mechero / code-quality-game

A simple, gamified way to improve code quality using SonarQube.
https://quboo.tpd.io
GNU Affero General Public License v3.0
66 stars 26 forks source link

some closed issues have no closeDate #21

Closed at3560k closed 4 years ago

at3560k commented 4 years ago

Sorry if this is a bit hurried, but I think it's sufficient to identify the root problem.

/src/main/java/com/thepracticaldeveloper/devgame/modules/stats/service/ScoreCardServiceImpl.java

can throw an NPE when filtering on getClosedDate()

        final Set<Issue> issuesFilteredByLegacyDate = fixedIssues.stream()
                .filter(i -> IssueDateFormatter.format(i.getCreationDate())
                        .isBefore(legacyDate))
                .filter(i -> IssueDateFormatter.format(i.getCloseDate())
                        .isAfter(campaignStartDate))
                .collect(Collectors.toSet());

When encountering a data structure containing a record like:

{
  "key": "AW72GI5CFw3lvOQ95If8",
  "rule": "python:S4721",
  "component": "test_code:a/b/sniff.py",
  "project": "test_project",
  "line": 31,
  "hash": "dcd2b55435d5198bf2dc023f79fd5b14",
  "textRange": {
    "startLine": 31,
    "endLine": 31,
    "startOffset": 15,
    "endOffset": 39
  },
  "flows": [],
  "resolution": "FIXED",
  "status": "REVIEWED",
  "message": "Make sure that executing this OS command is safe here.",
  "effort": "30min",
  "debt": "30min",
  "assignee": "redacted",
  "tags": [
    "cwe",
    "owasp-a1",
    "sans-top25-insecure"
  ],
  "creationDate": "2019-12-11T17:53:40+0000",
  "updateDate": "2019-12-11T20:54:11+0000",
  "type": "SECURITY_HOTSPOT",
  "organization": "default-organization",
  "fromHotspot": true
}

Note -- the issue is fixed, reviewed, and closed out, but there's no closedDate. I speculate because the code in question was fixed by deleting a file that should never have been present anyway, and it showed up in the query that was issued to sonarqube.

This crashed the service and caused no cards to render.

mechero commented 4 years ago

Thanks for reporting it! Should be fixed now, I'll release a new docker image for the backend, version 1.2.0: https://hub.docker.com/repository/docker/mechero/quboo-backend

at3560k commented 4 years ago

Thanks for the fix!