Open CameronGo opened 3 weeks ago
Shall this be an evolution of the actual sonarqube output format they are very close but some fields are moved or shall there be a sonarqube-external-issues format ?
I sought clarification on the changes in the file spec from Sonar and got some additional info. Here’s an example of an issue in the deprecated format of the report:
{
"issues": [
{
"engineId": "gosec",
"ruleId": "G101",
"primaryLocation": {
"message": "Potential hardcoded credentials",
"filePath": "/home/stevanvanderwerf/code/learn-go-with-tests/arrays/v1/sum.go",
"textRange": {
"startLine": 2,
"endLine": 2
}
},
"type": "VULNERABILITY",
"severity": "BLOCKER",
"effortMinutes": 5
}
]
}
The current format would look like this:
{
"rules": [
{
"id": "G101",
"name": "G101",
"engineId": "gosec",
"cleanCodeAttribute": "TRUSTWORTHY",
"impacts": [
{
"softwareQuality": "SECURITY",
"severity": "HIGH"
}
]
}
],
"issues": [
{
"ruleId": "G101",
"effortMinutes": 5,
"primaryLocation": {
"message": "Potential hardcoded credentials",
"filePath": "/home/stevanvanderwerf/code/learn-go-with-tests/arrays/v1/sum.go",
"textRange": {
"startLine": 2,
"endLine": 2
}
}
}
]
}
In the new format you can see that I’ve selected SECURITY as the SoftwareQuality impact. For reference: https://docs.sonarsource.com/sonarcloud/enriching/generic-issue-data/
Additionally, to see the differences between the deprecated format and current format of the Generic Issue Reports, you can also reference them in SonarQube: https://docs.sonarsource.com/sonarqube/9.9/analyzing-source-code/importing-external-issues/generic-issue-import-format/
Summary
When Sonarqube ingests the gosec output file, generated sonarqube format, a warning is displayed indicating that the file has deprecated fields which will not be supported in the future.
Steps to reproduce the behavior
Run gosec on the project with these parameters:
gosec -fmt=sonarqube -out=.testreports/gosec-report.json ./... ;
Then run sonar scanner CLI with the following parameter in the config file:
sonar.externalIssuesReportPaths=.testreports/gosec-report.json
gosec version
Using the docker container, which reports the following:
Go version (output of 'go version')
v1.23.0
Operating system / Environment
Linux
Expected behavior
Analysis of gosec report to complete without errors or warnings.
Actual behavior
The following warning is displayed: