I have a project configured in maven and the code analysis is done by SonarQube.

I am trying to configure SonarQube in the pom.xml file to exclude a few files from the code analysis. Those files can be identified by their class names, they contain the underscore character before the extension (they are metamodel classes). Below I give the part of the pom.xml file where I try to exclude them:

    &lt;plugin&gt;
    	&lt;groupId&gt;org.codehaus.mojo&lt;/groupId&gt;
    	&lt;artifactId&gt;sonar-maven-plugin&lt;/artifactId&gt;
    	&lt;version&gt;2.2&lt;/version&gt;
    	&lt;configuration&gt;
    		&lt;sonar.sources&gt;src/main/java&lt;/sonar.sources&gt;
    		&lt;sonar.exclusions&gt;file:**/src/main/java/**/*_.*&lt;/sonar.exclusions&gt;
    	&lt;/configuration&gt;
    &lt;/plugin&gt;

However, the above code does not work. Is there a way to configure SonarQube from my pom.xml file to ignore those files when analysing the source code?

Thank you in advance.


Configure Sonar to exclude files from Maven pom.xml

I really got an &#39;overflow&#39; trying to make these things to work together. I followed instruction from here: http://docs.sonarqube.org/display/PLUG/Android+Lint+Plugin and finally got a SonarQube 5.1.1 server with Android Lint plugin 1.1 installed. Then I configured my multi-module Gradle build to work with SonarQube plugin: see code fragment from root config below.

    plugins {
        id &#39;org.sonarqube&#39; version &#39;1.0&#39;
    }

    sonarqube {
        properties {

            property &#39;sonar.host.url&#39;, &#39;sonarqube-server:9000&#39;
            property &#39;sonar.jdbc.url&#39;, &#39;jdbc:mysql://sonarqube-db:3306/sonar?useUnicode=true&amp;amp;characterEncoding=utf8&#39;
            property &#39;sonar.jdbc.driverClassName&#39;, &#39;com.mysql.jdbc.Driver&#39;
            property &#39;sonar.jdbc.username&#39;, &#39;sonar&#39;
            property &#39;sonar.jdbc.password&#39;, &#39;sonar&#39;
            property &#39;sonar.sourceEncoding&#39;, &#39;UTF-8&#39;
            property &#39;sonar.login&#39;, &#39;admin&#39;
            property &#39;sonar.password&#39;, &#39;admin&#39;

            property &#39;sonar.profile&#39;, &#39;Android Lint&#39;

            property &#39;sonar.import_unknown_files&#39;, true
            property &#39;sonar.android.lint.report&#39;, &#39;build/outputs/lint-results.xml&#39;
        }
    }


And after that I ran `lint sonarqube`task to execute the analysis. As a result I got a bulk of Lint errors regarding &#39;retrolambda&#39; project (`java.lang.UnsupportedOperationException: Unknown ASTNode child: LambdaExpression`), which is quite normal, and `lint-results.xml` (accompanied with HTML version) files per each module containing descriptions of issues discovered. The report said that there were 8 errors and 434 warnings found. But things went wrong when sonarqube plugin tried to upload the results to SonarQube server. The log was full of &#39;Unable to find file&#39; and &#39;Unable to find rule&#39; messages. And when the processing was over, then there were no issues reported for my project on SonarQube server.

And I am wondering, what did went wrong? I checked the paths, and all files were there. I looked through all discussions I could reach, and it seems like my config is correct and I do everything right. Does anybody have any clue, what I missed and what needs to be checked? Any suggestions or ideas are welcome.

I will be also happy if there is a way to import lint data using external SonarQube Runner, since this tool seems to be more predictable and stable then a Gradle plugin.

Analyzing Android Project with Lint and SonarQube

I am struggling with an error with a multi-modules project, the struture is simple, it looks like this :

     root 
       module a
       module b
       module c
       pom.xml

After using the maven command line : `clean sonar:sonar deploy`

I have this error : 

&gt; Failed to execute goal
&gt; org.sonarsource.scanner.maven:sonar-maven-plugin:3.3.0.603:sonar
&gt; (default-cli) on project X : Please provide compiled classes of your
&gt; project with sonar.java.binaries property -&gt; [Help 1]

