sonarqube 9.4 issue

[nzin-appdirect]

• I just installed Sonarqube 9.4 with the 1.8 groovy plugin
• when scanning a project (with the latest “sonar-scanner”)
• if there are some .groovy file (in a test folder), I get the following error

ERROR: Error during SonarScanner execution
org.codehaus.groovy.runtime.typehandling.GroovyCastException: Cannot cast object ', (comma)' with class 'java.lang.String' to class 'char'
	at org.codehaus.groovy.runtime.typehandling.ShortTypeHandling.castToChar(ShortTypeHandling.java:72)
	at org.codehaus.groovy.runtime.typehandling.DefaultTypeTransformation.charUnbox(DefaultTypeTransformation.java:73)
	at org.codehaus.groovy.runtime.typehandling.DefaultTypeTransformation.castToPrimitive(DefaultTypeTransformation.java:341)
	at org.codehaus.groovy.runtime.typehandling.DefaultTypeTransformation.castToType(DefaultTypeTransformation.java:242)
	at groovy.lang.MetaClassImpl.setProperty(MetaClassImpl.java:2716)
	at groovy.lang.MetaClassImpl.setProperty(MetaClassImpl.java:3785)
...

[deyanstoykov]

We are also experiencing this problem, it only appears when using the sonar scanner for gradle. If we scan the same project with the standalone scanner or the maven scanner, it works.

We added the parameter below to the gradle command line to disable scanning of groovy files only on gradle projects.
-Dsonar.groovy.file.suffixes=.FOOBAR123

[peeyushsurolia]

Any updates on this issue ?

[deyanstoykov]

Looking at the SonarQube 9.4 changelog, this looks like a possible root cause:

[SONAR-15966] Use Spring instead of Pico as dependency injection framework in the scanner-engine

[deyanstoykov]

Disabling the "Duplicated string literal" rule fixed the issue for us (the stacktrace is not the same as yours though).

I recommend to carefully inspect the stacktrace for references to specific rules or any other hints.

[dvuke]

I just tested out the groovy plugin with:
sonarqube 9.6
plugin 1.8

I'm using the gradle sonarqube plugin in a grails application.

I'm seeing the groovy files in the code coverage, but there's no security/vulnerabilities being found. When inspecting the rules for the groovy language, i also saw none were defined.

is it safe to say that the groovy plugin doesn't identify security hotspots and vulnerabilities in the scans or do i have an environment issue?

[Malgosiatobiasz1]

Hi @TobiX , any updates on this issue? We are also experiencing this problem with sonarqube 9.7.1 and 1.8 groovy plugin

[TobiX]

See #179 - Pull requests always welcome!