I have some code that want to SonarQube not check this vulnerability while every deployment.
Any method for add rule for not check X type vulnerability with some error text ?
I found an answer and want to inform for who need answer
https://sqa.stackexchange.com/questions/24734/how-to-deactivate-a-rule-in-sonarqube
Need to copy existing SonarQube built-in profile and deactivate/add new rule in new profile,
after that go to project settings and change Quality Profile.
Related
We utilize the pipeline and after the build completes successfully we are running the following:
bat "mvn sonar:sonar -B -s ${buildSettings} -Dsonar.analysis.mode=preview -Dsonar.skipDesign=true -Dsonar.report.export.path=sonar-report.json"
sonarToGerrit(severity: 'Major', postScore: true, category: 'Code-Review', newIssuesOnly: true, issuesScore: '0', noIssuesScore: '0', changedLinesOnly: true)
The below build log shows that it found a good number of issues but yet the issues to be commented is 0.
Build log
Other posts suggest that it may not be finding the report but I don't believe it's the case as it found a number of issues. Any pipeline configuration advice would be much appreciated.
We are using Sonar Gerrit plugin version 2.2.1, Gerrit Trigger 2.27.3 and Jenkins Enterprise version is 2.60.3.1.
The most common case regarding to your question is related to the fact that SonarQube checks the whole project, regardless of amount of changes that were done in particular change. When creating a new report, it compares a result with a result that is stored to it's database (with previously found issues that were found in a mode other than preview). Thus sonar marks as new all the issues that it was not aware about before (and if you don't store this information in SonarQube at all - all the issues will be marked as new). But sonar-gerrit plugin can only post issues to the files that were affected by the change it is verifying. So, even if you set to "false" the settings "newIssuesOnly" and "changedLinesOnly", all the issues in files not affected by the change will be ignored.
Shortly, check that the issues marked with "isNew"="true" in your sonar report were actually changed (for changedLinesOnly=true) or located in the changed files (for changedLinesOnly = false) in the commit you are trying to check.
Another possible reason is the project configuration settings. If your files are part of a submodule, you'll need to include the submodule name to project base directories set. Or you may want to try a feature "allow auto match" instead. The feature tries to match SonarQube modules to Gerrit names automatically (available since 2.1).
Not related to your question advises regarding your pipeline code:
At the moment settings recognition for severity (and other enum values) is case-sensitive. In fact, the plugin ignores your "Major" setting as it cannot recognize it, and replaces it with default "INFO" value.
Another thing, I don't see why do you set your "postScore" to true as you set "issuesScore" = 0 and "noIssuesScore"=0. You can just set postScore=false and skip these settings along with "category" for sake of simplicity.
Also, if you use the version of plugin above 2.0, be aware that API has slightly changed and now uses the next structure:
sonarToGerrit (
reviewConfig: [
issueFilterConfig: [
severity: 'MAJOR',
newIssuesOnly: false,
changedLinesOnly: false
],
noIssuesTitleTemplate: 'Your text here',
someIssuesTitleTemplate: 'Your text here',
issueCommentTemplate: 'Your text here'
]
)
Though your code should also work (plugin does support previous versions), there is a bigger chance that there may be a bug.
I am also facing the same issue with Sonar-Gerrit jenkins plugin. Downloaded it from Jenkins plugins site.Using Sonar-Gerrit plugin 2.2.1, and analysing sonar scan against jenkins workspace.
For a sample,have changed just one file and provided the project base directory to the path of that file, and ran the sonar analysis in issues mode.
Issues are not loaded in Gerrit with logs
Report has loaded and contains 759 issues
Issues to be commented: 0
Issues to be involved in score calculation: 0
Review has been sent
I'm using sonarqube 5.6.6 and I've installed the sonar-scm-svn-plugin-1.3. The author of the committer is available in the source code. Can any one please describe the step in detail for auto assign the issue to the last committer.
Creating the project name as login credential and adding the SCM account name for the particular project.
Thanks,
Sangeetha k
Make sure sonarqube can perform a mapping between the author of the commit and a user in the sonarqube DB. The field "login" and "email" are automatically taken into account and you can specify additional SCM Accounts.
You could also update the SVN Plugin, the current version is 1.4.0.522.
I have a web app project where the quality is measured under sonarqube.
As i'm dealing with an external code within my project files
Recently i have had some issues appearing due to that exetrnal code and which i'm not focusing on its quality :
So i wanna just delete the issue to appear from my sonar dashboard (which looks like the following):
The solutions that i have had where not really usefull , as :
i was suggested to change the level of the rule itself from "issue" to "info" :
And of course that seems to be not usefful because , i won't affect the rule itself
the second suggestion was to use the :
#SuppressWarnings decorator in my blocks of code where the issues appeared ; : for example use it under classes or methods or even fields
-> this method results in adding some code to my extarnal code and that won't be also good as i'm not even having the permission to do it.
I wanna just the simpliest solution to delete the issue from the sonar dashboard , just suppress it from the SonarQube interface , strangely it seems that there is no a direct way to do it :
Any better ideas ??
The easiest way is excluding external code from the report with narrowing the focus feature.
Just add to your sonar-project.properties file path pattern to exclusion, for example
# Exclude all classes ending by "Bean"
# Matches org/sonar.api/MyBean.java, org/sonar/util/MyOtherBean.java, org/sonar/util/MyDTO.java, etc.
sonar.exclusions=**/*Bean.java,**/*DTO.java
# Exclude all classes in the "src/main/java/org/sonar" directory
# Matches src/main/java/org/sonar/MyClass.java, src/main/java/org/sonar/MyOtherClass.java
# But does not match src/main/java/org/sonar/util/MyClassUtil.java
sonar.exclusions=src/main/java/org/sonar/*
If you're not interested some issues because it's not your code, then you should not have SonarQube analyze that code. According to the SonarQube documention:
We recommend that you exclude generated code, source code from
libraries, etc.
You should check in particular the following settings in the same documentation page:
sonar.sources
sonar.exclusions
These settings will be taken into account the next time you run an analysis.
I am looking for a Sonar Property to attach the quality profile during the build. In previous versions of Sonar there was a property -Dsonar.profile which is deprecated now. Can anyone please help me to get the property to attach the quality profile at runtime.
I am using Sonar version 4.5.7. Any help is highly appreciated.
Thanks,
Sanjiv
It has been marked as deprecated with no replacement.
Quoting page http://docs.sonarqube.org/display/SONARQUBE43/Analysis+Parameters :
Note that only parameters set through the UI are stored in the
database. For example, if you override the sonar.profile parameter via
command line for a specific project, it will not be stored in the
database. Local analyses in Eclipse, for example, would still be run
against the default quality profile.
And the latest version of the same page http://docs.sonarqube.org/display/SONAR/Analysis+Parameters has link to ticket about deprecation that contains other details - https://jira.sonarsource.com/browse/SONAR-5370
In other words - profile should be configured via UI or using web services.
I am new to sonarqube and was able diable/deactivate default rules that comes with sonar. However I would like to know if there is a way to delete/remove default rules from sonar ?
yes of course you can disable some rules and change the level (major, minor etc) in the admin console of your sonarqube and you can use a custom quality profile with a selected rules to analyse you project
http://docs.sonarqube.org/plugins/servlet/mobile#content/view/6964603
Log in as Admin.
Through Quality profile we will be able to activate and deactivate the default rules.
3.Ability to create a new profile with specific rules and scan the project with this new profile.
The following worked for me:
Log in as admin
Set another profile as default, i.e. not the one you want to remove.
Now the non-default profile will be deletable.