SONARJAVA-6245

Summary

This PR updates rule S2092 (secure cookie flag) metadata to align with current SonarSource standards:

Key changes:

• Rule classification: Changed from SECURITY_HOTSPOT to VULNERABILITY in the JSON metadata
• Documentation restructure: Converted rule description HTML from legacy format (Ask Yourself Whether / Recommended Practices) to modern format (Why is this an issue? / Potential impact / How to fix it)
• Content improvements: Added detailed explanation of session hijacking risks, improved code examples with diff markup (data-diff-id/data-diff-type), and changed terminology from "Sensitive Code Example" to "Noncompliant code example" to match current conventions
• Title refinement: Simplified rule title from "Creating cookies without the "secure" flag is security-sensitive" to "Cookies should have the "secure" flag"
• Metadata cleanup: JSON formatting adjustment and timestamp update

The changes modernize the rule presentation without altering the core detection logic or severity assessment.

What reviewers should know

What to review:

1. Type change impact: The S2092 rule type changed from SECURITY_HOTSPOT to VULNERABILITY. Verify this classification change is intentional and doesn't affect how the rule is processed by SonarQube.

2. HTML documentation: Check that the restructured rule description is clearer and the new format (with diff markup in code examples) renders correctly in SonarQube.

3. Breaking changes: Confirm that changing from SECURITY_HOTSPOT to VULNERABILITY doesn't break any existing integrations, dashboards, or rule filtering logic that depends on the old type.

4. Metadata consistency: The JSON formatting moves quickfix earlier in the structure—verify this doesn't affect parsing or tooling that depends on JSON field order.

No logic changes—this is purely metadata and documentation updates.

• Generate Walkthrough
• Generate Diagram

🗣️ Give feedback

Quality Gate passed

Issues
0 New issues
0 Fixed issues
0 Accepted issues

Measures
0 Security Hotspots
0 Dependency risks
No data about Coverage
No data about Duplication

See analysis details on SonarQube