SONARJAVA-5555 Update rule metadata (#5210)

github-actions[bot] · tomasz-tylenda-sonarsource · web-flow · commit 293bdd9c4394 · 2025-06-24T17:01:42.000+02:00
Co-authored-by: tomasz-tylenda-sonarsource &lt;tomasz-tylenda-sonarsource@users.noreply.github.com&gt;
Co-authored-by: Tomasz Tylenda &lt;tomasz.tylenda@sonarsource.com&gt;
diff --git a/sonar-java-plugin/src/main/resources/org/sonar/l10n/java/rules/java/S1191.html b/sonar-java-plugin/src/main/resources/org/sonar/l10n/java/rules/java/S1191.html
@@ -12,7 +12,8 @@ <h3>Noncompliant code example</h3>
 <pre>
 import sun.misc.BASE64Encoder; // Noncompliant
 </pre>
-<h2>Documentation</h2>
+<h2>Resources</h2>
+<h3>Documentation</h3>
 <ul>
   <li> <a href="https://www.oracle.com/java/technologies/faq-sun-packages.html">Sun Packages</a> </li>
 </ul>
diff --git a/sonar-java-plugin/src/main/resources/org/sonar/l10n/java/rules/java/S1195.html b/sonar-java-plugin/src/main/resources/org/sonar/l10n/java/rules/java/S1195.html
@@ -18,7 +18,8 @@ <h3>Compliant solution</h3>
     public int[][] getMatrix() { /* ... */ }  // Compliant
 }
 </pre>
-<h2>Documentation</h2>
+<h2>Resources</h2>
+<h3>Documentation</h3>
 <ul>
   <li> <a href="https://docs.oracle.com/javase/specs/jls/se20/html/jls-10.html">Oracle Java Language Specification</a> - Arrays </li>
 </ul>
diff --git a/sonar-java-plugin/src/main/resources/org/sonar/l10n/java/rules/java/S1313.html b/sonar-java-plugin/src/main/resources/org/sonar/l10n/java/rules/java/S1313.html
@@ -1,7 +1,7 @@
 <p>Hardcoding IP addresses is security-sensitive. It has led in the past to the following vulnerabilities:</p>
 <ul>
-  <li> <a href="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-5901">CVE-2006-5901</a> </li>
-  <li> <a href="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-3725">CVE-2005-3725</a> </li>
+  <li> <a href="https://www.cve.org/CVERecord?id=CVE-2006-5901">CVE-2006-5901</a> </li>
+  <li> <a href="https://www.cve.org/CVERecord?id=CVE-2005-3725">CVE-2005-3725</a> </li>
 </ul>
 <p>Today’s services have an ever-changing architecture due to their scaling and redundancy needs. It is a mistake to think that a service will always
 have the same IP address. When it does change, the hardcoded IP will have to be modified too. This will have an impact on the product development,
diff --git a/sonar-java-plugin/src/main/resources/org/sonar/l10n/java/rules/java/S1643.html b/sonar-java-plugin/src/main/resources/org/sonar/l10n/java/rules/java/S1643.html
@@ -18,6 +18,8 @@ <h3>Compliant solution</h3>
   }
   String str = bld.toString();
 </pre>
+<h2>Resources</h2>
+<h3>Benchmarks</h3>
 <table>
   <colgroup>
     <col style="width: 20%;">
diff --git a/sonar-java-plugin/src/main/resources/org/sonar/l10n/java/rules/java/S1710.html b/sonar-java-plugin/src/main/resources/org/sonar/l10n/java/rules/java/S1710.html
@@ -24,7 +24,8 @@ <h4>Compliant solution</h4>
   ...
