Skip to content

Commit 6d5abf3

Browse files
PhilippSalvisbergPhilippSalvisberg
committed
add SonarQube related chapters
1 parent 802314b commit 6d5abf3

File tree

5 files changed

+425
-0
lines changed

5 files changed

+425
-0
lines changed

‎docs/src/content/docs/tools/sonarqube/quality-profiles.mdx‎

Lines changed: 15 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,15 @@
1+
---
2+
title: Quality Profiles
3+
description: Quality Profiles in SonarQube.
4+
sidebar:
5+
order: 30
6+
---
7+
8+
A quality profile defines the set of rules that will be applied during the analysis process.
9+
10+
## Built-in Profile
11+
12+
dbLinter's provided profile has enabled all rules.
13+
As you manage the enabled rules and their parameters within the dbLinter repository, there is no need to maintain custom profiles.
14+
15+
![Built-in Profile](../../../../assets/images/sonarqube/sonarqube-built-in-profile.png)

‎docs/src/content/docs/tools/sonarqube/results.mdx‎

Lines changed: 57 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,57 @@
1+
---
2+
title: Results
3+
description: Results in SonarQube.
4+
sidebar:
5+
order: 60
6+
---
7+
8+
The results of an analysis run using SonarScanner are sent to the SonarQube server and made available on the web interface.
9+
10+
Here we show some examples of projects specific results.
11+
12+
## Dashboard
13+
14+
The dashboard in the `Overview tab` shows result either for [new code](https://docs.sonarsource.com/sonarqube-community-build/user-guide/about-new-code#focus-on-new-code) or all code.
15+
16+
![Project Overview](../../../../assets/images/sonarqube/sonarqube-project-overview.png)
17+
18+
## Issues
19+
20+
The `Issues` tab displays all rule violations in a project.
21+
These results can be filtered by various criteria.
22+
In this case, the filter is set to the tag `dynamicsql`.
23+
24+
![Project Issues](../../../../assets/images/sonarqube/sonarqube-project-issues.png)
25+
26+
Clicking on `SQL injection possible via parameter in_table_name.` shows the following detail screen.
27+
The violation of rule G-9501 is shown on line 9, where an assertion is missing.
28+
Furthermore, the related lines are highlighted.
29+
Line 4 shows the unasserted parameter.
30+
Line 11 shows the statement that is vulnerable to SQL injection.
31+
32+
![Issue Details for G-9501](../../../../assets/images/sonarqube/sonarqube-project-issues-G-9501.png)
33+
34+
## Code Coverage
35+
36+
The SonarQube plugin registers executable lines for database objects that can be tested with [utPLSQL](https://www.utplsql.org/utPLSQL/latest/userguide/coverage.html).
37+
These are package bodies, type bodies, triggers, standalone functions, and standalone procedures.
38+
It is important to note that the line numbers in the file must match the line numbers of the database objects stored in the database.
39+
40+
Furthermore, only the first line of an executable statement is marked as such.
41+
This matches the behaviour of the PL/SQL profiler and the `DBMS_PLSQL_CODE_COVERAGE` package, which are used behind the scenes to record the covered code.
42+
43+
Here's an example of how covered and uncovered lines are visualised in SonarQube.
44+
Covered lines are marked with a green bar on the left, while uncovered lines are marked with a red bar.
45+
46+
![Code Coverage](../../../../assets/images/sonarqube/sonarqube-uncovered-line-in-create-free-tenant.png)
47+
48+
## Duplicated Code Blocks
49+
50+
The SonarQube plugin registers all the relevant tokens in the analysed files.
51+
A token is considered relevant if it is visible to the parser.
52+
Based on this information, SonarQube can detect duplicate code blocks.
53+
A duplicate code block contains at least 100 identical tokens that are spread across at least 10 lines.
54+
55+
The following example shows how duplicate code blocks are visualised in SonarQube.
56+
57+
![Duplicate Code Block](../../../../assets/images/sonarqube/sonarqube-duplicate-code-block-in-dbl_configs_dv.png)

‎docs/src/content/docs/tools/sonarqube/rules.mdx‎

Lines changed: 26 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,26 @@
1+
---
2+
title: Rules
3+
description: Rules in SonarQube.
4+
sidebar:
5+
order: 40
6+
---
7+
8+
The rules are copied from the dbLinter repository when the dbLinter SonarQube plugin is installed or updated.
9+
10+
SonarQube then visualises them in three sections.
11+
12+
## Why is this an issue?
13+
14+
The reason of the rule is stored in this section.
15+
16+
![Why is this an Issue?](../../../../assets/images/sonarqube/sonarqube-g-9501-why-is-this-an-issue.png)
17+
18+
19+
## How can I fix it?
20+
21+
![How can I fix it?](../../../../assets/images/sonarqube/sonarqube-g-9501-how-can-i-fix-it.png)
22+
23+
24+
## More Info
25+
26+
![More info](../../../../assets/images/sonarqube/sonarqube-g-9501-more-info.png)

