Depency check and files " indexed with no language"

SonarQube Server / Community Build
,
1
  • SonarQube9.9.4
  • Deployed with zip

I use OWASP dependency check 4.0.1 (gitlab-ci task using docker image registry.gitlab.com/gitlab-ci-utils/docker-dependency-check:latest) and import the reports into SonarQube using the dependency-check-sonar-plugin.

Everything works fine except for two steps :

  • Dependency-check returns absolute paths so file matching is all mixed up, issues are attached to other “lookalikes” files (this seems to be a plugin issue)
  • Dependency-check reports issues on files that are not “indexed in any language”, so these issues doesn’t show up in sonarqube reports. Is there a way to create a dummy language that could handle theses files (in my case mainly lock files: php composer.lock, js yarn.lock) ? Shall it be managed by the plugin?
2

Hi,

That’s one way to go about it, and yes it would need to be managed by the plugin. It’s also possible that it may work to add **/*.lock &etc to the Administration → Languages → Secrets → List of file path patterns to include.

 
HTH,
Ann

3

Hi,

That will not work : Administration → Languages → Secrets → List of file path patterns to include. :

“Additional list of binary file suffixes that should not be analyzed with rules targeting text files.”
Key: sonar.text.excluded.file.suffixes

By the way this setting title is confusing

4

Hi,

Here’s what I see in the current version:

Selection_1776

What’s the property key you see under the explanation?

 
Ann