Javascriptmodule is analyzed but not displayed

frank-e-ap · April 8, 2021, 9:27am

ALM used: GitHub
CI system used: GithubActions
Scanner command used when applicable
run: mvn -B clean verify -P deployableWar org.sonarsource.scanner.maven:sonar-maven-plugin:sonar -DresourceDir=~
Languages of the repository:
- Java
- Javascript (Vue.js)
Error observed (wrap logs/code around with triple quotes ``` for proper formatting)

We have the following project structure:

Mainproject

backend (Java/Spring boot)
frontend (Vue.js)

When running the scanner with the above given command the code in both submodules seems to be analyzed, but in the WebUI of sonarcloud I can only see the backend code displayed. In the log below I replaced all company and project information.

[INFO] Indexing files of module 'MainProject-Server-Backend'
[INFO]   Base dir: /home/runner/work/MainProject-Server/MainProject-Server/backend
[INFO]   Source paths: pom.xml, src/main/java
[INFO]   Test paths: src/test/java
[INFO] Indexing files of module 'MainProject-Server-Frontend'
[INFO]   Base dir: /home/runner/work/MainProject-Server/MainProject-Server/frontend
[INFO]   Source paths: src
[INFO] Indexing files of module 'MainProject-Server'
[INFO]   Base dir: /home/runner/work/MainProject-Server/MainProject-Server
[INFO]   Source paths: pom.xml
[INFO] 75 files indexed
[INFO] 0 files ignored because of scm ignore settings
[INFO] Quality profile for java: Sonar way
[INFO] Quality profile for js: Sonar way
[INFO] Quality profile for ts: Sonar way
[INFO] Quality profile for xml: Sonar way
[INFO] ------------- Run sensors on module MainProject-Server-Frontend
[INFO] JavaScript/TypeScript frontend is enabled
[INFO] Load metrics repository
[INFO] Load metrics repository (done) | time=110ms
[INFO] Sensor SonarCSS Rules [cssfamily]
[INFO] 20 source files to be analyzed
[INFO] 20/20 source files have been analyzed
[INFO] Sensor SonarCSS Rules [cssfamily] (done) | time=1631ms
[INFO] Sensor C# Project Type Information [csharp]
[INFO] Sensor C# Project Type Information [csharp] (done) | time=1ms
[INFO] Sensor C# Properties [csharp]
[INFO] Sensor C# Properties [csharp] (done) | time=1ms
[INFO] Sensor JavaXmlSensor [java]
[INFO] Sensor JavaXmlSensor [java] (done) | time=2ms
[INFO] Sensor HTML [web]
[INFO] Sensor HTML [web] (done) | time=94ms
[INFO] Sensor VB.NET Project Type Information [vbnet]
[INFO] Sensor VB.NET Project Type Information [vbnet] (done) | time=1ms
[INFO] Sensor VB.NET Properties [vbnet]
[INFO] Sensor VB.NET Properties [vbnet] (done) | time=1ms
[INFO] Sensor JaCoCo XML Report Importer [jacoco]
[INFO] 'sonar.coverage.jacoco.xmlReportPaths' is not defined. Using default locations: target/site/jacoco/jacoco.xml,target/site/jacoco-it/jacoco.xml,build/reports/jacoco/test/jacocoTestReport.xml
[INFO] No report imported, no coverage information will be imported by JaCoCo XML Report Importer
[INFO] Sensor JaCoCo XML Report Importer [jacoco] (done) | time=5ms
[INFO] Sensor JavaScript analysis [javascript]
[INFO] Deploying custom rules bundle jar:file:/home/runner/.sonar/cache/f2d4f3985cfdc8a536978941e81bc342/sonar-securityjsfrontend-plugin.jar!/js-vulnerabilities-rules-1.0.0.tgz to /home/runner/work/MainProject-Server/MainProject-Server/target/sonar/.sonartmp/eslint-bridge-bundle/package/custom-rules1763823768652586018
[INFO] 9 source files to be analyzed
[INFO] 9/9 source files have been analyzed
[INFO] Sensor JavaScript analysis [javascript] (done) | time=5557ms
[INFO] Sensor TypeScript analysis [javascript]
[INFO] Found 0 tsconfig.json file(s): []
[INFO] 20 source files to be analyzed
[INFO] Analyzing 20 files using tsconfig: /home/runner/work/MainProject-Server/MainProject-Server/target/sonar/.sonartmp/11843128633825099197.tmp
[INFO] 20/20 source files have been analyzed
[INFO] Sensor TypeScript analysis [javascript] (done) | time=5588ms
[INFO] Sensor ThymeLeaf template sensor [securityjavafrontend]
[INFO] Sensor ThymeLeaf template sensor [securityjavafrontend] (done) | time=1ms
[INFO] ------------- Run sensors on module MainProject-Server-Backend
[INFO] JavaScript/TypeScript frontend is enabled
[INFO] Sensor JavaSquidSensor [java]
[INFO] Configured Java source version (sonar.java.source): 8
[INFO] JavaClasspath initialization
[INFO] JavaClasspath initialization (done) | time=10ms
[INFO] JavaTestClasspath initialization
