Post Upgrade to LTS, there is a spike in Vulnerabilities Reported

[aravindnss (Aravind S)]

Hello,

Sonarqube Version - v9.9 LTS Sonarqube Data Center Edition
Deployed through Zip

Recently we upgraded from 9.8 to the latest LTS version.

Post Upgrade there was a sudden spike in Vulnerabilities for one of the projects and all this was reported by this one rule.
(Rule: I/O function calls should not be vulnerable to path injection attacks,
ID: roslyn.sonaranalyzer.security.cs:S2083).

Before Upgrade

After Upgrade

The issue here is there were no changes made to the source code and all these new vulnerabilities were reported in the overall code. (Also this project is using the default Quality Profile and Quality Gate both before and after the upgrade)

I’m trying to understand what might be the cause of this.
I noticed there was only one new rule(csharpsquid:S6444) added and one removed(csharpsquid:S4214) from the C# profile in this version. So this is totally not related.

Any help/suggestions is very much appreciated.
Please let me know if any more information is required.

Thanks in Advance.

Aravind

[Colin]

Hey there.

Rule implementations change from version to version, and in good news, such issues are backdated so that they don’t infect your New Code Period.

Are the new issues being raised valid issues?

[aravindnss (Aravind S)]

Hi @Colin,

Thanks for your response.

I’m sorry, I didn’t exactly understand what you mean by Rule Implementations, also are these implementation changes listed as part of the changelog?

The Rule that flags these vulnerabilities has already reported some issues during the previous scans and those were either fixed or marked as WF/FP.

Though most of the issues raised now were FP, still what could be the cause of these issues being reported now. (In some files, the same RULE as flagged issues during the previous scans but in different lines)

Thanks,
Aravind

[Colin]

@aravindnss

I’m sorry, I didn’t exactly understand what you mean by Rule Implementations, also are these implementation changes listed as part of the changelog?

The rules themselves become smarter during SonarQube upgrades, to suppress false-positive and fix false-negatives (where an issue should have been raised, but couldn’t be, due to an error in the logic or not supporting a specific framework).

So I return to this question:

@Colin

Are the new issues being raised valid issues?

[aravindnss (Aravind S)]

Hi @Colin,

Thanks for your response.

@Colin

Are the new issues being raised valid issues?

The new issues that were raised are not valid for this source code.

Thanks,
Aravind

[Colin]

I would recommend sharing the details here (see the following post):

How to Report a False-positive / False-negative

Hey SonarSource Community! False-positives happen, as do false-negatives, and we’re eager to fix them. We are thrilled when our users report problems, so we can make our products better. What is a false-positive (FP)? A false-positive is when an issue is raised unexpectedly on code that should not trigger an issue, or where the suggested action doesn’t make any sense for the code. What is a false-negative (FN)? A false-negative is when an issue should be raised on a piece of code, but isn’t…

[aravindnss (Aravind S)]

Got it, Will do it! Thanks @Colin!