Sensor to read reports from the Cppckeck tool. Cppcheck is a static analysis tool for C/C++ code. It provides unique code analysis to detect bugs and focuses on detecting undefined behaviour and dangerous coding constructs. Cppcheck is designed to be able to analyze your C/C++ code even if it has non-standard syntax (common in embedded projects).

Note: The cxx plugin itself does not run the tool, you have to do that yourself beforehand. The sensor only reads the report generated by the tool!

• Link to the tool page: http://cppcheck.sourceforge.net/
• The sensor supports rules from Cppcheck 2.9 (and previous versions).
• The report must be generated with XML file version 2 (default in Cppcheck > 1.81, in older version you have to use --xml-version=2).

In order to run Cppcheck and generate a fitting report, make sure:

• to call it from the projects root directory, so that the paths in the report fit
• to pass all include directories (using -I <path>) as otherwise the analysis will be incomplete
• that the parameter matches the sonar.sources list in sonar-project.properties
• to get the report from the standard error channel

A Cppcheck run may take a while on a big code base. To cut down analysis times, check the following options:

• use -j N option to run N workers in parallel
• use only checks you're interested in via the option --enable=<check>
• restrict checking of preprocessor configurations using the options -D -U
• start with project include folders (-I) without system include folders. System include folders and include folders of big libraries like Boost, XERXES, ... make Cppcheck run much slower.

Sample command lines:

cppcheck --xml . 2> report.xml
cppcheck -v --enable=all --xml -I[include directory] [sources] 2> report.xml

If the tool was executed successfully, a report like the example below should be generated:

<?xml version="1.0" encoding="UTF-8"?>
<results version="2">
    <cppcheck version="x.yz"> <!--version used for analysis-->
    <errors>
        <error id="someError" severity="error" msg="short error text"
            verbose="long error text" inconclusive="true">
            <location file=".\file1.cpp" line="1"/>
        </error>
    </errors>
</results>

1. First check if the file extensions read in by the cxx plugin are set (sonar.cxx.file.suffixes).
2. The rules for which you want to generate issue must be activated in the Quality Profile of your project. You can find instructions on how to do this under Manage Quality Profiles.
3. Set the analysis parameter sonar.cxx.cppcheck.reportPaths in the configuration file sonar-project.properties of your project. The Report Paths link describes the configuration options.
4. Execute the SonarScanner to transfer the project with the report to the SonarQube Server.

Sample for sonar-project.properties:

sonar.cxx.cppcheck.reportPaths=cppcheck.xml

• If no results are displayed after a successful scan, check Manage Quality Profiles first.
• If scanning is failing, check items listed under Troubleshooting Configuration.
• If no issues are displayed for your source code in SonarQube, check the items listed under Troubleshooting Reports.
• In the case of incomplete scans, Detect and fix parsing errors gives advice on how to fix this.