概述
我使用SonarQube 7.4.0.18908来收集代码覆盖率，并为Python 3.6项目执行静态代码分析。服务器正在AWS中运行。事情正在按预期进行(见下面的屏幕截图)。
现在我想为该项目添加安全扫描。我"选择"了Bandit，但实际上这似乎是目前唯一一个与SonarQube for Python集成的工具，如导入Bandit问题报告中所述。SonarPython插件支持安装在SonarQube服务器上的Bandit分析。为了在本地生成漏洞报告，我使用了Bandit 1.5.1 pip3模块。
问题
漏洞报告没有显示，甚至可能没有上传到SonarQube(见下面的同一屏幕截图)。
复制步骤
我在项目的sonar-project.properties文件中添加了这一行：
sonar.python.bandit.reportPaths=bandit-report.json
然后我运行了报告：
pip3 install bandit==1.5.1
bandit --format json --output bandit-report.json --recursive src
我验证了bandit-report.json包含正确的数据：
{
"errors": [],
"generated_at": "2019-01-30T14:49:18Z",
"metrics": {
...
"results": [
{
"code": "8 def prepare_df_for_comparison(df, name, ignore_columns=None, sort_columns=None):n9 assert df is not Nonen10 n11 # upper-case all columnsn12 df.columns = [x.upper() for x in df.columns]n",
"filename": "./build/lib/tasks/compare_df.py",
"issue_confidence": "HIGH",
"issue_severity": "LOW",
"issue_text": "Use of assert detected. The enclosed code will be removed when compiling to optimised byte code.",
...
然后我在SonarQube:上发表了
sonar-scanner
扫描仪的输出：
INFO: Scanner configuration file: NONE
INFO: Project root configuration file: /root_dir/sonar-project.properties
INFO: SonarQube Scanner 3.2.0.1227
INFO: Java 1.8.0_191 Oracle Corporation (64-bit)
INFO: Linux 4.9.125-linuxkit amd64
INFO: User cache: /root/.sonar/cache
INFO: SonarQube server 7.4.0
INFO: Default locale: "en_US", source code encoding: "UTF-8" (analysis is platform dependent)
INFO: Publish mode
INFO: Load global settings
INFO: Load global settings (done) | time=126ms
INFO: Server id: <snip>
INFO: User cache: /root/.sonar/cache
INFO: Load/download plugins
INFO: Load plugins index
INFO: Load plugins index (done) | time=102ms
INFO: Load/download plugins (done) | time=130ms
INFO: Loaded core extensions:
INFO: Process project properties
INFO: Load project repositories
INFO: Load project repositories (done) | time=84ms
INFO: Load quality profiles
INFO: Load quality profiles (done) | time=33ms
INFO: Load active rules
INFO: Load active rules (done) | time=554ms
INFO: Load metrics repository
INFO: Load metrics repository (done) | time=27ms
INFO: Project key: security-scan
INFO: Project base dir: /root_dir/src
INFO: ------------- Scan Security Scan
INFO: Base dir: /root_dir/src
INFO: Working dir: /root_dir/src/.scannerwork
INFO: Source paths: config, dag_factories, operators, tasks
INFO: Test paths: tests
INFO: Source encoding: UTF-8, default locale: en_US
INFO: Load server rules
INFO: Load server rules (done) | time=187ms
INFO: Language is forced to py
INFO: Index files
INFO: Excluded sources:
INFO: **/*.pyc
INFO: **/*.ini
INFO: Excluded tests:
INFO: **/*.pyc
INFO: 95 files indexed
INFO: 82 files ignored because of inclusion/exclusion patterns
INFO: Quality profile for py: Sonar way
INFO: Sensor Python Squid Sensor [python]
WARN: Metric 'comment_lines_data' is deprecated. Provided value is ignored.
INFO: Sensor Python Squid Sensor [python] (done) | time=2831ms
INFO: Sensor PythonXUnitSensor [python]
INFO: Sensor PythonXUnitSensor [python] (done) | time=318ms
INFO: Sensor JaCoCo XML Report Importer [jacoco]
INFO: Sensor JaCoCo XML Report Importer [jacoco] (done) | time=6ms
INFO: Sensor SonarJavaXmlFileSensor [java]
INFO: Sensor SonarJavaXmlFileSensor [java] (done) | time=1ms
INFO: Sensor Zero Coverage Sensor
INFO: Sensor Zero Coverage Sensor (done) | time=54ms
INFO: SCM Publisher is disabled
INFO: 3 files had no CPD blocks
INFO: Calculating CPD for 61 files
INFO: CPD calculation finished
INFO: Analysis report generated in 2349ms, dir size=617 KB
INFO: Analysis reports compressed in 15384ms, zip size=233 KB
INFO: Analysis report uploaded in 108ms
INFO: ANALYSIS SUCCESSFUL, you can browse https://sonarqube.mydomain/dashboard?id=security-scan
INFO: Note that you will be able to access the updated dashboard once the server has processed the submitted analysis report
INFO: More about the report processing at https://sonarqube.mydomain/api/ce/task?id=<snip>
INFO: Task total time: 26.187 s
INFO: ------------------------------------------------------------------------
INFO: EXECUTION SUCCESS
INFO: ------------------------------------------------------------------------
INFO: Total time: 27.558s
INFO: Final Memory: 16M/295M
INFO: ------------------------------------------------------------------------
以下是完整的sonar-project.properties文件：
sonar.host.url=https://sonarqube.mydomain
sonar.scm.disabled=true
sonar.projectKey=security-scan
sonar.projectName=Security Scan
sonar.projectVersion=1.0
sonar.language=py
sonar.sources=src
sonar.tests=tests
sonar.python.coverage.reportPath=coverage.xml
sonar.python.bandit.reportPaths=bandit-report.json
sonar.exclusions=**/*.pyc,**/*.ini
sonar.test.exclusions=**/*.pyc
但在SonarQube UI中，我没有看到这个报告。我错过了什么？
相关问题
使用Bandit进行安全分析的Python代码。
这是我能在SO上找到的唯一相关问题。我的问题不同。正如我提到的，Bandit报告是在本地正确生成的。但问题似乎是上传到SonarQube。
空漏洞报告截图
我们最近在SonarPython中添加了对Bandit的支持。
您是否在SonarQube 7.4实例中使用SonarPython 1.11？您可以在$SQ_HOME/extensions/plugins中进行检查。如果不是这样，只需将sonar-python-plugin-xxx.jar替换为1.11即可解决问题。
https://docs.sonarqube.org/display/PLUG/SonarPython
感谢
U必须在项目根目录中添加一个.bitt文件，并在那里定义规则。
然后你还需要在你的env中安装pipinstallbandit。希望它对你有用。这种方式适用于我，它生成了一个由规则定义的报告。