Third-party library scanning

SonarCloud
,
1

I understand that SonarCloud does not provide scan analysis for third-party tools.

I’m looking for some sort of statement that describes that is does not scan these.

Thanks

3

Hello,

I need you to clarify your question because there is a discrepancy between the title and the content.

Are you asking if SonarCloud can find problems related to dependencies such as if you are using a dependency that contains a vulnerability or if SonarCloud is able to load results from third-party linters?

The first use case, generally called SCA, is not supported by SonarCloud.
The second use case is supported and here is the documentation: External Analyzer Reports | SonarCloud Docs

Alex

4

@Alexandre_Gigleux,

Thank you for your reply.

To clarify: I am asking about SCA. Is there any posted documentation that SonarCloud does not support SCA?

5

Hi @antigravitygoat,

We support static analysis, including SAST. There are a lot of things we don’t support (E.G. IE 11 :wink:), but we don’t take the time to publish statements to that effect.

That said, what is supported is the import of external analyzer reports (as linked above) and of Generic Issue reports. Which means that you can run a SCA tool before analysis, translate the output into the Generic Issue format, and import that with analysis. But we won’t run the SCA scan for you.

 
HTH,
Ann

1 Like
6

Thank you. That looks like a plausible solution for me.

1 Like