EDIT : Here is the structure of my `pom.xml`

    &lt;?xml version=&quot;1.0&quot; encoding=&quot;UTF-8&quot;?&gt;
    &lt;project
    	xmlns=&quot;http://maven.apache.org/POM/4.0.0&quot;
    	xmlns:xsi=&quot;http://www.w3.org/2001/XMLSchema-instance&quot;
    	xsi:schemaLocation=&quot;http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd&quot;&gt;
    	&lt;groupId&gt;groupeId&lt;/groupId&gt;
    	&lt;artifactId&gt;artifactId&lt;/artifactId&gt;
    	&lt;version&gt;version&lt;/version&gt;
    	&lt;packaging&gt;pom&lt;/packaging&gt;
    	&lt;name&gt;${project.artifactId}-parent&lt;/name&gt;
    	&lt;description&gt;description&lt;/description&gt;
    	&lt;build&gt;
    		&lt;plugins&gt;
    			&lt;plugin&gt;
    				&lt;groupId&gt;org.sonarsource.scanner.maven&lt;/groupId&gt;
    				&lt;artifactId&gt;sonar-maven-plugin&lt;/artifactId&gt;
    				&lt;version&gt;3.3.0.603&lt;/version&gt;
    			&lt;/plugin&gt;
    		&lt;/plugins&gt;
    	&lt;/build&gt;
    	&lt;modules&gt;
    		&lt;module&gt;module a&lt;/module&gt;
    		&lt;module&gt;module b&lt;/module&gt;
    		&lt;module&gt;module c&lt;/module&gt;
    	&lt;/modules&gt;
    &lt;/project&gt;

Please provide compiled classes of your project with sonar.java.binaries

Is it possible to turn off sonar ([www.sonarsource.org][1]) measurements for specific blocks of code, which one doesn&#39;t want to be measured?

An example is the &quot;Preserve Stack Trace&quot; warning which Findbugs outputs.  When leaving the server, I might well want to only pass the message back to the client, not including the actual exception which I just caught, if that exception is unknown to the client (because the client doesn&#39;t have the JAR in which that exception was contained for example).

  [1]: http://www.sonarsource.org

Turning Sonar off for certain code

I am trying to exclude a directory from being analyzed by Sonar. I have the following properties defined in my `sonar-project.properties` file:

    sonar.sources=src/java
    sonar.exclusions=src/java/test/****/*.java

The directory structure I have is:

    src/java/dig
    src/java/test/dig

When I run the sonar-runner I get the following info:

     INFO  - Excluded sources:
     INFO  -   src/java/test/**/*.java
     INFO  - Excluded tests:
     INFO  -   **/package-info.java

But when I check the result of the analysis all the packages inside the test directory are still there.

I just need to tell Sonar to not analyze the test directory and any packages inside it.


SonarQube Exclude a directory

I&#39;ve searched up and down the internet for this one. There&#39;s lots of half-answers out there, to do with Maven properties such as `${sonar.jacoco.reportPath}`, or `org.jacoco:jacoco-maven-plugin:prepare-agent` or setting `maven-surefire-plugin` `argLine` with `-javaagent`.

Some how, none of these answers, either on their own, or in combination, are producing what I&#39;m after:
A coverage report which shows a class as covered if it is used in tests higher up the stack, such as entities being used by DAOs, even though it was not fully covered by tests in its own module.

Is there a definitive config somewhere, to achieve this, please?


How to configure multi-module Maven + Sonar + JaCoCo to give merged coverage report?

I am getting this warning on Sonar. I want solution to remove this warning on Sonar Qube.

My class is like this :

    public class FilePathHelper {
    	private static String resourcesPath;
    	public static String getFilePath(HttpServletRequest request) {
    		if(resourcesPath == null) {
    			String serverpath = request.getSession().getServletContext().getRealPath(&quot;&quot;);				
    			resourcesPath = serverpath + &quot;/WEB-INF/classes/&quot;;	
    		}
    		return resourcesPath;		
    	}
    }

i want proper solution to remove this warning on sonar.

Hide Utility Class Constructor : Utility classes should not have a public or default constructor

We are working on a web project from scratch and are looking at the following static code analysis tools.

 - Conventions (Checkstyle)
 - Bad practices (PMD) 
 - Potential bugs (FindBugs)

The project is built on Maven. Instead of using multiple tools for the purpose, I was looking at a single flexible solution and came across SonarQube.

Is it true that we can achieve the results from Checkstyle, PMD and Findbugs with SonarQube? 

Is SonarQube Replacement for Checkstyle, PMD, FindBugs?

How exactly is sonarQube different from SonarLint ? SonarQube has a server associated with it and Sonar lint works more like a plugin. But what are their specific difference ? 

SonarQube And SonarLint difference

Does anyone know how to delete a project from a SonarQube server?

Thanks,
Ronen.

Delete a project from SonarQube

We in our organization are trying to implement a source code quality management tool. SonarQube is one such tool that we have come across, and it&#39;s quite full of features and is phenomenal. We want to compare it with its peers, if there are any, before we actually implement it. 

