SAST Tool — SonarQube

SonarQube is a self-managed, automatic code review tool that systematically helps you deliver Clean Code. The tool analyses 30+ programming languages and integrates them into your CI pipeline and DevOps platform to ensure that your code meets high-quality standards.

Installation

1. install Docker

https://docs.docker.com/engine/install/

2. Launch from Docker

docker run -d --name sonarqube -e SONAR_ES_BOOTSTRAP_CHECKS_DISABLE=true -p 9000:9000 sonarqube:latest

3. Once your instance is up and running, Log in to http://{SONAR_IP_ADDRESS}:9000 using System Administrator credentials:

• login: admin
• password: admin

Analyzing a Project

1. Create a new project and click “Manually”

2. Setup “Project display name” and “Project key”

3. Click “Locally” and generate token

3. Clone your project

git clone https://github.com/gin-gonic/gin
cd gin

4. Setup sonar-scanner-cli

5. Download sonar-scanner-cli

SonarScanner

wget https://binaries.sonarsource.com/Distribution/sonar-scanner-cli/sonar-scanner-cli-4.7.0.2747-linux.zip
unzip sonar-scanner-cli-4.7.0.2747-linux.zip
export PATH=$PATH:$PWD/sonar-scanner-4.7.0.2747-linux/bin/
sonar-scanner -v
sonar-scanner \
  -Dsonar.projectKey=gin \
  -Dsonar.sources=. \
  -Dsonar.host.url=http://192.168.56.112:9000 \
  -Dsonar.login=sqp_0f9a299ef2d8ca7a79d5bf83b776f3037dfec966

6. Check the scan result on the terminal

INFO: ------------- Run sensors on project
INFO: Sensor Analysis Warnings import [csharp]
INFO: Sensor Analysis Warnings import [csharp] (done) | time=1ms
INFO: Sensor Zero Coverage Sensor
INFO: Sensor Zero Coverage Sensor (done) | time=171ms
INFO: SCM Publisher SCM provider for this project is: git
INFO: SCM Publisher 96 source files to be analyzed
INFO: SCM Publisher 96/96 source files have been analyzed (done) | time=5213ms
INFO: CPD Executor 9 files had no CPD blocks
INFO: CPD Executor Calculating CPD for 87 files
INFO: CPD Executor CPD calculation finished (done) | time=233ms
INFO: Analysis report generated in 638ms, dir size=1.2 MB
INFO: Analysis report compressed in 610ms, zip size=471.3 kB
INFO: Analysis report uploaded in 2187ms
INFO: ANALYSIS SUCCESSFUL, you can find the results at: http://192.168.56.112:9000/dashboard?id=gin
INFO: Note that you will be able to access the updated dashboard once the server has processed the submitted analysis report
INFO: More about the report processing at http://192.168.56.112:9000/api/ce/task?id=AYSCjroDaK4msd9itT3J
INFO: Analysis total time: 1:13.733 s
INFO: ------------------------------------------------------------------------
INFO: EXECUTION SUCCESS
INFO: ------------------------------------------------------------------------
INFO: Total time: 1:20.783s
INFO: Final Memory: 19M/121M

6. Check the scan result on the web console