Import Sarif report - source context not matching

SonarQube Server / Community Build
,
1

Hello,
There is a problem when importing the sarif report for a .net solution. The vulnerability cannot be matched with the right file.
I would also like to point out that all csproj are imported into SonarCloud.

image
image1399Ă—432 21.2 KB

Problem

image
image1638Ă—673 71.1 KB

devops.log (60.5 KB)

Environment

sarif.zip (1.5 KB)

Solution Structure

image
image588Ă—645 32.9 KB

Thanks,
HF

2

Hi,

Your complaint is that the issues are raised at the directory/project level instead of on individual files?

Looking at the report you uploaded, it seems that the locations for all the issues in it are (somewhat ironically) on .csproj files. Other than raising the issues on the .csproj files, it’s not clear to me what you were expecting.

 
Ann

3

Hi,

what I’m looking for is to have issues on indexed files (csproj) and not on directories or the project name.

HF

4

my real question is: What value should I put in the URI field in my case ?

6

Hi,

Thanks for clarifying. I initially misunderstood your mention that the csproj files are imported.

I’ve flagged this for more expert eyes.

 
Ann

1 Like
7

Hi @Heni_Fazzani

Thanks for raising this issue. Can you please share the verbose logs by adding the /d:"sonar.verbose=true" to the "SonarQubePrepare” or “SonarCloudPrepare” task’s extraProperties argument if you are using Azure DevOps
For example:

- task: SonarCloudPrepare@3
    inputs:
      SonarCloud: 'sonarcloud'
      organization: 'foo'
      scannerMode: 'dotnet'
      projectKey: 'foo_sonar-scanning-someconsoleapp'
      projectName: 'sonar-scanning-someconsoleapp'
      extraProperties: |
        sonar.verbose=true

Thanks

1 Like
8

sonar.log (2.1 MB)
Hi @alexander.meseldzija ,

please find attached the requested file

thx
HF

10

Hello
Any news please ?

11

Hi @Heni_Fazzani, sorry for the delay.
I plan to look into this this week.

1 Like
15

Hi @Heni_Fazzani,

It should work with relative location, but we suspect there might be an issue depending on what we consider a base directory.
To validate this hypothesis, could you maybe try on your side with absolute URIs in the SARIF report and let us know?
Here is an example of some path that should work for you:
file:///agent/_work/1/s/Up.France.Commercant.BO.Infrastructure/Up.France.Commercant.BO.Infrastructure.csproj

1 Like