如何禁用SonarQube自定义规则包 解决Node报错完成C++代码分析

问题现状 #

• 项目内不存在.js、.css文件，已在sonar-project.properties中配置sonar.exclusions=**/*.js排除JS类文件，项目本身可正常构建、跑通测试
• 接入SonarQube做代码分析时抛出Node.js缺失相关错误，按照官方缩小分析范围的方案调整后仍然无效
• 分析日志后续还会抛出java.lang.IllegalStateException: The "build-wrapper-dump.json" file was found empty. Please make sure that:报错，暂时无法确认是否和前述错误有关联
• 核心诉求：停止部署非必要的自定义规则包，顺利完成项目的C++代码分析

报错日志 #

INFO: Sensor CSS Metrics [javascript]
INFO: Sensor CSS Metrics [javascript] (done) | time=65ms
INFO: Sensor CSS Rules [javascript]
INFO: Deploying custom rules bundle jar:file:/jenkins/.sonar/cache/407d827e66c5794ecc2c8947635359f7/sonar-securityjsfrontend-plugin.jar!/js-vulnerabilities-rules-1.0.0.tgz to /jenkins/workspace/<branch name>/.scannerwork/.sonartmp/eslint-bridge-bundle/package/custom-rules5067734496114002493
ERROR: Error when running: 'node -v'. Is Node.js available during analysis?
org.sonarsource.nodejs.NodeCommandException: Error when running: 'node -v'. Is Node.js available during analysis?
    at org.sonarsource.nodejs.NodeCommand.start(NodeCommand.java:77)
    at org.sonarsource.nodejs.NodeCommandBuilderImpl.getVersion(NodeCommandBuilderImpl.java:190)
    at org.sonarsource.nodejs.NodeCommandBuilderImpl.checkNodeCompatibility(NodeCommandBuilderImpl.java:168)
    at org.sonarsource.nodejs.NodeCommandBuilderImpl.build(NodeCommandBuilderImpl.java:142)
    at org.sonar.plugins.javascript.eslint.EslintBridgeServerImpl.initNodeCommand(EslintBridgeServerImpl.java:183)
    at org.sonar.plugins.javascript.eslint.EslintBridgeServerImpl.startServer(EslintBridgeServerImpl.java:128)
    at org.sonar.plugins.javascript.eslint.EslintBridgeServerImpl.startServerLazily(EslintBridgeServerImpl.java:212)
    at org.sonar.plugins.javascript.eslint.AbstractEslintSensor.execute(AbstractEslintSensor.java:66)
    at org.sonar.plugins.javascript.eslint.CssRuleSensor.execute(CssRuleSensor.java:96)
    at org.sonar.scanner.sensor.AbstractSensorWrapper.analyse(AbstractSensorWrapper.java:64)
    at org.sonar.scanner.sensor.ModuleSensorsExecutor.execute(ModuleSensorsExecutor.java:85)
    at org.sonar.scanner.sensor.ModuleSensorsExecutor.lambda$execute$1(ModuleSensorsExecutor.java:59)
    at org.sonar.scanner.sensor.ModuleSensorsExecutor.withModuleStrategy(ModuleSensorsExecutor.java:77)
    at org.sonar.scanner.sensor.ModuleSensorsExecutor.execute(ModuleSensorsExecutor.java:59)
    at org.sonar.scanner.scan.SpringModuleScanContainer.doAfterStart(SpringModuleScanContainer.java:81)
    at org.sonar.core.platform.SpringComponentContainer.startComponents(SpringComponentContainer.java:188)
    at org.sonar.core.platform.SpringComponentContainer.execute(SpringComponentContainer.java:167)
    at org.sonar.scanner.scan.SpringProjectScanContainer.scan(SpringProjectScanContainer.java:392)
    at org.sonar.scanner.scan.SpringProjectScanContainer.scanRecursively(SpringProjectScanContainer.java:388)
    at org.sonar.scanner.scan.SpringProjectScanContainer.doAfterStart(SpringProjectScanContainer.java:357)
    at org.sonar.core.platform.SpringComponentContainer.startComponents(SpringComponentContainer.java:188)
    at org.sonar.core.platform.SpringComponentContainer.execute(SpringComponentContainer.java:167)
    at org.sonar.scanner.bootstrap.SpringGlobalContainer.doAfterStart(SpringGlobalContainer.java:134)
    at org.sonar.core.platform.SpringComponentContainer.startComponents(SpringComponentContainer.java:188)
    at org.sonar.core.platform.SpringComponentContainer.execute(SpringComponentContainer.java:167)
    at org.sonar.batch.bootstrapper.Batch.doExecute(Batch.java:72)
    at org.sonar.batch.bootstrapper.Batch.execute(Batch.java:66)
    at org.sonarsource.scanner.api.internal.batch.BatchIsolatedLauncher.execute(BatchIsolatedLauncher.java:46)
    at java.base/jdk.internal.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
    at java.base/jdk.internal.reflect.NativeMethodAccessorImpl.invoke(Unknown Source)
    at java.base/jdk.internal.reflect.DelegatingMethodAccessorImpl.invoke(Unknown Source)
    at java.base/java.lang.reflect.Method.invoke(Unknown Source)
    at org.sonarsource.scanner.api.internal.IsolatedLauncherProxy.invoke(IsolatedLauncherProxy.java:60)
    at com.sun.proxy.$Proxy0.execute(Unknown Source)
    at org.sonarsource.scanner.api.EmbeddedScanner.doExecute(EmbeddedScanner.java:189)
    at org.sonarsource.scanner.api.EmbeddedScanner.execute(EmbeddedScanner.java:138)
    at org.sonarsource.scanner.cli.Main.execute(Main.java:112)
    at org.sonarsource.scanner.cli.Main.execute(Main.java:75)
    at org.sonarsource.scanner.cli.Main.main(Main.java:61)
Caused by: java.io.IOException: Cannot run program "node": error=2, No such file or directory
    at java.base/java.lang.ProcessBuilder.start(Unknown Source)
    at java.base/java.lang.ProcessBuilder.start(Unknown Source)
    at org.sonarsource.nodejs.ProcessWrapperImpl.startProcess(ProcessWrapperImpl.java:39)
    at org.sonarsource.nodejs.NodeCommand.start(NodeCommand.java:75)
    ... 38 common frames omitted
Caused by: java.io.IOException: error=2, No such file or directory
    at java.base/java.lang.ProcessImpl.forkAndExec(Native Method)
    at java.base/java.lang.ProcessImpl.<init>(Unknown Source)
    at java.base/java.lang.ProcessImpl.start(Unknown Source)
    ... 42 common frames omitted

