search

OtherDevOpsGene / zap-sonar-plugin

Integrates OWASP Zed Attack Proxy reports into SonarQube
GNU General Public License v3.0
69 stars 31 forks source link

Sonarqube 7.3 support #41

Closed pethers closed 5 years ago

pethers commented 6 years ago

https://github.com/Coveros/zap-sonar-plugin/issues/40

still work in progress.

pethers commented 6 years ago

Working example https://www.hack23.com/sonar/project/issues?id=com.hack23.cia%3Acia-all&resolved=false&types=VULNERABILITY

pethers commented 6 years ago

Security reports https://www.hack23.com/sonar/project/security_reports/owasp_top_10?id=com.hack23.cia%3Acia-all , wip.

dhartford commented 5 years ago

Just checking in if this was about to get updated, but possible forgotten.

Usecase: Moving from Sonarqube LTS to Sonarqube 7.x in order to automate the webhook setup to check the quality gate within jenkins. Unfortunately, the ZAP plugin with sonarqube not working on 7.x is a barrier as we really, really like it!!

pethers commented 5 years ago

@dhartford you can always build the branch pethers:develop, tested with sonarqube 7.3 -> 7.7 and works well. Had no response on this issue and considered to fork the project and create a release, but would prefer not to.

dhartford commented 5 years ago

@pethers if the only issue is that potentially unused variable, can you either remove it or use it in the constructor so it has a value (or is there a way to exclude src/test/java from that scan...I'm assuming not as it probably is intentional).

sonar-zap-plugin/src/test/java/org/sonar/zaproxy/parser/ZapSensorTest.java

Perhaps 'sensorContext' could be replaced by a local variable. private SensorContext sensorContext;

OtherDevOpsGene commented 5 years ago

Merging into develop so I can delete the branch and switch to GitHub Flow. Keeping the changes.