# Cross Site Scripting in SonarQube

**URL:** <https://community.sonarsource.com/t/cross-site-scripting-in-sonarqube/1028>\
**Category:** IntelliJ Platform\
**Tags:** php, security, intellij\
**Created:** [July 13, 2018, 11:57am UTC](https://community.sonarsource.com/t/cross-site-scripting-in-sonarqube/1028 "2018-07-13T11:57:41Z")\
**Posts on this page:** 7\
**Page:** 1

<div class="post-metadata">

**Author:** ![Ahmed\_92](https://avatars.discourse-cdn.com/v4/letter/a/a4c791/32.png) [@Ahmed\_92](https://community.sonarsource.com/u/Ahmed_92)\
**Post date:** [July 13, 2018, 11:57am UTC](https://community.sonarsource.com/t/cross-site-scripting-in-sonarqube/1028/1 "2018-07-13T11:57:41Z")

</div>

I think sonarlint doesn’t support many cases of corss site scripting detection like the below cases.

```
echo $_GET['name'];
echo $_POST['name'];

```

I’m using sonarQube to analyse my project and I already put the above lines in the code but sonar didn’t detect these issues which is strange for me.

It detects only `eval($_GET['name']);`

---

<div class="post-metadata">

**Author:** ![janos](https://dub1.discourse-cdn.com/sonarsource/user_avatar/community.sonarsource.com/janos/32/60_2.png) [@janos](https://community.sonarsource.com/u/janos)\
**Post date:** [July 18, 2018, 9:33am UTC](https://community.sonarsource.com/t/cross-site-scripting-in-sonarqube/1028/2 "2018-07-18T09:33:55Z")

</div>

At the moment we don’t have a rule that would catch such cross site scripting suspects. We’re actively working on this, so stay tuned for upcoming releases later this year. Note however that such rule might be limited to SonarQube/SonarCloud in the short-mid term, and not be available in SonarLint.

---

<div class="post-metadata">

**Author:** ![Ahmed\_92](https://avatars.discourse-cdn.com/v4/letter/a/a4c791/32.png) [@Ahmed\_92](https://community.sonarsource.com/u/Ahmed_92)\
**Post date:** [July 18, 2018, 12:56pm UTC](https://community.sonarsource.com/t/cross-site-scripting-in-sonarqube/1028/3 "2018-07-18T12:56:13Z")

</div>

I’m doing this and working on it for MSc so could you give me an access to API or source code? and I will share results with you if you acknowledge my name.

---

<div class="post-metadata">

**Author:** ![janos](https://dub1.discourse-cdn.com/sonarsource/user_avatar/community.sonarsource.com/janos/32/60_2.png) [@janos](https://community.sonarsource.com/u/janos)\
**Post date:** [July 18, 2018, 1:01pm UTC](https://community.sonarsource.com/t/cross-site-scripting-in-sonarqube/1028/4 "2018-07-18T13:01:23Z")

</div>

Perhaps you’re looking for our [Extension Guide](https://docs.sonarqube.org/display/DEV).

Our open-source code are available on [GitHub](http://github.com/SonarSource/).

---

<div class="post-metadata">

**Author:** ![ndrw](https://dub1.discourse-cdn.com/sonarsource/user_avatar/community.sonarsource.com/ndrw/32/4614_2.png) [@ndrw](https://community.sonarsource.com/u/ndrw)\
**Post date:** [February 6, 2019, 7:51am UTC](https://community.sonarsource.com/t/cross-site-scripting-in-sonarqube/1028/5 "2019-02-06T07:51:31Z")

</div>

Hi Janos, I was just wondering if this made it’s way into sonarqube?

---

<div class="post-metadata">

**Author:** ![Alexandre\_Gigleux](https://dub1.discourse-cdn.com/sonarsource/user_avatar/community.sonarsource.com/alexandre_gigleux/32/26_2.png) [@Alexandre\_Gigleux](https://community.sonarsource.com/u/Alexandre_Gigleux)\
**Post date:** [February 6, 2019, 8:09am UTC](https://community.sonarsource.com/t/cross-site-scripting-in-sonarqube/1028/6 "2019-02-06T08:09:07Z")

</div>

Hello Andrew,

We are working to provided XSS detection capabilities for Java, C# and PHP. This will be available in [SonarCloud](https://sonarcloud.io/) and with the [SonarQube Developer Edition](https://www.sonarsource.com/plans-and-pricing/developer/).

FYI: related specification ticket: [https://jira.sonarsource.com/browse/MMF-1569](https://jira.sonarsource.com/browse/MMF-1569)

Regards

---

<div class="post-metadata">

**Author:** ![Alexandre\_Gigleux](https://dub1.discourse-cdn.com/sonarsource/user_avatar/community.sonarsource.com/alexandre_gigleux/32/26_2.png) [@Alexandre\_Gigleux](https://community.sonarsource.com/u/Alexandre_Gigleux)\
**Post date:** [August 26, 2019, 3:15pm UTC](https://community.sonarsource.com/t/cross-site-scripting-in-sonarqube/1028/7 "2019-08-26T15:15:41Z")

</div>

Hello @Ahmed_92, @ndrw,

I’m resurrecting this old thread to confirm that the rule [S5131](https://rules.sonarsource.com/php/RSPEC-5131) able to detect this PHP XSS issue is available on [SonarQube 7.9.1 LTS](https://www.sonarqube.org/sonarqube-7-9-lts/) and [SonarCloud.io](https://sonarcloud.io/organizations/agigleux/rules?languages=php&open=phpsecurity%3AS5131&q=S5131).

Regards