Do I need to add dependencies for custom rule for SonarJava analyzer in SonarQube?

Question

I wrote a custom plugin which scans for a method from javax.servlet.http.HttpServletRequest .

For running test cases the dependency can be added in copy execution in pom.xml file. After adding the test cases passed for the rule.

But when the repository is scanned using the plugin the method is not getting captured. How to add the dependency jar to capture the method of that class during analysis?

Answer 1

You don't need to pack dependencies with method signatures you are trying to detect. Because those methods are used in the code of the project, so naturally they should be available on the classpath of the analysis, and they will be resolved by the analyzer.

Run the analysis with debug output ( -X with mvn, see doc for others) and check that dependency is available on the classpath (the log will have a line like Classpath analyzed by Squid: )