# \#xml **URL:** https://community.sonarsource.com/tag/xml/19.md [Latest](https://community.sonarsource.com/latest.md) · [Categories](https://community.sonarsource.com/categories.md) · [Tags](https://community.sonarsource.com/tags.md) --- ## [Honor XML encoding declaration over sonar.sourceEncoding property](https://community.sonarsource.com/t/honor-xml-encoding-declaration-over-sonar-sourceencoding-property/63754)
**Author:** [@CrushaKRool](https://community.sonarsource.com/u/CrushaKRool)\ **Replies:** 1\ **Last updated:** [May 7, 2026, 9:43am UTC](https://community.sonarsource.com/t/honor-xml-encoding-declaration-over-sonar-sourceencoding-property/63754 "2026-05-07T09:43:24Z")
Running the Gradle Sonar Scanner for an 8.9 LTS SonarQube server, I noticed the following output in the console: Invalid character encountered in file /path/to/my/project/filename.xsl at line 136 for encoding UTF-8. Pl… --- ## [New to SonarQube : Guide me to create custom rules with SQ Community free edition](https://community.sonarsource.com/t/new-to-sonarqube-guide-me-to-create-custom-rules-with-sq-community-free-edition/138921)
**Author:** [@sniggy1990](https://community.sonarsource.com/u/sniggy1990)\ **Replies:** 5\ **Last updated:** [May 7, 2025, 12:07pm UTC](https://community.sonarsource.com/t/new-to-sonarqube-guide-me-to-create-custom-rules-with-sq-community-free-edition/138921 "2025-05-07T12:07:25Z")
Dear Team, I am a test automation engineer (java selenium), I want to use sonarqube community free edition for my test scripts review (Static code analysis to improve the code quality). Please guide me which version I n… --- ## [SonarQube for IDE: IntelliJ 10.21 - New help and feedback tab, new rules for Java, Kotlin and XML](https://community.sonarsource.com/t/sonarqube-for-ide-intellij-10-21-new-help-and-feedback-tab-new-rules-for-java-kotlin-and-xml/139177)
**Author:** [@Farah](https://community.sonarsource.com/u/Farah)\ **Replies:** 0\ **Last updated:** [April 23, 2025, 9:42am UTC](https://community.sonarsource.com/t/sonarqube-for-ide-intellij-10-21-new-help-and-feedback-tab-new-rules-for-java-kotlin-and-xml/139177 "2025-04-23T09:42:40Z")
Dear IntelliJ users, SonarQube for IDE: IntelliJ 10.21 is now available! In this version, discover the new ‘Help & Feedback’ tab to easily reach out to us through this community forum or suggest new ideas to the SonarQ… --- ## [Issue with SonarQube Not Detecting JMX Remote Authentication and SSL Settings](https://community.sonarsource.com/t/issue-with-sonarqube-not-detecting-jmx-remote-authentication-and-ssl-settings/134973)
**Author:** [@Bentom](https://community.sonarsource.com/u/Bentom)\ **Replies:** 1\ **Last updated:** [February 12, 2025, 9:49am UTC](https://community.sonarsource.com/t/issue-with-sonarqube-not-detecting-jmx-remote-authentication-and-ssl-settings/134973 "2025-02-12T09:49:04Z")
Dear SonarQube Community I am currently experiencing an issue with SonarQube where it does not seem to detect the following settings in the pom.xml file: com.sun.management.jmxremote.authenticate=false com.sun.manageme… --- ## [Error on parsing file .flow files](https://community.sonarsource.com/t/error-on-parsing-file-flow-files/132072)
**Author:** [@Aslan](https://community.sonarsource.com/u/Aslan)\ **Replies:** 4\ **Last updated:** [December 17, 2024, 2:06pm UTC](https://community.sonarsource.com/t/error-on-parsing-file-flow-files/132072 "2024-12-17T14:06:38Z")
Hello, I’m trying to scan the whole project containing different languages (html, css, js, xml, flow, dockerfiles). When running the SonarQubeAnalyze@7 task in Azure Pipeline, the analysis works correctly until it reac… --- ## [Plist files not detect and scanned in Sonar](https://community.sonarsource.com/t/plist-files-not-detect-and-scanned-in-sonar/131652)
