Sonar is showing new violations in old code

Question

We are using Sonar Qube 6.7.3 and sonar-java-plugin 5.3

We have made below changes to our sonar configuration recently

1. Enabled new rules
2. Changed configuration to include byte code(changed from 'clean sonar:sonar' to 'clean package sonar:sonar')

We are using sonar svn plugin and provide valid credentials to it.

I understand providing byte code to sonar will help it identify more issues but, I expect Sonar to flag new issues based on svn code commit date and last analysis date, but it is not.

Please let me know why it is flagging issues in old code as new?

Answer 1

Sonar Sanner always scans the entire code base. If somebody has decided that some code structures are wrong or dangerous (the ruleset have been changed) then SonarQube has to notify about all occurrences of that code. Why? Let's think about the following example:

After a plugin upgrade, SonarQube provides a new very important security rule which forbids the use of a dangerous cipher algorithm. Now is the question:

• is it only dangerous in new code?
• is it always dangerous?

Of course, it is always dangerous. SonarQube doesn't force you to fix everything (usage of the quality gates is optional). Its main goal is to let you know how many problems (code smells/bugs/vulnerabilities) exist in the whole code base.