Why doesn’t SonarQube detect taint analysis in WebGoat demo?

[emans (Eman)]

Hello SonarSource Support,

We are testing SonarQube Server Enterprise with the WebGoat project, specifically the taint analysis.

The two relevant files are:

• ProfileUploadBase.java (uses the user-controlled parameter directly in a File constructor)

• ProfileUploadFix.java (applies .replace("../", "") to the input before passing it along)

Expectation:
According to the Java security rules, I expected SonarQube to report a taint analysis issue ( rule S2083) for ProfileUploadBase.java. I also expected to see the taint flow in the UI (SOURCE → propagation → SINK).

Observation:

• No taint analysis issues are reported for these files (or any files in this repo) in our scan.

• I confirmed that rule javasecurity:S2083 is active in the Java Quality Profile assigned to the project (we are using the default Java profile) + I enabled the debug for scan and noticed this rule is active for Java.

Questions:

1. Is it expected that WebGoat repo don’t have any taint analysis in this demo?

2. Do we need to use Security Engine Custom Configuration in order to detect these flows, or should SonarQube detect them automatically?

3. Are there any additional configuration steps required to ensure taint analysis results (execution flows) are displayed in the UI?

Thanks,

[Loris (Loris Sierra)]

Hi @emans and welcome to these forums !

I specifically checked our coverage 3 months ago and we should be finding a lot of issues in that file. I’ll check it and come back to you

[Loris (Loris Sierra)]

I just scanned it and I can confirm SonarQube does detect the issues you are expecting:

My personal scanning config is the Maven one: SonarScanner for Maven | SonarQube Server Documentation

TLDR: I just run mvn clean verify sonar:sonar, with the relevant parameters to connect to your SQ instance.

To specifically search for the target files, I clicked here:

And then typed:

Once in the file, click here:

And all issues will appear.

You can also specifically search for one by clicking on the dot next to the sink line number: