Over reporting of an Azure storage key warning in config file, leads to CPU lock out

Please provide

  • Operating system: Windows 10
  • SonarLint plugin version: 6.15
  • Programming language you’re coding in: C#
  • Is connected mode used:
    • Connected to SonarCloud

And a thorough description of the problem / question:

I have a .net core C# project, it contains an appsettings.json file
In this are three settings containing connection strings for azure cosmos, one is commented out
When I open the settings file and hover over one of the green underlined keys, the warning that keys should be stored securely comes up once on the first key and twice on subsequent keys.
If I switch to another file and come back to the settings file and hover over the key it displays like in the screenshot, with more repeats of the warning than can fit on the screen.
If I leave Visual Studio open for long enough then try to edit the settings file, it will max out a CPU on my box, and Visual Studio stops responding, after a long time (minutes) the warning messages flash up briefly no matter where the mouse cursor is, I can edit the file until focus is lost from the text editor, then it will lock up again trying to go back in.
Closing the file and reopening it seems to reset it.

It looks like it is stuck in a loop

SonarLint output window contents:

No open solution or folder
Current VS version:
    Visual Studio Professional 2022
    17.5.33502.453
    17.5.2
Finished initializing the telemetry package...
Initializing the daemon package...
[Open in IDE] Creating request listener...
Finished initializing the daemon package.
[Open in IDE] Checking availability of port 64120
[Open in IDE] Request listener created successfully. Listening on port 64120.
[SecretsAnalyzer] Analyzing C:\Projects\CST\OrdersToCosmosDBMigration\OrdersToCosmosDBMigration\OrdersToCosmosDBMigration\appsettings.json
[SecretsAnalyzer] Finished analyzing C:\Projects\CST\OrdersToCosmosDBMigration\OrdersToCosmosDBMigration\OrdersToCosmosDBMigration\appsettings.json, analysis time: 0.066s
[SecretsAnalyzer] Found 3 issue(s) for C:\Projects\CST\OrdersToCosmosDBMigration\OrdersToCosmosDBMigration\OrdersToCosmosDBMigration\appsettings.json
Initializing the SonarLint package...
Finishing initializing the SonarLint package
Initializing the notifications package...
Not connected: not checking for notifications
Finished initializing the notifications package
[SecretsAnalyzer] Analyzing C:\Projects\CST\OrdersToCosmosDBMigration\OrdersToCosmosDBMigration\OrdersToCosmosDBMigration\appsettings.json
[SecretsAnalyzer] Finished analyzing C:\Projects\CST\OrdersToCosmosDBMigration\OrdersToCosmosDBMigration\OrdersToCosmosDBMigration\appsettings.json, analysis time: 0.001s
[SecretsAnalyzer] Found 3 issue(s) for C:\Projects\CST\OrdersToCosmosDBMigration\OrdersToCosmosDBMigration\OrdersToCosmosDBMigration\appsettings.json
[SecretsAnalyzer] Analyzing C:\Projects\CST\OrdersToCosmosDBMigration\OrdersToCosmosDBMigration\OrdersToCosmosDBMigration\Clients\CosmosDbClient.cs
[SecretsAnalyzer] Finished analyzing C:\Projects\CST\OrdersToCosmosDBMigration\OrdersToCosmosDBMigration\OrdersToCosmosDBMigration\Clients\CosmosDbClient.cs, analysis time: 0.003s
[SecretsAnalyzer] Found 0 issue(s) for C:\Projects\CST\OrdersToCosmosDBMigration\OrdersToCosmosDBMigration\OrdersToCosmosDBMigration\Clients\CosmosDbClient.cs

Hi,

SonarLint 6.16.0.69538 was released last week. Could you upgrade and see if this is still replicable, please?

 
Thx,
Ann

At some point yesterday my extension updated itself, issue still exists today

1 Like

Uncommenting the commented out connection string stops the issue from occurring. (i.e. only happens if one of the lines it is reporting on is commented out)

Hello @bonner-earle. Does this issue appear on the latest version of SLVS?

Hello I can still reproduce this in this version

Sorry for the delay. We’ve finally come up with a reproducer for this issue.

You can follow the progress on GitHub: Issues raised by the secrets analyzer are multiplied in the tooltip · Issue #5002 · SonarSource/sonarlint-visualstudio · GitHub

1 Like