Mapping SonarQube Rules to Fortify Categories

SonarQube
1

SonarQube Version: 10.3 (build 82913)

How deployed?

  • Don’t know; we have access to it via the web and sonarscanner

What are you trying to achieve?

  • Trying to determine which SonarQube Rules maps to Fortify Categories and when a match is found, how to trigger this rule to fail just like Fortify fails it.

Fortify spit out errors for the category ‘XML External Entity Injection (XXE) attacks’ in some Java code. The Sonarqube rule ‘Rule for XML parsers should not be vulnerable to XXE attacks’ seems most to match to this Fortify category. However, when the Sonarqube is run on the same Java software, Sonarqube is not showing a finding.

I’m looking for 2 things:

  1. What is the mapping of sonarqube rules to fortify categories?
  2. Why does the rule not trigger in sonarqube if there is such a mapping?
2

What edition of SonarQube are you using?

I wouldn’t say there is one.

Great question! Can you share the code where you expect an issue to be raised?

3

I appreciate the response.

The SonarQube rule in question is Java (XML parsers should not be vulnerable to XXE attacks).
XXE being XML External Entity. These are used for denial of service.

Would you please provide example code that would trigger any of the XXE rules?

4

I’m referring to the edition of SonarQube (Community, Developer, Enterprise, Data Center), not the version. In particular, because these rules are only executed in Developer Edition and above ($).

You can find non-compliant code examples in the rule description.

5

We have Enterprise Edition of SonarQube