 }
 </pre>
-<h2>References</h2>
+<h2>Resources</h2>
+<h3>Documentation</h3>
 <ul>
   <li> <a href="https://docs.oracle.com/javase/tutorial/java/annotations/repeating.html">Repeating Annotations - The Java™ Tutorials</a> </li>
 </ul>
diff --git a/sonar-java-plugin/src/main/resources/org/sonar/l10n/java/rules/java/S1844.html b/sonar-java-plugin/src/main/resources/org/sonar/l10n/java/rules/java/S1844.html
@@ -4,24 +4,25 @@ <h2>Why is this an issue?</h2>
 nuanced <code>await</code> methods.</p>
 <p>Consequently, calling the method <code>Object.wait</code> on a class implementing the <code>Condition</code> interface is contradictory and should
 be avoided. Use <code>Condition.await</code> instead.</p>
-<h2>Code examples</h2>
-<h3>Noncompliant code example</h3>
+<h3>Code examples</h3>
+<h4>Noncompliant code example</h4>
 <pre data-diff-id="1" data-diff-type="noncompliant">
 void doSomething(Condition condition) {
     condition.wait(); // Noncompliant, Object.wait is called
 
         ...
 }
 </pre>
-<h3>Compliant solution</h3>
+<h4>Compliant solution</h4>
 <pre data-diff-id="1" data-diff-type="compliant">
 void doSomething(Condition condition) {
     condition.await(); // Compliant, Condition.await is called
 
         ...
 }
 </pre>
-<h2>References</h2>
+<h2>Resources</h2>
+<h3>Documentation</h3>
 <ul>
   <li> <a href="https://docs.oracle.com/javase/8/docs/api/java/util/concurrent/locks/Condition.html">Interface Condition - Java™ Platform SE 8, API
   Specification</a> </li>
diff --git a/sonar-java-plugin/src/main/resources/org/sonar/l10n/java/rules/java/S1849.html b/sonar-java-plugin/src/main/resources/org/sonar/l10n/java/rules/java/S1849.html
@@ -5,8 +5,8 @@ <h2>Why is this an issue?</h2>
 <h2>How to fix it</h2>
 <p>How to fix this issue strongly depends on the specific implementation of the iterator. Make sure that the logic of the <code>hasNext()</code>
 implementation does not change the state of the iterator or any underlying data sources. Instead, it should merely return state information.</p>
-<h2>Code examples</h2>
-<h3>Noncompliant code example</h3>
+<h3>Code examples</h3>
+<h4>Noncompliant code example</h4>
 <pre data-diff-id="1" data-diff-type="noncompliant">
 class MyIterator implements Iterator&lt;Integer&gt; {
 
@@ -30,7 +30,7 @@ <h3>Noncompliant code example</h3>
   }
 }
 </pre>
-<h3>Compliant solution</h3>
+<h4>Compliant solution</h4>
 <pre data-diff-id="1" data-diff-type="compliant">
 class MyIterator implements Iterator&lt;Integer&gt; {
 
diff --git a/sonar-java-plugin/src/main/resources/org/sonar/l10n/java/rules/java/S2068.html b/sonar-java-plugin/src/main/resources/org/sonar/l10n/java/rules/java/S2068.html
@@ -2,8 +2,8 @@
 applications that are distributed or that are open-source.</p>
 <p>In the past, it has led to the following vulnerabilities:</p>
 <ul>
-  <li> <a href="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-13466">CVE-2019-13466</a> </li>
-  <li> <a href="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-15389">CVE-2018-15389</a> </li>
+  <li> <a href="https://www.cve.org/CVERecord?id=CVE-2019-13466">CVE-2019-13466</a> </li>
+  <li> <a href="https://www.cve.org/CVERecord?id=CVE-2018-15389">CVE-2018-15389</a> </li>
 </ul>
 <p>Passwords should be stored outside of the code in a configuration file, a database, or a password management service.</p>
 <p>This rule flags instances of hard-coded passwords used in database and LDAP connections. It looks for hard-coded passwords in connection strings,
diff --git a/sonar-java-plugin/src/main/resources/org/sonar/l10n/java/rules/java/S2245.html b/sonar-java-plugin/src/main/resources/org/sonar/l10n/java/rules/java/S2245.html
@@ -7,9 +7,9 @@