[INFO] JavaTestClasspath initialization (done) | time=2ms
[INFO] Java Main Files AST scan
[INFO] 21 source files to be analyzed
[INFO] 21/21 source files have been analyzed
[INFO] Java Main Files AST scan (done) | time=5609ms
[INFO] Java Test Files AST scan
[INFO] 3 source files to be analyzed
[INFO] 3/3 source files have been analyzed
[INFO] Java Test Files AST scan (done) | time=267ms
[INFO] Java Generated Files AST scan
[INFO] 0 source files to be analyzed
[INFO] 0/0 source files have been analyzed
[INFO] Java Generated Files AST scan (done) | time=2ms
[INFO] Sensor JavaSquidSensor [java] (done) | time=6328ms
[INFO] Sensor SonarCSS Rules [cssfamily]
[INFO] No CSS, PHP, HTML or VueJS files are found in the project. CSS analysis is skipped.
[INFO] Sensor SonarCSS Rules [cssfamily] (done) | time=0ms
[INFO] Sensor C# Project Type Information [csharp]
[INFO] Sensor C# Project Type Information [csharp] (done) | time=0ms
[INFO] Sensor C# Properties [csharp]
[INFO] Sensor C# Properties [csharp] (done) | time=0ms
[INFO] Sensor SurefireSensor [java]
[INFO] parsing [/home/runner/work/MainProject-Server/MainProject-Server/backend/target/surefire-reports]
[INFO] Sensor SurefireSensor [java] (done) | time=90ms
[INFO] Sensor JavaXmlSensor [java]
[INFO] 1 source file to be analyzed
[INFO] 1/1 source file has been analyzed
[INFO] Sensor JavaXmlSensor [java] (done) | time=243ms
[INFO] Sensor HTML [web]
[INFO] Sensor HTML [web] (done) | time=0ms
[INFO] Sensor XML Sensor [xml]
[INFO] 1 source file to be analyzed
[INFO] 1/1 source file has been analyzed
[INFO] Sensor XML Sensor [xml] (done) | time=195ms
[INFO] Sensor VB.NET Project Type Information [vbnet]
[INFO] Sensor VB.NET Project Type Information [vbnet] (done) | time=2ms
[INFO] Sensor VB.NET Properties [vbnet]
[INFO] Sensor VB.NET Properties [vbnet] (done) | time=1ms
[INFO] Sensor JaCoCo XML Report Importer [jacoco]
[INFO] 'sonar.coverage.jacoco.xmlReportPaths' is not defined. Using default locations: target/site/jacoco/jacoco.xml,target/site/jacoco-it/jacoco.xml,build/reports/jacoco/test/jacocoTestReport.xml
[INFO] Importing 1 report(s). Turn your logs in debug mode in order to see the exhaustive list.
[INFO] Sensor JaCoCo XML Report Importer [jacoco] (done) | time=37ms
[INFO] Sensor ThymeLeaf template sensor [securityjavafrontend]
[INFO] Sensor ThymeLeaf template sensor [securityjavafrontend] (done) | time=3ms
[INFO] ------------- Run sensors on module MainProject-Server
[INFO] JavaScript/TypeScript frontend is enabled
[INFO] Sensor SonarCSS Rules [cssfamily]
[INFO] No CSS, PHP, HTML or VueJS files are found in the project. CSS analysis is skipped.
[INFO] Sensor SonarCSS Rules [cssfamily] (done) | time=2ms
[INFO] Sensor C# Project Type Information [csharp]
[INFO] Sensor C# Project Type Information [csharp] (done) | time=1ms
[INFO] Sensor C# Properties [csharp]
[INFO] Sensor C# Properties [csharp] (done) | time=1ms
[INFO] Sensor JavaXmlSensor [java]
[INFO] 1 source file to be analyzed
[INFO] 1/1 source file has been analyzed
[INFO] Sensor JavaXmlSensor [java] (done) | time=16ms
[INFO] Sensor HTML [web]
[INFO] Sensor HTML [web] (done) | time=1ms
[INFO] Sensor XML Sensor [xml]
[INFO] 1 source file to be analyzed
[INFO] 1/1 source file has been analyzed
[INFO] Sensor XML Sensor [xml] (done) | time=18ms
[INFO] Sensor VB.NET Project Type Information [vbnet]
[INFO] Sensor VB.NET Project Type Information [vbnet] (done) | time=1ms
[INFO] Sensor VB.NET Properties [vbnet]
[INFO] Sensor VB.NET Properties [vbnet] (done) | time=1ms
[INFO] Sensor JaCoCo XML Report Importer [jacoco]
[INFO] 'sonar.coverage.jacoco.xmlReportPaths' is not defined. Using default locations: target/site/jacoco/jacoco.xml,target/site/jacoco-it/jacoco.xml,build/reports/jacoco/test/jacocoTestReport.xml
[INFO] No report imported, no coverage information will be imported by JaCoCo XML Report Importer
[INFO] Sensor JaCoCo XML Report Importer [jacoco] (done) | time=4ms
[INFO] Sensor ThymeLeaf template sensor [securityjavafrontend]
[INFO] Sensor ThymeLeaf template sensor [securityjavafrontend] (done) | time=0ms
[INFO] Sensor JavaSecuritySensor [security]
[INFO] Reading type hierarchy from: /home/runner/work/MainProject-Server/MainProject-Server/target/sonar/ucfg2/java
[INFO] Read 157 type definitions
[INFO] Reading UCFGs from: /home/runner/work/MainProject-Server/MainProject-Server/target/sonar/ucfg2/java
