Sonar Support with JSP & HTML

JSP/HTML land, usefull tests could be done via some regexp, ie check if style/css are used (to avoid dirty colors/fonts hard-coded for example).

If we want to build something pretty robust and extensible, I think we should integrate a java library which is able to transform a XHTML or badly formatted HTML document into a DOM :

http://htmlparser.sourceforge.net/
http://jtidy.sourceforge.net/
http://sourceforge.net/projects/nekohtml/

a complete list of available libraries is available here : http://java-source.net/open-source/html-parsers

With a DOM we could then imagine to implement a visitor pattern in order to let users create new rules.

Some very simple rules in order to start.
Rule 1: disallow scriptlets
Rule 2: disallow some taglibs (JSTL SQL comes to mind). Could be parametrized by Taglib URL to list all disallowed taglibs.
Rule 3: enforce JSP style (XML syntax)
Rule 4: disallow hard coded labels
Rule 5: disallow dynamic JSP includes (<jsp:include>)
Rule 6: disallow external file in page attribute of dynamic JSP include
Rule 7: disallow TLD location for URI in taglib declaration
For HTML
Rule 8: enforce <script> at the end of the body
Rule 9: disallow <style>
Rule 10: disallow non empty <script> content
Rule 11: enforce a limit on the number of called external files (js and css)

• Author
• Recent Posts

Mantosh Singh

I am working as a Training Development Manager in Cotocus, managing a team of Trainers, Consultants, and Experts who support DevOps, DevSecOps, Master in DevOps, Site Reliability Engineering (SRE) training, consulting and outsourcing projects for our Corporate clients and individuals.

In just 4 years of hard work and commitment to deliver results, our organization is continuously growing and serving 30+ clients globally. We ensure the highest levels of certainty and satisfaction through a deep-set commitment to our clients with our comprehensive industry expertise and a global network of innovative professionals. Our dedication towards delivering the right solution and approach has earned us top clients from the industry with the highest satisfaction rating.

We provide over 40 specialized programs on DevOps, Cloud, and Containers, DevSecOps, SRE, MDE that are focused on industry requirements and each curriculum is developed and delivered by leading experts in each domain and aligned to authoritative certification bodies.

Contact me at contact@DevOpsSchool.com

Latest posts by Mantosh Singh (see all)

• What is Quantum Computing and How to learn it? - November 3, 2023
• Top 10 IT Corporate Training and Consulting Companies - October 11, 2023
• Google My Business Website – All you need to know? - August 25, 2023