[lijun-chen-sonarsource]

Delegate address validation and S1313 exemptions to analyzer commons.
Extract hosts from URLs and endpoints, preserving CIDR prefixes for
whole-range classification.

Use shared parsing to exclude IP literals from hardcoded-secret
detection and remove the rule-local IP regexes.

[hashicorp-vault-sonar-prod]

SONARPHP-1927

[guillem-bartrina-sonarsource]

LGTM, let's see with the bumped analyzer-commons version

✅ All code review findings resolved.

_{Configure merge blocking}

[gitar-bot]

Code Review ✅ Approved 2 closed / 2 findings

🟡 Medium risk · Switching S1313 and secret filtering to shared IP parsing could misclassify literals, suppressing unsafe-address warnings or flagging benign values.

Delegates IP address extraction and S1313 hardcoded-IP exemptions to analyzer-commons IpAddressClassifier, removing the rule-local IP regexes. Scheme-less ip/path and ip:port/path strings are no longer flagged, addressing that finding. No open issues remain.

✅ 2 closed

✅ Bug: Scheme-less ip/path and ip:port/path strings are no longer flagged

📄 php-checks/src/main/java/org/sonar/php/checks/HardCodedIpAddressCheck.java:87-96 📄 php-checks/src/main/java/org/sonar/php/checks/HardCodedIpAddressCheck.java:116 📄 php-checks/src/test/resources/checks/HardCodedIpAddressCheck.php:93-97
extractAddress only removes a path when the string starts with scheme:// or //. In every other case it treats everything after the first / as a CIDR suffix. So "8.8.8.8/api", "10.1.2.3/" or "1.2.3.4:8080/foo" (after the port is stripped) all get sent to IpAddressClassifier.parse as 8.8.8.8/api, 10.1.2.3/ and 1.2.3.4/foo. The new tests say an invalid prefix gives no issue: "10.0.0.1/33" is marked Compliant. A non-numeric prefix like /api is just as invalid, so these literals stop raising.

The old regex required only (?![\w.]) after the IPv4 address, so it flagged all of them. That is a silent false-negative regression in S1313. It also breaks the PR's claim that it extracts hosts from endpoints. The CIDR suffix should be kept only when it is / followed by digits. Any other /... should be treated as a path and dropped.

✅ Cross-PR: php-checks won't compile until analyzer-commons ships parse/ParsedIp

📄 php-checks/src/main/java/org/sonar/php/checks/HardCodedIpAddressCheck.java:36 📄 php-checks/src/main/java/org/sonar/php/checks/HardCodedIpAddressCheck.java:69 📄 php-checks/src/main/java/org/sonar/php/checks/HardCodedSecretCheck.java:42 📄 php-checks/src/main/java/org/sonar/php/checks/HardCodedSecretCheck.java:240
Breaks when this PR merges while sonar-commons is still pinned to 2.33.0.5369, before SonarSource/sonar-analyzer-commons#571 is merged, released and picked up here.

How

1. HardCodedIpAddressCheck.java:69 calls IpAddressClassifier.parse(ip) and ParsedIp.isS1313Exempt(). HardCodedSecretCheck.java:240 calls IpAddressClassifier.parse(literal).isEmpty().
2. gradle/libs.versions.toml:10 still pins sonar-commons = "2.33.0.5369", and the gradle lockfiles lock that same version. This PR does not bump it.
3. The counterpart's commons/src/main/java/org/sonarsource/analyzer/commons/appsec/IpAddressClassifier.java is where the public parse(String), ParsedIp, isMulticast and isS1313Exempt are added. It also removes the old package-private Classification/isInternetRoutable API, so the pinned release doesn't expose them.
4. The new fixture cases in HardCodedIpAddressCheck.php:78-98 depend on the counterpart's behaviour: ff02::1 exempt as multicast, zone suffixes ignored for 2003::1%, and whole-CIDR classification for 127.0.0.1/7 vs /8.

Fix

• This PR: Bump sonar-commons in gradle/libs.versions.toml (and regenerate the lockfiles) to the analyzer-commons release that contains the new IpAddressClassifier API, and merge only after that release exists.
• ACOMMONS-164 Improve IP classification and allow querying without reparsing sonar-analyzer-commons#571: Merge and release first, keeping the parse/ParsedIp.isS1313Exempt signatures and the multicast, zone-stripping and CIDR semantics this PR's tests rely on.

Compared 01bc3ca with SonarSource/sonar-analyzer-commons#571 at b2d76c1

Verification Rules 2/2 met Repos 4 inspected

Functional validation No results

Rules 2 passed 1 not applicable

✅ Internal artifact registries
✅ Repository license compliance

Broader impact Repos 4 inspected

Cross-repo 4 repositories inspected 0 open impacts

SonarSource/sonarlint-vscode Inspected
SonarSource/sonarlint-language-server Inspected
SonarSource/sonarlint-intellij Inspected
SonarSource/sonarqube-mcp-server Inspected

Auto-approval Not enabled

Set up

_{For more verification details, comment gitar display:verbose.}

Options

Auto-apply is off → Gitar will not commit updates to this branch.
Display: compact → Showing compact verification results.

Comment with these commands to change the behavior for this request:

Auto-apply	Compact
gitar auto-apply:on	gitar display:verbose

_{Was this helpful? React with 👍 / 👎 | Gitar}

[sonarqube-next]

Quality Gate passed

Issues
0 New issues
12 Fixed issues
0 Accepted issues

Measures
0 Security Hotspots
0 Dependency risks
100.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube