work-around for issue #55 #61
Merged
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
use dependency-check-report.xml as inputFile dependency-check-report.xml has an entry for each vulnerability, which can be referenced by line, thus avoiding the shuffling problem.
|
@sschober Apologies for the delay. Big thanks for the PR. |
Closed
|
I'm not sure this is the "proper" fix. Now all my Maven projects only throw warnings in the style of: and no issues are reported anymore :( |
|
Hm, besides the typo that message means your dependency-check-report.xml cannot be found. |
|
But that should be impossible at that point, since it has been found before to iterate the dependencies... |
|
Is it possible that this only works if the user manually adds the report XML as an input file to the SonarQube analysis? |
|
@TobiX - I just ran into the same issue and yes, the report XML file needs to be inside a path defined by the sonar.sources property. |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
This is just a proof-of-concept implementation, meant to support my supposition: it indicates, that issue #55 is caused by invalid comparison strategies in SonarQube.
This work-around solution uses dependency-check-report.xml as input component to report the issues on. That way there is a sensible line number that can be attached to each issue, thus circumventing the sorting issue.