Scan SPFx Code For Vulnerabilities Using SonarCloud In Azure DevOps

Introduction

• Install the SonarCloud Marketplace extension.
• Create a SonarCloud service connection.
• Add variables to Azure Pipelines.
• Add scan tasks to your Azure Pipelines configuration.
• Analyze the results on SonarCloud.

Install the SonarCloud Marketplace extension

• Go to the below URL and add the freely available SonarCloud Marketplace extension in Azure DevOps, as shown in the below image,
  
  https://marketplace.visualstudio.com/items?itemName=SonarSource.sonarcloud
  
  
  

• Once you click on the “Get it free” button, you will be redirected to another page where you need to select your Azure DevOps organization from the drop-down box.
  
  After selecting the organization, click on Install button and an email will be triggered to Azure admin for approval to add this extension. If the extension is already added in your DevOps account, then you will see the below image,
  
  
  

Create a SonarCloud service connection

• From Azure DevOps, navigate to your project and select Project settings in the lower corner.
  
  
  

• Under Pipelines, select Service connections.
  
  
  

• Select New service connection, then select SonarCloud, and then select Next.
  
  
  

• In the dialog box that appears, enter the below details and then click on Verify and save,
  
  
  1. SonarCloud Token
  2. Connection name

• For creating this token, navigate to the URL - https://sonarcloud.io/ . Below is the screen shot of this URL showing that you can analyze your repo from 4 sources i.e. GitHub, Bitbucket, Azure DevOps and GitLab. In this article, we will use Azure DevOps.
  
  
  

• Login to SonarCloud website using your Azure Devops account and click on “My Account” as shown in below image,
  
  
  

• Click on “Security” tab and generate the token as shown in below image,
  
  
  

• Once the token will be generated, you can copy the token and can use it in your Azure DevOps pipeline (in continuation with Step-4 above), as shown in the below image,
  
  
  

• Add the token in Azure DevOps service connection and click on Verify and save.
  
  
  

• Once the token will be verified, a new service connection will be created in Azure Devops Pipeline, as shown in the below image,
  
  
  

Add variables to Azure Pipelines

• From Azure DevOps, navigate to your pipeline and select Edit.
• Select Variables at the top right and click on “Add”.
• Create 3 variables – SonarProjectKey, SonarProjectName and SonarOrganization, as shown in below image,
  
  
  

Add scan tasks to your Azure Pipelines configuration

• Prepare Analysis Configuration task – This task is required to configure all the required settings before executing the build. For this task,
  
  
  1. You need to create an organization in SonarCloud, as shown in the below image,
     
     
     
     
  2. Once you click on “Create new organization”, a Key needs to be entered, as shown in the below image,
     
     
     
     
  3. Once key is added, you need to select a plan. You can select a Free plan for your testing purpose and then click on Create Organization, as shown in the below image,
     
     
     
     
  4. Once organization is created in SonarCloud, you can add the task in Azure Pipeline, as shown in the below image,
     
     
     

• Run Code Analysis task – This task is used to actually execute the analysis of the source code. Add this task in Azure DevOps pipeline, as shown in the below image,
  
  
  

• Publish Quality Gate Result task – This task is used to display the Quality Gate status in the build summary and give you a sense of whether the application is ready for production or not. Add this task in Azure DevOps pipeline, as shown in below image,
  
  
  

Analyze the results on SonarCloud

Summary