‎docs/src/content/docs/tools/sonarqube/settings.mdx‎

Lines changed: 125 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,125 @@
1+
---
2+
title: Settings
3+
description: General and project settings in SonarQube.
4+
sidebar:
5+
order: 20
6+
---
7+
8+
## Scope
9+
10+
The dbLinter settings in SonarQube have a global scope and a project scope.
11+
This means that global settings can be overridden at project level via the SonarQube web interface and via property file or paramters for SonarScanner runs.
12+
13+
import { Tabs, TabItem } from '@astrojs/starlight/components';
14+
15+
<Tabs>
16+
<TabItem label="Global">
17+
Administration -> Configuration -> General Settings -> dbLinter
18+
19+
![Global Settings](../../../../assets/images/sonarqube/sonarqube-global-settings.png)
20+
</TabItem>
21+
<TabItem label="Project">
22+
Projects -> "Project" -> Project Settings -> General Settings -> dbLinter
23+
24+
![Project Settings](../../../../assets/images/sonarqube/sonarqube-project-settings.png)
25+
</TabItem>
26+
<TabItem label="Property">
27+
Example in `sonar-project.properties` to override global/project setting:
28+
29+
```
30+
sonar.dblinter.access.token=IGsLxJQLnfZPFAkbMCaJntBjIaKtmYSOjnYiRTIlfYJYRggZgG
31+
```
32+
</TabItem>
33+
<TabItem label="Parameter">
34+
Example as parameter of `sonar-scanner` call to override global/project/property file setting:
35+
36+
```
37+
-Dsonar.dblinter.access.token=IGsLxJQLnfZPFAkbMCaJntBjIaKtmYSOjnYiRTIlfYJYRggZgG
38+
```
39+
</TabItem>
40+
</Tabs>
41+
42+
## 1) General
43+
44+
- **Language Key** `sonar.dblinter.language.key`<br/>
45+
Language to use.
46+
- Select `dblinter` if you do not want to use the checks provided by other PL/SQL plugins.
47+
In other words, use dbLinter as primary plugin.
48+
- Select `plsql` to also use the included checks in the Developer, Enterprise and Data Center editions.
49+
- Use `plsqlopen` to also use the checks provided by the ZPA plugin.
50+
51+
Requires the dbLinter plugin to be reinstalled to take effect.
52+
53+
- **File Suffixes** `sonar.dblinter.file.suffixes`<br/>
54+
List of file suffixes containing code to be analysed with dbLinter.
55+
These file extensions are only relevant for the `dblinter` language key.
56+
Set the file suffixes for other languages in the associated plugins.
57+
This filter is applied before the include and exclude file patterns of a configuration.
58+
Use a comma separated list when defined as property or parameter.
59+
60+
## 2) Remote Access
61+
62+
- **Repo URL** `sonar.dblinter.repo.url`<br/>
63+
This is the URL of the dbLinter REST API. The default is https://api.dblinter.app/.
64+
You only need to set this URL when developing and testing custom rules.
65+
66+
- **Tenant Name** `sonar.dblinter.tenant.name`<br/>
67+
dbLinter tenant for authentication.
68+
SonarScanner uses this for checks, while the SonarQube server uses it to register all applicable rules when the plugin is installed.
69+
70+
- **User Name** `sonar.dblinter.user.name`<br/>
71+
dbLinter user (e-mail address) for authentication.
72+
SonarScanner uses this for checks, while the SonarQube server uses it to register all applicable rules when the plugin is installed.
73+
74+
- **Access Token** `sonar.dblinter.access.token`<br/>
75+
dbLinter access token for authentication.
76+
SonarScanner uses this for checks, while the SonarQube server uses it to register all applicable rules when the plugin is installed.
77+
78+
- **Config Name** `sonar.dblinter.config.name`<br/>
79+
Name of the dbLinter configuration for checks.
80+
SonarScanner uses this for checks.
81+
This configuration determines which rules are enabled and, consequently, checked.
82+
Therefore, you should ensure that all rules are enabled in the active quality profiles.
83+
84+
## 3) Read-only DB Access
85+
86+
Read-only access is recommended to achieve the best check results.
87+
88+
To enable read-only access, you will need to create a database user with the following permissions:
89+
90+
```sql
91+
create user if not exists dbl_read identified by "(...)";
92+
grant connect to dbl_read;
93+
grant select any dictionary to dbl_read;
94+
```
95+
96+
- **JDBC URL** `sonar.dblinter.conn.jdbc.url`<br/>
97+
Override JDBC URL for read-only database access within checks.
98+
E.g. jdbc:oracle:thin:@localhost:1521/FREEPDB1 or jdbc:postgresql://localhost:5432/postgres.
99+
The default is configured in the dbLinter repository.
100+
101+
- **Username** `sonar.dblinter.conn.user.name`<br/>
102+
Override username for read-only database access within checks.
103+
The default is configured in the dbLinter repository.
104+
105+
- **Password** `sonar.dblinter.conn.password`<br/>
106+
Override connection password for read-only database access within checks.
107+
The default is configured in the dbLinter repository.
108+
109+
## 4) Language Server
110+
111+
- **Parallel Files** `sonar.dblinter.ls.parallel.files`<br/>
112+
Number of files analysed in parallel when using the command line interface.
113+
The default is 1.
114+
To achieve better performance with higher values, you need enough free system resources.
115+
116+
- **Clear Cache Threshold** `sonar.dblinter.ls.clear.cache.threshold`<br/>
117+
Memory threshold in megabytes.
118+
This clears the ANTLR caches once the heap size used by the language server exceeds the threshold.
119+
This frees memory, but subsequent parsing is slower.
120+
Set the threshold to a value below zero to keep the cache.
121+
Leave empty for default behaviour.
122+
123+
- **Log Format** `sonar.dblinter.ls.log.format`<br/>
124+
Log format for log messages.
125+
Log messages from the language server will only be displayed if the `sonar.log.level` property is set to `DEBUG` or `TRACE`.

0 commit comments

Comments
 (0)