYPE_PATTERN = Pattern.compile(

src/main/java/apiaddicts/sonar/openapi/checks/format/OAR115VerifyRequiredFields.java

@@ -2,6 +2,7 @@
 
 import apiaddicts.sonar.openapi.checks.BaseCheck;
 import static apiaddicts.sonar.openapi.utils.JsonNodeUtils.isExternalRef;
+import static apiaddicts.sonar.openapi.utils.JsonNodeUtils.isObjectType;
 import static apiaddicts.sonar.openapi.utils.JsonNodeUtils.resolve;
 import com.google.common.collect.ImmutableSet;
 import com.sonar.sslr.api.AstNodeType;
@@ -58,7 +59,7 @@ public void resolveExteralRef(JsonNode node) {
 
     public void verifyTypeObject(JsonNode node){
         JsonNode typeNode = node.get("type");
-        if (typeNode != null && "object".equals(typeNode.getTokenValue())) {
+        if (typeNode != null && isObjectType(typeNode)) {
             validateRequiredFields(node);
         }
     }

src/main/java/apiaddicts/sonar/openapi/checks/format/OAR116PathPatternCheck.java

@@ -0,0 +1,53 @@
+package apiaddicts.sonar.openapi.checks.format;
+
+import java.util.Set;
+import java.util.regex.Pattern;
+
+import com.google.common.collect.ImmutableSet;
+import com.sonar.sslr.api.AstNodeType;
+
+import org.sonar.check.Rule;
+import org.sonar.check.RuleProperty;
+
+import apiaddicts.sonar.openapi.checks.BaseCheck;
+import org.apiaddicts.apitools.dosonarapi.api.v2.OpenApi2Grammar;
+import org.apiaddicts.apitools.dosonarapi.api.v3.OpenApi3Grammar;
+import org.apiaddicts.apitools.dosonarapi.api.v31.OpenApi31Grammar;
+import org.apiaddicts.apitools.dosonarapi.api.v32.OpenApi32Grammar;
+import org.apiaddicts.apitools.dosonarapi.sslr.yaml.grammar.JsonNode;
+
+@Rule(key = OAR116PathPatternCheck.KEY)
+public class OAR116PathPatternCheck extends BaseCheck {
+
+    public static final String KEY = "OAR116";
+    private static final String MESSAGE = "OAR116.error";
+    private static final String DEFAULT_PATTERN = "^/";
+
+    @RuleProperty(
+            key = "pattern",
+            description = "Regular expression every API path must match.",
+            defaultValue = DEFAULT_PATTERN
+    )
+    private String patternStr = DEFAULT_PATTERN;
+
+    private Pattern pattern;
+
+    @Override
+    public Set<AstNodeType> subscribedKinds() {
+        return ImmutableSet.of(OpenApi2Grammar.PATH, OpenApi3Grammar.PATH, OpenApi31Grammar.PATH, OpenApi32Grammar.PATH);
+    }
+
+    @Override
+    protected void visitFile(JsonNode root) {
+        pattern = Pattern.compile(patternStr != null ? patternStr : DEFAULT_PATTERN);
+        super.visitFile(root);
+    }
+
+    @Override
+    public void visitNode(JsonNode node) {
+        String path = node.key().getTokenValue();
+        if (!pattern.matcher(path).find()) {
+            addIssue(KEY, translate(MESSAGE, patternStr), node.key());
+        }
+    }
+}

src/main/java/apiaddicts/sonar/openapi/checks/owasp/OAR070BrokenAccessControlCheck.java

@@ -4,6 +4,8 @@
 import org.apiaddicts.apitools.dosonarapi.sslr.yaml.grammar.JsonNode;
 import org.sonar.check.Rule;
 
+import static apiaddicts.sonar.openapi.utils.JsonNodeUtils.isType;
+
 @Rule(key = OAR070BrokenAccessControlCheck.KEY)
 public class OAR070BrokenAccessControlCheck extends AbstractParameterCheck {
 
@@ -24,20 +26,18 @@ protected void visitParameterNode(JsonNode node) {
         JsonNode schemaNode = node.get("schema");
 
         boolean isNumericType =
-                typeNode != null &&
-                ("integer".equals(typeNode.getTokenValue()) ||
-                 "number".equals(typeNode.getTokenValue()) ||
-                 "float".equals(typeNode.getTokenValue()));
+                isType(typeNode, "integer") ||
+                isType(typeNode, "number") ||
+                isType(typeNode, "float");
 
         if (!isNumericType && schemaNode != null) {
 
             JsonNode schemaTypeNode = schemaNode.get("type");
 
             isNumericType =
-                    schemaTypeNode != null &&
-                    ("integer".equals(schemaTypeNode.getTokenValue()) ||
-                     "number".equals(schemaTypeNode.getTokenValue()) ||
-                     "float".equals(schemaTypeNode.getTokenValue()));
+                    isType(schemaTypeNode, "integer") ||
+                    isType(schemaTypeNode, "number") ||
+                    isType(schemaTypeNode, "float");
 
             typeNode = schemaTypeNode;
         }