# \#sast **URL:** https://community.sonarsource.com/tag/sast/246.md [Latest](https://community.sonarsource.com/latest.md) · [Categories](https://community.sonarsource.com/categories.md) · [Tags](https://community.sonarsource.com/tags.md) --- ## [🚀 A Major Leap Forward for JavaScript/TypeScript SAST!](https://community.sonarsource.com/t/a-major-leap-forward-for-javascript-typescript-sast/152408)
**Author:** [@Alexandre\_Gigleux](https://community.sonarsource.com/u/Alexandre_Gigleux)\ **Replies:** 1\ **Last updated:** [November 14, 2025, 7:40pm UTC](https://community.sonarsource.com/t/a-major-leap-forward-for-javascript-typescript-sast/152408 "2025-11-14T19:40:46Z")
Hello JavaScript & TypeScript Developers! We have some fantastic news to share. For the past few months, we’ve been rolling out our new-generation SAST analyzer for JavaScript and TypeScript (which we’ve nicknamed “Jasm… --- ## [Python SAST engine sinks config](https://community.sonarsource.com/t/python-sast-engine-sinks-config/145026)
**Author:** [@Victor\_Ciresica](https://community.sonarsource.com/u/Victor_Ciresica)\ **Replies:** 1\ **Last updated:** [August 21, 2025, 8:22am UTC](https://community.sonarsource.com/t/python-sast-engine-sinks-config/145026 "2025-08-21T08:22:23Z")
Hello, I am looking into the S3649 SQL Injection rule for python and while trying it out with the clickhouse-connect library I realized it does not work with this library’s methods. So I tried to set a custom configurat… --- ## [Software compositin analysis in SonarCloud/SonarQube](https://community.sonarsource.com/t/software-compositin-analysis-in-sonarcloud-sonarqube/73181)
**Author:** [@fabio.bazzani](https://community.sonarsource.com/u/fabio.bazzani)\ **Replies:** 2\ **Last updated:** [March 18, 2025, 2:27pm UTC](https://community.sonarsource.com/t/software-compositin-analysis-in-sonarcloud-sonarqube/73181 "2025-03-18T14:27:13Z")
Hello, I was looking for Software Composition Analysis in Sonarcloud. is there this capability? What in SonarQube using plugins? thanks, fabio --- ## [Sonar SAST Engine custom config](https://community.sonarsource.com/t/sonar-sast-engine-custom-config/132371)
**Author:** [@Victor\_Ciresica](https://community.sonarsource.com/u/Victor_Ciresica)\ **Replies:** 2\ **Last updated:** [December 19, 2024, 1:48pm UTC](https://community.sonarsource.com/t/sonar-sast-engine-custom-config/132371 "2024-12-19T13:48:39Z")
Hello, I am trying to write another custom configuration, for the Java Security Engine, for the jakarta.ws.rs.core.Response.seeOther method. I want to mark the method as a sink for the S5146 rule. I cannot figure out ho… --- ## [SonarCloud SAST security scan report](https://community.sonarsource.com/t/sonarcloud-sast-security-scan-report/107466)
**Author:** [@RtCode](https://community.sonarsource.com/u/RtCode)\ **Replies:** 2\ **Last updated:** [August 5, 2024, 2:48pm UTC](https://community.sonarsource.com/t/sonarcloud-sast-security-scan-report/107466 "2024-08-05T14:48:37Z")
Hello everyone, I’m interested in finding out if SonarCloud offers security reports alongside security hotspots. I found a post on the community forum mentioning that these reports weren’t available until 2021 (SAST RES… --- ## [How to avoid "High simulation costs for sink in" error](https://community.sonarsource.com/t/how-to-avoid-high-simulation-costs-for-sink-in-error/107841)
