Vulnerability false positive for Blob Storage Emulator account key

[AlanKlaassen]

For Azure Storage account key rule here:
https://sonar.prod.thomsonreuters.com/coding_rules?open=secrets%3AS6338&rule_key=secrets%3AS6338

There is a false positive trigger on Blob Storage Emulator storage account key. Our unit testing code hard codes in the blob storage emulator account key, but these are publicly available credentials that are used to connect to a locally running emulator so it is not a security threat. I would suggest putting in an exception to the rule for this specific account key so that it doesn’t trigger the vulnerability scanner.

Additional information about the emulator storage account including the account key: Use the Azure Storage Emulator for development and testing (deprecated) | Microsoft Learn
Use Azurite emulator for local Azure Storage development | Microsoft Learn

[Colin]

Hey there!

I don’t have access to your SonarQube instance. Can you please post the information requested in this post?

How to Report a False-positive / False-negative

Hey SonarSource Community! False-positives happen, as do false-negatives, and we’re eager to fix them. We are thrilled when our users report problems, so we can make our products better. What is a false-positive (FP)? A false-positive is when an issue is raised unexpectedly on code that should not trigger an issue, or where the suggested action doesn’t make any sense for the code. What is a false-negative (FN)? A false-negative is when an issue should be raised on a piece of code, but isn’t…

Specifically a self-contained snippet of code that produces the false-positive, and what version of SonarQube you’re using.

[AlanKlaassen]

I had to register with my personal email because I couldn’t login to the forum with SAML. Here is the code snippet that triggers the vulnerability scanner:

   private const string StorageAccountName = "devstoreaccount1";
   private const string EmulatorHostName = "http://127.0.0.1:10000";
   private const string AccountKey = "Eby8vdM02xNOcqFlqUwJPLlmEtlCDXJ1OUzFT50uSRZ6IFsuFq2UVErCz4I6tq/K1SZFPTOtr/KBHBeksoGMGw==";

[AlanKlaassen]

It also might be worth noting that I can’t actually override the policy or mark it as a false positive on our scan, which is frustrating. I don’t know if this is just how our SonarQube instance is setup, I lack the permissions, or if it is something specific to this policy.

[AlanKlaassen]

It looks like the version that we are using is SonarQube 9.9 LTS.

[Colin]

Thanks.

• Good news, we now account for this key so we don’t raise an issue (as of August 2023) and is included in the latest version of SonarQube, v10.2
• A user with Administer Issues permission on the project can mark the issue as a false-positive.