Are there any good contenders to Sonar&#39;s capabilities and features?

Are there any Quality Management tools other than SonarQube

I&#39;m using SonarQube for code quality control and suddenly builds that would otherwise pass can&#39;t be analyzed and fails. 

&gt; [INFO] [00:00:03.630] Analysing /mySuperProject/target/jacoco.exec -&gt;
&gt; java.io.IOException: Incompatible version 1007

When I invoke maven build with debug switch, this cause is revealed

    Caused by: java.io.IOException: Incompatible version 1007.
	at org.jacoco.core.data.ExecutionDataReader.readHeader(ExecutionDataReader.java:127)
	at org.jacoco.core.data.ExecutionDataReader.readBlock(ExecutionDataReader.java:107)
	at org.jacoco.core.data.ExecutionDataReader.read(ExecutionDataReader.java:87)
	at org.sonar.plugins.jacoco.AbstractAnalyzer.readExecutionData(AbstractAnalyzer.java:134)
	at org.sonar.plugins.jacoco.AbstractAnalyzer.analyse(AbstractAnalyzer.java:107)

While inspecting jacoco ExecutionDataReader, I found that exception is thrown from 

&lt;!-- language: lang-java --&gt;

	if (version != ExecutionDataWriter.FORMAT_VERSION) {
		throw new IOException(format(&quot;Incompatible version %x.&quot;,Integer.valueOf(version)));
	}

and from ExecutionDataWriter I&#39;ve found out 

&lt;!-- language: lang-java --&gt;

    /** File format version, will be incremented for each incompatible change. */
    public static final char FORMAT_VERSION = 0x1007;

What is this **incompatible change** and why does it happen?
Any ideas how to fix this challenge?


JaCoCo SonarQube incompatible version 1007

I am trying to run `Sonarqube` service using the following [helm chart](https://github.com/devopskube/devopskube/tree/master/charts/sonarqube).

So the set-up is like it starts a MySQL and Sonarqube service in the minikube cluster and Sonarqube service talks to the MySQL service to dump the data.

When I do `helm install` followed by `kubectl get pods` I see the `MySQL` pod status as `running`, but the `Sonarqube` pos status shows as `CreateContainerConfigError`. I reckon it has to do with the mounting volume thingy: [link](https://github.com/devopskube/devopskube/blob/master/charts/sonarqube/templates/deployment.yaml#L58). Although I am not quite sure how to fix it (pretty nnew to Kubernetes environment and till learning :) )




Pod status as `CreateContainerConfigError` in Minikube cluster

I was using [Sonar][1] to make my code cleaner, and it pointed out that I&#39;m using `new Integer(1)` instead of `Integer.valueOf(1)`. Because it seems that `valueOf` does not instantiate a new object so is more memory-friendly. How can `valueOf` not instantiate a new object? How does it work? Is this true for all integers?

  [1]: http://www.sonarsource.org


New Integer vs valueOf

I have a Sonar profile in Maven. Everything works fine except the code coverage metric. I want to make Sonar ignore some classes only for the code coverage metric. I have the following profile:

&lt;!-- language-all: xml --&gt;

    &lt;profile&gt;
        &lt;id&gt;sonar&lt;/id&gt;
        &lt;properties&gt;
            &lt;sonar.exclusions&gt;**/beans/jaxb/**&lt;/sonar.exclusions&gt;
        &lt;/properties&gt;
        &lt;build&gt;
            &lt;plugins&gt;
                &lt;plugin&gt;
                    &lt;groupId&gt;org.apache.maven.plugins&lt;/groupId&gt;
                    &lt;artifactId&gt;maven-surefire-plugin&lt;/artifactId&gt;
                    &lt;version&gt;${maven.surefire.plugin.version}&lt;/version&gt;
                    &lt;configuration&gt;
                        &lt;redirectTestOutputToFile&gt;true&lt;/redirectTestOutputToFile&gt;
                        &lt;excludes&gt;
                            &lt;exclude&gt;**/*Suite*.java&lt;/exclude&gt;
                            &lt;exclude&gt;**/*RemoteTest.java&lt;/exclude&gt;
                            &lt;exclude&gt;**/*SpringTest.java&lt;/exclude&gt;
                            &lt;exclude&gt;**/*CamelTest.java&lt;/exclude&gt;
                            &lt;exclude&gt;**/*FunctionalTest.java&lt;/exclude&gt;
                            &lt;exclude&gt;**/*IntegrationTest.java&lt;/exclude&gt;
                            &lt;exclude&gt;**/*DaoBeanTest.java&lt;/exclude&gt;
                        &lt;/excludes&gt;
                    &lt;/configuration&gt;
                &lt;/plugin&gt;                    
            &lt;/plugins&gt;
        &lt;/build&gt;
    &lt;/profile&gt;

