dependency-check / dependency-check/dependency-check-sonar-plugin
Vulnerabilities not visible in Sonar on pull requests
- Dominant language
- Java
- Stars
- 694
- Forks
- 146
- PR merge metrics
- No merged PRs in 30d
Description
**Describe the bug**
When Sonar analyzes pull request, reported vulnerabilities are not visible in Sonar. They are visible on release branches. Applies to Java and TypeScript code.
For Java I tried using Maven plugin and invoking directly, both from Jenkins.
Shell command:
```
mvn install org.owasp:dependency-check-maven:check sonar:sonar -Dformats=json,html -Dhttp.proxyHost=XXX -Dhttp.proxyPort=8080 -Dhttps.proxyHost=XXX -Dhttps.proxyPort=8080 -Dhttp.nonProxyHosts=XXX -P CCC -P !DDD,!EEE -Dsonar.pullrequest.key=YYY -Dsonar.pullrequest.branch=feature/ZZZ -Dsonar.pullrequest.base=develop -Dsonar.pullrequest.bitbucketserver.project=AAA -Dsonar.pullrequest.bitbucketserver.repository=BBB javadoc:javadoc -DskipITs=false
```
Maven plugin setup:
```
org.owasp
dependency-check-maven
${dependency-check-maven.version}
true
HTML
JSON
check
```
For TypeScript (Angular) I invoke directly.
For both cases vulnerabilities are written to the standard output, JSON and HTML reports.
HTML report is visible in Sonar.
Processing by Sonnar seems successful:
```
[INFO] Sensor Dependency-Check [dependencycheck]
[INFO] Process Dependency-Check report
[INFO] Using JSON-Reportparser
[INFO] Linking 96 dependencies
[WARNING] vulnerability CVE-2015-6644 is unscored. Using MEDIUM
[WARNING] vulnerability CVE-2015-6644 is unscored. Using MEDIUM
[INFO] Upload Dependency-Check HTML-Report
[INFO] Process Dependency-Check report (done) | time=412ms
[INFO] Sensor Dependency-Check [dependencycheck] (done) | time=413ms
```
**To Reproduce**
It would be helpful when you support us with [example](https://github.com/dependency-check/dependency-check-sonar-plugin/tree/master/examples) projects.
Steps to reproduce the behavior:
Analyze pull request with Sonar.
**Current behavior**
Vulnerabilities not visible in Sonar (except for embedded HTML report). Neither in overview nor in code sections.
**Expected behavior**
Vulnerabilities visible in Sonar in overview and in code sections.
**Versions (please complete the following information):**
- dependency-check: 6.2.2
- sonarqube: Developer EditionVersion 8.9 (build 43852)
- dependency-check-sonar-plugin: 2.0.8
Contributor guide
No contributing guide indexed for this repository
Assessment
This issue has not been assessed yet.