**Author:** [@gabriel.linero](https://community.sonarsource.com/u/gabriel.linero)\ **Replies:** 4\ **Last updated:** [December 9, 2024, 2:28pm UTC](https://community.sonarsource.com/t/plist-files-not-detect-and-scanned-in-sonar/131652 "2024-12-09T14:28:31Z")
description of the Rule. I want to detect specific configuration in a plist file (that follows xml), which is basically specific for iOS applications. However, sonar does not take the plist file and onboard it in the … --- ## [Need to add Customized rules for mulesoft xml](https://community.sonarsource.com/t/need-to-add-customized-rules-for-mulesoft-xml/127266)
**Author:** [@PDhengale](https://community.sonarsource.com/u/PDhengale)\ **Replies:** 1\ **Last updated:** [October 4, 2024, 3:10pm UTC](https://community.sonarsource.com/t/need-to-add-customized-rules-for-mulesoft-xml/127266 "2024-10-04T15:10:48Z")
Hello Sonar team, I wanted to create customized rules for Mulesoft, Can you please suggest how could i proceed on that. --- ## [False positive security hotspots due to merged manifests](https://community.sonarsource.com/t/false-positive-security-hotspots-due-to-merged-manifests/114226)
**Author:** [@woodii](https://community.sonarsource.com/u/woodii)\ **Replies:** 1\ **Last updated:** [April 30, 2024, 3:29pm UTC](https://community.sonarsource.com/t/false-positive-security-hotspots-due-to-merged-manifests/114226 "2024-04-30T15:29:25Z")
What language is this for? XML / Android Project Which rule? xml:S5332 xml:S6358 Why do you believe it’s a false-positive/false-negative? Sonarqube does not respect merged manifests. Altough usesCleartextTraff… --- ## [Sonar does not analyze XML resources](https://community.sonarsource.com/t/sonar-does-not-analyze-xml-resources/110847)
**Author:** [@gatzka-swp](https://community.sonarsource.com/u/gatzka-swp)\ **Replies:** 5\ **Last updated:** [March 18, 2024, 3:48pm UTC](https://community.sonarsource.com/t/sonar-does-not-analyze-xml-resources/110847 "2024-03-18T15:48:55Z")
Sonar does not analyze XML resources This is how i set up my Java Gradle project. build.gradle src/main/resources/datasource.xml Analysis is performed via GitHub Actions In another project, there are some secre… --- ## [Why the built jar of sonar-xml plugin contains javax.xml.\* packages?](https://community.sonarsource.com/t/why-the-built-jar-of-sonar-xml-plugin-contains-javax-xml-packages/84357)
**Author:** [@sify21](https://community.sonarsource.com/u/sify21)\ **Replies:** 1\ **Last updated:** [March 11, 2024, 10:03am UTC](https://community.sonarsource.com/t/why-the-built-jar-of-sonar-xml-plugin-contains-javax-xml-packages/84357 "2024-03-11T10:03:00Z")
I built sonar-xml from source by its latest tag 2.7.0.3820 (mvn clean package), I found that the final jar sonar-xml-plugin-2.7.0-SNAPSHOT.jar contains classes for package javax.xml. Even more, I decompiled javax.xml.xpa… --- ## [SonarLint Eclipse / Java 1.8](https://community.sonarsource.com/t/sonarlint-eclipse-java-1-8/85014)
**Author:** [@gquerret](https://community.sonarsource.com/u/gquerret)\ **Replies:** 7\ **Last updated:** [February 22, 2024, 1:19pm UTC](https://community.sonarsource.com/t/sonarlint-eclipse-java-1-8/85014 "2024-02-22T13:19:26Z")
I’m trying to run SonarLint (6.2) on an old Eclipse instance with Java 1.8 (due to very old plugins), project bound to SonarQube Developer Edition 9.9. When analyzing file, I can see in the SonarLint log: Plugin 'HTML … --- ## [Problem with custom xml rule](https://community.sonarsource.com/t/problem-with-custom-xml-rule/102152)
**Author:** [@Alan\_Q](https://community.sonarsource.com/u/Alan_Q)\ **Replies:** 5\ **Last updated:** [October 11, 2023, 12:06pm UTC](https://community.sonarsource.com/t/problem-with-custom-xml-rule/102152 "2023-10-11T12:06:02Z")
Hi, i’m trying to make a rule in which the version of xpto.micronaut cannot be lower than 4.9.\*, however, the rule is not being applied. SonarQube version: 10.2.1 My custom rule: My project pom.xml: \ **Author:** [@AkhilRavula](https://community.sonarsource.com/u/AkhilRavula)\ **Replies:** 8\ **Last updated:** [August 15, 2023, 12:12pm UTC](https://community.sonarsource.com/t/sonarqube-doesnt-copy-analyze-xaml-files/96858 "2023-08-15T12:12:25Z") I am trying to create a build pipeline for a WPF solution .But .XAML files are ignored by sonarqube .I did add AdditionalAnalysisfiletypes parameter in build arguments as per other threads on this forum ,but it doesnt wo… --- ## [Feasibility of combining multiple rules of different languages](https://community.sonarsource.com/t/feasibility-of-combining-multiple-rules-of-different-languages/96753)