Please help. I tried to add something like 

    &lt;exclude&gt;com/qwerty/dw/publisher/Main.class&lt;/exclude&gt;

but it didn&#39;t help

**UPDATE**

I have a correct Cobertura profile. I tried to add it to the Sonar profile, but still I have 53% instead about 95% like in the Cobertura profile

    &lt;profile&gt;
        &lt;id&gt;sonar&lt;/id&gt;
        &lt;properties&gt;
            &lt;sonar.exclusions&gt;**/beans/jaxb/**&lt;/sonar.exclusions&gt;
            &lt;sonar.core.codeCoveragePlugin&gt;cobertura&lt;/sonar.core.codeCoveragePlugin&gt;
        &lt;/properties&gt;
        &lt;build&gt;
            &lt;plugins&gt;
                &lt;plugin&gt;
                    &lt;groupId&gt;org.apache.maven.plugins&lt;/groupId&gt;
                    &lt;artifactId&gt;maven-surefire-plugin&lt;/artifactId&gt;
                    &lt;version&gt;${maven.surefire.plugin.version}&lt;/version&gt;
                    &lt;configuration&gt;
                        &lt;redirectTestOutputToFile&gt;true&lt;/redirectTestOutputToFile&gt;
                        &lt;excludes&gt;
                            &lt;exclude&gt;**/*Suite*.java&lt;/exclude&gt;
                            &lt;exclude&gt;**/*RemoteTest.java&lt;/exclude&gt;
                            &lt;exclude&gt;**/*SpringTest.java&lt;/exclude&gt;
                            &lt;exclude&gt;**/*CamelTest.java&lt;/exclude&gt;
                            &lt;exclude&gt;**/*FunctionalTest.java&lt;/exclude&gt;
                            &lt;exclude&gt;**/*IntegrationTest.java&lt;/exclude&gt;
                            &lt;exclude&gt;**/*DaoBeanTest.java&lt;/exclude&gt;
                        &lt;/excludes&gt;
                    &lt;/configuration&gt;
                &lt;/plugin&gt;
                &lt;plugin&gt;
                    &lt;groupId&gt;org.codehaus.mojo&lt;/groupId&gt;
                    &lt;artifactId&gt;cobertura-maven-plugin&lt;/artifactId&gt;
                    &lt;version&gt;${cobertura.maven.plugin.version}&lt;/version&gt;
                    &lt;configuration&gt;
                        &lt;instrumentation&gt;
                            &lt;excludes&gt;
                                &lt;exclude&gt;com/qwerty/dw/dao/*&lt;/exclude&gt;
                                &lt;exclude&gt;com/qwerty/dw/domain/*&lt;/exclude&gt;
                                &lt;exclude&gt;com/qwerty/dw/beans/**/*&lt;/exclude&gt;
                                &lt;exclude&gt;com/qwerty/dw/daemon/exception/*&lt;/exclude&gt;
                                &lt;exclude&gt;com/qwerty/dw/daemon/Main.class&lt;/exclude&gt;
                                &lt;exclude&gt;com/qwerty/dw/sink/Main.class&lt;/exclude&gt;
                                &lt;exclude&gt;com/qwerty/dw/publisher/Main.class&lt;/exclude&gt;
                                &lt;exclude&gt;com/qwerty/dw/publisher/dao/*&lt;/exclude&gt;
                                &lt;exclude&gt;com/qwerty/dw/publisher/domain/*&lt;/exclude&gt;
                            &lt;/excludes&gt;
                        &lt;/instrumentation&gt;
                        &lt;formats&gt;
                            &lt;format&gt;html&lt;/format&gt;
                        &lt;/formats&gt;
                        &lt;aggregate&gt;true&lt;/aggregate&gt;
                        &lt;check&gt;
                            &lt;haltOnFailure&gt;true&lt;/haltOnFailure&gt;
                            &lt;branchRate&gt;60&lt;/branchRate&gt;
                            &lt;lineRate&gt;60&lt;/lineRate&gt;
                            &lt;totalBranchRate&gt;60&lt;/totalBranchRate&gt;
                            &lt;totalLineRate&gt;60&lt;/totalLineRate&gt;
                        &lt;/check&gt;
                    &lt;/configuration&gt;
                    &lt;executions&gt;
                        &lt;execution&gt;
                            &lt;goals&gt;
                                &lt;goal&gt;clean&lt;/goal&gt;
                                &lt;goal&gt;check&lt;/goal&gt;
                            &lt;/goals&gt;
                        &lt;/execution&gt;
                    &lt;/executions&gt;
                &lt;/plugin&gt;
            &lt;/plugins&gt;
        &lt;/build&gt;
    &lt;/profile&gt;

How to make Sonar ignore some classes for codeCoverage metric?

