JsSecuritySensor stops before reaching maximum UCFGs

SonarQube Server / Community Build
,
1
  • which versions are you using : Sonarqube: 10.3.0.82913, Jenkins Scanner plugin: 2.16.1
  • how is SonarQube deployed: Docker
  • what are you trying to achieve: Run sonar analysis on TS code repo

I am running Sonar analysis on TS code repo. In logs it seems to stop at 5100 UCFGs (not always same but about approx 5000 always) but there is no error. Is this working as expected or there is some other issue? I have all default settings in Sonarqube server.

03:37:40  INFO: 5100 / 14748 UCFGs simulated, memory usage: 2597 MB
03:37:40  INFO: Taint analysis for js: Time spent was 00:04:18.180
03:37:40  INFO: Report issues: Starting
03:37:41  INFO: Report issues: Time spent was 00:00:00.431
03:37:41  INFO: Store cache: Starting
03:37:42  INFO: Store cache: Time spent was 00:00:01.064
03:37:42  INFO: js security sensor: Time spent was 00:04:41.865
03:37:42  INFO: js security sensor: Begin: 2024-02-05T16:33:00.277353340Z, End: 2024-02-05T16:37:42.142992804Z, Duration: 00:04:41.865
03:37:42    Load type hierarchy and UCFGs: Begin: 2024-02-05T16:33:00.277557470Z, End: 2024-02-05T16:33:06.905953914Z, Duration: 00:00:06.628
03:37:42      Load type hierarchy: Begin: 2024-02-05T16:33:00.277580825Z, End: 2024-02-05T16:33:00.292175933Z, Duration: 00:00:00.014
03:37:42      Load UCFGs: Begin: 2024-02-05T16:33:00.292263146Z, End: 2024-02-05T16:33:06.905607569Z, Duration: 00:00:06.613
03:37:42    Check cache: Begin: 2024-02-05T16:33:06.906150493Z, End: 2024-02-05T16:33:06.906770503Z, Duration: 00:00:00.000
03:37:42      Load cache: Begin: 2024-02-05T16:33:06.906184411Z, End: 2024-02-05T16:33:06.906257539Z, Duration: 00:00:00.000
03:37:42    Create runtime call graph: Begin: 2024-02-05T16:33:06.906893400Z, End: 2024-02-05T16:33:10.821841299Z, Duration: 00:00:03.914
03:37:42      Variable Type Analysis #1: Begin: 2024-02-05T16:33:06.908054115Z, End: 2024-02-05T16:33:08.962665174Z, Duration: 00:00:02.054
03:37:42        Create runtime type propagation graph: Begin: 2024-02-05T16:33:06.909169002Z, End: 2024-02-05T16:33:08.277800570Z, Duration: 00:00:01.368
03:37:42        Run SCC (Tarjan) on 130209 nodes: Begin: 2024-02-05T16:33:08.278416641Z, End: 2024-02-05T16:33:08.596742594Z, Duration: 00:00:00.318
03:37:42        Propagate runtime types to strongly connected components: Begin: 2024-02-05T16:33:08.597091070Z, End: 2024-02-05T16:33:08.962407017Z, Duration: 00:00:00.365
03:37:42      Variable Type Analysis #2: Begin: 2024-02-05T16:33:08.964654613Z, End: 2024-02-05T16:33:10.806339315Z, Duration: 00:00:01.841
03:37:42        Create runtime type propagation graph: Begin: 2024-02-05T16:33:08.964728161Z, End: 2024-02-05T16:33:10.033949443Z, Duration: 00:00:01.069
03:37:42        Run SCC (Tarjan) on 130209 nodes: Begin: 2024-02-05T16:33:10.034186880Z, End: 2024-02-05T16:33:10.204886902Z, Duration: 00:00:00.170
03:37:42        Propagate runtime types to strongly connected components: Begin: 2024-02-05T16:33:10.205190822Z, End: 2024-02-05T16:33:10.806044484Z, Duration: 00:00:00.600
03:37:42    Load config: Begin: 2024-02-05T16:33:10.822097380Z, End: 2024-02-05T16:33:10.963528969Z, Duration: 00:00:00.141
03:37:42    Compute entry points: Begin: 2024-02-05T16:33:10.963724209Z, End: 2024-02-05T16:33:19.292460648Z, Duration: 00:00:08.328
03:37:42    Slice call graph: Begin: 2024-02-05T16:33:19.298676441Z, End: 2024-02-05T16:33:19.298694286Z, Duration: 00:00:00.000
03:37:42    Live variable analysis: Begin: 2024-02-05T16:33:19.298754201Z, End: 2024-02-05T16:33:22.459373661Z, Duration: 00:00:03.160
03:37:42    Taint analysis for js: Begin: 2024-02-05T16:33:22.461365418Z, End: 2024-02-05T16:37:40.641630592Z, Duration: 00:04:18.180
03:37:42    Report issues: Begin: 2024-02-05T16:37:40.645577724Z, End: 2024-02-05T16:37:41.076852469Z, Duration: 00:00:00.431
03:37:42    Store cache: Begin: 2024-02-05T16:37:41.077031237Z, End: 2024-02-05T16:37:42.141987284Z, Duration: 00:00:01.064
03:37:42  INFO: js security sensor peak memory: 3026 MB
03:37:42  INFO: Sensor JsSecuritySensor [security] (done) | time=281907ms
2

Hi,

It’s not clear to me what the question is.

I’m not seeing any errors in the log snippet you’ve provided. So then… analysis is successful?

 
Ann

3

Hi @ganncamp
The first line of logs if you check says

03:37:40 INFO: 5100 / 14748 UCFGs

It seems from logs that the scan did not finish all 14748 UCFGs.
My question is if scan finished properly and that’s how logs are displayed OR it just stopped at 5100 and skipped rest of UCFGs?

4

Hi,

Thanks for the explanation.

Can you share the log lines leading up to the snippet you shared?

 
Ann

1 Like
7

Hey @ld_singh,

My question is if scan finished properly and that’s how logs are displayed OR it just stopped at 5100 and skipped rest of UCFGs?

The first is correct: Scan finished properly and that’s how logs are displayed.

I agree this is misleading and is not an actual progress log despite looking like it.

I’ll create an internal ticket to improve this.

Thank you very much for making us aware!

1 Like
10

Thanks @Karim_El_Ouerghemmi for confirmation!!