**Author:** [@tnoiret](https://community.sonarsource.com/u/tnoiret)\ **Replies:** 1\ **Last updated:** [January 24, 2024, 9:06pm UTC](https://community.sonarsource.com/t/how-to-avoid-high-simulation-costs-for-sink-in-error/107841 "2024-01-24T21:06:59Z")
Hi With latest SonarQube Enterprise 9.9.3 LTS version (same with previous 9.9 LTS), when i’m scanning my .net projects, on my azure pipeline i have some “INFO” line with “High simulation costs for sink in 'filepath.cs:l… --- ## [Java: 5 additional Injection Vulnerability detection rules (NoSQL, Thread Suspensions, Reflection, JSON, XML)](https://community.sonarsource.com/t/java-5-additional-injection-vulnerability-detection-rules-nosql-thread-suspensions-reflection-json-xml/58596)
**Author:** [@Alexandre\_Gigleux](https://community.sonarsource.com/u/Alexandre_Gigleux)\ **Replies:** 1\ **Last updated:** [May 11, 2023, 7:55am UTC](https://community.sonarsource.com/t/java-5-additional-injection-vulnerability-detection-rules-nosql-thread-suspensions-reflection-json-xml/58596 "2023-05-11T07:55:31Z")
Hello Java developers, We happy to announce you can now detect 5 additional vulnerability types coming on top of the 18 existing injection vulnerability detection rules. Here is the list of the 5 new rules: S5147: N… --- ## [Issues with SAST Custom Configuration](https://community.sonarsource.com/t/issues-with-sast-custom-configuration/88819)
**Author:** [@youngroman](https://community.sonarsource.com/u/youngroman)\ **Replies:** 1\ **Last updated:** [April 17, 2023, 7:14am UTC](https://community.sonarsource.com/t/issues-with-sast-custom-configuration/88819 "2023-04-17T07:14:53Z")
version: 9.9 Datacenter Edition (deployed as zip) I tried to add some SAST custom configurations based on this documentation: I try to add sources and sinks, which is working in most cases. But I have a few cases wher… --- ## [Spring RestController - java.util.Optional not recognized](https://community.sonarsource.com/t/spring-restcontroller-java-util-optional-not-recognized/88821)
**Author:** [@youngroman](https://community.sonarsource.com/u/youngroman)\ **Replies:** 1\ **Last updated:** [April 11, 2023, 1:53pm UTC](https://community.sonarsource.com/t/spring-restcontroller-java-util-optional-not-recognized/88821 "2023-04-11T13:53:08Z")
version: 9.9 Datacenter Edition (deployed as zip) When using java.util.Optional with Spring RestController, it is not recognized as tainted source. sample code: @RestController @RequestMapping("api/test") public class… --- ## [Can SonarQube detect code that used the Log4J2 in a way that is vulnerable?](https://community.sonarsource.com/t/can-sonarqube-detect-code-that-used-the-log4j2-in-a-way-that-is-vulnerable/54956)
**Author:** [@SteveM](https://community.sonarsource.com/u/SteveM)\ **Replies:** 3\ **Last updated:** [January 11, 2022, 4:27pm UTC](https://community.sonarsource.com/t/can-sonarqube-detect-code-that-used-the-log4j2-in-a-way-that-is-vulnerable/54956 "2022-01-11T16:27:44Z")
Can or could SonarQube detect code that uses Log4J in a way that is vulnerable? --- ## [APEX Code Coverage and Security Report](https://community.sonarsource.com/t/apex-code-coverage-and-security-report/51175)
**Author:** [@aworm](https://community.sonarsource.com/u/aworm)\ **Replies:** 1\ **Last updated:** [October 11, 2021, 7:38am UTC](https://community.sonarsource.com/t/apex-code-coverage-and-security-report/51175 "2021-10-11T07:38:23Z")
Must-share information (formatted with Markdown): which versions are you using (SonarQube Enterprise) Hi, I was tasked with evaluating SonarQube for an Apex SAST project. After reviewing the documentation on generati… --- ## [The security analyzer detects more vulnerabilities by making a clear distinction between Sanitizers and Validators](https://community.sonarsource.com/t/the-security-analyzer-detects-more-vulnerabilities-by-making-a-clear-distinction-between-sanitizers-and-validators/51151)