INFO: Sensor CSS Rules [javascript] (done) | time=842ms
INFO: Sensor ThymeLeaf template sensor [securityjavafrontend]
INFO: Sensor ThymeLeaf template sensor [securityjavafrontend] (done) | time=1ms

解决方法 #

禁用触发问题的自定义规则包 #

从日志可以明确看到，部署前端自定义规则包的来源是第三方插件sonar-securityjsfrontend-plugin.jar，这不是SonarQube官方自带插件，属于后续安装的前端安全规则组件，有两种处理方式：

• 方式一：直接卸载插件。登录SonarQube服务端，进入应用市场的已安装插件列表，找到该前端安全插件选择卸载，重启SonarQube服务后就不会再加载对应的自定义规则包。如果是离线部署的SonarQube，直接进入SonarQube安装目录下的extensions/plugins文件夹，删除sonar-securityjsfrontend-plugin.jar文件后重启服务即可。
• 方式二：配置扫描时跳过前端相关分析器。如果不想卸载插件，可以在项目的sonar-project.properties中添加配置，指定仅运行C++相关的扫描传感器，跳过所有JS/CSS/前端类传感器：

# 仅启用C/C++相关扫描传感器
sonar.sensors=cpp

如果配置后仍有前端相关传感器触发，可以追加以下配置彻底关闭前端文件识别：

sonar.javascript.file.suffixes=.disabled
sonar.typescript.file.suffixes=.disabled
sonar.css.file.suffixes=.disabled

关联报错处理 #

后续出现的build-wrapper-dump.json为空的报错和前面的Node.js、前端规则问题没有关联，属于C++分析本身的配置问题：

• 执行build-wrapper构建包装器时，必须完整包裹项目的清理+全量构建命令，不要在增量构建状态下运行包装器
• 确认构建命令执行完成后，指定输出目录下生成的build-wrapper-dump.json文件大小不为0，再运行sonar-scanner执行分析即可

内容的提问来源于stack exchange，提问作者Michael Williamson