SONARPY-4757 S5332: Do not raise on a bare clear-text scheme literal ("http://", "ftp://")

GitOrigin-RevId: a6d2cf1060a447f63b807e100f6ba170bd96701d

Author: ZiadMarey

python-checks/src/main/java/org/sonar/python/checks/hotspots/ClearTextProtocolsCheck.java

@@ -80,7 +80,7 @@ public void initialize(Context originalContext) {
     context.registerSyntaxNodeConsumer(Tree.Kind.STRING_ELEMENT, ctx -> {
       Tree node = ctx.syntaxNode();
       String value = Expressions.unescape((StringElement) node);
-      unsafeProtocol(value)
+      unsafeProtocol(value, node)
         .filter(protocol -> !isProtocolIdentificationArgument(node, ctx))
         // cleanup slashes
         .map(protocol -> protocol.substring(0, protocol.length() - 3))
@@ -273,14 +273,17 @@ private static void handleAssignmentStatement(AssignmentStatement assignmentStat
     }
   }
 
-  private static Optional<String> unsafeProtocol(String literalValue) {
+  private static Optional<String> unsafeProtocol(String literalValue, Tree stringElement) {
     return CLEARTEXT_PROTOCOLS.stream()
       .filter(literalValue::startsWith)
       .filter(p -> {
         String rest = literalValue.substring(p.length());
         if (rest.isEmpty()) {
-          // Bare scheme string (e.g. "http://") — always flag
-          return true;
+          // Keep direct replace arguments reportable; the identification filter exempts the old value.
+          return stringElement.parent().parent() instanceof RegularArgument argument
+            && TreeUtils.firstAncestorOfKind(argument, Tree.Kind.CALL_EXPR) instanceof CallExpression call
+            && call.callee() instanceof QualifiedExpression callee
+            && "replace".equals(callee.name().name());
         }
         char first = rest.charAt(0);
         if (first == '/' || first == '?' || first == '#') {

python-checks/src/test/resources/checks/hotspots/clearTextProtocols.py

@@ -7,8 +7,7 @@
 import urllib.request
 
 def clear_text_protocol():
-  url = "http://" # Noncompliant {{Using HTTP protocol is insecure. Use HTTPS instead.}}
-  #     ^^^^^^^^^
+  url = "http://" # Compliant
   url = "http://exemple.com" # Noncompliant
   url = "http://0001::1" # Noncompliant
   url = "http://dead:beef::1" # Noncompliant
@@ -18,9 +17,9 @@ def clear_text_protocol():
   url = "http://subdomain.exemple.com" # Noncompliant
   #     ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
 
-  url = "ftp://" # Noncompliant {{Using FTP protocol is insecure. Use SFTP, SCP or FTPS instead.}}
+  url = "ftp://" # Compliant
   url = "ftp://anonymous@exemple.com" # Noncompliant
-  url = "telnet://" # Noncompliant
+  url = "telnet://" # Compliant
   url = "telnet://anonymous@exemple.com" # Noncompliant {{Using Telnet protocol is insecure. Use SSH instead.}}
 
   # Argument default value
@@ -178,6 +177,7 @@ def clear_text_protocol_used_as_prefix_grouped(url: str):
 
 def clear_text_protocol_used_outside_startswith_prefix(url: str):
   check_protocol("http://insecure.com") # Noncompliant
+  check_protocol("http://") # Compliant
   url.endswith("http://insecure.com") # Noncompliant
   url.startswith(prefix="http://insecure.com") # Noncompliant
   str.startswith("http://insecure.com") # Noncompliant