spikerj/spikersoft-issues
1
0
Fork 0
Code Issues 196 Pull Requests Actions Packages Projects Releases Wiki Activity

[Backend] Detector/rule-engine override parameters renamed to match their base declarations (SonarQube S927 x14) + proposal: drop CA1873/CA1861 imports from sonar (56% of all open issues) #638

New Issue
Closed
opened 2026-07-17 05:20:02 +00:00 by spikerj · 2 comments
spikerj commented 2026-07-17 05:20:02 +00:00
Owner
Copy Link
Copy Source

Two things from the SonarQube triage loop (2026-07-17):

Fixed (PR incoming): S927 x14. All six SecurityMonitor detectors abbreviated their override parameters (e/s/ct) against the ISecurityDetector base's evt/snapshot/cancellationToken, and RemediationRuleEngine did the same against IRemediationRuleEngine. Renames are mechanical (no named-argument call sites exist — verified), scoped per method; both projects build and their test suites pass (91 + 82).

Proposal, deliberately NOT actioned without your call: the rule histogram shows 4,923 of 8,825 open backend issues (56%) come from two imported Roslyn perf rules: CA1873 'avoid potentially expensive logging' (3,511) and CA1861 'avoid constant arrays as arguments' (1,412). Nobody is realistically burning these down issue-by-issue, and they bury the signal (the 44 real BUG findings were invisible under them). Options, narrowest blast radius first:

  1. Scanner-side ignore via sonar.issue.ignore.multicriteria in sonar-scan.yml (sonar only; local builds unchanged; reversible one-liner; precedent exists in that workflow).
  2. .editorconfig severity=none (also silences local builds — bigger call).
  3. Leave them and filter in the UI (status quo).

Recommend option 1 for CA1873 at minimum. Next tier of noise for later review: S101 naming (663 — fires on the deliberate Marker_*/MongoDB_HealthCheck underscore style), S1192 duplicated literals (404).

Two things from the SonarQube triage loop (2026-07-17): **Fixed (PR incoming): S927 x14.** All six SecurityMonitor detectors abbreviated their override parameters (`e`/`s`/`ct`) against the ISecurityDetector base's `evt`/`snapshot`/`cancellationToken`, and RemediationRuleEngine did the same against IRemediationRuleEngine. Renames are mechanical (no named-argument call sites exist — verified), scoped per method; both projects build and their test suites pass (91 + 82). **Proposal, deliberately NOT actioned without your call:** the rule histogram shows **4,923 of 8,825 open backend issues (56%) come from two imported Roslyn perf rules**: CA1873 'avoid potentially expensive logging' (3,511) and CA1861 'avoid constant arrays as arguments' (1,412). Nobody is realistically burning these down issue-by-issue, and they bury the signal (the 44 real BUG findings were invisible under them). Options, narrowest blast radius first: 1. Scanner-side ignore via `sonar.issue.ignore.multicriteria` in sonar-scan.yml (sonar only; local builds unchanged; reversible one-liner; precedent exists in that workflow). 2. `.editorconfig` severity=none (also silences local builds — bigger call). 3. Leave them and filter in the UI (status quo). Recommend option 1 for CA1873 at minimum. Next tier of noise for later review: S101 naming (663 — fires on the deliberate Marker_*/MongoDB_HealthCheck underscore style), S1192 duplicated literals (404).
spikerj commented 2026-07-17 05:31:05 +00:00
Author
Owner
Copy Link
Copy Source

Adding a third noise-family to the proposal from continued triage: S1075 'hardcoded URIs/paths' (74 findings). Sampled sites are dominated by deliberate constants — /var/run/docker.sock in DockerMonitor (the canonical socket path), the Vault KV path delimiter in SpikerSoft.Secrets, external-provider API base URLs (Checkr/Sterling) that are config defaults. Same recommendation tier as S101/S1192: rule-level decision (deactivate or downgrade in the profile / scanner ignore), not per-issue burn-down. Awaiting your call on the whole set: CA1873 (3,511), CA1861 (1,412), S101 (663), S1192 (404), S1075 (74).

Adding a third noise-family to the proposal from continued triage: S1075 'hardcoded URIs/paths' (74 findings). Sampled sites are dominated by deliberate constants — /var/run/docker.sock in DockerMonitor (the canonical socket path), the Vault KV path delimiter in SpikerSoft.Secrets, external-provider API base URLs (Checkr/Sterling) that are config defaults. Same recommendation tier as S101/S1192: rule-level decision (deactivate or downgrade in the profile / scanner ignore), not per-issue burn-down. Awaiting your call on the whole set: CA1873 (3,511), CA1861 (1,412), S101 (663), S1192 (404), S1075 (74).
spikerj commented 2026-07-17 06:52:48 +00:00
Author
Owner
Copy Link
Copy Source

The fix half is resolved: spikersoft-backend PR #346 merged with all checks green — all 14 S927 override-parameter renames across the SecurityMonitor detectors and RemediationRuleEngine. The CA1873/CA1861/S101/S1192/S1075 noise-policy proposal moves to its own decision ticket (#643) so it stays visible. Closing.

The fix half is resolved: spikersoft-backend PR #346 merged with all checks green — all 14 S927 override-parameter renames across the SecurityMonitor detectors and RemediationRuleEngine. The CA1873/CA1861/S101/S1192/S1075 noise-policy proposal moves to its own decision ticket (#643) so it stays visible. Closing.
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
agentic
Actionable surfaced by the agentic architecture & security review
 bug
Something is not working
 duplicate
This issue or pull request already exists
 enhancement
New feature
 help wanted
Need some help
 invalid
Something is wrong
 question
More information is needed
 sonarqube
Code quality issue surfaced by SonarQube (bug / code smell)
 wontfix
This won't be fixed
No labels
Milestone
No items
No Milestone
Projects
Clear projects
No projects
Assignees
Clear assignees
spikerj (Joseph Spiker)
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: spikerj/spikersoft-issues#638