Mapping of Standard Experience Mode (old) to Multi-Quality Rule (MQR) Mode

guwirth · January 20, 2025, 10:57am

Hi,

I read your pages about Standard Experience Mode (old) and Multi-Quality Rule (MQR) Mode and that currently both is supported side-by-side.

Reading your documentation I couldn’t find an answer to the question, if there is an automatic mapping of Standard Experience Mode rule types and severity levels to the new MQR mode?

Question behind this is:
If I have a plugin supporting only the “Standard Experience Mode” and the Administration > Configuration > General Settings > Mode setting on the server is MQR, what happens then?

Regards,
Günter

guwirth · January 23, 2025, 12:34pm

Hi,

what I found so far:

In the documentation Generic issue import format | SonarQube Server Documentation

Starting the SQ Community server 25.1 there is the hint:

This seems to be the default mapping if Impacts is not defined (red)?

The Severity inside of Impacts seems to be converted as follows:

Severity (old)	Impacts / Severity (new)
—	BLOCKER
BLOCKER	HIGH
CRITICAL	HIGH
MAJOR	MEDIUM
MINOR	LOW
INFO	LOW
—	INFO

The default for the cleanCodeAttribute is CONVENTIONAL.

In my tests I have a plugin setting the values for Standard Experience Mode only. The server is also starting in Multi-Quality Rule mode with the plugin creating for each rule one default entry in Impacts (see above).

Can someone give a hint, where in the code this magic happens?

Regards,
Günter

guwirth · January 23, 2025, 12:49pm

Hi,

digging deeper I found the source code doing the mapping:

github.com/SonarSource/sonar-php

sonar-php-plugin/src/main/java/org/sonar/plugins/php/reports/ExternalIssuesSensor.java

745f4f331


      
                case "MINOR" -> org.sonar.api.batch.rule.Severity.MINOR;
                case "MAJOR" -> org.sonar.api.batch.rule.Severity.MAJOR;
                case "CRITICAL" -> org.sonar.api.batch.rule.Severity.CRITICAL;
                case "BLOCKER" -> org.sonar.api.batch.rule.Severity.BLOCKER;
                default -> DEFAULT_RULE_SEVERITY;
              };
            }
            return DEFAULT_RULE_SEVERITY;
          }
          
          private static SoftwareQuality toSoftwareQuality(RuleType ruleType) {
            return switch (ruleType) {
              case BUG -> SoftwareQuality.RELIABILITY;
              case SECURITY_HOTSPOT, VULNERABILITY -> SoftwareQuality.SECURITY;
              case CODE_SMELL -> SoftwareQuality.MAINTAINABILITY;
            };
          }
          
          private static Severity toImpactSeverity(org.sonar.api.batch.rule.Severity ruleSeverity) {
            return switch (ruleSeverity) {
              case INFO, MINOR -> Severity.LOW;

github.com/SonarSource/sonar-php

sonar-php-plugin/src/main/java/org/sonar/plugins/php/reports/ExternalIssuesSensor.java

745f4f331


      
          }
          
          private static SoftwareQuality toSoftwareQuality(RuleType ruleType) {
            return switch (ruleType) {
              case BUG -> SoftwareQuality.RELIABILITY;
              case SECURITY_HOTSPOT, VULNERABILITY -> SoftwareQuality.SECURITY;
              case CODE_SMELL -> SoftwareQuality.MAINTAINABILITY;
            };
          }
          
          private static Severity toImpactSeverity(org.sonar.api.batch.rule.Severity ruleSeverity) {
            return switch (ruleSeverity) {
              case INFO, MINOR -> Severity.LOW;
              case MAJOR -> Severity.MEDIUM;
              case CRITICAL, BLOCKER -> Severity.HIGH;
            };
          }
          
          private String toRuleId(@Nullable String ruleId) {
            if (ruleId != null && externalRuleLoader.ruleKeys().contains(ruleId)) {
              return ruleId;

Regards,
Günter

john.clifton · January 23, 2025, 5:13pm

Hi @guwirth,

Thank you for your question and for digging into this so deeply!

That’s right, today we will give new rules that only have type+severity defined (standard experience) a quality+severity so they work in MQR mode.

If you are using generic issues defined using an older format, you get Maintainability+Medium. With the newer format you get pretty much what you would expect except Blocker → High and Info → Low as you spotted. We initially mapped Blocker in standard to High and Info → Low in the new severity system because we wanted to avoid a load of rules suddenly appear as Blocker/Info before users used to Low/Medium/High were ready to handle them. This isn’t ideal because you don’t get a rule being treated in the same way in both modes. We are looking to go to the more obvious Blocker/Info (standard) → Blocker/Info (MQR) mapping now that we’ve had the 5 severities in MQR mode for a little bit. I don’t have a date when we expect to do that by just yet. We will also look to update the docs to make it easier for other people to find the answer to the question you raised.

Thank you again for your question because it helps us improve the Sonar experience.

John

system · January 31, 2025, 10:55am

This topic was automatically closed 7 days after the last reply. New replies are no longer allowed.