[INFO] 09:12:34.329925 Building Runtime Type propagation graph
[INFO] 09:12:34.343883 Running Tarjan on 371 nodes
[INFO] 09:12:34.347457 Tarjan found 371 components
[INFO] 09:12:34.351275 Variable type analysis: done
[INFO] 09:12:34.354635 Building Runtime Type propagation graph
[INFO] 09:12:34.366899 Running Tarjan on 371 nodes
[INFO] 09:12:34.368456 Tarjan found 371 components
[INFO] 09:12:34.369812 Variable type analysis: done
[INFO] Analyzing 126 ucfgs to detect vulnerabilities.
[INFO] All rules entrypoints : 14 Retained UCFGs : 22
[INFO] rule: S5131, entrypoints: 0
[INFO] rule: S5131 done
[INFO] rule: S3649, entrypoints: 0
[INFO] rule: S3649 done
[INFO] rule: S2076, entrypoints: 0
[INFO] rule: S2076 done
[INFO] rule: S2091, entrypoints: 0
[INFO] rule: S2091 done
[INFO] rule: S2078, entrypoints: 0
[INFO] rule: S2078 done
[INFO] rule: S2631, entrypoints: 0
[INFO] rule: S2631 done
[INFO] rule: S5135, entrypoints: 0
[INFO] rule: S5135 done
[INFO] rule: S2083, entrypoints: 1
[INFO] Running symbolic analysis
[INFO] rule: S2083 done
[INFO] rule: S5167, entrypoints: 0
[INFO] rule: S5167 done
[INFO] rule: S5144, entrypoints: 13
[INFO] Running symbolic analysis
[INFO] rule: S5144 done
[INFO] rule: S5145, entrypoints: 0
[INFO] rule: S5145 done
[INFO] rule: S5146, entrypoints: 0
[INFO] rule: S5146 done
[INFO] rule: S5334, entrypoints: 0
[INFO] rule: S5334 done
[INFO] rule: S6096, entrypoints: 0
[INFO] rule: S6096 done
[INFO] Sensor JavaSecuritySensor [security] (done) | time=904ms
[INFO] Sensor CSharpSecuritySensor [security]
[INFO] Reading type hierarchy from: /home/runner/work/MainProject-Server/MainProject-Server/target/ucfg_cs2
[INFO] Read 0 type definitions
[INFO] Reading UCFGs from: /home/runner/work/MainProject-Server/MainProject-Server/target/ucfg_cs2
[INFO] No UCFGs have been included for analysis.
[INFO] Sensor CSharpSecuritySensor [security] (done) | time=4ms
[INFO] Sensor PhpSecuritySensor [security]
[INFO] Reading type hierarchy from: /home/runner/work/MainProject-Server/MainProject-Server/target/sonar/ucfg2/php
[INFO] Read 0 type definitions
[INFO] Reading UCFGs from: /home/runner/work/MainProject-Server/MainProject-Server/target/sonar/ucfg2/php
[INFO] No UCFGs have been included for analysis.
[INFO] Sensor PhpSecuritySensor [security] (done) | time=4ms
[INFO] Sensor PythonSecuritySensor [security]
[INFO] Reading type hierarchy from: /home/runner/work/MainProject-Server/MainProject-Server/target/sonar/ucfg2/python
[INFO] Read 0 type definitions
[INFO] Reading UCFGs from: /home/runner/work/MainProject-Server/MainProject-Server/target/sonar/ucfg2/python
[INFO] No UCFGs have been included for analysis.
[INFO] Sensor PythonSecuritySensor [security] (done) | time=6ms
[INFO] Sensor JsSecuritySensor [security]
[INFO] Reading type hierarchy from: /home/runner/work/MainProject-Server/MainProject-Server/target/sonar/ucfg2/js
[INFO] Read 0 type definitions
[INFO] Reading UCFGs from: /home/runner/work/MainProject-Server/MainProject-Server/target/sonar/ucfg2/js
[INFO] No UCFGs have been included for analysis.
[INFO] Sensor JsSecuritySensor [security] (done) | time=4ms
[INFO] ------------- Run sensors on project
[INFO] Sensor Zero Coverage Sensor
[INFO] Sensor Zero Coverage Sensor (done) | time=7ms
[INFO] Sensor Java CPD Block Indexer
[INFO] Sensor Java CPD Block Indexer (done) | time=45ms
[INFO] SCM Publisher SCM provider for this project is: git
[INFO] SCM Publisher 7 source files to be analyzed
[INFO] SCM Publisher 7/7 source files have been analyzed (done) | time=271ms
[INFO] CPD Executor 4 files had no CPD blocks
[INFO] CPD Executor Calculating CPD for 46 files
[INFO] CPD Executor CPD calculation finished (done) | time=37ms
[INFO] SCM writing changed lines
[INFO] SCM writing changed lines (done) | time=103ms
[INFO] Analysis report generated in 1787ms, dir size=273 KB
[INFO] Analysis report compressed in 71ms, zip size=102 KB
[INFO] Analysis report uploaded in 462ms
[INFO] ANALYSIS SUCCESSFUL, you can find the results at: https://sonarcloud.io/dashboard?id=myCompany_MainProject-Server&pullRequest=15
[INFO] Note that you will be able to access the updated dashboard once the server has processed the submitted analysis report
[INFO] More about the report processing at https://sonarcloud.io/api/ce/task?id=AXiwwT4uCg3BGfTAwbtI
[INFO] Analysis total time: 38.566 s ```

