No way to supress S6418 in appsettings.json?

Rules and Languages Report False-positive / False-negative...
1

  • What language is this for?
    c#

  • Which rule?
    S6418

We have some secrets in our appsettings that are actually securely encrypted using a key vault. It’s fine that sonar raises this issue, but we want to be able to suppress it after confirming that a specific value is properly encrypted. It seems like there is no way to suppress specific issues in json files, is there?

As a next step I tried to disable the rule for json files by editing the editorconfig file by adding:

[*.json]
dotnet_diagnostic.S6418.severity = none

however, this does not seem to have any effect at all. So how can I disable this rule for a specific line or alternatively for all json files?

Since all our encrypted appsettings have a common suffix, as a future suggestion it would be nice if you could configure exclusion patterns for the config settings.

2

Hi there, @tkenbw

I believe this issue is not raised by the .NET analyzers but by a different one, so it is not affected by editorconfig settings.
You can exclude the files completely if you want, using the normal sonar.exclusions analysis property, but in that case you will lose any issue on those files (not only 6418-related).

However, the simplest thing is to either

  • Mark it as a False-Positive
  • Accept it

Denis

3

for sonar qube this is fine, however the issues also show up as warnings during the CI build with sonar scanner. This breaks our zero warning policy. Is there a way to hide these errors during the CI build process?

4

Alas, no there is not.

We are aware of the limitation that prevents using a zero-warning policy, but tackling it is a problem in and of itself.

Denis

5

Will sonar.exclusions remove the warnings from the CI build as well? or only in sonarqube?

6

Only in SonarQube, I’m afraid. We are looking at ways around that but I cannot promise anything to be honest.

Denis