Hi all,
I am trying to take a report Sonarqube. But I realized that Sonarqube’ rules and tag types are not same for C# compared to SonarScanner(1).By the way, the report doesn’t provide same output compared to other static analysis tools. How can I equate?For example, Sonarqube I used, has 384 rules while SonarScanner has 393 rules for C#. Moreover,
-
Sonarqube I used, has no “injection” tag in Rules tab while SonarScanner has it.
-
Sonarqube I used, has 50 rules in “cwe” tag, but SonarScanner has 59 rules.
-
etc.
Note: The sonar version I used: 8.2(Also, I am examined 8.4 version but unfortunately, it has these issues)
1- C# static code analysis: HTTP responses should not be vulnerable to session fixation
Kindly help me in this regard.
Thanks in advance.
