Versions:
- SonarQube Server: v26.9.0.129388
- SonarQube Scanner: Maven Plugin 5.8.0.7211
- Java: 25.0.2 (Azul Systems)
- OS: Mac OS X 26.6.2 (aarch64)
Deployment:
Localhost deployment (http://localhost:9000)
What I’m Trying to Achieve
View the source code of a specific Java file (OTMSServer.java) in the SonarQube UI after a successful Maven scan. The file should display with readable code for analysis purposes.
Current Problem
After running a SonarQube analysis via Maven, when I navigate to view the OTMSServer.java file in the SonarQube UI:
- All source code lines are censored/masked with asterisks (
*and*****) - Some lines display purple/magenta asterisks instead of white
- The file is completely unreadable
- Other files in the same project display normally
- This issue is specific to this one file only
What I’ve Tried
-
Disabled Secrets Analysis:
- Set
sonar.text.activate=false - Set
sonar.secrets.disableKnownFakeSecretFilter=true - Set
sonar.secrets.disableEntropyFilter=true
- Set
-
Checked Security Hotspots & Issues:
- Security Hotspots: Empty (no issues)
- Issues page: No reported issues for this file
- File shows Cyclomatic Complexity metric (127) but code is not visible
-
Verified Permissions:
- User is Global Admin with full permissions
- Has “See Source Code” permission on project
- Administrator user account confirmed in UI
-
Browser & Cache:
- Cleared browser cache and cookies
- Tested in private/incognito window
- Tested in different browser
- Tested on localhost (not public deployment)
-
Scan Commands Tested:
mvn clean verify org.sonarsource.scanner.maven:sonar-maven-plugin:sonar \
-Djarsigner.skip=true \
-Ddependency-check.skip=true \
-Dsonar.projectKey=OTMS_test \
-Dsonar.projectName=‘OTMS_test’ \
-Dsonar.host.url=http://localhost:9000 \
-Dsonar.token=sqp_e75ce10d2200e03d2efe29bd27882f35cb1861b5 \
-Dsonar.text.activate=false \
-Dsonar.secrets.excluded.file.suffixes=.java
-
Other Attempts:
- Excluded file from secrets analysis
- Project deletion and rescan
- Verified source code is being uploaded (other files visible)
Expected Behavior
The source code should be fully readable in the file viewer, showing all code lines without masking, allowing me to analyze the cyclomatic complexity and other metrics.
Question
Is this expected behavior for a specific type of file content, or is there a configuration setting that’s causing this selective masking on a per-file basis? How can I disable source code masking for files analyzed on a local SonarQube instance?
This format should help the SonarQube community provide better assistance!
Ask
Explain
Today at 08:57
add to it that even the comments are censored, and i even tried to scan that one specific file not the whole monolith of the project but still did not made any change
Advantage Assist
Today at 08:57
Used claude-haiku-4-5
Here’s the updated community forum post:
Source Code Censored/Masked in File Viewer After SonarQube Scan
Must-share Information
Versions:
- SonarQube Server: (Please specify - check Administration → System)
- SonarQube Scanner: Maven Plugin 5.8.0.7211
- Java: 25.0.2 (Azul Systems)
- OS: Mac OS X 26.6.2 (aarch64)
Deployment:
- Localhost deployment (http://localhost:9000)
What I’m Trying to Achieve
View the source code of a specific Java file (OTMSServer.java) in the SonarQube UI after a successful Maven scan. The file should display with readable code for analysis purposes.
Current Problem
After running a SonarQube analysis via Maven, when I navigate to view the OTMSServer.java file in the SonarQube UI:
- All source code lines are censored/masked with asterisks (
*and*****) - Even comments are censored/masked - not just code, but ALL content on those lines
- Some lines display purple/magenta asterisks instead of white
- The file is completely unreadable
- Other files in the same project display normally
- This issue is specific to this one file only
What I’ve Tried
-
Disabled Secrets Analysis:
- Set
sonar.text.activate=false - Set
sonar.secrets.disableKnownFakeSecretFilter=true - Set
sonar.secrets.disableEntropyFilter=true
- Set
-
Checked Security Hotspots & Issues:
- Security Hotspots: Empty (no issues)
- Issues page: No reported issues for this file
- File shows Cyclomatic Complexity metric (127) but code is not visible
-
Verified Permissions:
- User is Global Admin with full permissions
- Has “See Source Code” permission on project
- Administrator user account confirmed in UI
-
Browser & Cache:
- Cleared browser cache and cookies
- Tested in private/incognito window
- Tested in different browser
- Tested on localhost (not public deployment)
-
Isolated File Scanning:
- Scanned only the specific
OTMSServer.javafile instead of the entire monolithic project - Issue persisted - file still completely censored after isolated scan
- Confirmed the scan ran successfully (metrics and analysis data present)
- Scanned only the specific
-
Scan Commands Tested:
mvn clean verify org.sonarsource.scanner.maven:sonar-maven-plugin:sonar \
-Djarsigner.skip=true \
-Ddependency-check.skip=true \
-Dsonar.projectKey=myproject \
-Dsonar.projectName=‘myproject’ \
-Dsonar.host.url=http://localhost:9000 \
-Dsonar.token=my_token \
-Dsonar.text.activate=false \
-Dsonar.secrets.excluded.file.suffixes=.java
# Isolated file scan (still resulted in censored output)
mvn sonar:sonar \
-Dsonar.projectKey=myproject \
-Dsonar.projectName=‘myproject’ \
-Dsonar.host.url=http://localhost:9000 \
-Dsonar.token=my_token \
-Dsonar.sources=src/main/java/otms/server/server.java
-
Other Attempts:
- Excluded file from secrets analysis
- Project deletion and rescan
- Verified source code is being uploaded (other files visible)
- Attempted single file scan
Key Observations
- Comments are also masked - not just sensitive code patterns, suggesting this isn’t standard secret detection
- Selective masking - only affects this specific file, all other files in project are readable
- Persistent issue - occurs regardless of scan scope (full project vs. isolated file)
- No corresponding issues - no Security Hotspots or vulnerabilities reported that would explain the masking
- Metrics visible - analysis metrics like Cyclomatic Complexity are calculated and displayed, but source visibility is blocked
Expected Behavior
The source code should be fully readable in the file viewer, showing all code lines (including comments) without masking, allowing me to analyze the cyclomatic complexity and other metrics.
Question
Is this expected behavior for a specific type of file content, or is there a configuration setting that’s causing this selective masking on a per-file basis? Why would comments also be censored if this were normal secret detection? How can I disable source code masking for files analyzed on a local SonarQube instance?