**Author:** [@niteesh22](https://community.sonarsource.com/u/niteesh22)\ **Replies:** 1\ **Last updated:** [August 4, 2023, 9:15am UTC](https://community.sonarsource.com/t/feasibility-of-combining-multiple-rules-of-different-languages/96753 "2023-08-04T09:15:49Z")
Hello Community, I’m a newbie here is that feasibility of combining two rules of different types in a same project. I have already written a rule inside the java plugin for one condition and was able to raise violation.… --- ## [SonarQube Trigger a rule check from another rule inside plugin](https://community.sonarsource.com/t/sonarqube-trigger-a-rule-check-from-another-rule-inside-plugin/96186)
**Author:** [@niteesh22](https://community.sonarsource.com/u/niteesh22)\ **Replies:** 11\ **Last updated:** [August 3, 2023, 9:47am UTC](https://community.sonarsource.com/t/sonarqube-trigger-a-rule-check-from-another-rule-inside-plugin/96186 "2023-08-03T09:47:49Z")
Hello Sonar Community, I am a newbie to sonar and using a java plugin(GitHub - I8C/sonar-flow-plugin: A sonarqube plugin to analyse webmethods flow code) to scan the potential bugs in a flow language. I was able to achi… --- ## [java:S2755: XML parsers should not be vulnerable to XXE attacks](https://community.sonarsource.com/t/java-xml-parsers-should-not-be-vulnerable-to-xxe-attacks/71239)
**Author:** [@anemonetea](https://community.sonarsource.com/u/anemonetea)\ **Replies:** 1\ **Last updated:** [June 20, 2023, 9:25pm UTC](https://community.sonarsource.com/t/java-xml-parsers-should-not-be-vulnerable-to-xxe-attacks/71239 "2023-06-20T21:25:59Z")
Our code is triggering java:S2755 but I think it’s a false positive. Here is the relevant piece of code: DocumentBuilderFactory factory = DocumentBuilderFactory.newInstance(); factory.setFeature(XMLConstants.FEATURE\_SE… --- ## [No discovery of xUnit python unittest results created via unittest-xml-reporting](https://community.sonarsource.com/t/no-discovery-of-xunit-python-unittest-results-created-via-unittest-xml-reporting/81570)
**Author:** [@Spen](https://community.sonarsource.com/u/Spen)\ **Replies:** 4\ **Last updated:** [March 19, 2023, 3:32pm UTC](https://community.sonarsource.com/t/no-discovery-of-xunit-python-unittest-results-created-via-unittest-xml-reporting/81570 "2023-03-19T15:32:49Z")
We are running python unit tests via the unittest-xml-reporting (aka xmlrunner) package. This outputs XML files in the xUnit format. Based on the docs, SonarCloud supports xUnit files by setting the option sonar.python… --- ## [Xpath expression for blocking missing \ node](https://community.sonarsource.com/t/xpath-expression-for-blocking-missing-scope-node/67900)
**Author:** [@ramarro123](https://community.sonarsource.com/u/ramarro123)\ **Replies:** 1\ **Last updated:** [March 2, 2023, 4:44pm UTC](https://community.sonarsource.com/t/xpath-expression-for-blocking-missing-scope-node/67900 "2023-03-02T16:44:23Z")
9.5 community block an xml (a pom) that doesn’t contain a certain tag via xpath template hello, i would like to create an xml template to match this situation \ \blabla\ … --- ## [The coverage of my project is not shown neither in sonarqube nor in sonarcloud it is 0%k](https://community.sonarsource.com/t/the-coverage-of-my-project-is-not-shown-neither-in-sonarqube-nor-in-sonarcloud-it-is-0-k/80588)