 values that must remain confidential and resistant to guessing attacks.</p>
 <p>For example, the use of non-cryptographic PRNGs has led to vulnerabilities such as:</p>
 <ul>
-  <li> <a href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-6386">CVE-2013-6386</a> </li>
-  <li> <a href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-3419">CVE-2006-3419</a> </li>
-  <li> <a href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-4102">CVE-2008-4102</a> </li>
+  <li> <a href="https://www.cve.org/CVERecord?id=CVE-2013-6386">CVE-2013-6386</a> </li>
+  <li> <a href="https://www.cve.org/CVERecord?id=CVE-2006-3419">CVE-2006-3419</a> </li>
+  <li> <a href="https://www.cve.org/CVERecord?id=CVE-2008-4102">CVE-2008-4102</a> </li>
 </ul>
 <p>When software generates predictable values in a context requiring unpredictability, it may be possible for an attacker to guess the next value that
 will be generated, and use this guess to impersonate another user or access sensitive information. Therefore, it is critical to use CSPRNGs in any
diff --git a/sonar-java-plugin/src/main/resources/org/sonar/l10n/java/rules/java/S2273.html b/sonar-java-plugin/src/main/resources/org/sonar/l10n/java/rules/java/S2273.html
@@ -30,7 +30,8 @@ <h4>Compliant solution</h4>
   }
 }
 </pre>
-<h2>References</h2>
+<h2>Resources</h2>
+<h3>Documentation</h3>
 <ul>
   <li> <a href="https://docs.oracle.com/javase/tutorial/essential/concurrency/syncmeth.html">Java Documentation</a> - Synchronized methods </li>
   <li> <a href="https://docs.oracle.com/javase%2F7%2Fdocs%2Fapi%2F%2F/java/lang/Object.html#wait()">Java Documentation</a> - java.lang.Object class
diff --git a/sonar-java-plugin/src/main/resources/org/sonar/l10n/java/rules/java/S2293.html b/sonar-java-plugin/src/main/resources/org/sonar/l10n/java/rules/java/S2293.html
@@ -22,7 +22,8 @@ <h4>Compliant solution</h4>
 List&lt;String&gt; strings = new ArrayList&lt;&gt;();        // Compliant, the compiler will infer the type argument
 Map&lt;String,List&lt;Integer&gt;&gt; map = new HashMap&lt;&gt;(); // Compliant, the compiler will infer the type argument
 </pre>
-<h2>References</h2>
+<h2>Resources</h2>
+<h3>Documentation</h3>
 <ul>
   <li> <a href="https://docs.oracle.com/javase/tutorial/java/generics/genTypeInference.html">The Java™ Tutorials</a> - Type Inference (Generics) </li>
 </ul>
diff --git a/sonar-java-plugin/src/main/resources/org/sonar/l10n/java/rules/java/S2864.html b/sonar-java-plugin/src/main/resources/org/sonar/l10n/java/rules/java/S2864.html
@@ -24,6 +24,15 @@ <h3>Compliant solution</h3>
   }
 }
 </pre>
+<h2>Resources</h2>
+<h3>Documentation</h3>
+<ul>
+  <li> <a href="https://docs.oracle.com/en/java/javase/20/docs/api/java.base/java/util/Map.html">Oracle SE 20 - Map</a> </li>
+</ul>
+<h3>Articles &amp; blog posts</h3>
+<ul>
+  <li> <a href="https://www.baeldung.com/java-map-entries-methods">Baeldung - Java Map methods</a> </li>
+</ul>
 <h3>Benchmarks</h3>
 <table>
   <colgroup>
@@ -127,13 +136,4 @@ <h3>Benchmarks</h3>
   }
 }
 </pre>
-<h2>Resources</h2>
-<h3>Documentation</h3>
-<ul>
-  <li> <a href="https://docs.oracle.com/en/java/javase/20/docs/api/java.base/java/util/Map.html">Oracle SE 20 - Map</a> </li>
-</ul>
-<h3>Articles &amp; blog posts</h3>
-<ul>
-  <li> <a href="https://www.baeldung.com/java-map-entries-methods">Baeldung - Java Map methods</a> </li>
-</ul>
 
diff --git a/sonar-java-plugin/src/main/resources/org/sonar/l10n/java/rules/java/S3024.html b/sonar-java-plugin/src/main/resources/org/sonar/l10n/java/rules/java/S3024.html
@@ -3,22 +3,17 @@ <h2>Why is this an issue?</h2>
 when you perform a large number of appends. Using <code>String</code> concatenation within <code>StringBuilder.append</code> defeats the purpose of
