Sonar Community Roundup, December 5 - 12

Sonar Updates
1

Hi all,

After a couple years of debating about how to refer to individual users here in the roundup (“Hmm… Does that avatar look like a ‘she’ or a ‘they’?”) I’ve added a ‘pronouns’ user field. It’ll be presented to all new users at signup going forward, but you can go backfill in your profile if you like. The field is optional, and will show up on your user summary.

Administrative business aside, like every week, we’d like to take a moment to recognize you, the users, who help improve the ecosystem for everyone by sparking valuable discussions and providing feedback that drives continuous improvement in our products.

SonarQube MCP Server

SonarQube for IDE:

  • @CWDev had a heck of a time after an automatic update of SonarQube for Visual Studio. @jaromir chimed in too to provide their details as well. In the end, it came down to case-sensitiving pathing. SLVS-2761
  • SonarQube for IntelliJ uses Intelli’s PasswordSafe API to store credentials, which delegates to the system’s native password storage. That’s gnome-keyring in @desckapg’s case. Unfortunately, when the native keyring fails or is unavailable, we’re swallowing the exceptions and only giving generic error messages. SLI-2398 will fix it.

SonarQube Cloud:

Rules & Languages Improvements:

  • @Stine’s pipeline was set up to insert tokens before deploying the code. Unfortunately analysis was happening in between those two steps, so she was getting issues from secrets:S8135 seemingly out of the blue. :sweat_smile: We can’t change the pipeline, but we can detect which files have been modified since checkout, so we’ve created a ticket to skip them during analysis.

  • tssecurity:S2083 doesn’t catch sinks that come from resolve or join. Thanks @rkg! We’re on it.

  • @nickbhasin hit a stackoverflow error trying to analyze some complex regexes. Thanks for a great initial report. We’ve added a ticket to the backlog.

  • roslyn.sonaranalyzer.security.cs:S3649 doesn’t recognize that a method annotated with Function is a source of tainted data. Thanks @tonyh! We’re on it!

  • csharpsquid:S1144 is confused by debugger display attributes. Thanks @Corniel! There’s a ticket in the backlog.

  • @James_Wakefield reported that typescript:S2699 raises false positives on uses of chained expect matchers. Thanks! It’s already fixed in code! SonarJS#6065

  • java:S2638 is incorrectly applying @Nullable to return types when generics are involved. Thanks @osmundf! SONARJAVA-5918

Thank you again to everyone mentioned—and to those we may have missed—for your ongoing contributions in making this community stronger and helping us improve Sonar products.

If you’d like to give a shout-out to someone, whether a community member or a SonarSourcer who helped you, please do so below. And if there’s someone you think we should acknowledge next week, let us know!

 
Ann
(she/her)

4 Likes