I am having issues with sonar picking up the jacoco analysis report. Jenkins however is able to pick up the report and display the results.
My project is a maven build, built by Jenkins. The jacoco report is generated by maven (configured in the pom). Sonar is executed by using the Jenkins plugin.

This is what I see on SonarQube:

![SonarQube Screen Capture][1]

This is the report i can see of the project in jenkins.

![Jacoco report in Jenkins][2]

The maven plugin config:

&lt;!-- language: xml --&gt;

    &lt;plugin&gt;
        &lt;groupId&gt;org.jacoco&lt;/groupId&gt;
        &lt;artifactId&gt;jacoco-maven-plugin&lt;/artifactId&gt;
        &lt;version&gt;0.6.4.201312101107&lt;/version&gt;
        &lt;executions&gt;
          &lt;execution&gt;
            &lt;id&gt;default-prepare-agent&lt;/id&gt;
            &lt;goals&gt;
                &lt;goal&gt;prepare-agent&lt;/goal&gt;
            &lt;/goals&gt;
          &lt;/execution&gt;
          &lt;execution&gt;
            &lt;id&gt;default-report&lt;/id&gt;
            &lt;phase&gt;prepare-package&lt;/phase&gt;
            &lt;goals&gt;
                &lt;goal&gt;report&lt;/goal&gt;
            &lt;/goals&gt;
          &lt;/execution&gt;
          &lt;execution&gt;
              &lt;id&gt;default-check&lt;/id&gt;
              &lt;goals&gt;
                  &lt;goal&gt;check&lt;/goal&gt;
              &lt;/goals&gt;
          &lt;/execution&gt;
        &lt;/executions&gt;
    &lt;/plugin&gt;




Jenkins Sonar Plugin config
![enter image description here][3]


  [1]: http://i.stack.imgur.com/r8aYd.png
  [2]: http://i.stack.imgur.com/XRGda.png
  [3]: http://i.stack.imgur.com/C3HuP.png

SonarQube not picking up Unit Test Coverage

I saw a StackOverflow question regarding static analysis in Scala, but that  one was answered in 2009. As you know, the Scala tools are changing very rapidly. 

I was therefore wondering if someone familiar with the current state of static analysis tools in Scala could tell me if there&#39;s, say, a Findbugs equivalent for Scala. I found that Findbugs issues many unnecessary warnings for Scala, probably having to do with the way the &quot;object&quot; singleton compiles to bytecode, due to traits, etc. I heard that Scalastyle is not only a Scala version of Java&#39;s CheckStyle, that it also includes bits of Findbugs and PMD. But if it doesn&#39;t implement all of Findbugs and/or PMD, then are there other tools that supplement it? Or, is Scalastyle good not only for style checking, but is it good for improving code quality?

Also, what about Scala&#39;s integration with, say, Sonar? Is the Scala Sonar plugin (which works with Scalastyle) reliable?

 

What&#39;s the current state of static analysis tools for Scala?

There is a Sonar Violation:

**Sonar Violation: Security - Array is stored directly**

    public void setMyArray(String[] myArray) { 
      this.myArray = myArray; 
    } 

**Solution:**

    public void setMyArray(String[] newMyArray) { 
      if(newMyArray == null) { 
        this.myArray = new String[0]; 
      } else { 
       this.myArray = Arrays.copyOf(newMyArray, newMyArray.length); 
      } 
    }

But I wonder why ?

Sonar Violation: Security - Array is stored directly

I have a Maven web project in my repo.  

I am a Maven noob but still I understand the fact that there are plugins which we need to configure only then we could run plugin specific commands.

**Facts:**

I have a sonar server running on my local machine at port 9000.

I have not added any sonar specific plugin in my POM.xml

**Reference:**

http://www.sonarsource.org/we-had-a-dream-mvn-sonarsonar/

**Observation:**

But still when I run `mvn sonar:sonar` in my project from command line it works fine.

Matter of the fact is **I have NOT configured sonar plugin in my POM.xml Even then from where the hell Maven is picking up and understanding &quot;sonar:sonar&quot; goal/command?**

**Question / curiosity:**

I don&#39;t want the working knowledge of sonar itself. I want to know why `mvn sonar:sonar` works without configuring a sonar plugin in my pom.xml

WHY and how?

All Sonarqube Solutions on Gang of Coders

Total of 19 Sonarqube Solutions