Hi Team, How do I avoid developers to bypass SonarQube rules using NOSONAR as mentioned in the SonarQube documentation - FAQ it will suppress/ bypass the issue by simply typing //NOSONAR at the end of the line since, developers are having access to write code in a file, they are adding that word …

Tell the developers “don’t do that”. In all seriousness: when you say “anybody” can bypass analysis, who is contributing to your project? “Anybody” can also add code to send user passwords to their Russian botnet or format your hard drive – maliciously avoiding quality analysis falls into the same…

Hi Sohail, There is a rule implemented for 8 languages to allow you to track use of NOSONAR: C, C++ PL/SQL, T-SQL, PHP, COBOL, Objective-C, Java. You probably want to add it to your relevant Quality Profiles. If you’re concerned with other languages, please list them. Ann

[image] Thw0rted: when you say “anybody” can bypass analysis, who is contributing to your project? Don’t you think anybody stands for developers doesn’t matter junior, senior, or architect, My question to you is that why should I use SonarQube ? when it can be bypassed by any dev. We are usi…

[image] ganncamp: If you’re concerned with other languages, please list them. Hello Ann, we are analysing Salesforce project, so that languages that we would need track on it - JS, Apex and .trigger files Thanks, Abhishek

I apologize if my snarky comment came off as rude rather than silly, but I do maintain that this is a business problem with a business solution. The point is that inline NOSONAR statements are in code because they are code, just like anything that executes on the server or in a client – this just h…

[image] ganncamp: There is a rule implemented for 8 languages to allow you to track use of NOSONAR Hello @ganncamp , Could you tell me the rule name? to track the NOSONAR comment on the code? ++ And there any planned activity to have this same rule for Apex? JS? .trigger files? .cls files o…

Go to Rules in Sonarqube and search for NOSONAR. They’re all listed.

@ganncamp - C#, VB.Net , Javascript, Kotlin

Got it. is there any planned activity/future release to support for apex.?

How do we avoid developers to use NOSONAR / Avoid Bypassing of rule using NOSONAR

SonarQube Server / Community Build

ganncamp (G Ann Campbell) September 14, 2020, 6:31pm 14

Hi all,

Thanks for your inputs. I’ve passed this on internally with this list:

Ann

Rule to detect the usage of NOSONAR in C# code

Topic		Replies	Views
Rule-specific NOSONAR Suggest new features	15	6569	June 25, 2026
Disable NOSONAR comment SonarQube Cloud scanner , sonarqube-cloud	4	7444	December 19, 2022
[SonarQube CSS] Suppress sonar rule in code? SonarQube Server / Community Build	9	11703	January 25, 2021
Disable NOSONAR usage globally SonarQube Cloud scanner , nosonar , sonarqube-cloud	2	817	July 4, 2023
Can I suppress SonarQube issues in C/C++? SonarQube Server / Community Build cpp , exclusions	4	3819	September 17, 2018

How do we avoid developers to use NOSONAR / Avoid Bypassing of rule using NOSONAR

Related topics