dependency-check / dependency-check/dependency-check-sonar-plugin

Bug wrong path issue dependency check in SonarQube

Open
#1,054 4 comments 0 reactions 0 assignees View on GitHub
bug lifecycle/frozen
Dominant language
Java
Stars
694
Forks
146
PR merge metrics
No merged PRs in 30d

Description

**Describe the bug**
I scan a project that has two package-lock.json. One is located at the frontend/package-lock.json path and one is located at the backend/package-lock.json path.
The package-lock.json with vulnerabilities is the frontend/package-lock.json but if I look at the report from the project's sonarqube issues dashboard the report is assigned to package-lock.json located at backend/package-lock.json.

**To Reproduce**
Run a dependency-check. Run the Sonarscanner scan and push the reports ( i push the reports in format .html, .xml and .json). Then check the path from the report in html and the path from the Sonarqube issues dashboard.

**Current behavior**
In the Sonarqube issues section the issues are associated to the backend/package-lock.json but the issues are in the frontend/package-lock.json

**Expected behavior**
In the Sonarqube issues section the issues must be associated correctly.

**Screenshots**

- Part of json report file which shows where the vulnerable library was detected:

```
{
"evidenceCollected": {
"productEvidence": [
{
"confidence": "HIGHEST",
"name": "name",
"source": "package.json",
"type": "product",
"value": "store2"
}
],
"vendorEvidence": [
{
"confidence": "HIGH",
"name": "name",
"source": "package.json",
"type": "vendor",
"value": "store2"
}
],
"versionEvidence": [
{
"confidence": "HIGHEST",
"name": "version",
"source": "package.json",
"type": "version",
"value": "2.14.2"
}
]
},
"fileName": "store2:2.14.2",
"filePath": "/code/source/frontend/package-lock.json?store2",
"isVirtual": true,
"packages": [
{
"confidence": "HIGHEST",
"id": "pkg:npm/store2@2.14.2",
"url": "https://ossindex.sonatype.org/component/pkg:npm/store2@2.14.2?utm_source=dependency-check&utm_medium=integration&utm_content=12.1.0"
}
],
. . .
. . .
. . .

```

- Screeenshot html report

![Image](https://github.com/user-attachments/assets/01fc9ca8-1b99-4c33-8393-ae98fbc66c6d)

- Path mismatch

![Image](https://github.com/user-attachments/assets/f8628e0d-6d27-49bc-b359-530fae66445e)

- Some other libraries with mismatch paths

![Image](https://github.com/user-attachments/assets/cb14861f-a13d-404d-87bf-df3482616948)

**Versions (please complete the following information):**

- Dependency-Check Core version 12.1.0
- Sonarqube Community Edition v25.5.0.107428
- dependency-check-sonar-plugin 5.0.0

**Additional context**

I already opened an issue in the sonarqube issues manager (community.sonarsource.com). They replied me to open the issue here.

Contributor guide

No contributing guide indexed for this repository

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.