US: NOSONAR support

[ociotec]

In JAVA analysis there is a way to ignore a warning in one class/method just adding a annotated value:

@java.lang.SuppressWarnings("squid:S00112")

It's also possible to add //NOSONAR comment in the line to ignore. This ignores all warnings for that line (too aggressive from my point of view).

Is there an equivalent supported way on sonar-cxx plugin?

If not, is it planned? (I already checked the issues list...).

Thanks in advance.

[guwirth]

@ociotec I'm sorry I never tried this out. For my understanding \\NOSONAR should work. Currently there is no other way planned.

I have different opinions to this. First of all I'm thinking that such comments are wasting the source code. On the other hand such comments are sometimes the only 'false positive' which are 'surviving' CI errors or SQ database updates.

[ociotec]

@guwirth the issue is that I tried with //NOSONAR comment (in the line itself and in previous line) but it doesn't work.

I've tested with latest released plugin version (0.9.7).

[guwirth]

@ociotec think it's a little bit more complicated with our plugin. Typically you are importing reports from external tools were you have to use own annotations (e.g. cppcheck, ...). So there seems to be no one fits all?

[ociotec]

@guwirth that's OK, for cppcheck warnings I use inline comments like this:

// cppcheck-suppress unusedFunction

For vera++ I use command line exclusions like this:

vera++ --exclusions vera++.exclusions ...

But my actual case is about cxx:MethodName rule, this seems to be generated by the plugin itself (maybe I'm wrong) so I don't know the way to disable it for a specific line code (or in any way).

I cannot disable it in SonarQube directly because we use branches (master, develop and one per feature), so there is a different project for each branch, so if we fix or marked as not fixed in one project branch, other branch projects will have the open issues...

Any solution or workaround?
Thanks in advance.

[guwirth]

@ociotec nosonar is not supported. I saw in https://github.com/SonarSource/SonarJS/blob/23cb649e641f0bf4d746d9a39d0263144dbe7d59/javascript-frontend/src/main/java/org/sonar/javascript/metrics/NoSonarVisitor.java that we have to support org.sonar.api.issue.NoSonarFilter.

[ociotec]

@guwirth is there any chance to include it in next release?

It will be a great way to bypass a few controlled situations in the code that are not possible to fix.

[guwirth]

@ociotec should be not too difficult. maybe someone has time to do it.