 the <code>StringBuilder</code>. If you concatenate only a few strings, use direct <code>String</code> concatenation. Otherwise, replace
 <code>String</code> concatenation with calls to <code>append</code>.</p>
+<p>This rule applies to String concatenations performed repeatedly, inside loops. In such scenarios, the performance penalty associated with
+inefficient StringBuilder.append usage can multiply significantly.</p>
 <h3>Noncompliant code example</h3>
 <pre data-diff-id="1" data-diff-type="noncompliant">
 StringBuilder sb = new StringBuilder();
-String s = sb.append("foo is: " + getFoo()).toString(); // Noncompliant
-</pre>
-<pre data-diff-id="2" data-diff-type="noncompliant">
-StringBuilder sb = new StringBuilder();
 for (String name : names) {
   sb.append("Hello : " + name); // Noncompliant
 }
 </pre>
 <h3>Compliant solution</h3>
 <pre data-diff-id="1" data-diff-type="compliant">
-String s = "foo is: " + getFoo();
-</pre>
-<pre data-diff-id="2" data-diff-type="compliant">
 StringBuilder sb = new StringBuilder();
 for (String name : names) {
   sb.append("Hello : ").append(name);
diff --git a/sonar-java-plugin/src/main/resources/org/sonar/l10n/java/rules/java/S3024.json b/sonar-java-plugin/src/main/resources/org/sonar/l10n/java/rules/java/S3024.json
@@ -10,9 +10,15 @@
     "performance",
     "clumsy"
   ],
-  "defaultSeverity": "Major",
+  "defaultSeverity": "Minor",
   "ruleSpecification": "RSPEC-3024",
   "sqKey": "S3024",
   "scope": "Main",
-  "quickfix": "unknown"
+  "quickfix": "covered",
+  "code": {
+    "impacts": {
+      "MAINTAINABILITY": "LOW"
+    },
+    "attribute": "EFFICIENT"
+  }
 }
diff --git a/sonar-java-plugin/src/main/resources/org/sonar/l10n/java/rules/java/S3033.json b/sonar-java-plugin/src/main/resources/org/sonar/l10n/java/rules/java/S3033.json
@@ -1,6 +1,12 @@
 {
-  "title": "\".length\" should be used to test for the emptiness of StringBuffers",
+  "title": "\".isEmpty\" should be used to test for the emptiness of StringBuffers\/Builders",
   "type": "CODE_SMELL",
+  "code": {
+    "impacts": {
+      "MAINTAINABILITY": "LOW"
+    },
+    "attribute": "EFFICIENT"
+  },
   "status": "ready",
   "remediation": {
     "func": "Constant\/Issue",
@@ -10,9 +16,9 @@
     "performance",
     "clumsy"
   ],
-  "defaultSeverity": "Major",
+  "defaultSeverity": "Minor",
   "ruleSpecification": "RSPEC-3033",
   "sqKey": "S3033",
   "scope": "Main",
-  "quickfix": "unknown"
+  "quickfix": "partial"
 }
diff --git a/sonar-java-plugin/src/main/resources/org/sonar/l10n/java/rules/java/S3034.html b/sonar-java-plugin/src/main/resources/org/sonar/l10n/java/rules/java/S3034.html
@@ -60,7 +60,7 @@ <h4>Compliant solution</h4>
     return originalInt;
   }
 </pre>
-<h2>References</h2>
+<h2>Resources</h2>
 <ul>
   <li> <a href="https://wiki.sei.cmu.edu/confluence/x/kDZGBQ">CERT, NUM52-J.</a> - Be aware of numeric promotion behavior </li>
   <li> <a href="https://en.wikipedia.org/wiki/Signed_number_representations#Two.27s_complement">Wikipedia</a> - Two’s complement </li>
diff --git a/sonar-java-plugin/src/main/resources/org/sonar/l10n/java/rules/java/S4512.html b/sonar-java-plugin/src/main/resources/org/sonar/l10n/java/rules/java/S4512.html
@@ -1,6 +1,6 @@
 <p>Setting JavaBean properties is security sensitive. Doing it with untrusted values has led in the past to the following vulnerability:</p>
 <ul>
-  <li> <a href="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0114">CVE-2014-0114</a> </li>
+  <li> <a href="https://www.cve.org/CVERecord?id=CVE-2014-0114">CVE-2014-0114</a> </li>
 </ul>
