Feature Request: SonarLint support about sonar-css-plugin

[racodond]

Hi Roman,

SonarSource is preventing all non-SonarSource products from being executed in SonarLint. Thus, unfortunately, you'll never see this CSS plugin in action in your IDE...

David

[Ivan-L]

Hi @racodond,

I know that you closed this issue about a year ago, but I wanted to ask if anything has changed since then. We use SonarQube for commenting on pull requests and use your Sonar CSS plugin extensively. What we have found is that the rules of this plugin tend to be violated the most in our team (but that is fine, we correct the code since we want it to be uniform). However, it would be extremely useful if we saw the rule violations prior to pull requests being created.

We use the SonarLint plugin within Visual Studio for Windows and Visual Studio Code to warn us of rule violations for files other than CSS/SCSS. Adding support for CSS/SCSS support would be greatly advantageous to us since we would be able to see the rule violations within the editor.

I have recently tried to modify the SonarLint plugin for Visual Studio Code, located here. It took very few changes to get it to download the latest .jar file from your repository and invoke it for .css and .scss files. However, SonarLint.Core complained that the CSS plugin (.jar) does not support SonarLint:

It would seem that you need to add a sonarLintSupported entry to your pom.xml file to make SonarLint.Core recognize that your plugin supports SonarLint, see here as an example. I am not familiar at all with SonarLint plugins or their requirements, so I am not sure whether anything further is required to be implemented, apart from that extra entry.

Is this something that you could consider adding support for?

[Ivan-L]

Just an update, the entry should be <sonar.sonarLintSupported>true</sonar.sonarLintSupported> under the <properties> element of the pom.xml file. I did get the plugin to load now, the scss file that I had open in the editor did get indexed, but the analysis does not execute. As mentioned, my SonarQube plugin knowledge is extremely limited.

[roman-hres]

Hi @Ivan-L ,

I think that there nothing that can be done on the side of the sonar-css-plugin.
As far as I know, Sonar has created a whitelist inside the their code. Probably in the core project.
(You can see it here: https://github.com/SonarSource/sonarlint-core/blob/51f1534fea84e900ee62508b3d6c82b30b66a7ff/core/src/main/java/org/sonarsource/sonarlint/core/plugin/PluginCacheLoader.java)

SonarLint is using this list to check is it possible to index and analyze the file. Unfortunately css or less is not included in the list so SonarLint will ignore them. As far as I know it had be done with purpose. There is a ticket on Sonar jira with a little explanation why it had be done https://jira.sonarsource.com/browse/SLCORE-65

So it's more on SonarLint side then on sonar-css-plugin.
You can try to fork the SonarLint repository, extend the list (add css or less) and build corresponded jar for your project. Unfortunately I don't know exactly how it can be done for Visual Studio Code (I'm using IntelliJ IDEA)

Hope it will help you
Best regards,
Roman

[Ivan-L]

Hi @Phoenix8095 ,

Yeah I managed to bypass the whitelist by adding <sonar.sonarLintSupported>true</sonar.sonarLintSupported> to the <properties> element of the pom.xml in the sonar-css-plugin folder of this repo. Note that plugins either have to be whitelisted or need to indicate that they support SonarLint, as on line 67.

However, I could not get further as the ScssAnalyzerSensor or CssAnalyzerSensor sensors of this plugin never get executed by SonarLint Core. I spent a good deal of time trying to figure out how sensors are discovered by SonarLint Core within plugins that are loaded and how they are then executed, but gave up due to time constraints. I also could not get SonarLint Core to compile, although that is probably my lack of Java / Maven knowledge. I may give it another go when time permits.

[racodond]

Hi guys,

SonarSource do not want non-SonarSource plugins to run in SonarLint. So, they won't make it easy to hack. If they did want so, they would just have added a white list that could be extended in configuration.

Regards,

David

[Ivan-L]

I gave it one last shot and did manage to get the ScssAnalyzerSensor to start analyzing a file from SonarLint within Visual Studio Code. @racodond You are right they did not make it easy.

Continuing with the approach of setting the sonar.sonarLintSupported flag to true in the plugin in order to try to get SonarLint Core to execute the SCSS sensor, I hit the whitelist for a second time, this time in the ExtensionInstaller. Indeed, only SonarSource sensors can be executed and this time having the sonarLintSupported flag set to true, along with annotating the base class for all of the plugin sensors with @SonarLintSide (which required the bumping of sonar.version in the plugin to 6.0) did not help.

@Phoenix8095, you were right, modifying the whitelist to add a value of css was actually easier and I did not need to have any other flags set. By the way, I could not build the SonarLint Language Server (which I believe contains SonarLint Core, the .jar output of which is used by Visual Studio Code) because of missing Maven dependencies due to their commercial nature, however after removing them and building without running the tests, the build did succeed.

So in the end, the ScssAnalyzerSensor started analyzing a file within Visual Studio Code but did not complete the analysis for some reason. At least the sensor code did run. I am going to stop here though and throw in the towel as too much needs to be modified in order to get this to work.

It is a pity. The SonarQube Issues Report plugin is also not working, so there is no way currently to see any CSS rule violations prior to doing a PR. I can only hope that SonarSource improve on this situation as this plugin is very useful and seeing the rule violations in the IDE or before a commit would definitely save time.

[racodond]

Thanks for your investigation. But don't have vain hopes about SonarLint supporting non-SonarSource plugins...

[Hilalem]

Hello @racodond
since sonar-css joined the family with 7.3 when will sonarLint support css?

https://www.sonarqube.org/sonarqube-7-3/

[racodond]

Hi @Hilalem,

The new sonar-css plugin developped by SonarSource is not linked to mine in any way. You should talk to SonarSource about your issue instead.

David

[Hilalem]

Hello, thank you very much Racodond iPhone’umdan gönderildi David RACODON <[email protected]<mailto:[email protected]>> şunları yazdı (17 Oca 2019 19:09): Hi @Hilalem<https://github.com/Hilalem>, The new sonar-css plugin developped by SonarSource is not linked to mine in any way. You should talk to SonarSource about your issue instead. David — You are receiving this because you were mentioned. Reply to this email directly, view it on GitHub<#8 (comment)>, or mute the thread<https://github.com/notifications/unsubscribe-auth/Akept7sgVOoxKIjUTPf6dlz1rJ0TzkAVks5vEKAngaJpZM4NJ67Y>. Bu mesaj ve ekleri, mesajda gonderildigi belirtilen kisi/kisilere ozeldir ve gizlidir. Bu mesajin muhatabi olmamaniza ragmen tarafiniza ulasmis olmasi halinde mesaj iceriginin gizliligi ve bu gizlilik yukumlulugune uyulmasi zorunlulugu tarafiniz icin de soz konusudur. Mesaj ve eklerinde yer alan bilgilerin dogrulugu ve guncelligi konusunda gonderenin ya da sirketimizin herhangi bir sorumlulugu bulunmamaktadir. Sirketimiz mesajin ve bilgilerinin size degisiklige ugrayarak veya gec ulasmasindan, butunlugunun ve gizliliginin korunamamasindan, virus icermesinden ve bilgisayar sisteminize verebilecegi herhangi bir zarardan sorumlu tutulamaz. This message and attachments are confidential and intended solely for the individual(s) stated in this message. If you received this message although you are not the addressee, you are responsible to keep the message confidential. The sender has no responsibility for the accuracy or correctness of the information in the message and its attachments. Our company shall have no liability for any changes or late receiving, loss of integrity and confidentiality, viruses and any damages caused in anyway to your computer system.