**Author:** [@Jeremy\_Roman](https://community.sonarsource.com/u/Jeremy_Roman)\ **Replies:** 3\ **Last updated:** [January 9, 2023, 8:09pm UTC](https://community.sonarsource.com/t/the-coverage-of-my-project-is-not-shown-neither-in-sonarqube-nor-in-sonarcloud-it-is-0-k/80588 "2023-01-09T20:09:20Z")
Hello everyone, I am trying to upload an example project to a local sonarqube (Version 9.4) and it shows me when uploading it that it does not have coverage, so I have investigated by looking at the log when uploading it… --- ## [S2068 "password" flagged in XML incorrectly](https://community.sonarsource.com/t/s2068-password-flagged-in-xml-incorrectly/79127)
**Author:** [@KevIRL](https://community.sonarsource.com/u/KevIRL)\ **Replies:** 5\ **Last updated:** [December 19, 2022, 4:24pm UTC](https://community.sonarsource.com/t/s2068-password-flagged-in-xml-incorrectly/79127 "2022-12-19T16:24:50Z")
Make sure to read this post before raising a thread here: Then tell us: What language is this for? XML Which rule? S2068 Why do you believe it’s a false-positive/false-negative? its flagging any instance of passwo… --- ## [XPath help to create custom rules for xml](https://community.sonarsource.com/t/xpath-help-to-create-custom-rules-for-xml/19183)
**Author:** [@Arjunkalikota](https://community.sonarsource.com/u/Arjunkalikota)\ **Replies:** 2\ **Last updated:** [November 27, 2022, 12:53am UTC](https://community.sonarsource.com/t/xpath-help-to-create-custom-rules-for-xml/19183 "2022-11-27T00:53:31Z")
Hello All, I am new to SonarQube tool and would like to use scan the couple of xml files (apigee proxy bundle). As part of this I would like perform custom checks in the xml files and for that I need to create custom ru… --- ## [When i check java project, i want to check xml files too](https://community.sonarsource.com/t/when-i-check-java-project-i-want-to-check-xml-files-too/68447)
**Author:** [@HAYOUNGCHOI](https://community.sonarsource.com/u/HAYOUNGCHOI)\ **Replies:** 1\ **Last updated:** [July 21, 2022, 9:23am UTC](https://community.sonarsource.com/t/when-i-check-java-project-i-want-to-check-xml-files-too/68447 "2022-07-21T09:23:32Z")
When i scan java project ( it is spring boot ) , i also want to check xml files too. The xml files are likes mapper.xml , setting.xml . And these xml files are located in /src/main/resources/\* . But when i scan the ja… --- ## [SonarLint for Eclipse 7.2 released - Automatic sync of SonarQube quality profiles](https://community.sonarsource.com/t/sonarlint-for-eclipse-7-2-released-automatic-sync-of-sonarqube-quality-profiles/57234)
**Author:** [@Marco\_Comi](https://community.sonarsource.com/u/Marco_Comi)\ **Replies:** 2\ **Last updated:** [July 21, 2022, 7:10am UTC](https://community.sonarsource.com/t/sonarlint-for-eclipse-7-2-released-automatic-sync-of-sonarqube-quality-profiles/57234 "2022-07-21T07:10:39Z")
Hello Eclipse users, As many of you use SonarQube or SonarCloud to analyze your projects, the SonarLint team at SonarSource is working to improve the integration between the products, so that it will be easier for you t… --- ## [Is java:S3373 in the wrong language?](https://community.sonarsource.com/t/is-java-s3373-in-the-wrong-language/67202)
**Author:** [@MisterPi](https://community.sonarsource.com/u/MisterPi)\ **Replies:** 1\ **Last updated:** [June 29, 2022, 4:02pm UTC](https://community.sonarsource.com/t/is-java-s3373-in-the-wrong-language/67202 "2022-06-29T16:02:41Z")
On SQ 8.6 Community, there’s a rule java:S3373 about forwards in an action, which is not on by default and not in Sonar way. When I experimentally turned it on, I got issues that seem to be exclusively on XML pages rela… --- ## [Sonarcloud not detecting the sourcefiles in the repo](https://community.sonarsource.com/t/sonarcloud-not-detecting-the-sourcefiles-in-the-repo/66901)
