Hello everyone,
I've been running SonarQube (Developer Edition) for about three years now, first with a predominantly Java/Spring Boot backend and, for the last 18 months, with an expanding Node.js/TypeScript frontend and BFF layer. I have to say, I'm consistently underwhelmed by the JavaScript and TypeScript analysis compared to the Java offering. It feels like we're dealing with a different class of tool.
The depth of the Java rule set is phenomenal—it catches intricate design pitfalls, performance anti-patterns, and has a real understanding of the Spring ecosystem. With JavaScript/TypeScript, I find the rules are far more superficial. They catch the obvious syntax issues and basic bugs (which is valuable!), but they often miss the nuance of a modern JS/TS codebase.
Here are a few concrete pain points I've observed:
* **False Negatives with Framework Code:** SonarQube struggles to track issues through frameworks like Express or NestJS. A security rule that would correctly flag an unvalidated parameter in a Spring `@RestController` might completely miss the same issue in an Express route handler. The data flow analysis seems less capable.
* **TypeScript Specificity:** While it parses TypeScript, many rules don't leverage the type system for deeper analysis. For instance, issues around strict null checks or generic type misuse often slip through, which is ironic given that TypeScript's primary value is its type system.
* **Inconsistent or Missing Rules:** Some cornerstone Java rules simply don't have a JS/TS equivalent. Where's the JS/TS version of "Silly equality checks should not be made" (S2160) for complex objects? Or more advanced rules about module coupling?
Consider this trivial Express example that, in my experience, doesn't reliably trigger a security hotspot for missing input sanitization:
```javascript
// SonarQube often doesn't flag `req.query.id` as untrusted data needing validation
app.get('/user', (req, res) => {
const userId = req.query.id;
db.findUser(userId, (err, user) => { // Potential injection here
res.send(user);
});
});
```
The same pattern in Java with `HttpServletRequest.getParameter()` would be highlighted immediately.
I'm wondering if this is a universal experience. Is the underlying analyzer for JS/TS (SonarJS) fundamentally less powerful than SonarJava? Is it a matter of the language's dynamic nature making static analysis harder, or is the rule set genuinely less mature? Have any of you found effective ways to bridge this gap, perhaps through custom rules or supplementing with other linters like ESLint (with the SonarJS integration)?
I love what SonarQube does for our Java services—it's a cornerstone of our code quality gate. I just wish I could say the same for our JavaScript and TypeScript projects.
—Felix