Thymeleaf templates are not indexed : you may want to add “src/main/resources” in the scanned files

SonarQube Cloud
, , , ,
1

The following issue is being reported in SonarCloud:

Some thymeleaf templates are not indexed : you may want to add “src/main/resources” in the scanned files of this project to detect java XSS vulnerabilities

We are using Azure DevOps with the SonarCloudPrepare and SonarCloudPublish tasks and can’t see anywhere where we would configure the scanner to include the resources folder. Can anyone hep with this please?

Thanks, Andy.

2

Anyone?

3

Resolved myself.For anyone else simply add:-

<sonar.sources>src/main/java,src/main/resources/templates</sonar.sources>

to your POM.

4

Hello,

For reference, here is the entry related to your question in the SonarCloud’s documentation: https://sonarcloud.io/documentation/analysis/languages/java/#analysing-jsp-and-thymeleaf-for-xss-vulnerabilities

Alex

5

@Alexandre_Gigleux That link does exist anymore. Is that the new link: Java | SonarCloud Docs ?

6

Hey @kistlers

Yes, that’s the new link.

7

This topic was automatically closed 7 days after the last reply. New replies are no longer allowed.