 <p>JavaBeans can have their properties or nested properties set by population functions. An attacker can leverage this feature to push into the
 JavaBean malicious data that can compromise the software integrity. A typical attack will try to manipulate the ClassLoader and finally execute
diff --git a/sonar-java-plugin/src/main/resources/org/sonar/l10n/java/rules/java/S4544.html b/sonar-java-plugin/src/main/resources/org/sonar/l10n/java/rules/java/S4544.html
@@ -1,7 +1,7 @@
 <p>Using unsafe Jackson deserialization configuration is security-sensitive. It has led in the past to the following vulnerabilities:</p>
 <ul>
-  <li> <a href="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-4995">CVE-2017-4995</a> </li>
-  <li> <a href="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-19362">CVE-2018-19362</a> </li>
+  <li> <a href="https://www.cve.org/CVERecord?id=CVE-2017-4995">CVE-2017-4995</a> </li>
+  <li> <a href="https://www.cve.org/CVERecord?id=CVE-2018-19362">CVE-2018-19362</a> </li>
 </ul>
 <p>When Jackson is configured to allow Polymorphic Type Handling (aka PTH), formerly known as Polymorphic Deserialization, "deserialization gadgets"
 may allow an attacker to perform remote code execution.</p>
diff --git a/sonar-java-plugin/src/main/resources/org/sonar/l10n/java/rules/java/S4792.html b/sonar-java-plugin/src/main/resources/org/sonar/l10n/java/rules/java/S4792.html
@@ -1,10 +1,10 @@
 <p>This rule is deprecated, and will eventually be removed.</p>
 <p>Configuring loggers is security-sensitive. It has led in the past to the following vulnerabilities:</p>
 <ul>
-  <li> <a href="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-0285">CVE-2018-0285</a> </li>
-  <li> <a href="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2000-1127">CVE-2000-1127</a> </li>
-  <li> <a href="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-15113">CVE-2017-15113</a> </li>
-  <li> <a href="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-5742">CVE-2015-5742</a> </li>
+  <li> <a href="https://www.cve.org/CVERecord?id=CVE-2018-0285">CVE-2018-0285</a> </li>
+  <li> <a href="https://www.cve.org/CVERecord?id=CVE-2000-1127">CVE-2000-1127</a> </li>
+  <li> <a href="https://www.cve.org/CVERecord?id=CVE-2017-15113">CVE-2017-15113</a> </li>
+  <li> <a href="https://www.cve.org/CVERecord?id=CVE-2015-5742">CVE-2015-5742</a> </li>
 </ul>
 <p>Logs are useful before, during and after a security incident.</p>
 <ul>
diff --git a/sonar-java-plugin/src/main/resources/org/sonar/l10n/java/rules/java/S5122.html b/sonar-java-plugin/src/main/resources/org/sonar/l10n/java/rules/java/S5122.html
@@ -1,7 +1,7 @@
 <p>Having a permissive Cross-Origin Resource Sharing policy is security-sensitive. It has led in the past to the following vulnerabilities:</p>
 <ul>
-  <li> <a href="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-0269">CVE-2018-0269</a> </li>
-  <li> <a href="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-14460">CVE-2017-14460</a> </li>
+  <li> <a href="https://www.cve.org/CVERecord?id=CVE-2018-0269">CVE-2018-0269</a> </li>
+  <li> <a href="https://www.cve.org/CVERecord?id=CVE-2017-14460">CVE-2017-14460</a> </li>
 </ul>
 <p><a href="https://developer.mozilla.org/en-US/docs/Web/Security/Same-origin_policy">Same origin policy</a> in browsers prevents, by default and for
 security-reasons, a javascript frontend to perform a cross-origin HTTP request to a resource that has a different origin (domain, protocol, or port)
diff --git a/sonar-java-plugin/src/main/resources/org/sonar/l10n/java/rules/java/S5301.html b/sonar-java-plugin/src/main/resources/org/sonar/l10n/java/rules/java/S5301.html
@@ -54,7 +54,7 @@ <h2>Resources</h2>
 <h3>Documentation</h3>
 <ul>
