Add security sub-category to patterns.json about codacy-sonar-csharp

[mrfyda]

Sounds good to me!

[ljmf00]

I propose two ways of implemention this:

• Add subcategories with - char. This will make it compatible with other versions of the API for patterns category. Like:

{
  "patternId": "S3330",
  "category": "Security-XSS",
  "parameters": [],
  "level": "Warning"
}

"Security-XSS" is a XSS specific vulnerability. If there's just "Security", it's a general security issue.

• Another viable option is to add subcategory to the API. Like:

{
  "patternId": "S3330",
  "category": "Security",
  "subcategory": "XSS",
  "parameters": [],
  "level": "Warning"
}

[mrfyda]

While the first option is API compatible, it would require work on the worker to make it compatible. (And I don't see the value in making it API compatible since it's something new that we are adding.)

I do prefer the second option for legibility. And since it's an addition to the API, I don't believe it's a breaking change; it also doesn't require any previous work on the worker beforehand to make it work.

[gjsduarte]

Yeah, I tend to agree with @mrfyda.

[ljmf00]

So in this case, I'll need to make sure, on the seed level, that the subcategory is well matched with the right category, like adding a validate method here https://github.com/codacy/codacy-engine-csharp-seed/blob/master/src/Patterns/Pattern.cs .

I'm also with the second one 😄 . If its good, I'll start implementing that on the seed and then update the documentation according to the owasp-, overflow and other security tags.