When I encounter a violation in Sonar (in violation drilldown tab), in the source code view Sonar has some action like comment, assign, etc, one of those is False-positive, I want to know what exactly is the meaning of this operation, and when should I use it?
A false-positive is when an issue is raised unexpectedly on code that should not trigger an issue, or where the suggested action doesn't make any sense for the code.
Open - set by SonarQube on new issues. Confirmed - set manually to indicate that the issue is valid. Resolved - set manually to indicate that the next analysis should Close the issue. Reopened - set automatically by SonarQube when a Resolved issue hasn't actually been corrected.
For most languages, SonarQube supports the use of the generic mechanism: //NOSONAR at the end of the line of the issue. This will suppress all issues - now and in the future - that might be raised on the line.
Bug – A coding error that will break your code and needs to be fixed immediately. Vulnerability – A point in your code that's open to attack. Code Smell – A maintainability issue that makes your code confusing and difficult to maintain.
As any automatic tool, Sonar - and the rule engines it relies on (Findbugs/PMD/Checkstyle/...), can make "mistakes" while raising a violation: only a human can detect this, and you have the ability to flag this "mistake" as a false-positive to be sure that you won't spend time on it again.
Obviously, this feature must not be used to mute real violations. What's more, each time you flag a violation as false-positive, a good habit is to write a meaningful comment (and also report the issue on the user mailing list of the corresponding tool).
False-positive is then the software tells you there is a violation but you know better (like there is a reason, better than laziness, why the statement is poorly written) and this way you can mark the encounter as "Done The Right Way".
However, this functionality is sometimes used to get "clean" report for the manager. It's the worst that could happen.
Generally speaking - you should not use it.
If you love us? You can donate to us via Paypal or buy me a coffee so we can maintain and grow! Thank you!
Donate Us With