**Author:** [@kethireddysudhakar](https://community.sonarsource.com/u/kethireddysudhakar)\ **Replies:** 1\ **Last updated:** [June 24, 2022, 3:36pm UTC](https://community.sonarsource.com/t/sonarcloud-not-detecting-the-sourcefiles-in-the-repo/66901 "2022-06-24T15:36:51Z")
Template for a good new topic, formatted with Markdown: we are using Azure devops to intergatre the sonar cloud and everything is setup properly, it is mulesoft project, it includes xml, Raml files. and here is the co… --- ## [Can i write custom rule for xml file and properties file](https://community.sonarsource.com/t/can-i-write-custom-rule-for-xml-file-and-properties-file/63513)
**Author:** [@HAYOUNGCHOI](https://community.sonarsource.com/u/HAYOUNGCHOI)\ **Replies:** 1\ **Last updated:** [May 23, 2022, 7:07pm UTC](https://community.sonarsource.com/t/can-i-write-custom-rule-for-xml-file-and-properties-file/63513 "2022-05-23T19:07:03Z")
hi i want to make custom rule for xml file and properties file. Actually i have java project . In java project, i use xml file and properties file for the project properties. And i want to make custom rule for these f… --- ## [Detection of hardcoded credentials in .NET project web.config or app.config file](https://community.sonarsource.com/t/detection-of-hardcoded-credentials-in-net-project-web-config-or-app-config-file/59358)
**Author:** [@robatilho](https://community.sonarsource.com/u/robatilho)\ **Replies:** 1\ **Last updated:** [March 7, 2022, 7:35am UTC](https://community.sonarsource.com/t/detection-of-hardcoded-credentials-in-net-project-web-config-or-app-config-file/59358 "2022-03-07T07:35:48Z")
Hello, I’m wondering if there was ever any motion on this? Specifically the example I am dealing with is a traditional .NET project with a web.config or app.config file containing hardcoded credentials in database conn… --- ## [Security check for sensitive data stored as plain text in xml files](https://community.sonarsource.com/t/security-check-for-sensitive-data-stored-as-plain-text-in-xml-files/11250)
**Author:** [@bartek.wesolowski](https://community.sonarsource.com/u/bartek.wesolowski)\ **Replies:** 6\ **Last updated:** [July 17, 2019, 12:55pm UTC](https://community.sonarsource.com/t/security-check-for-sensitive-data-stored-as-plain-text-in-xml-files/11250 "2019-07-17T12:55:47Z")
Hi all! I am wondering whether it would be a good idea to add sonar check for xml (or any other properties file) that would ensure that no credentials/api tokens (secrets in general) are stored in our source control as … --- ## [SonarLint for IntelliJ 6.5 - XML analysis for all users, rules for insecure XML, PHP regexps](https://community.sonarsource.com/t/sonarlint-for-intellij-6-5-xml-analysis-for-all-users-rules-for-insecure-xml-php-regexps/58848)
**Author:** [@Marco\_Comi](https://community.sonarsource.com/u/Marco_Comi)\ **Replies:** 0\ **Last updated:** [February 23, 2022, 1:30pm UTC](https://community.sonarsource.com/t/sonarlint-for-intellij-6-5-xml-analysis-for-all-users-rules-for-insecure-xml-php-regexps/58848 "2022-02-23T13:30:46Z")
Hello, We’ve released a new version of SonarLint for IntelliJ-based IDEs that improves the stability and fixes a few bugs. This release also brings plenty of new functionality, here are a few highlights: In addition t… --- ## [SonarLint for Visual Studio Code 3.3 released - Automatic sync of SonarQube quality profiles](https://community.sonarsource.com/t/sonarlint-for-visual-studio-code-3-3-released-automatic-sync-of-sonarqube-quality-profiles/58103)
**Author:** [@Marco\_Comi](https://community.sonarsource.com/u/Marco_Comi)\ **Replies:** 0\ **Last updated:** [February 10, 2022, 3:16pm UTC](https://community.sonarsource.com/t/sonarlint-for-visual-studio-code-3-3-released-automatic-sync-of-sonarqube-quality-profiles/58103 "2022-02-10T15:16:27Z")
Hello VSCode users, As many of you use SonarQube or SonarCloud to analyze your projects, the SonarLint team at SonarSource is working to improve the integration between the products, so that it will be easier for you to… [Next page](https://community.sonarsource.com/tag/xml/19.md?match_all_tags=true&page=1&tags%5B%5D=xml)