S3267 in razor files does not respect editorconfig setting

SonarQube Cloud
1

Template for a good new topic, formatted with Markdown:

  • ALM used: Azure DevOps
  • CI system used: Azure DevOps
  • Scanner command used: sonar vs extension as well as SonarQube scanner
  • Languages of the repository: C# and TS
  • S3267
  • Set your .editorConfig to have ‘dotnet_diagnostic.S3267.severity = none’ then put a foreach loop in a razor file for a blazor page or component.
  • None

Sonarqube properly ignores this in code, but in the razor file it reports it. We treat warning as errors so this ends up failing our build.

2

The NOSONAR flag doesn’t work in razor files. Applying an exclusion via the scanner doesn’t work since the analyzers run against the build. We are going to have to stop using SonarQube in order to work around this issue.

3

Hey @austinmcdaniel, this is a known limitation that we are tracking internally and which also has an open issue on GitHub (feel free to follow progress there).

However, I don’t think you need to completely stop using SonarQube because of this. I would say you have 2 potential workarounds:

  • Use MSBuild’s NoWarn to suppress S3267 at compiler output level. Other users with similar issues have added this to directory.build.targets:

    <Target Name="SonarQubeRestoreWarningsAsErrors"
        Condition=" $(SonarQubeTempPath) != '' "
        AfterTargets="OverrideRoslynCodeAnalysisProperties"
        BeforeTargets="CoreCompile">
    <PropertyGroup>      
      <NoWarn>$(NoWarn);S6605;S1121;...;</NoWarn>
    </PropertyGroup>
  </Target>

  • Deactivate this rule in a custom quality profile so that it doesn’t run at all.