   <li> Apache ActiveMQ Documentation - <a href="https://activemq.apache.org/objectmessage.html">ObjectMessage</a> </li>
-  <li> CVE - <a href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-5254">CVE-2015-5254</a> </li>
+  <li> CVE - <a href="https://www.cve.org/CVERecord?id=CVE-2015-5254">CVE-2015-5254</a> </li>
 </ul>
 <h3>Standards</h3>
 <ul>
diff --git a/sonar-java-plugin/src/main/resources/org/sonar/l10n/java/rules/java/S5320.html b/sonar-java-plugin/src/main/resources/org/sonar/l10n/java/rules/java/S5320.html
@@ -1,6 +1,6 @@
 <p>In Android applications, broadcasting intents is security-sensitive. For example, it has led in the past to the following vulnerability:</p>
 <ul>
-  <li> <a href="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-9489">CVE-2018-9489</a> </li>
+  <li> <a href="https://www.cve.org/CVERecord?id=CVE-2018-9489">CVE-2018-9489</a> </li>
 </ul>
 <p>By default, broadcasted intents are visible to every application, exposing all sensitive information they contain.</p>
 <p>This rule raises an issue when an intent is broadcasted without specifying any "receiver permission".</p>
diff --git a/sonar-java-plugin/src/main/resources/org/sonar/l10n/java/rules/java/S5322.html b/sonar-java-plugin/src/main/resources/org/sonar/l10n/java/rules/java/S5322.html
@@ -1,8 +1,8 @@
 <p>Android applications can receive broadcasts from the system or other applications. Receiving intents is security-sensitive. For example, it has led
 in the past to the following vulnerabilities:</p>
 <ul>
-  <li> <a href="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-1677">CVE-2019-1677</a> </li>
-  <li> <a href="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-1275">CVE-2015-1275</a> </li>
+  <li> <a href="https://www.cve.org/CVERecord?id=CVE-2019-1677">CVE-2019-1677</a> </li>
+  <li> <a href="https://www.cve.org/CVERecord?id=CVE-2015-1275">CVE-2015-1275</a> </li>
 </ul>
 <p>Receivers can be declared in the manifest or in the code to make them context-specific. If the receiver is declared in the manifest Android will
 start the application if it is not already running once a matching broadcast is received. The receiver is an entry point into the application.</p>
diff --git a/sonar-java-plugin/src/main/resources/org/sonar/l10n/java/rules/java/S5679.html b/sonar-java-plugin/src/main/resources/org/sonar/l10n/java/rules/java/S5679.html
@@ -77,14 +77,14 @@ <h3>Articles &amp; blog posts</h3>
   week’s SAML Vulnerability</a> </li>
   <li> Spring Security SAML - <a href="https://github.com/spring-projects/spring-security-saml/issues/228">Issue #228 Multiple SAML libraries may
   allow authentication bypass via incorrect XML canonicalization and DOM traversal</a> </li>
-  <li> CVE - <a href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-11427">CVE-2017-11427</a> </li>
-  <li> CVE - <a href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-11428">CVE-2017-11428</a> </li>
-  <li> CVE - <a href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-11429">CVE-2017-11429</a> </li>
-  <li> CVE - <a href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-11430">CVE-2017-11430</a> </li>
-  <li> CVE - <a href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-0489">CVE-2018-0489</a> </li>
-  <li> CVE - <a href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-7340">CVE-2018-7340</a> </li>
+  <li> CVE - <a href="https://www.cve.org/CVERecord?id=CVE-2017-11427">CVE-2017-11427</a> </li>
+  <li> CVE - <a href="https://www.cve.org/CVERecord?id=CVE-2017-11428">CVE-2017-11428</a> </li>
+  <li> CVE - <a href="https://www.cve.org/CVERecord?id=CVE-2017-11429">CVE-2017-11429</a> </li>
+  <li> CVE - <a href="https://www.cve.org/CVERecord?id=CVE-2017-11430">CVE-2017-11430</a> </li>
