False Positive Duplicate Code Detection Across Multiple ASP.NET Projects

SonarQube Server / Community Build
,
1

SonarQube Version: SonarQube Server v2025.1.1
Deployment Type: ZIP Installation

What are we trying to achieve?

We would like to reduce the number of duplicated lines of code reported by SonarQube where the duplication appears to be identified incorrectly across different projects within the same source repository.

Project Structure

Under our SourceCode folder, we have multiple ASP.NET projects, for example:
SourceCode/

├── ProjectA/

│ └── Program.cs

├── ProjectB/

│ └── Program.cs

Issue Description

During analysis, SonarQube is reporting more than 50 duplicated lines in the Program.cs files across different projects. However, this appears to be a false positive from our perspective.

In ASP.NET applications, Program.cs is a mandatory entry point file, and it is expected that multiple projects contain very similar or identical startup and configuration code. The duplicated code is not the result of copy-paste between projects but rather follows the standard ASP.NET application structure and framework requirements.

Since ProjectA and ProjectB are owned and maintained by different development teams, centralizing the shared startup logic is not a feasible option. Any changes required for one project may not be suitable for the other, and maintaining a common shared implementation would introduce additional management and dependency challenges.

Request

Could you please advise on the best approach to handle this scenario?

Specifically, we would like to know:
ur primary question is whether SonarQube can be configured to avoid comparing code duplication between ProjectA and ProjectB. Since these are independent projects maintained by different teams, we would like duplicate code analysis to be performed within each project individually rather than across projects. Is such a configuration supported, and if so, what is the recommended approach?

Any guidance or recommendations would be greatly appreciated.

Thank you

2

Hey @SantoshKumar,

This is expected: the duplicate detection mechanism doesn’t take into account the fact that Program.cs files contain boilerplate and therefore are very similar.

Moreover, there is no setting to retain duplication analysis within one SonarQube project while suppressing only cross-subproject comparisons. What you could do is:

  1. Exclude the files from duplication detection:

    sonar.cpd.exclusions=**/Program.cs

    Or get even more specific:

    sonar.cpd.exclusions=SourceCode/ProjectA/Program.cs,SourceCode/ProjectB/Program.cs

    This preserves other analysis results for those files; it only removes them from duplication calculations. Configure it under Project Settings > General Settings > Analysis Scope > Duplication Exclusions, or pass the property to the scanner.

  2. Analyze each sub-project as a separate SonarQube project, using separate analysis/build invocations and distinct project keys. Since duplication is reported for the analyzed SonarQube project, this prevents cross-project comparison; it also means other analysis results, like code issues, will be separate too.