Sonar Cloud Security Configuration

SonarQube Cloud
, ,
1

Sonar has a module, Sonar Cloud. How can i set up a thorough secure code review with all the possible vulnerabilities, setting up hotspot. I have worked closely with sonar cloud but failed to find the vulnerabilities in code but other tools report more observations. Also, Sonar Lint is one of the IDE incorporated solution which doesn’t solves my purpose of a secure code. Need help to fine tune the security configuration if any?

2

Hi,

Welcome to the community!

Taint analysis rules purposely aren’t run in SonarLint because they would drag down the IDE performance.

Are they correct observations? It’s not a quantitative game, but a qualitative one.

And if there are true-positive issues raised by other tools, but not by us, we’re eager to learn of them so we can fix the problem.

 
Ann

3

Yes, there were many not been reported by Sonar Cloud. Basic hardcoded credentials was even not been reported by Sonar.

I am open to have your support team help me with an SOP to setup a thorough Security Profile.

I am ok, have documentation from your end as well, I am ok to be proved wrong but as mentioned above many of them are not reported by Sonar.

4

Hi,

Could you give an example of a hardcoded credential that wasn’t picked-up on?

 
Thx,
Ann

5

DB credentials stored in the credentials are the examples. I would like to know the list best security practices for Sonar Cloud.

6

Hi,

I’m looking for an example / reproducer. Are we talking about credentials hard coded in a DB connection string?

 
Thx,
Ann

7

ORM with Host, Credentials and db name
ORM with Host, Credentials and db name1239×694 177 KB

8

Need security checklist to ensure practices have been followed to avoid such observation as in screenshots.

9

Hi,

What kind of file is that in your screenshot? What’s the file extension?

 
Thx,
Ann

10

hi,
Why are you asking use less questions. When you can see the other tools reports gives me the output but not if you have list security controls to get better results please let me know. Kindly dont waste your and my time in this with these irrelevnt questions.

12

Hi,

You’re reporting a false negative. Without the details of

  • language
  • rule
  • reproducer

then all I have is “something’s wrong”, and there’s not much I can do with that.

Looking more closely at your screenshot, it seems the file type is .js. Knowing the language, I can verify that we do have a rule for that: S2068, which is a Security Hotspot rule.

Have you checked the Security Hotspots tab?

 
Ann