Logo Questions Linux Laravel Mysql Ubuntu Git Menu
 

What exactly is the meaning of False-positive operation in sonar?

Tags:

qa

sonarqube

When I encounter a violation in Sonar (in violation drilldown tab), in the source code view Sonar has some action like comment, assign, etc, one of those is False-positive, I want to know what exactly is the meaning of this operation, and when should I use it?

like image 679
Saeed Zarinfam Avatar asked Sep 04 '12 07:09

Saeed Zarinfam


People also ask

What is false positive in Sonar?

A false-positive is when an issue is raised unexpectedly on code that should not trigger an issue, or where the suggested action doesn't make any sense for the code.

How do you fix sonar issues?

Open - set by SonarQube on new issues. Confirmed - set manually to indicate that the issue is valid. Resolved - set manually to indicate that the next analysis should Close the issue. Reopened - set automatically by SonarQube when a Resolved issue hasn't actually been corrected.

How do you stop the problem in SonarQube?

For most languages, SonarQube supports the use of the generic mechanism: //NOSONAR at the end of the line of the issue. This will suppress all issues - now and in the future - that might be raised on the line.

What is a bug in SonarQube?

Bug – A coding error that will break your code and needs to be fixed immediately. Vulnerability – A point in your code that's open to attack. Code Smell – A maintainability issue that makes your code confusing and difficult to maintain.


2 Answers

As any automatic tool, Sonar - and the rule engines it relies on (Findbugs/PMD/Checkstyle/...), can make "mistakes" while raising a violation: only a human can detect this, and you have the ability to flag this "mistake" as a false-positive to be sure that you won't spend time on it again.

Obviously, this feature must not be used to mute real violations. What's more, each time you flag a violation as false-positive, a good habit is to write a meaningful comment (and also report the issue on the user mailing list of the corresponding tool).

like image 112
Fabrice - SonarSource Team Avatar answered Oct 25 '22 02:10

Fabrice - SonarSource Team


False-positive is then the software tells you there is a violation but you know better (like there is a reason, better than laziness, why the statement is poorly written) and this way you can mark the encounter as "Done The Right Way".

However, this functionality is sometimes used to get "clean" report for the manager. It's the worst that could happen.

Generally speaking - you should not use it.

like image 39
Artur Czajka Avatar answered Oct 25 '22 01:10

Artur Czajka