Javascript plugins are throwing lot of issues and vulnerabilities

SonarCloud
1

Hi Team,

we are interested in doing analysis using Sonar cloud.

Our project is on ReactJs with Java as a backend.

We are using multiple JS plugins in the UI part like JQuery-UI, Bootstrap and datatables. When i run the Sonarqube analysis, those plugins are throwing many issues and vulnerabilities. I tried to update the plugins to the latest version which but it throws more issues.

In few forums i have read the we need to exclude the JS plugins from the sonar qube analysis. If that is true, please give us some suggestion or input.

2

Third-party libraries should not be scanned and should often be excluded by default (for example, if they are in a node_modules folder).

If that’s not enough, you can further Narrow the Focus in lots of fancy ways.

3

We have few plugins we are using which are not through the node_modules, and are placed in the plugins folder and importing them in the index.html which are causing issues. Would you suggest to exclude them as well?

4

Whether they are imported in the index.html will not matter. If they are in the sources you want to scan, they’ll get scanned (an oversimplification, but for your purposes I think it will be useful to think of it that way!)

So it might make sense to set an exclusion for the whole directory (plugins/**/*) or just individal libraries (plugins/jquery.js,plugins/bootstrap.css)

1 Like
5

Thanks for the support @Colin_SonarSource . I will add them to the exclusion list.

1 Like