# How sonarqube analyse source codes **URL:** \ **Category:** Plugin Development\ **Tags:** cfamily\ **Created:** [July 22, 2019, 8:57am UTC](https://community.sonarsource.com/t/how-sonarqube-analyse-source-codes/12158 "2019-07-22T08:57:59Z")\ **Posts on this page:** 16\ **Page:** 1
**Author:** ![for-just-we](https://avatars.discourse-cdn.com/v4/letter/f/35a633/32.png) [@for-just-we](https://community.sonarsource.com/u/for-just-we)\ **Post date:** [July 22, 2019, 8:57am UTC](https://community.sonarsource.com/t/how-sonarqube-analyse-source-codes/12158/1 "2019-07-22T08:57:59Z")
Hello, I am a Sonar green hand. And I need to develop a plugin for C language Source-code analysis. And I have some questions with the source-codes of SonarQube from github 1.Is all source-code-analysis-function integrated on the plugin.Such as if you develop SonarJava plugin,you can use SonarQube to analyse java. And if you develop SonarC++ ,you can analyse C++. No need to develop a new Sonar Scanner? 2.How does the language plugins get the input-source-codes? For example, how does SonarJava get input-java-codes? And There are modules like its,java-checks,java-fronted,sonar-java-plugin etc.,what are thoese modules function respectively? And how does those language plugin output theirs report to SonarQube Server to show in the webpages? 3.Is the Syntax tree SonarQube use resemble ANTLR? In other words,can I develop a C plugin based on ANTLR Please help and advise Thank you very much ---
**Author:** ![saberduck](https://dub1.discourse-cdn.com/sonarsource/user_avatar/community.sonarsource.com/saberduck/32/27_2.png) [@saberduck](https://community.sonarsource.com/u/saberduck)\ **Post date:** [July 22, 2019, 9:19am UTC](https://community.sonarsource.com/t/how-sonarqube-analyse-source-codes/12158/2 "2019-07-22T09:19:22Z")
hello @for-just-we, I think this documentation [https://docs.sonarqube.org/latest/extend/developing-plugin/](https://docs.sonarqube.org/latest/extend/developing-plugin/) will give you a good introduction into development of custom plugin. To answer your question specifically 1. yes, everything analysis related is done in the plugin itself. Scanner is just providing access to the filesystem and project configuration. 2. Language plugins use `org.sonar.api.batch.fs.FileSystem#inputFiles` API to get access to the filesystem. 3. SonarQube doesn’t provide the AST, it’s plugins responsibility to parse the source files and they can use any mechanism to do so. ---
**Author:** ![JolyLoic](https://dub1.discourse-cdn.com/sonarsource/user_avatar/community.sonarsource.com/jolyloic/32/199_2.png) [@JolyLoic](https://community.sonarsource.com/u/JolyLoic)\ **Post date:** [July 22, 2019, 10:15am UTC](https://community.sonarsource.com/t/how-sonarqube-analyse-source-codes/12158/3 "2019-07-22T10:15:08Z")
For your information, SonarSource is already providing a plugin for C code, maybe you want to try it before developing your own? Or if you tried it and disagree with its results, if you share them here, we might improve it? This plug-in is available for free if you use :sonarcloud: SonarCloud to analyze an open-source project. Developing a plug-in for C is not such an easy task, especially because you have to run the preprocessor before having something you can base an AST on, which also means you need to know how the file was compiled… ---
**Author:** ![for-just-we](https://avatars.discourse-cdn.com/v4/letter/f/35a633/32.png) [@for-just-we](https://community.sonarsource.com/u/for-just-we)\ **Post date:** [July 22, 2019, 1:02pm UTC](https://community.sonarsource.com/t/how-sonarqube-analyse-source-codes/12158/4 "2019-07-22T13:02:31Z")
Thank you for your reply. Here are some questions I still got? 1. As SonarQube doesn’t provide the AST, then the plugins such as SonarJava provide AST? 2. like In SonarJava, the Interface Tree and the class SubscriptionVisitor. Are those classes or Interfaces related to AST defined by SonarSource? 3. If so,could I use ANTLRv4 API as AST? 4.If I develop a new C plugin. I just need to do as [https://docs.sonarqube.org/latest/extend/developing-plugin/](https://docs.sonarqube.org/latest/extend/developing-plugin/) says. No extra needs? Thank you again ---
**Author:** ![for-just-we](https://avatars.discourse-cdn.com/v4/letter/f/35a633/32.png) [@for-just-we](https://community.sonarsource.com/u/for-just-we)\ **Post date:** [July 22, 2019, 1:10pm UTC](https://community.sonarsource.com/t/how-sonarqube-analyse-source-codes/12158/5 "2019-07-22T13:10:30Z")
Thank you for your reply. 1. Here is my situations. Our group is working on code detection now. And focus on CWE119 and CWE399. No codesmell or some bugs. The method is referenced from the deep-learning-model Vuldeepecker. And there are a lot to do in generate codegadget. what I need to do is develop a SonarPlugin based on that. 2.I know two plugins of C, first is CFamily,but it seems not for free.Second is Sonar-Cxx,but it must be used with another tools such as Cppcheck,And I already made some modifications based on that.So I don’t know which one you talk about? BTW,thank you again ---
