Using ant scanner ‘scanner sonarqube-ant-task-2.6.0.1426.jar’ (with SonarQube 7.9.1)
When performing a build on Jenkins, the sonar scan shows excessive build ouput …
[sonar:sonar] Location: 15: istore[54](2) 4 in basic block 8
[sonar:sonar] After: +============================
[sonar:sonar] | /!\ Warning : The taint debugging is not fully activated.
[sonar:sonar] | [[ Stack ]]
[sonar:sonar] | Empty
[sonar:sonar] |============================
[sonar:sonar] | [[ Local variables ]]
[sonar:sonar] | null = U0[1] source={parameter[1]}
[sonar:sonar] | null = U1[0] source={parameter[0]}
[sonar:sonar] | null = U2 source={method[com/company/SomeClass.<init>()V]}
[sonar:sonar] | null = U3 source={method[com/company/OtherClass.getFoo() [Lcom/company/Bar;]}
[sonar:sonar] | null = U4
[sonar:sonar] | null = S5
[sonar:sonar] | null = U6
[sonar:sonar] | null = U7
There’s about 980,000 lines of similar looking output making our build log 130Mb. A lot seems repeated. Sometimes with different classes and methods, with many Before and After sections, sometimes with different Locations like:
[sonar:sonar] Location: 26: aload_0[42](1) in basic block 8
[sonar:sonar] Location: 27: invokespecial[183](3) 228 in basic block 10
[sonar:sonar] Location: 36: ldc[18](2) 131 in basic block 12
The scan completes and I see reasonable results in SonarQube, so I’m not sure if anything is wrong with the scan or wrong with our code. It just seems to bloat the build logs and makes it hard to find actual errors/warnings in the sonar scan output.
So,
- What does it mean?
- Is the “Warning : The taint debugging is not fully activated” for me, or for sonar scanner devs?
- How do I avoid this excess build output?
Our ant build.xml is essentially a copy of the sample