Turning Sonar off for certain code

Question

Is it possible to turn off sonar (www.sonarsource.org) measurements for specific blocks of code, which one doesn't want to be measured?

An example is the "Preserve Stack Trace" warning which Findbugs outputs. When leaving the server, I might well want to only pass the message back to the client, not including the actual exception which I just caught, if that exception is unknown to the client (because the client doesn't have the JAR in which that exception was contained for example).

maestr0 · Answer 1 · 2016-09-04T23:21:18.080

340

You can annotate a class or a method with SuppressWarnings

@java.lang.SuppressWarnings("squid:S00112")

squid:S00112 in this case is a Sonar issue ID. You can find this ID in the Sonar UI. Go to Issues Drilldown. Find an issue you want to suppress warnings on. In the red issue box in your code is there a Rule link with a definition of a given issue. Once you click that you will see the ID at the top of the page.

edited Sep 04 '16 at 23:21

answered Apr 01 '15 at 21:05

maestr0

5,318
3
28
27

14

I can confirm that this also works with a specific FindBugs rule-ID, e.g. `@SuppressWarnings("findbugs:UI_INHERITANCE_UNSAFE_GETRESOURCE")`. – bcody Aug 14 '15 at 11:00
22

The problem is that Eclipse displays a warning `Unsupported @SuppressWarnings("squid:S00112")`. You can configure Eclipse to ignore this but then a typo such as in `@SuppressWarnings("uncheckedd")` will not be detected. – Ortomala Lokni Mar 01 '17 at 08:31
1

See https://docs.codescan.io/hc/en-us/articles/360012109711-Ignoring-violations for docs on @SuppressWarnings and Sonar. – Rich Dougherty Aug 22 '19 at 22:32
How do we add comments/justification when we suppress? – Gentleman Aug 07 '20 at 12:54
Looks like this answer should be marked as accepted. – rilaby Aug 10 '21 at 11:02
Fun fact: This annotation can also be added to a class variable or even a local variable. – Jans Rautenbach Feb 07 '23 at 09:22

score 139 · Answer 2 · edited Sep 24 '20 at 14:33

I recommend you try to suppress specific warnings by using @SuppressWarnings("squid:S2078").

For suppressing multiple warnings you can do it like this @SuppressWarnings({"squid:S2078", "squid:S2076"})

There is also the //NOSONAR comment that tells SonarQube to ignore all errors for a specific line.

Finally if you have the proper rights for the user interface you can issue a flag as a false positive directly from the interface.

The reason why I recommend suppression of specific warnings is that it's a better practice to block a specific issue instead of using //NOSONAR and risk a Sonar issue creeping in your code by accident.

You can read more about this in the FAQ

Edit: 6/30/16 SonarQube is now called SonarLint

In case you are wondering how to find the squid number. Just click on the Sonar message (ex. Remove this method to simply inherit it.) and the Sonar issue will expand.

On the bottom left it will have the squid number (ex. squid:S1185 Maintainability > Understandability)

So then you can suppress it by @SuppressWarnings("squid:S1185")

The other issue with marking it as a false positive on the interface is that if for whatever reason the project is deleted and added again, all of the flags you have set will be gone. — annedroiid, Nov 01 '16 at 06:26
@annedroiid - Is there any way if same can be done in pom.xml file ? I've raise question here: https://stackoverflow.com/questions/57789832/disable-sonar-rule-using-pom-xml — PAA, Sep 04 '19 at 13:56

score 118 · Accepted Answer · edited Mar 12 '21 at 05:36

118

This is a FAQ. You can put //NOSONAR at the end of the line triggering the warning.

//NOSONAR

For most languages, SonarQube supports the use of the generic mechanism: //NOSONAR at the end of the line of the issue. This will suppress all issues - now and in the future - that might be raised on the line.

I prefer using the FindBugs mechanism though, which consists in adding the @SuppressFBWarnings annotation:

@edu.umd.cs.findbugs.annotations.SuppressFBWarnings(
    value = "NAME_OF_THE_FINDBUGS_RULE_TO_IGNORE",
    justification = "Why you choose to ignore it")

edited Mar 12 '21 at 05:36

ryenus

15,711
5
56
63

answered Jun 10 '12 at 20:48

JB Nizet

678,734
91
1,224
1,255

2

Agreed. However, I'm not sure if Sonar correctly interprets `@SuppressFBWarnings` (added to avoid clashes with `java.lang.SuppressWarnings`) and also ignores it. – Marcel Stör Jul 17 '13 at 06:39
AFAIK, Sonar uses FindBugs. So if FindBugs handles these annotations, I don't see why they wouldn't work when running FindBugs through Sonar. Shouldn't be hard to test anyway. – JB Nizet Jul 17 '13 at 06:41
4

The FAQ link is outdated. Here is the new [FAQ](http://docs.sonarqube.org/display/HOME/Frequently+Asked+Questions#FrequentlyAskedQuestions-Howtoremovefalsepositiveissues?) – wiredniko May 21 '15 at 19:57
16

Could you please provide other link to a SonarQube FAQ? I see a login form instead of FAQ – Win4ster Mar 12 '18 at 10:54
https://docs.sonarqube.org/latest/faq/#header-1 – Laloi Oct 25 '21 at 08:45
A space is needed "// NOSONAR" before NOSONAR. – Larry_C May 04 '22 at 15:35
Even that updated FAQ link is now obsolete. Looks like SonarQube itself could benefit from a rule for that issue. – Thomas Urban Jun 06 '23 at 07:11

score 14 · Answer 4 · answered Oct 19 '18 at 07:11

14

Use //NOSONAR on the line you get warning if it is something you cannot help your code with. It works!

answered Oct 19 '18 at 07:11

Jain

201
2
2

score 6 · Answer 5 · answered Mar 15 '17 at 14:39

6

I not be able to find squid number in sonar 5.6, with this annotation also works:

@SuppressWarnings({"pmd:AvoidCatchingGenericException", "checkstyle:com.puppycrawl.tools.checkstyle.checks.coding.IllegalCatchCheck"})

answered Mar 15 '17 at 14:39

Noker

61
1
1

1

`squid` is for the Sonar-sourced Java database (SonarAnalyzer Java). `pmd` and `checkstyle` are on other rule repositories. – Daniel C. Sobral Sep 27 '18 at 19:15

score 6 · Answer 6 · edited Jun 23 '21 at 13:11

Actually it's a tricky to understand which is the ID of issue so i used @SuppressWarnings("all") annotation which basically is applied of all rules but to be more precise is better to use the ID. Click to see picture -> Sonar Issue ID

So when click on "Why is this an issue?" in the red box, i you will get to a screen with explanation. On top of the screen in left side you can see rule name, and on the left the id of this rule. So to applied for this rule only you have to add this annotation to your class or method.

@SuppressWarnings("common-java:DuplicatedBlocks")

score 1 · Answer 7 · answered Mar 07 '23 at 06:15

1

code complexity of any method is allowed only 15, if we have to resolve this issue without refactoring the methods we can use this at the top of method definition:-@SuppressWarnings({"java:S3776"})

answered Mar 07 '23 at 06:15

Abhijeet Kumar

11
1

Turning Sonar off for certain code

7 Answers7

Linked

Related