**Author:** [@Alexandre\_Gigleux](https://community.sonarsource.com/u/Alexandre_Gigleux)\ **Replies:** 0\ **Last updated:** [October 8, 2021, 2:05pm UTC](https://community.sonarsource.com/t/the-security-analyzer-detects-more-vulnerabilities-by-making-a-clear-distinction-between-sanitizers-and-validators/51151 "2021-10-08T14:05:28Z")
Hello SonarCloud users, The SAST engine for Java, C#, PHP, Python, JavaScript and TypeScript was improved to discard less True-Positive issues from being reported. Let’s take an example to illustrate the change which i… --- ## [The security analyzer runs faster than ever on SonarCloud 🚀](https://community.sonarsource.com/t/the-security-analyzer-runs-faster-than-ever-on-sonarcloud/49894)
**Author:** [@Alexandre\_Gigleux](https://community.sonarsource.com/u/Alexandre_Gigleux)\ **Replies:** 1\ **Last updated:** [September 24, 2021, 6:53am UTC](https://community.sonarsource.com/t/the-security-analyzer-runs-faster-than-ever-on-sonarcloud/49894 "2021-09-24T06:53:30Z")
Hello SonarCloud users, The SAST engine for Java, C#, PHP, Python, JavaScript and TypeScript you are using every day received a major update to run faster than ever. Even if the SonarCloud SAST engine is one of the fast… --- ## [SonarQube vs Checkmarx CxSAST](https://community.sonarsource.com/t/sonarqube-vs-checkmarx-cxsast/44553)
**Author:** [@Navin\_prasad](https://community.sonarsource.com/u/Navin_prasad)\ **Replies:** 1\ **Last updated:** [July 13, 2021, 6:33pm UTC](https://community.sonarsource.com/t/sonarqube-vs-checkmarx-cxsast/44553 "2021-07-13T18:33:20Z")
I have few questions regarding SAST. Could someone please clarify? What is the difference between SonarQube and Checkmarx CxSAST? what is the common thing between these two? At which situations SonarQube is preferred? --- ## [Blog post: Taking the angst out of SAST analysis](https://community.sonarsource.com/t/blog-post-taking-the-angst-out-of-sast-analysis/37088)
**Author:** [@ganncamp](https://community.sonarsource.com/u/ganncamp)\ **Replies:** 0\ **Last updated:** [January 15, 2021, 3:50pm UTC](https://community.sonarsource.com/t/blog-post-taking-the-angst-out-of-sast-analysis/37088 "2021-01-15T15:50:14Z")
Hi all, We’ve published a new blog post: In 2008 SonarSource upended the static analysis market for code quality and reliability. Today it’s doing it again for code security. When SonarSource was founded in 2008, … --- ## [Blog post: Code security: now there's a tool for developers](https://community.sonarsource.com/t/blog-post-code-security-now-theres-a-tool-for-developers/35856)
**Author:** [@ganncamp](https://community.sonarsource.com/u/ganncamp)\ **Replies:** 5\ **Last updated:** [January 6, 2021, 7:06pm UTC](https://community.sonarsource.com/t/blog-post-code-security-now-theres-a-tool-for-developers/35856 "2021-01-06T19:06:21Z")
Hi all, Our elves (please don’t tell them I called them that! :grinning\_face\_with\_smiling\_eyes:) have been hard at work all year to bring you one of the best holiday presents ever: Hey SonarQube and SonarCloud user… --- ## [Is there a list of PHP frameworks that are currently supported by SonarQube?](https://community.sonarsource.com/t/is-there-a-list-of-php-frameworks-that-are-currently-supported-by-sonarqube/36472)
**Author:** [@ohader](https://community.sonarsource.com/u/ohader)\ **Replies:** 1\ **Last updated:** [January 5, 2021, 1:50pm UTC](https://community.sonarsource.com/t/is-there-a-list-of-php-frameworks-that-are-currently-supported-by-sonarqube/36472 "2021-01-05T13:50:17Z")
Is there a list of frameworks that are currently supported by SonarSource & SonarCube (my personal interest is in PHP-related frameworks)? Besides that, is there a way in SonarSource (including paid plans as well) to de…