How to suppress warning from Security Hotspot?

SonarCloud
, ,
1

Hi
We use Azure DevOps and SonarCloud to build a .NET project.
SonarCloud reported a Security Hotspot, and we assessed it and marked it as “Safe” in the SonarCloud UI.
However, the build log continues to show a warning for this issue (we did not change any code).
What is the correct way to eliminate this warning, once the Security Hotspot has been assessed?
We tried to use “#pragma warning disable/restore” but this seems to make no difference for Security Hotspots.
We ended up concluding the only option we had was to use the SuppressMessageAttribute.
What is the recommended approach for this kind of scenario, where the flagged code will not be changed?

I already read these without finding any clear guidance:

2

The MSbuild scanner does not get the project settings from sonar cloud and use those for the scan, so it’s going to report errors for the wrong rules if you got different rules configured than “sonar way”, it’s going to not honor your ignores/FP for security exceptions, etc, etc.

There’s a ticket on this board somewhere for fixing that Ms build scanner and project integration, if you go through my comment history you probably will find it. Or search for it

2 Likes
4

Hi Emil

Thanks for raising this. As Andrew says there is an issue for this that is still outstanding. Hopefully, we can get this fixed soon.

Kind regards

Tom

1 Like
5

Thanks Andrew and Tom for confirming, that currently we have to do something else than using #pragma in this case.

6

Hi @Tom_Howlett
I see the issue on Github has been closed. Thats awesome!
What is the expected timeframe for this fix to roll out to SonarCloud?
Regards,
Emil

7

Hi Emil

Yes, your post prompted a good discussion and we were luckily able to make the change quickly. You should see it on SonarCloud in the next few weeks. I’ll update this thread when we do.

Thanks!

Tom

1 Like