JS-2368 S5332: False positive on http:// URLs used as schema/namespace identifiers (CycloneDX schema, SNOMED/SOAP/XMPP/ESCO namespaces)

[oleksandr-selehenenko-sonarsource]

Summary

• S5332 was flagging http:// URLs used purely as spec-mandated identifiers (JSON-Schema $schema, coding-system/namespace URIs) that are never dereferenced.
• Extends the existing NAMESPACE_URI_AUTHORITIES allowlist (from JS-1877) with cyclonedx.org, snomed.info, adlnet.gov, jabber.org, etherx.jabber.org.
• Refactored the allowlist check from a single alternation regex to a plain string array + exact-authority helper, avoiding a regex-complexity issue on the extended list.

Test plan

• Added CycloneDX $schema and SNOMED coding-system reproducers, confirmed red before the fix, green after
• Added subdomain-spoofing negative tests per new host (e.g. cyclonedx.org.evil.com) to prove exact-authority anchoring
• Full S5332 suite green

Jira: JS-2368

[hashicorp-vault-sonar-prod]

JS-2368

[sonarqube-next]

Quality Gate passed

Issues
0 New issues
1 Fixed issue
0 Accepted issues

Measures
0 Security Hotspots
0 Dependency risks
100.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube

[github-actions]

Ruling Report

No changes to ruling expected issues in this PR