regarding usage of Apache commons-text library about sonar-findbugs HOT 6 CLOSED

Yes, it's a transitive dependency of SpotBugs so the plugin bundles it.
When the plugin is executed (on the server or on the analyzer), sonar unpacks the dependencies
This should be solved once the plugin upgrades to SpotBugs 4.7.3 and is released, I'm planning to do that soon

from sonar-findbugs.

Here's how it works:

• Someone installed the plugin on your sonarqube plugin, probably from the marketplace
• When someone runs the sonarscanner it downloads the plugin from your server
• Sonarscanner unpacks the plugin (and its bundled dependencies) locally in a temporary folder to execute it during the analysis

It's hard to say whether SpotBugs uses StringSubstitutor but if you're concerned the safest thing is probably to upgrade.

I've just released version 4.2.2 of the plugin, it uses SpotBugs 4.7.3 which is on commons-text 1.10.0
Once it is approved by sonarsource you (or someone with admin rights on your sonarqube server) should be able to upgrade from the "Administration" / "Marketplace" page of the sonarqube server
Then on the next analysis the scanner will pick up that updated version from your server

from sonar-findbugs.

Version 4.2.2 is available from the marketplace so you should be able to update

from sonar-findbugs.

Hi @gtoison
Thank you for your quick reply.
Sorry, I still dont have clarity :(
So is this related to sonar-findbug plugin in the sonarqube server not the sonarscanner?
Im using sonarqube 8.8 and When I looked in the sonarqube server extensions in path /opt/sonarqube/lib/common, I couldnt find the sonar-findbugs jar file there. Do you know which jar file it is ?

Does SpotBugs use the StringSubstitutor module of commons-text?

When the SpotBugs 4.7.3 plugin is released do we have to do anything on the sonarqube server or sonarscanner?

Thanks

from sonar-findbugs.

Thank you for the details and updated version. :)

from sonar-findbugs.

I'll close this now since the new release no longer bundles the vulnerable commons-text version.

from sonar-findbugs.