SonarLint - Can it checks for vulnerabilities such as SQL Injection?

SonarLint Visual Studio
,
1

Hi Team,

Can I check whether there are plans to include SQL Injection checks in the Sonar Lint plugin?

This feature is very useful for the developers. Right now, I don’t see the plugin doing such checks.

1 Like
2

A post was split to a new topic: Unable to analyze JS files in Visual Studio 2019

3

Hi @bxblin,

SonarLint - Can it checks for vulnerabilities such as SQL Injection?

Short answer: no.

We made multiple attempts of enabling advanced security rules in SonarLint, and so far it has not been successful. Those rules are based on a complex algorithm that is currently not IDE friendly, since it needs to analyze the entire project to give good results (by entire project, I really mean all project modules, that are possibly not even there in the IDE workspace). It is also not incremental, so a change of a single line of code requires to scan again the entire project, which on big projects can take minutes/hours.

This is still in our 2020 roadmap, so we will continue to work on it and trying to find solutions.

1 Like