**Author:** ![JolyLoic](https://dub1.discourse-cdn.com/sonarsource/user_avatar/community.sonarsource.com/jolyloic/32/199_2.png) [@JolyLoic](https://community.sonarsource.com/u/JolyLoic)\ **Post date:** [July 22, 2019, 1:44pm UTC](https://community.sonarsource.com/t/how-sonarqube-analyse-source-codes/12158/6 "2019-07-22T13:44:07Z")
Hello @for-just-we, I’m talking about the CFamily plugin. Which is free in the situation I described (which can allow you to test its capabilities), but you must pay for it in other situations (and I would balance this cost with the cost of developing and maintaining your own plugin). I don’t know much about the community plugin sonar-cxx, and can’t help you with it. In CFamily, we have the rule [https://rules.sonarsource.com/c/RSPEC-3519](https://rules.sonarsource.com/c/RSPEC-3519) that targets CWE119. For CWE-399, I’m not sure, it seems to be a category, and a broad one, so I cannot tell for sure. We do have rules that cover some aspects of this category. If your goal is not just to find issues in your code, but to explore the specific tool Vuldeepecket, then you are on your own. Some plugins provide the AST in some form for users to develop custom plugins on top of the plugin. This is the case for Java, but not for CFamily. So you would have to create your own AST, using the tool of your choice (ANTLR or any other tool, but, as said in my previous post, I don’t think it would be a good choice, unless you run ANTLR on the result of already preprocessed code…). Hope this helps… ---
**Author:** ![for-just-we](https://avatars.discourse-cdn.com/v4/letter/f/35a633/32.png) [@for-just-we](https://community.sonarsource.com/u/for-just-we)\ **Post date:** [July 23, 2019, 2:43am UTC](https://community.sonarsource.com/t/how-sonarqube-analyse-source-codes/12158/7 "2019-07-23T02:43:57Z")
OK, appriciate you for the informations about CFamily. And my work is kind of explore the specific tool Vuldeepecker and we could use it to detect CWE119 and CWE399, BUT we still need to improve in generating code gadgets. Still I have the a question. In the doucumentation [https://docs.sonarqube.org/latest/extend/new-languages/](https://docs.sonarqube.org/latest/extend/new-languages/) . There are 6 points of parsing a new language. What confused me is how to input my source-code to the new plugin. I know that **org.sonar.api.batch.fs.FileSystem#inputFiles** API could get access to the filesystem. But how to use it to generate AST. I saw the classes **Context,SensorContext** are important in SonarJava and **PythonVisitorContext** in SonarPython. I just didn’t see how they relate to **org.sonar.api.batch.fs.FileSystem#inputFiles**. Appriciate for your help again and please enlighten me:joy:😂 ---
**Author:** ![JolyLoic](https://dub1.discourse-cdn.com/sonarsource/user_avatar/community.sonarsource.com/jolyloic/32/199_2.png) [@JolyLoic](https://community.sonarsource.com/u/JolyLoic)\ **Post date:** [July 23, 2019, 8:18am UTC](https://community.sonarsource.com/t/how-sonarqube-analyse-source-codes/12158/8 "2019-07-23T08:18:18Z")
> [@for-just-we](#): > > But how to use it to generate AST. I saw the classes **Context,SensorContext** are important in SonarJava and **PythonVisitorContext** in SonarPython. Because these plugins internally build the AST for their own purpose, and allow external plugins to access these internal ASTs. For C, you are on your own, and you should directly create the AST from the files, using whatever technique is appropriate to you. For your situation, SonarQube will _not_ help you writing your analyzer, it will only help you storing, managing, displaying the results of your analysis. ---
**Author:** ![for-just-we](https://avatars.discourse-cdn.com/v4/letter/f/35a633/32.png) [@for-just-we](https://community.sonarsource.com/u/for-just-we)\ **Post date:** [July 23, 2019, 9:20am UTC](https://community.sonarsource.com/t/how-sonarqube-analyse-source-codes/12158/9 "2019-07-23T09:20:29Z")
Your answer just enlighten me to the real questions:joy: 1. which is how to get input files to plugin ? In our project, we directly use .cpp files as input and output as xml. So If I intend to modify our project to a plugin. could we just use the classes **org.sonar.api.batch.fs.inputFiles** directly create a InputStream to create a AST or should I find another way. For there are no documentations about the basic need to develop a totally new plugin. Just how to extend plugins 2.How to output our result to SonarQube ? Are there any classes we should extend or Interface we should implement? BTW, it’s really enlightening to talk with you:joy: ---