+  <li> CVE - <a href="https://www.cve.org/CVERecord?id=CVE-2018-0489">CVE-2018-0489</a> </li>
+  <li> CVE - <a href="https://www.cve.org/CVERecord?id=CVE-2018-7340">CVE-2018-7340</a> </li>
 </ul>
-<h2>Standards</h2>
+<h3>Standards</h3>
 <ul>
   <li> OWASP - <a href="https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures/">Top 10 2021 Category A7 - Identification and
   Authentication Failures</a> </li>
diff --git a/sonar-java-plugin/src/main/resources/org/sonar/l10n/java/rules/java/S6418.html b/sonar-java-plugin/src/main/resources/org/sonar/l10n/java/rules/java/S6418.html
@@ -2,8 +2,8 @@
 applications that are distributed or that are open-source.</p>
 <p>In the past, it has led to the following vulnerabilities:</p>
 <ul>
-  <li> <a href="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-25510">CVE-2022-25510</a> </li>
-  <li> <a href="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-42635">CVE-2021-42635</a> </li>
+  <li> <a href="https://www.cve.org/CVERecord?id=CVE-2022-25510">CVE-2022-25510</a> </li>
+  <li> <a href="https://www.cve.org/CVERecord?id=CVE-2021-42635">CVE-2021-42635</a> </li>
 </ul>
 <p>Secrets should be stored outside of the source code in a configuration file or a management service for secrets.</p>
 <p>This rule detects variables/fields having a name matching a list of words (secret, token, credential, auth, api[_.-]?key) being assigned a
@@ -87,6 +87,8 @@ <h2>See</h2>
   <li> OWASP - <a href="https://owasp.org/www-project-top-ten/2017/A2_2017-Broken_Authentication">Top 10 2017 Category A2 - Broken Authentication</a>
   </li>
   <li> CWE - <a href="https://cwe.mitre.org/data/definitions/798">CWE-798 - Use of Hard-coded Credentials</a> </li>
+  <li> OWASP - <a href="https://owasp.org/www-project-mobile-top-10/2023-risks/m1-improper-credential-usage.html">Mobile Top 10 2024 Category M1 -
+  Improper Credential Usage</a> </li>
   <li> MSC - <a href="https://wiki.sei.cmu.edu/confluence/x/OjdGBQ">MSC03-J - Never hard code sensitive information</a> </li>
 </ul>
 
diff --git a/sonar-java-plugin/src/main/resources/org/sonar/l10n/java/rules/java/S6418.json b/sonar-java-plugin/src/main/resources/org/sonar/l10n/java/rules/java/S6418.json
@@ -33,6 +33,9 @@
     "OWASP Top 10 2021": [
       "A7"
     ],
+    "OWASP Mobile Top 10 2024": [
+      "M1"
+    ],
     "PCI DSS 3.2": [
       "6.5.10"
     ],
diff --git a/sonar-java-plugin/src/main/resources/org/sonar/l10n/java/rules/java/S7158.html b/sonar-java-plugin/src/main/resources/org/sonar/l10n/java/rules/java/S7158.html
diff --git a/sonar-java-plugin/src/main/resources/org/sonar/l10n/java/rules/java/S7409.json b/sonar-java-plugin/src/main/resources/org/sonar/l10n/java/rules/java/S7409.json
diff --git a/sonarpedia.json b/sonarpedia.json

Original file line number	Diff line number	Diff line change
`@@ -18,6 +18,8 @@ <h3>Compliant solution</h3>`
`18`	`18`	`}`
`19`	`19`	`String str = bld.toString();`
`20`	`20`	`</pre>`
	`21`	`+<h2>Resources</h2>`
	`22`	`+<h3>Benchmarks</h3>`
`21`	`23`	`<table>`
`22`	`24`	`<colgroup>`
`23`	`25`	`<col style="width: 20%;">`
Original file line number	Diff line number	Diff line change
`@@ -30,7 +30,8 @@ <h4>Compliant solution</h4>`
`30`	`30`	`}`
`31`	`31`	`}`
`32`	`32`	`</pre>`
`33`		`-<h2>References</h2>`
	`33`	`+<h2>Resources</h2>`
	`34`	`+<h3>Documentation</h3>`
`34`	`35`	`<ul>`
`35`	`36`	`<li> <a href="https://docs.oracle.com/javase/tutorial/essential/concurrency/syncmeth.html">Java Documentation</a> - Synchronized methods </li>`
`36`	`37`	`<li> <a href="https://docs.oracle.com/javase%2F7%2Fdocs%2Fapi%2F%2F/java/lang/Object.html#wait()">Java Documentation</a> - java.lang.Object class`