Avoid the use or report of sonar.exclusions

[MMichiels (MichelM)]

• which versions are you using - SonarQube 8.9.2 LTS
• what are you trying to achieve - Avoid or report the use of sonar.exclusions
• what have you tried so far to achieve this - Found nothing relevant or working

Hello everybody,
I would like to block our developpers to use sonar.exclusions to avoid the sonar analysis.
I doubt that there is a way to block it but I would like to know if there is a way to emit a report (mail) when an analysis using it is possible.
Thanks for your help,
Michel

[Rebse (Gilbert Rebhan)]

You’ve raised a very important point, but it seems we’re on our own, see this thread

Sonarqube Enterprise Edition exclusion property can be edited to exclude files at developer discretion

We have Jenkins that uses the SonarQube extension and scan the project. In the properties, the developers are allowed to set sonar.exclusion and provide folders/files to exclude. Thus giving developers freedom to exclude any of the source code files as per their choice, thus posing a security risk of few files being excluded which may contain a vulnerability from being scanned. Is there a feature in SonarQube where this can be centralized and controlled by security team or overridden by the con…

Guess we will need to diff their sonar.exclusions with the sonar.exclusions configured at
Sonarqube server and break the build if there is more excluded.
Still considering how to implement that for Maven pipelines using the sonar:sonar goal , any ideas !?
Will use api/settings/values?keys=sonar.global.exclusions and compare it with the given
property sonar.exclusions from the pom.
The tricky part is, when the global setting uses glob patterns and sonar.exclusions has absolute path.