CE crashes when sonar.issue.ignore.multicriteria is saved with empty file path pattern

SonarQube Server / Community Build
,
1

CE crashes when sonar.issue.ignore.multicriteria is saved with empty file path pattern

Environment:

  • SonarQube 26.2.0.119303 (Community Build)
  • Java 21 (OpenJDK 21.0.10)
  • PostgreSQL backend

Description

When a project has sonar.issue.ignore.multicriteria saved as an empty value (no keys/patterns defined), every Compute Engine REPORT task for that project fails. ISSUE_SYNC tasks succeed — only REPORT processing is affected.

The empty value is reachable through normal UI interaction: navigate to Project Settings → General Settings → Analysis Scope → Ignore Issues on Multiple Criteria, add a row, remove it, and save. The settings API accepts and persists the empty value without validation.

Steps to reproduce

  1. Open any project in SonarQube
  2. Go to Project Settings → General Settings → Analysis Scope → Ignore Issues on Multiple Criteria
  3. Add a multicriteria entry, then remove it and save — or set the value via the API:
POST /api/settings/set?key=sonar.issue.ignore.multicriteria&component=<project-key>&values=
  1. Run a scanner analysis and submit the report
  2. The CE task fails with status FAILED

Error message (surface)

Unable to load component class org.sonar.ce.task.projectanalysis.step.ExecuteVisitorsStep

Root cause (innermost exception from CE stacktrace)

java.lang.IllegalArgumentException: File path pattern cannot be empty.
Please check 'sonar.issue.ignore.multicriteria' settings
    at com.google.common.base.Preconditions.checkArgument(Preconditions.java:141)
    at org.sonar.ce.task.projectanalysis.issue.filter.IssueFilter.loadPatterns(IssueFilter.java:115)
    at org.sonar.ce.task.projectanalysis.issue.filter.IssueFilter.<init>(IssueFilter.java:53)

The full Spring dependency chain:

IssueFilter (constructor throws IllegalArgumentException)
  → TrackerRawInputFactory (depends on IssueFilter, constructor param 3)
    → IntegrateIssuesVisitor (depends on TrackerRawInputFactory, constructor param 1)
      → ExecuteVisitorsStep (depends on IntegrateIssuesVisitor, constructor param 1)
        → SpringComponentContainer.getComponentByType() wraps as IllegalStateException

Prior community reports

This issue has been reported in the community at least twice but has never been formally tracked as a bug:

This indicates the bug has existed since at least SQ 9.5 (2023) and persists through 26.2 (2026).

Expected behavior

Either:

  • IssueFilter.loadPatterns() should gracefully handle an empty multicriteria value by treating it as “no exclusion patterns defined” and skipping pattern loading, or
  • The settings API and UI should validate and reject saving an empty/incomplete value for sonar.issue.ignore.multicriteria at write time

The validation currently only exists in the CE at analysis time (IssueFilter.java:115). The settings definition in IssueExclusionProperties.java contains no validation, creating a gap where invalid state is accepted on save but crashes on read.

Workaround

Reset the setting via the Web API:

POST /api/settings/reset?keys=sonar.issue.ignore.multicriteria&component=<project-key>
2

Hi,

Yes, this is a long-standing known issue. IIRC, you can similarly make SonarQube fall on its face by setting bad exclusion patterns or rule parameter values. There is no validation of settings values.

I’ve been told that adding that would unfortunately require a wholesale rewrite of that part of the UI, and there’s never been any appetite for that. I don’t anticipate any appetite for it now, but I’ll flag this for the PMs.

 
Ann