Demo SAST Analysis

Perform Static Application Security Testing (SAST) on your JavaScript (Node.js) code using SonarQube. We assume SonarQube is running at http://<host>:9000.

1. Configure the Default Quality Gate

1. Log in to SonarQube and navigate to Quality Gates.
2. Select Dasher-Quality-Gate and click Set as default.
3. Verify the key condition: Overall Coverage < 90%.

2. Create a New Project

2.1. Define Project Basics

1. Click Create Project → Manually.
2. Fill in the form:
   • Project Display Name: Solar-System-Project
   • Project Key: Solar-System-Project
   • Main Branch Name: main

2.2. Select Technology and OS

• Under Technology, choose Other.
• For Operating System, select Linux.

2.3. Generate an Authentication Token

1. In the project dashboard, click Generate Token.
2. Provide a name and select No expiration (for demo only).

3. Local Analysis with sonar-scanner

Install the SonarQube Scanner locally or via your package manager. Then run:

sonar-scanner \
  -Dsonar.projectKey=Solar-System-Project \
  -Dsonar.sources=. \
  -Dsonar.host.url=http://<host>:9000 \
  -Dsonar.login=<YOUR_TOKEN>

4. Jenkins Pipeline Configuration

Integrate SAST into your CI by adding a SonarQube stage to your Jenkinsfile:

pipeline {
  agent any
  environment {
    SONAR_SCANNER_HOME = tool 'sonarqube-scanner-6.1.0'
  }
  stages {
    stage('Installing Dependencies')   { steps { /* ... */ } }
    stage('Dependency Scanning')      { steps { /* ... */ } }
    stage('Unit Testing')             { steps { /* ... */ } }
    stage('Code Coverage')            { steps { /* ... */ } }
    stage('SAST - SonarQube') {
      steps {
        sh 'echo $SONAR_SCANNER_HOME'
        sh """
          $SONAR_SCANNER_HOME/bin/sonar-scanner \
            -Dsonar.projectKey=Solar-System-Project \
            -Dsonar.sources=app.js \
            -Dsonar.host.url=http://<host>:9000 \
            -Dsonar.login=<YOUR_TOKEN>
        """
      }
    }
  }
}

For more options, see the Jenkins Pipeline Syntax guide.

5. Installing SonarScanner in Jenkins

1. Go to Manage Jenkins → Manage Plugins.
2. Under Available, search for sonar and install SonarQube Scanner. Restart Jenkins.

3. After restart, navigate to Manage Jenkins → Global Tool Configuration → SonarQube Scanner.
   • Name: sonarqube-scanner-6.1.0
   • Select Install automatically from Maven Central

6. First SonarQube Analysis Result

Run your Jenkins pipeline. After it completes, refresh SonarQube:

ANALYSIS SUCCESSFUL, you can find the results at: http://<host>:9000/dashboard?id=Solar-System-Project

Coverage is reported as 0%, so the Quality Gate fails (coverage < 90%).

7. Adding Code Coverage Reports

1. Generate coverage before the SonarQube stage:

   npm run coverage
   

   This creates ./coverage/lcov.info.

2. Import the report by updating the scanner command:

   stage('SAST - SonarQube') {
     steps {
       sh 'echo $SONAR_SCANNER_HOME'
       sh """
         $SONAR_SCANNER_HOME/bin/sonar-scanner \
           -Dsonar.projectKey=Solar-System-Project \
           -Dsonar.sources=app.js \
           -Dsonar.host.url=http://<host>:9000 \
           -Dsonar.javascript.lcov.reportPaths=./coverage/lcov.info \
           -Dsonar.login=<YOUR_TOKEN>
       """
     }
   }
   

After rerunning the pipeline, your coverage will appear (e.g., 73%) but still below 90%.

Links and References

• SonarQube Documentation
• Jenkins Pipeline Syntax
• npm test scripts