**Author:** ![JolyLoic](https://dub1.discourse-cdn.com/sonarsource/user_avatar/community.sonarsource.com/jolyloic/32/199_2.png) [@JolyLoic](https://community.sonarsource.com/u/JolyLoic)\ **Post date:** [July 24, 2019, 8:23am UTC](https://community.sonarsource.com/t/how-sonarqube-analyse-source-codes/12158/10 "2019-07-24T08:23:36Z")
Hello @for-just-we, Have you looked at the example plug-in, and specially at [this part on creating rules](https://github.com/SonarSource/sonar-custom-plugin-example/blob/master/src/main/java/org/sonarsource/plugins/example/rules/CreateIssuesOnJavaFilesSensor.java)? It shows how to retrieve the list of files associated to a language (`hasLanguage`), and how to output violations to SonarQube (the `newIssue` part). You “just” have to put real code analysis between those lines 🙂 ---
**Author:** ![for-just-we](https://avatars.discourse-cdn.com/v4/letter/f/35a633/32.png) [@for-just-we](https://community.sonarsource.com/u/for-just-we)\ **Post date:** [July 25, 2019, 9:10am UTC](https://community.sonarsource.com/t/how-sonarqube-analyse-source-codes/12158/11 "2019-07-25T09:10:51Z")
Hello, I have looked at this plugin, it’s one month ago. Last time I looked I am confused by many things, and still, I am confused by how does this plugin works? For there are a lot of **Script files like some HTML files** , and the **RulesDefinitions** and the **Sensor** definitions, Which require loader. Maybe I should learn how to load those than adding our code analysis to the plugin. I wish there are some detailed documentation to talk about the frame of some Open-Source Sonar-Plugins. I guess it will take some days to figure out. BTW, this conversation makes me learn many things, thank you ---
**Author:** ![mpaladin](https://dub1.discourse-cdn.com/sonarsource/user_avatar/community.sonarsource.com/mpaladin/32/118_2.png) [@mpaladin](https://community.sonarsource.com/u/mpaladin)\ **Post date:** [August 15, 2019, 2:30pm UTC](https://community.sonarsource.com/t/how-sonarqube-analyse-source-codes/12158/12 "2019-08-15T14:30:00Z")
The simpler would be [Help with developing a custom plugin for c and c++](https://community.sonarsource.com/t/help-with-developing-a-custom-plugin-for-c-and-c/11537/2) as recommended in the other thread. ---
**Author:** ![jubecca](https://dub1.discourse-cdn.com/sonarsource/user_avatar/community.sonarsource.com/jubecca/32/19860_2.png) [@jubecca](https://community.sonarsource.com/u/jubecca)\ **Post date:** [March 5, 2021, 8:11pm UTC](https://community.sonarsource.com/t/how-sonarqube-analyse-source-codes/12158/13 "2021-03-05T20:11:33Z")
Hello! I tried to use the generic plugin [GitHub - SonarSource/sonar-custom-plugin-example: Shows how to write a SQ plugin for LTS](https://github.com/SonarSource/sonar-custom-plugin-example) and I am even able to debug it but I don’t see a way to get access to the Java tokens. Let’s say I want to get all the Java String constants declared in the code. Is there a way to do so using the internal AST? I don’t think that it would be meaningful to build my Scanner and Parser inside the plugin with ANTLR… ---
**Author:** ![dsamersoff](https://dub1.discourse-cdn.com/sonarsource/user_avatar/community.sonarsource.com/dsamersoff/32/30368_2.png) [@dsamersoff](https://community.sonarsource.com/u/dsamersoff)\ **Post date:** [February 14, 2022, 2:25pm UTC](https://community.sonarsource.com/t/how-sonarqube-analyse-source-codes/12158/14 "2022-02-14T14:25:14Z")
Hello Massimo, What language parser (AST builder) SonarCFamily uses? Is it something developed from scratch by SonarSource team or it’s based on some well-known one (clang, gcc etc)? Thank you! ---
**Author:** ![JolyLoic](https://dub1.discourse-cdn.com/sonarsource/user_avatar/community.sonarsource.com/jolyloic/32/199_2.png) [@JolyLoic](https://community.sonarsource.com/u/JolyLoic)\ **Post date:** [February 14, 2022, 2:53pm UTC](https://community.sonarsource.com/t/how-sonarqube-analyse-source-codes/12158/15 "2022-02-14T14:53:47Z")
Hello @dsamersoff, We are currently bases on a fork of Clang. Hope that helps, ---
**Author:** ![system](https://dub1.discourse-cdn.com/sonarsource/user_avatar/community.sonarsource.com/system/32/31083_2.png) [@system](https://community.sonarsource.com/u/system)\ **Post date:** [February 21, 2022, 2:54pm UTC](https://community.sonarsource.com/t/how-sonarqube-analyse-source-codes/12158/16 "2022-02-21T14:54:21Z")
This topic was automatically closed 7 days after the last reply. New replies are no longer allowed.