SonarC# False Positives in Blazor Files

Hey :slightly_smiling_face:,

I’ve run into a problem with SonarC# when it inspects Blazor files ending in .razor.cs. It generates false positives, like suggesting changes to ‘partial’ or recommending ‘use static readonly instead of constant,’ which always results in build errors.

Why is this an issue?

Dealing with these problems is an important part of development as it ensures good code quality and consistency. It is just really frustrating when it flags a false positive. Here is an example of the issue: https://github.com/NickYoung-PanoramicData/CSharpToDo/blob/main/Client/Pages/Index.razor.cs .

Because only the .cs files are being checked, it is saying that partial is gratuitous - when in actuality it is needed to allow the code behind feature to work for the .razor files. This is because code defined in a ‘.razor.cs’ file acts as code for the ‘.razor’ file).

The only alternative I have is to disable the pattern for the whole codebase - which is not only tedious to implement but will also let real errors through, which is not the ideal solution.

It would be good to either use a parameter for the given pattern (SonarCSharp_S2333) to ignore certain file extensions (like .razor.cs) to stop false positives from being triggered or for a folder to place files like this in to ignore the pattern.

If a solution for this already exists, please let me know.

Thanks for your time!

Hi,

Welcome to the community!

What version of SonarQube are you using? If you’re not sure, you’ll find it in the page footer.

 
Ann

I am currently using version 8.40 of SonarC# running through Codacy.

Hi,

Version 8.40 was released in May 2022. We’re on 9.6.0 by now. :smile:

Would you mind sharing why you’re using Codacy and not SonarQube or SonarCloud directly? Because SonarQube Community Edition gives you - for free - the same analyzer Codacy is using, but in the most current version.

And if you care to pay - SonarQube Developer Edition($) starts at $150/year - you also get taint analysis, which Codacy isn’t giving you.

 
Ann

1 Like