我有多模块项目设置。由于我的项目没有 Jenkins/Maven 设置,我使用 CLI 分别获取每个模块的依赖关系报告,并将它们复制到根据其模块命名的根项目文件夹中
对于考试 :
D: MyProject
--module1
--src
--module2
--src
--dependency-check-module1-report
--dependency-check-report (XML)
--dependency-check-report (HTML)
--dependency-check-module2-report
--dependency-check-report (XML)
--dependency-check-report (HTML)
我已经明确提到了sonar-project.properties
文件中的模块明智的报告路径
#----- Default SonarQube server
sonar.host.url=http://localhost:9000
# Root project information
sonar.projectKey=MyProject
sonar.projectName=MyProject
sonar.projectVersion=1.0
# Some properties that will be inherited by the modules
sonar.sources=src
sonar.language=java
sonar.java.binaries=src
sonar.java.libraries=src
# List of the module identifiers
sonar.modules=module1,module2
# Properties can obviously be overriden for each module - just prefix them with the module ID
#module1.sonar.projectName=MyProject-module1
#module2.sonar.projectName=MyProject-module2
# Encoding of the source files
sonar.sourceEncoding=UTF-8
module1.sonar.dependencyCheck.reportPath=D:/MyProject/dependency-check-module1-report/dependency-check-report.xml
module1.sonar.dependencyCheck.htmlReportPath=D:/MyProject/dependency-check-module1-report/dependency-check-report.html
module2.dependencyCheck.reportPath=D:/MyProject/dependency-check-module2-report/dependency-check-report.xml
module2.dependencyCheck.htmlReportPath=D:/MyProject/dependency-check-module2-report/dependency-check-report.html
声纳扫描仪运行良好,但跳过以选取依赖性检查,因为它始终检查 ${WORKSPACE}/dependency-check-report.html这是在 sonarQube dashboard->Configuraiton->Dependency-Check 中定义的
在仪表板中,我只能提到其中一个模块的报告文件,但我需要将两个模块报告集成到SonarQube扫描结果中。
日志:
12:45:46.752 DEBUG: Sensors : Dependency-Check -> SonarJavaXmlFileSensor -> Analyzer for "php.ini" files -> Zero Coverage Sensor -> CPD Block Indexer
12:45:46.752 INFO: Sensor Dependency-Check [dependencycheck]
12:45:46.752 INFO: Process Dependency-Check report
12:45:46.752 WARN: Dependency-Check report does not exist. SKIPPING. Please check property sonar.dependencyCheck.reportPath: ${WORKSPACE}/dependency-check-report.xml
12:45:46.752 DEBUG: Analysis aborted due to missing report file
java.io.FileNotFoundException: Dependency-Check report does not exist.
at org.sonar.dependencycheck.parser.XmlReportFile.getInputStream(XmlReportFile.java:82)
at org.sonar.dependencycheck.DependencyCheckSensor.parseAnalysis(DependencyCheckSensor.java:173)
at org.sonar.dependencycheck.DependencyCheckSensor.execute(DependencyCheckSensor.java:227)
at org.sonar.scanner.sensor.SensorWrapper.analyse(SensorWrapper.java:53)
at org.sonar.scanner.phases.SensorsExecutor.executeSensor(SensorsExecutor.java:88)
at org.sonar.scanner.phases.SensorsExecutor.execute(SensorsExecutor.java:82)
at org.sonar.scanner.phases.SensorsExecutor.execute(SensorsExecutor.java:68)
at org.sonar.scanner.phases.AbstractPhaseExecutor.execute(AbstractPhaseExecutor.java:88)
at org.sonar.scanner.scan.ModuleScanContainer.doAfterStart(ModuleScanContainer.java:177)
at org.sonar.core.platform.ComponentContainer.startComponents(ComponentContainer.java:135)
at org.sonar.core.platform.ComponentContainer.execute(ComponentContainer.java:121)
at org.sonar.scanner.scan.ProjectScanContainer.scan(ProjectScanContainer.java:291)
at org.sonar.scanner.scan.ProjectScanContainer.scanRecursively(ProjectScanContainer.java:286)
at org.sonar.scanner.scan.ProjectScanContainer.doAfterStart(ProjectScanContainer.java:264)
at org.sonar.core.platform.ComponentContainer.startComponents(ComponentContainer.java:135)
at org.sonar.core.platform.ComponentContainer.execute(ComponentContainer.java:121)
at org.sonar.scanner.task.ScanTask.execute(ScanTask.java:48)
at org.sonar.scanner.task.TaskContainer.doAfterStart(TaskContainer.java:84)
at org.sonar.core.platform.ComponentContainer.startComponents(ComponentContainer.java:135)
at org.sonar.core.platform.ComponentContainer.execute(ComponentContainer.java:121)
