Doubt about not detected hotspot in web.config about hardcoded credentials

SonarQube
, ,
1

Dear all,

I have a C# project with a web.config file that does not have a project solution file. For this reason, I am analyzing this project with sonar-scanner-cli (versión 5.0.1.3006) with Server SonarQube Enterprise 9.9.6

The reason of this post is to ask why the xml scanner does not detect a hotspot regarding hard-coded passwords. I have another project that indeed has sln file and when I use the MsBuild Scanner, the hotspot is detected. See screenshots.
Hotspot detected with MSBUILD

HotspotDetectedC#-MSbuildScanner
HotspotDetectedC#-MSbuildScanner1606×812 101 KB

Hotspot not detected with sonar-scanner:

SecurityhotspotNotDetectedInXML-SonarScannerCli
SecurityhotspotNotDetectedInXML-SonarScannerCli1495×477 62.9 KB

Thank you.

2

Hey @mvillanueva

Detecting issues on web.config files involve rules coming from GitHub - SonarSource/sonar-dotnet: Code analyzer for C# and VB.NET projects, which are only executed when using the Scanner for .NET (because they use the Roslyn framework, which are executed at build time). So this is expected behavior.

To be clear, none of your C# files are getting analyzed when you do this.