What am I doing wrong?

Colin · April 8, 2021, 6:45pm

Hey there.

This looks like a pull request analysis, which means only changed code will appear. Is this code merged into your main branch, and do you see it there?

frank-e-ap · April 9, 2021, 6:17am

Hi Colin,

thanks for the reply I have not merged the code yet. Is this also the case for branches? As I cannot see the frontend module in the branch, too.
Would be great if this was documented more explicitly in https://sonarcloud.io/documentation/analysis/pull-request/ so that non-native speakers will catch on to this fact more easily.

Thank you,
Frank

Colin · April 9, 2021, 9:12am

Hey there.

Yes – the same is true for short-lived branches.

What do you think could be made more clear about the existing documentation?

PR analysis only analyzes code changes introduced by the PR itself . In other words, the set of lines of code analyzed is determined by comparing the PR with its target branch and only the lines that have changed as a result of the PR are analyzed.

frank-e-ap · April 9, 2021, 9:59am

Hi Colin,

I think what’s missing here is the fact that only the analyzed code will be visible in the code view. As I hadn’t changed anything in the frontend module the whole module wasn’t displayed and I spent a few hours to read documentation and try different methods before creating this topic.
Thanks to your help it is now clear to me, but I think it would be good to have htis fact explicitly mentioned.

Cheers,
Frank

Colin · April 9, 2021, 10:07am

Thanks @frank-e-ap. I’ve passed along the feedback.