Avoid the use or report of sonar.exclusions

[anon67236913]

You’ve raised a very important point, but it seems we’re on our own, see this thread

Sonarqube Enterprise Edition exclusion property can be edited to exclude files at developer discretion

We have Jenkins that uses the SonarQube extension and scan the project. In the properties, the developers are allowed to set sonar.exclusion and provide folders/files to exclude. Thus giving developers freedom to exclude any of the source code files as per their choice, thus posing a security risk of few files being excluded which may contain a vulnerability from being scanned. Is there a feature in SonarQube where this can be centralized and controlled by security team or overridden by the con…

Guess we will need to diff their sonar.exclusions with the sonar.exclusions configured at
Sonarqube server and break the build if there is more excluded.
Still considering how to implement that for Maven pipelines using the sonar:sonar goal , any ideas !?
Will use api/settings/values?keys=sonar.global.exclusions and compare it with the given
property sonar.exclusions from the pom.
The tricky part is, when the global setting uses glob patterns and sonar.exclusions has absolute path.