Missing Description and CWE when importing from sonarqube

[valentijnscholten]

Discussed in https://github.com/DefectDojo/django-DefectDojo/discussions/12539

^{Originally posted by nmathews24 June 2, 2025} After we upgraded Sonarqube to v2025.1.1, the sonarqube import-scan is not pulling some fields like Description and CWE in Defectdojo. It seems the htmlDesc field is not returned in the Rules object anymore with this Sonarqube version and importer.py under DefectDojo/django-DefectDojo/tree/master/dojo/tools/api_sonarqube seems to be looking for this to populate some info. Anyone facing similar issue and aware of any fix?

[nmathews24]

Anyone aware of this issue or of a fix for this? Importing scans from Sonarqube using API is not pulling key fields like Description and CWE into Defectdojo. Any input will be helpful.

Following is the code within django-DefectDojo/dojo/tools/api_sonarqube/importer.py. The if block never gets executed now since 'htmlDesc' is deprecated and not returned in responses with Sonarqube v2025.1.1

if "htmlDesc" in rule: description = self.clean_rule_description_html( rule["htmlDesc"], ) cwe = self.clean_cwe(rule["htmlDesc"]) references = sonarqube_permalink + self.get_references(rule["htmlDesc"]) else: description = "" cwe = None

[valentijnscholten]

Are you able to test and do a PR? I don't think we have access to a SonarQube (cloud) instance currently which makes it hard or even impossible for us to work on this.