sonar-cxx

SonarQube C++ Community plugin (cxx plugin)

SonarQube is an open platform to manage code quality. This plugin adds C++ support to SonarQube with the focus on integration of existing C++ tools.

The sensors for reading reports can be used with this cxx plugin or SonarCFamily plugin.

License

This plugin is free software; you can redistribute it and/or modify it under the terms of the GNU Lesser General Public License as published by the Free Software Foundation; either version 3 of the License, or (at your option) any later version.

Features

• parser supporting
  • C++03, C++11, C++14,C++17, C++20, C++23
  • C89, C99, C11, C17
• compiler specific extensions
  • Microsoft extensions: C++/CLI, Attributed ATL
  • GNU extensions
  • CUDA extensions
• Microsoft Windows and Linux for runtime environment

Sensors for static and dynamic code analysis:

• Cppcheck warnings support (http://cppcheck.sourceforge.net/)
  • sonar.cxx.cppcheck.reportPaths
• GCC/G++ warnings support (https://gcc.gnu.org/)
  • sonar.cxx.gcc.reportPaths
• Visual Studio and Core Guideline Checker warnings support (https://www.visualstudio.com/)
  • sonar.cxx.vc.reportPaths
• Clang Static Analyzer support (https://clang-analyzer.llvm.org/)
  • sonar.cxx.clangsa.reportPaths
• Clang-Tidy warnings support (http://clang.llvm.org/extra/clang-tidy/)
  • sonar.cxx.clangtidy.reportPaths
• Infer warnings support (https://fbinfer.com/)
  • sonar.cxx.infer.reportPaths
• PC-Lint warnings support (http://www.gimpel.com/)
  • sonar.cxx.pclint.reportPaths
• RATS (https://github.com/andrew-d/rough-auditing-tool-for-security)
  • sonar.cxx.rats.reportPaths
• Valgrind (http://valgrind.org/)
  • sonar.cxx.valgrind.reportPaths
• Vera++ (https://bitbucket.org/verateam/vera/wiki/Home)
  • sonar.cxx.vera.reportPaths
• Dr. Memory warnings support (http://drmemory.org/)
  • sonar.cxx.drmemory.reportPaths
• Generic Issue Import Format support
• any other tool can be integrated:
  • Generic issue import format support
  • Importing issues from SARIF reports
  • sonar.cxx.other.reportPaths

Test framework sensors for:

• XUnit file format
  • sonar.cxx.xunit.reportPaths
• Google Test (gtest) file format (https://github.com/google/googletest)
  • sonar.cxx.xunit.reportPaths
• Boost.Test file format (https://www.boost.org/doc/libs/release/libs/test/)
  • sonar.cxx.xunit.reportPaths with sonar.cxx.xslt
• ctest (cmake) file format (https://cmake.org/cmake/help/latest/manual/ctest.1.html)
  • sonar.cxx.xunit.reportPaths with ctest option --output-junit
• CppTest file format (https://cpptest.sourceforge.io/)
  • sonar.cxx.xunit.reportPaths with sonar.cxx.xslt
• CppUnit file format (https://sourceforge.net/projects/cppunit/)
  • sonar.cxx.xunit.reportPaths with sonar.cxx.xslt
• VSTest file format (https://github.com/microsoft/vstest)
  • sonar.cxx.vstest.reportPaths
• NUnit file format (https://nunit.org/)
  • sonar.cxx.nunit.reportPaths
• any other tool can be integrated:
  • Generic test execution report format support
  • adaptations possible via XLST: sonar.cxx.xslt

Coverage sensors for:

• Visual Studio coverage reports (https://www.visualstudio.com/)
  • sonar.cxx.vscoveragexml.reportPaths
• BullseyeCoverage reports (http://www.bullseye.com/)
  • sonar.cxx.bullseye.reportPaths
• Cobertura coverage reports (http://cobertura.github.io/cobertura/)
  • gcov / gcovr coverage reports with option --xml https://gcovr.com/en/stable/guide.html
  • OpenCppCoverage with option --export_type=cobertura (https://github.com/OpenCppCoverage/OpenCppCoverage/)
  • sonar.cxx.cobertura.reportPaths
• Testwell CTC++ coverage reports (https://www.verifysoft.com/en_ctcpp.html)
  • sonar.cxx.ctctxt.reportPaths
• any other tool can be integrated:
  • Generic test coverage report format support
  • adaptations possible via XLST: sonar.cxx.xslt

Simple to customize

• custom rules by regular expression template possible
• custom rules by XPath template rule possible
• extend CXX repositories with custom rules
• easy 3rd party tool integration with XML rule definitions and reports possible
  • sonar.cxx.other.reportPaths
• provide the ability to add custom rules
  • Writing a SonarQube plugin in Java that uses SonarQube APIs to add new rules

Quickstart

1. Setup a SonarQube instance
2. Install the Plugin
3. Run an analysis

Resources

• Latest release
• Download latest snapshot
• Documentation
• Issue Tracker

Contributing

You are welcome to contribute. Help is needed.

Alternatives

That's not the only choice when you are looking for C++ support in SonarQube there is also

• the commercial SonarCFamily plugin from SonarSource
• the commercial C/C++ plugin from CppDepend
• the commercial PVS-Studio plugin
• the Coverity plugin

Choose whatever fits your needs.