dependency-check / dependency-check/dependency-check-sonar-plugin

Vulnerabilities not visible in Sonar on pull requests

Open
#485 11 comments 5 reactions 0 assignees View on GitHub
bug lifecycle/frozen
Dominant language
Java
Stars
694
Forks
146
PR merge metrics
No merged PRs in 30d

Description

**Describe the bug**
When Sonar analyzes pull request, reported vulnerabilities are not visible in Sonar. They are visible on release branches. Applies to Java and TypeScript code.

For Java I tried using Maven plugin and invoking directly, both from Jenkins.

Shell command:
```
mvn install org.owasp:dependency-check-maven:check sonar:sonar -Dformats=json,html -Dhttp.proxyHost=XXX -Dhttp.proxyPort=8080 -Dhttps.proxyHost=XXX -Dhttps.proxyPort=8080 -Dhttp.nonProxyHosts=XXX -P CCC -P !DDD,!EEE -Dsonar.pullrequest.key=YYY -Dsonar.pullrequest.branch=feature/ZZZ -Dsonar.pullrequest.base=develop -Dsonar.pullrequest.bitbucketserver.project=AAA -Dsonar.pullrequest.bitbucketserver.repository=BBB javadoc:javadoc -DskipITs=false
```

Maven plugin setup:
```

org.owasp
dependency-check-maven
${dependency-check-maven.version}

true

HTML
JSON





check


```

For TypeScript (Angular) I invoke directly.

For both cases vulnerabilities are written to the standard output, JSON and HTML reports.

HTML report is visible in Sonar.

Processing by Sonnar seems successful:
```
[INFO] Sensor Dependency-Check [dependencycheck]
[INFO] Process Dependency-Check report
[INFO] Using JSON-Reportparser
[INFO] Linking 96 dependencies
[WARNING] vulnerability CVE-2015-6644 is unscored. Using MEDIUM
[WARNING] vulnerability CVE-2015-6644 is unscored. Using MEDIUM
[INFO] Upload Dependency-Check HTML-Report
[INFO] Process Dependency-Check report (done) | time=412ms
[INFO] Sensor Dependency-Check [dependencycheck] (done) | time=413ms
```

**To Reproduce**
It would be helpful when you support us with [example](https://github.com/dependency-check/dependency-check-sonar-plugin/tree/master/examples) projects.
Steps to reproduce the behavior:

Analyze pull request with Sonar.

**Current behavior**
Vulnerabilities not visible in Sonar (except for embedded HTML report). Neither in overview nor in code sections.

**Expected behavior**
Vulnerabilities visible in Sonar in overview and in code sections.

**Versions (please complete the following information):**

- dependency-check: 6.2.2
- sonarqube: Developer EditionVersion 8.9 (build 43852)
- dependency-check-sonar-plugin: 2.0.8

Contributor guide

No contributing guide indexed for this repository

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.