Map SARIF issues to custom rules

SonarQube Server / Community Build Writing rules
1

Hallo,

I want import issues from an external tool with the SARIF format. Those issues belong to the maintainability domain and have different severities. Since the SARIF format does not provide fields for providing the softwareQuality and severity I can not provide this information in the SARIF file itself.

I already tried to create a custom rule as described in Rules with the correct quality (maintainability) and severity.
I used the same rule rule-id in the custom rule and in the SARIF file, but the issue was not mapped to the custom rule.

Is it somehow possible to map the issue from the SARIF file to a custom rule?

Thank you,
Andreas

2

Hi Andreas,

It is not. SARIF issues are imported as external issues. If you want more control, your options are to use the Generic Issue format, or write a plugin. For that you probably want to take an existing 3rd-party plugin as an example, such as the Dependency Check plugin.

 
HTH,
Ann