概述
我正在使用 SonarQube 7.4.0.18908 来收集代码覆盖率并为 Python 3.6 项目执行静态代码分析。服务器在 AWS 中运行。事情按预期工作（见下面的截图）。
现在我想为项目添加安全扫描。我“选择”了Bandit，但实际上这似乎是目前与 SonarQube for Python 集成的唯一工具，如Import Bandit Issues Reports中所述。SonarPython 插件支持安装在 SonarQube 服务器上的 Bandit 分析。为了在本地生成漏洞报告，我使用的是 Bandit 1.5.1 pip3 模块。
问题
漏洞报告没有显示 - 甚至可能没有上传 - 到 SonarQube（参见下面的相同屏幕截图）。
重现步骤
我将此行添加到项目的sonar-project.properties文件中：
sonar.python.bandit.reportPaths=bandit-report.json
然后我运行了报告：
pip3 install bandit==1.5.1
bandit --format json --output bandit-report.json --recursive src
我验证了它bandit-report.json包含正确的数据：
{
"errors": [],
"generated_at": "2019-01-30T14:49:18Z",
"metrics": {
...
"results": [
{
"code": "8 def prepare_df_for_comparison(df, name, ignore_columns=None, sort_columns=None):\n9 assert df is not None\n10 \n11 # upper-case all columns\n12 df.columns = [x.upper() for x in df.columns]\n",
"filename": "./build/lib/tasks/compare_df.py",
"issue_confidence": "HIGH",
"issue_severity": "LOW",
"issue_text": "Use of assert detected. The enclosed code will be removed when compiling to optimised byte code.",
...
然后我发布到 SonarQube：
sonar-scanner
扫描仪的输出：
INFO: Scanner configuration file: NONE
INFO: Project root configuration file: /root_dir/sonar-project.properties
INFO: SonarQube Scanner 3.2.0.1227
INFO: Java 1.8.0_191 Oracle Corporation (64-bit)
INFO: Linux 4.9.125-linuxkit amd64
INFO: User cache: /root/.sonar/cache
INFO: SonarQube server 7.4.0
INFO: Default locale: "en_US", source code encoding: "UTF-8" (analysis is platform dependent)
INFO: Publish mode
INFO: Load global settings
INFO: Load global settings (done) | time=126ms
INFO: Server id: <snip>
INFO: User cache: /root/.sonar/cache
INFO: Load/download plugins
INFO: Load plugins index
INFO: Load plugins index (done) | time=102ms
INFO: Load/download plugins (done) | time=130ms
INFO: Loaded core extensions:
INFO: Process project properties
INFO: Load project repositories
INFO: Load project repositories (done) | time=84ms
INFO: Load quality profiles
INFO: Load quality profiles (done) | time=33ms
INFO: Load active rules
INFO: Load active rules (done) | time=554ms
INFO: Load metrics repository
INFO: Load metrics repository (done) | time=27ms
INFO: Project key: security-scan
INFO: Project base dir: /root_dir/src
INFO: ------------- Scan Security Scan
INFO: Base dir: /root_dir/src
INFO: Working dir: /root_dir/src/.scannerwork
INFO: Source paths: config, dag_factories, operators, tasks
INFO: Test paths: tests
INFO: Source encoding: UTF-8, default locale: en_US
INFO: Load server rules
INFO: Load server rules (done) | time=187ms
INFO: Language is forced to py
INFO: Index files
INFO: Excluded sources:
INFO: **/*.pyc
INFO: **/*.ini
INFO: Excluded tests:
INFO: **/*.pyc
INFO: 95 files indexed
INFO: 82 files ignored because of inclusion/exclusion patterns
INFO: Quality profile for py: Sonar way
INFO: Sensor Python Squid Sensor [python]
WARN: Metric 'comment_lines_data' is deprecated. Provided value is ignored.
INFO: Sensor Python Squid Sensor [python] (done) | time=2831ms
INFO: Sensor PythonXUnitSensor [python]
INFO: Sensor PythonXUnitSensor [python] (done) | time=318ms
INFO: Sensor JaCoCo XML Report Importer [jacoco]
INFO: Sensor JaCoCo XML Report Importer [jacoco] (done) | time=6ms
INFO: Sensor SonarJavaXmlFileSensor [java]
INFO: Sensor SonarJavaXmlFileSensor [java] (done) | time=1ms
INFO: Sensor Zero Coverage Sensor
INFO: Sensor Zero Coverage Sensor (done) | time=54ms
INFO: SCM Publisher is disabled
INFO: 3 files had no CPD blocks
INFO: Calculating CPD for 61 files
INFO: CPD calculation finished
INFO: Analysis report generated in 2349ms, dir size=617 KB
INFO: Analysis reports compressed in 15384ms, zip size=233 KB
INFO: Analysis report uploaded in 108ms
INFO: ANALYSIS SUCCESSFUL, you can browse https://sonarqube.mydomain/dashboard?id=security-scan
INFO: Note that you will be able to access the updated dashboard once the server has processed the submitted analysis report
INFO: More about the report processing at https://sonarqube.mydomain/api/ce/task?id=<snip>
INFO: Task total time: 26.187 s
INFO: ------------------------------------------------------------------------
INFO: EXECUTION SUCCESS
INFO: ------------------------------------------------------------------------
INFO: Total time: 27.558s
INFO: Final Memory: 16M/295M
INFO: ------------------------------------------------------------------------
这是完整的sonar-project.properties文件：
sonar.host.url=https://sonarqube.mydomain
sonar.scm.disabled=true
sonar.projectKey=security-scan
sonar.projectName=Security Scan
sonar.projectVersion=1.0
sonar.language=py
sonar.sources=src
sonar.tests=tests
sonar.python.coverage.reportPath=coverage.xml
sonar.python.bandit.reportPaths=bandit-report.json
sonar.exclusions=**/*.pyc,**/*.ini
sonar.test.exclusions=**/*.pyc
但是我在 SonarQube UI 中没有看到这个报告。我错过了什么？
相关问题
这是我可以在 SO 上找到的唯一相关问题。我的问题不一样。正如我所提到的，Bandit 报告是在本地正确生成的。但问题似乎在于上传到 SonarQube。
