The problem about importing external issues to SonarQube (8.3.1)

SonarQube
,
1

Dear All,

I am trying to import Fortify produced external issues to SonarQube.

I am using the following items for this;

Fortify SSC 20.2 (it is integrated with AzureDevops 2019)

Fortify Vulnerability Exporter 1.1.0

AzureDevops 2019 On-Prem

SonarScanner for AzureDevops 4.18

SonarQube Community Edition 8.3.1 (it is integrated with AzureDevops 2019).

Windows 2016 Server for Fortify SSC

Windows 2016 Server for SonarQube Community Edition

.NET Web Project (4.6+)

  1. I am doing a Fortify scan with Azure DevOps and Fortify SSC integration

  2. The scan result (FPR file) is uploading to Fortify SSC automatically

  3. I am getting an export from Fortify SSC through Fortify Vulnerability Exporter (with Generic Issue Import Format)

  4. I am trying to import Generic Issue Import Formatted File (Json file) to SonarQube through SonarScanner for AzureDevops. I added 3 additional parameters on SonarScanner for AzureDevops

sonar.externalIssuesReportPaths=E:\Fortify\FortifyVulnerabilityExporter\sq-fortify-sast.json

sonar.cs.roslyn.ignoreIssues=true (I tried without this also but there was no change)

sonar.verbose=true

  1. I am encountering 2 problems

5.1. There are no issues imported (External issues ignored for 441 unknown files, including…)

2021-03-16T10:22:10.2220504Z 13:22:10.210 DEBUG: Importing issues from ‘E:\Fortify\FortifyVulnerabilityExporter\sq-fortify-sast.json’

2021-03-16T10:22:10.2654950Z 13:22:10.257 INFO: Imported 0 issues in 0 files

2021-03-16T10:22:10.2670160Z 13:22:10.257 INFO: External issues ignored for 441 unknown files, including: Agents/vbc/a0/_work/1/s/Source/………

5.2. I noticed that it seems a path problem (Agents/vbc/a0/_work/1/s/Source/………) and replaced the path with full path (E:/Agents/vbc/a0/_work/1/s/Source/………) in the external issues json file.

5.3. After that changing the problem is also changed. It seems working on the beginning. But it is getting an error and fail the task.

Error_Log.txt (17.3 KB)

Do you have any comments on this?

2

Hi,

There are a couple noteworthy things here. Primarily this:

in 0 files

Issues in SonarQube are attached to files (and okay, sometime directories or projects. But generally files). Your external issues report is trying to attach issues to 441 files that the main part of the analysis simply isn’t finding.

You need to make sure you’re analyzing the files that the Fortify report relates to.

 
Ann

3

Hi Ann,
Thank you so much for your interest and prompt answer.
You are completely right, therefore I noticed that it seems a path problem and replaced the path with full path (E:/Agents/vbc/a0/_work/1/s/Source/………) in the external issues json file.
After that, the problem is also changed. Did you have a chance to see Error_Log.txt file

2021-03-17T09:08:00.6088305Z 12:08:00.604 DEBUG: Importing issues from ‘E:\Fortify\FortifyVulnerabilityExporter\sq-fortify-sast.json’

2021-03-17T09:08:00.7218217Z 12:08:00.714 INFO: Imported 13 issues in 4 files

It seems working on the beginning. But it is getting an error and fails the task. I didn’t paste all logs to the chat due to the much more information in the logs. You can see the latest situation in the Error_Logs.txt file, there are more details.

Kind Regards
Muhyid

4

Hi Muhyid,

You say the error has changed. That makes me wonder whether that file is still valid. Nonetheless, I see this. A lot:

##[error]java.lang.IllegalArgumentException: 0 is not a valid line for a file

Off-hand it looks like Fortify isn’t providing you with a valid input document. I think I’m going to have to point you back at them to diagnose their output.

 
:woman_shrugging:
Ann

5

Hi Ann,
I couldn’t recognize the “0 is not a valid line for a file” error therefore I am trying to clarify the error is coming from the SonarQube import process or external issues JSON file. I will be looking deeply at Fortify’s external issues export process.
Thanks for your help

6

Hi,

The error is coming from trying to import an apparently invalid file.

 
HTH,
Ann