at org.sonar.scanner.bootstrap.GlobalContainer.executeTask(GlobalContainer.java:121)
at org.sonar.batch.bootstrapper.Batch.doExecuteTask(Batch.java:116)
at org.sonar.batch.bootstrapper.Batch.execute(Batch.java:71)
at org.sonarsource.scanner.api.internal.batch.BatchIsolatedLauncher.execute(BatchIsolatedLauncher.java:46)
at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
at sun.reflect.NativeMethodAccessorImpl.invoke(Unknown Source)
at sun.reflect.DelegatingMethodAccessorImpl.invoke(Unknown Source)
at java.lang.reflect.Method.invoke(Unknown Source)
at org.sonarsource.scanner.api.internal.IsolatedLauncherProxy.invoke(IsolatedLauncherProxy.java:60)
at com.sun.proxy.$Proxy0.execute(Unknown Source)
at org.sonarsource.scanner.api.EmbeddedScanner.doExecute(EmbeddedScanner.java:171)
at org.sonarsource.scanner.api.EmbeddedScanner.execute(EmbeddedScanner.java:128)
at org.sonarsource.scanner.cli.Main.execute(Main.java:111)
at org.sonarsource.scanner.cli.Main.execute(Main.java:75)
at org.sonarsource.scanner.cli.Main.main(Main.java:61)
12:45:46.784 INFO: Process Dependency-Check report (done) | time=32ms
12:45:46.784 WARN: Dependency-Check report does not exist. SKIPPING. Please check property sonar.dependencyCheck.reportPath: ${WORKSPACE}/dependency-check-report.html
12:45:46.784 INFO: Sensor Dependency-Check [dependencycheck] (done) | time=32ms
12:45:46.784 INFO: Sensor SonarJavaXmlFileSensor [java]
12:45:46.784 INFO: Sensor SonarJavaXmlFileSensor [java] (done) | time=0ms
有没有办法告诉声纳扫描仪不要检查声纳Qube-Dashboard中提到的依赖报告路径,而是检查声纳项目属性
另外,如果可能的话,我在哪里可以在仪表板中看到owasp依赖关系报告?(这是我的项目吗 -->措施 -->OWASP 依赖性检查?
现在在仪表板中,我只看到"MyProject",并且它正在为两个模块添加漏洞,代码异味等。我以为我会单独看到模块明智的扫描结果。
仅供参考,我使用 声纳库贝-6.7.5 声纳依赖检查插件-1.1.1 声纳-java-plugin-5.7.0.15470 声纳扫描仪-3.2.0.1227
提前感谢您的线索。
文件中定义的属性sonar-project.properties
将覆盖服务器上配置的默认值。
我在以下配置中发现了一个问题:
module1.sonar.dependencyCheck.reportPath=D:/MyProject/dependency-check-module1-report/dependency-check-report.xml
module1.sonar.dependencyCheck.htmlReportPath=D:/MyProject/dependency-check-module1-report/dependency-check-report.html
module2.dependencyCheck.reportPath=D:/MyProject/dependency-check-module2-report/dependency-check-report.xml
module2.dependencyCheck.htmlReportPath=D:/MyProject/dependency-check-module2-report/dependency-check-report.html
您忘记在module2
和dependencyCheck
之间添加sonar
:
module2.sonar.dependencyCheck.reportPath=D:/MyProject/dependency-check-module2-report/dependency-check-report.xml
module2.sonar.dependencyCheck.htmlReportPath=D:/MyProject/dependency-check-module2-report/dependency-check-report.html
也许这个错误就是问题的原因。
我希望这些文件存在于您的构建服务器上:
D:/MyProject/dependency-check-module1-report/dependency-check-report.xml
D:/MyProject/dependency-check-module1-report/dependency-check-report.html
D:/MyProject/dependency-check-module2-report/dependency-check-report.xml
D:/MyProject/dependency-check-module2-report/dependency-check-report.html
编辑:
您使用 Windows,因此路径配置不正确。取代:
module1.sonar.dependencyCheck.reportPath=D:/MyProject/dependency-check-module1-report/dependency-check-report.xml
module1.sonar.dependencyCheck.htmlReportPath=D:/MyProject/dependency-check-module1-report/dependency-check-report.html
module2.sonar.dependencyCheck.reportPath=D:/MyProject/dependency-check-module2-report/dependency-check-report.xml
module2.sonar.dependencyCheck.htmlReportPath=D:/MyProject/dependency-check-module2-report/dependency-check-report.html
跟:
module1.sonar.dependencyCheck.reportPath=D:MyProjectdependency-check-module1-reportdependency-check-report.xml
module1.sonar.dependencyCheck.htmlReportPath=D:MyProjectdependency-check-module1-reportdependency-check-report.html
module2.sonar.dependencyCheck.reportPath=D:MyProjectdependency-check-module2-reportdependency-check-report.xml
module2.sonar.dependencyCheck.htmlReportPath=D:MyProjectdependency-check-module2-reportdependency-check-report.html