Skip to content

New changes 20260122 - #7

Open
jonathanvila wants to merge 12 commits into
mainfrom
20260122
Open

New changes 20260122#7
jonathanvila wants to merge 12 commits into
mainfrom
20260122

Conversation

@jonathanvila

@jonathanvilajonathanvila commented Jan 22, 2026

Copy link
Copy Markdown

No description provided.

@sonarqubecloud

sonarqubecloudBot commented Jan 22, 2026

Copy link
Copy Markdown

Quality Gate FailedQuality Gate failed

Failed conditions
0.0% Coverage on New Code (required ≥ 30%)
E Security Rating on New Code (required ≥ A)

See analysis details on SonarQube Cloud

Catch issues before they fail your Quality Gate with our IDE extension SonarQube for IDE

github-advanced-security[bot]
github-advanced-securityAI found potential problems Jan 22, 2026
View reviewed changes
Comment threadsrc/main/java/demo/security/util/DBUtils.java
String myJDBCPasswd = "myJDBCPasswd";
connection = DriverManager.getConnection(
"mYJDBCUrl", "myJDBCUser", "myJDBCPasswd");
"mYJDBCUrl", "myJDBCUser", myJDBCPasswd);

Check failure

Code scanning / SonarCloud

Credentials should not be hard-coded

<!--SONAR_ISSUE_KEY:AZvmahNCtvKpHQXPw_7--->Revoke and change this password, as it is compromised. <p>See more on <a href="https://sonarcloud.io/project/issues?id=jonathanvila_java-security-demo&issues=AZvmahNCtvKpHQXPw_7-&open=AZvmahNCtvKpHQXPw_7-&pullRequest=7">SonarQube Cloud</a></p>
github-advanced-security[bot]
github-advanced-securityAI found potential problems Jan 22, 2026
View reviewed changes
Comment threadsrc/main/java/demo/security/util/DBUtils.java
String myJDBCPasswd = "myJDBCPasswd";
connection = DriverManager.getConnection(
"mYJDBCUrl", "myJDBCUser", "myJDBCPasswd");
"mYJDBCUrl", "myJDBCUser", myJDBCPasswd);

Check failure

Code scanning / SonarCloud

Credentials should not be hard-coded

<!--SONAR_ISSUE_KEY:AZvmah-ctvKpHQXPw_8e-->Revoke and change this password, as it is compromised. <p>See more on <a href="https://sonarcloud.io/project/issues?id=jonathanvila_java-security-demo&issues=AZvmah-ctvKpHQXPw_8e&open=AZvmah-ctvKpHQXPw_8e&branch=20260122">SonarQube Cloud</a></p>
@sonarqubecloud

sonarqubecloudBot commented Jan 22, 2026

Copy link
Copy Markdown

SonarQube reviewer guide

Summary: Downgrade Java from 21 to 17, update Sonar configuration, and remove vulnerable/complex code methods.

Review Focus: Removal of SQL injection vulnerable findItem() method and virtual thread implementation connectToExternalUrlConcurrently(). Hardcoded password in newConnect() remains a security issue.

Start review at: src/main/java/demo/security/util/DBUtils.java. Contains critical security changes including removed vulnerable methods and a remaining hardcoded credential that needs addressing.

💬 Please send your feedback

Review in SonarQube
See all code changes, issues, and quality metrics in one place.

Quality Gate FailedQuality Gate failed

Failed conditions
5 New issues
0.0% Coverage on New Code (required ≥ 80%)

See analysis details on SonarQube Cloud

Catch issues before they fail your Quality Gate with our IDE extension SonarQube for IDE

@sonarqube-cloud-dev7

sonarqube-cloud-dev7Bot commented Jul 28, 2026

Copy link
Copy Markdown

Quality Gate FailedQuality Gate failed

Failed conditions
E Security Rating on New Code (required ≥ A)

See analysis details on SonarQube Cloud

💡 Need a hand with PR review? Try Gitar by Sonar!

github-advanced-security[bot]
github-advanced-securityAI found potential problems Jul 28, 2026
View reviewed changes
Comment threadsrc/main/java/demo/security/util/DBUtils.java
}

public List<String> findItem(String itemId) throws Exception {
String query = "SELECT item_id FROM items WHERE item_id = '" + itemId + "'";

Check failure

Code scanning / SonarCloudDev7

Credentials should not be hard-coded High

Revoke and change this password, as it is compromised. See more on SonarQube Cloud
Sign up for freeto join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

2 participants

@jonathanvila@github-advanced-security