SONARJAVA-6745 Implement new rule S9146: Apache XML RPC extensions should not be enabled

[romainbrenguier]

Detect calls to setEnabledForExtensions() on Apache XML-RPC configuration objects where the argument is not provably false, as enabling extensions activates Java object deserialization which can lead to remote code execution.

Part of

[hashicorp-vault-sonar-prod]

SONARJAVA-6745

[sonarqube-next]

Quality Gate passed

Issues
0 New issues
0 Fixed issues
0 Accepted issues

Measures
0 Security Hotspots
0 Dependency risks
100.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube

[rombirli]

Great impl

[gitar-bot]

Code Review ✅ Approved 1 resolved / 1 findings

Implements new rule S9146 to detect insecure Apache XML-RPC extension enablement, addressing the vulnerability reports for unknown boolean arguments. No issues found.

✅ 1 resolved

✅ Edge Case: Rule reports as VULNERABILITY for unknown boolean arguments

📄 java-checks/src/main/java/org/sonar/java/checks/security/XmlRpcExtensionsCheck.java:40-43 📄 java-checks-test-sources/default/src/main/files/non-compiling/checks/security/XmlRpcExtensionsCheckSample.java:33-36
The check flags any argument that is not provably Boolean.FALSE, including runtime-computed values (e.g. setEnabledForExtensions(enable)). Since the rule type is VULNERABILITY (not a Security Hotspot), this can produce false positives in code that legitimately passes a boolean that is false at runtime but not resolvable as a compile-time constant. This is intentional per the test samples, but consider whether such unresolvable cases warrant a Security Hotspot classification or a distinct message to reduce noise.

Implementation Status ✅ 1 / 1 issues implemented

✅ SONARJAVA-6742 — 1 / 1 objectives

The PR implements the new rule S9146 to check that Apache XML RPC extensions are not enabled.

✅ 1 complete

• ✅ Implement new rule S9146: Apache XML RPC extensions should not be enabled

Options

Auto-apply is off → Gitar will not commit updates to this branch.
Display: compact → Showing less information.

Comment with these commands to change the behavior for this request:

Auto-apply	Compact
gitar auto-apply:on	gitar display:verbose

_{Was this helpful? React with 👍 / 👎 | Gitar}