Deprecate S6299: Disabling Vue.js built-in escaping is security-sensitive

[loris-s-sonarsource]

This rule is not consistent with the rule quality the AppSec squad enforces:

The rule risks a non-negligible number of FPs for the chance of having TPs.
It is non-productive as TPs would get drowned in between FPs. we lose credibility and engagement even if we do find TPs

The rule is hardly actionable as is, as it only shows a “sink”, not the rest of where the variable is coming from, to check if it is an actual problem

Security Hotspots are meant to raise issues that require data that cannot be put in the same code base, such as organizational needs. The why of the rule seems related to the fact that the analyzer does not support VueJS and the specificator still wanted to make a move.
This is not a standard practice at AppSec and does not follow the company delivery model

Review

A dedicated reviewer checked the rule description successfully for:

• logical errors and incorrect information
• information gaps and missing content
• text style and tone
• PR summary and labels follow the guidelines

[sonarqube-next]

Quality Gate passed for 'rspec-tools'

Issues
0 New issues
0 Fixed issues
0 Accepted issues

Measures
0 Security Hotspots
No data about Coverage
No data about Duplication

See analysis details on SonarQube

[sonarqube-next]

Quality Gate passed for 'rspec-frontend'

Issues
0 New issues
0 Fixed issues
0 Accepted issues

Measures
0 Security Hotspots
No data about Coverage
No data about Duplication

See analysis details on SonarQube

[hendrik-buchwald-sonarsource]

LGTM