Vulnerabilities report from API

[rcrook (robert crook)]

I was informed that I could use Web API to extract vulnerability issues within SonarQube and was wondering fi someone can be very detailed on how to go about doing this.

The previous version of SonarQube we had was 7.9.1 before it upgraded to the 8.1 which had the export CSV feature. The reason I am asking is because this was a significant part that we used regularly when it comes to reporting on the issues (unresolved vulnerabilities) via running the CSV report through Vulnerator to produce a POA&M for our government client. Then we create a mitigation for the vulnerabilities. Any help would be greatly appreciated.

[Rebse (Gilbert Rebhan)]

Welcome

using Sonarqube for some years now, i never used an export csv feature.
Is this a builtin function or provided by a plugin ?

Using the Sonarqube web api means
you write a script or use curl to call the relevant endpoints
you get the json in response
then it’s usual json parsing and creating the content (csv, pdf …)
see this threads for some snippets using Groovy

Liste of issue for a rule with WEB API

Hi, it’s json parsing as usual. First you’ll have to get the json by web api call, then you’ll need to parse it. My generic Groovy snippet for Sonarqube web api calls is like that: import groovy.json.* def sonarRest(url,method,usertoken) { jsonSlurper = new JsonSlurper() raw = usertoken + ':' bauth = 'Basic ' + javax.xml.bind.DatatypeConverter.printBase64Binary(raw.getBytes()) conn = new URL(url).openConnection() as HttpURLConnection conn.setRequestMethod(method) conn.setRequest…

AD groups configuration

Hi, you take the total count of groups from json response and use in a loop. Here’s an example using Groovy printing the group name. import groovy.json.* def sonarRest(url,method) { jsonSlurper = new JsonSlurper() raw = 'someusertoken:' bauth = 'Basic ' + javax.xml.bind.DatatypeConverter.printBase64Binary(raw.getBytes()) conn = new URL(url).openConnection() as HttpURLConnection conn.setRequestMethod(method) conn.setRequestProperty("Authorization", bauth) conn.connect() httpst…

Sonar REST api call from Jenkins pipeline

Hi, is your sonarAuthToken base64 encoded, and does it end with the separator : ? Here is my groovy snippet for such cases and it works fine: import groovy.json.* def sonarRest(url,method) { jsonSlurper = new JsonSlurper() raw = 'your u s e r t o k e n:' bauth = 'Basic ' + javax.xml.bind.DatatypeConverter.printBase64Binary(raw.getBytes()) conn = new URL(url).openConnection() as HttpURLConnection conn.setRequestMethod(method) conn.setRequestProperty("Authorization", bauth) conn.…

Otherwise there are plugins:

Free (works only with Sonarqube 7)

GitHub - cnescatlab/sonar-cnes-report: Generates analysis reports from...

great potential, unfortunately it’s not ready yet
see this thread for details

[First release] cnesreport 3.0.1

Hello every one, we would like to submit you a new plugin we have developed for SonarQube. Here come required information: Short description: CNES app/plugin for SonarQube that allows users to export analysis reports as OpenXML, Markdown and CSV. SonarQube compatibility: 6.7LTS & 7.9LTS SonarCloud project: https://sonarcloud.io/dashboard?id=fr.cnes.sonar%3Acnesreport Pull Request: https://github.com/SonarSource/sonar-update-center-properties/pull/39 It is the first release of the plugin, so…

$
the Governance plugin by Sonarsource, available with Enterprise edition and higher

PDF reports

Finally it maybe even possible to use Excel > Data from web > Sonarqube url to produce
some csv

Gilbert