Traceability for security hotspots

SonarQube
1

Must-share information (formatted with Markdown):

  • which versions are you using: Enterprise Edition Version 9.9 (build 65466)

  • how is SonarQube deployed: zip

  • what are you trying to achieve:
    I want to be able to see a history of security hotspots that have been fixed already. For example, a project recently was added to SonarQube and I get sent a link to a security hotspot and get asked to review if we need to address this via customer notification. But before i look at the link, the issue has been fixed by the project team. Now, opening SonarQubes hotspot link, I only get:
    image
    I have no way to see what the issue was about, nor a timeline how long the fix took etc…
    Is there any way I did not find, to view already fixed vulnerabilities & hotspots with their details? Since we are working for customers on project basis, I also might need this information if customer asks about billed hours, so I can show them the issues that have been fixed in these hours etc. Currently I have no reasoning to show.

2

Hi,

Do you see a ‘Fixed’ filter at the top of the left-hand column on the Security Hotspots page?

Selection_1142
Selection_11421608×653 93.8 KB

 
Ann

3

Yes but it doesn’t show any of the issues. Could it be that this is only showing something if the Status was changed to “Fixed” manually and not when SonarQube recognized the fix with the next Scan itself?

image
image963×434 6.78 KB

4

Hi,

I know fixed issues get cleaned out of the database after a set time. How old are the fixed Security Hotspots you’re expecting to see?

 
Ann

5

Not sure when it was created, probably last month. The PR that fixed it was merged 16 days ago.

6

Hi,

I’ve taken a closer look. The ‘Fixed’ status is awarded manually: someone marks it ‘fixed’ to indicate that a code change was made. But if the code that gave rise to the Security Hotspot is removed, it looks like they just go away with no subsequent ability to report on them.

 
Ann

8

Thank you.
That is unfortunately pretty inconsistent then and not really good for reporting, traceability etc.
Could this be reconsidered for future releases? I would expect a similar treatment like the manual Fixed status.

9

Hi,

In fact, it’s much the same as the manual Fixed status. It’s the issues in the equivalent to Closed status that get a different treatment.

And I’ve pinged the relevant Product Manager for consideration of this topic.

 
Ann

1 Like