« Blog Home

SonarQube and JavaScript

December 9, 2025 ¬ 1:36 amh.Tamir Gefen

In the following article, I will review SonarQube capabilities related to JavaScript (JS) that help developers and development managers, including demonstrations.

SonarQube offers Static Application Security Testing (SAST) for over 30 languages and frameworks (including infrastructure languages).
One of the most popular among them is JavaScript (JS).
The tool offers over 420 rules for JS (many of them unique) and supports 5 aspects:
Bugs, Security Vulnerability, Security Hotspot, Code Smell, and Quick fix.
You can receive a detailed and up-to-date Excel file from us containing all rules for JS (and other languages) – contact us via the email listed below.

Bugs

SonarQube has over 80 rules for JS that detect bugs and explain how to fix them.
Here are a few examples:

Security Vulnerability

SonarQube currently has over 30 rules for JS that detect security vulnerabilities and explain how to fix them.
Here are a few examples:

"memset" should not be used to delete sensitive data

Accessing files should not introduce TOCTOU vulnerabilities

Security Hotspot

SonarQube has over 60 rules for JS that detect Security Hotspots and explain how to fix them.

A Security Hotspot is an area in the code suspected of being a vulnerability – usually due to working with sensitive APIs, patterns, or actions that might be sensitive – requiring human review to decide if a vulnerability exists.
Here are a few examples:

Setting loose POSIX file permissions is security-sensitive

Using "strncpy" or "wcsncpy" is security-sensitive

Code Smell

SonarQube has over 240 rules for JS that detect Code Smells and explain how to fix them.
Here are a few examples:

Collapsible "if" statements should be merged

What makes SonarQube particularly suitable for JavaScript?

Wide range of rules (over 420)
Adaptation to many JS frameworks (such as React, Node.JS, Vue.js, Angular, etc. – details below)
“Clean Code” approach
Fast scanning! Including Incremental analysis (only on changed code) and Multi-threaded analysis for optimal use of computing resources
Detection of bugs related to information security
Strong integration with development processes and CI
Integration with IDEs and development tools that support JavaScript
Quality support from the vendor, including local support options or our managed service, saving you the need to deal with server maintenance and ongoing operations

SonarQube and JS Demo Video

Below is a demo video of SonarQube integrated with JavaScript.
For your convenience, we have added key points on the video timeline (clickable via the player):

13:20 Demonstration of Clean Code and New Code with JS using SonarQube
18:20 68% of developers write JavaScript

Support for a wide range of standards and Frameworks:

Editions 3 & 5, ECMAScript 2015 to 2022
React JSX, Angular, Vue.js, Node.js, Express, Flow
Support for Test Frameworks (Mocha, Chai)
Support for Cloud native applications:
Dedicated AWS CDK rules to find vulnerabilities in cloud infrastructures described by JS/TS
Support for database APIs:
Sequelize, pg, pg-pool, pg-promise, mysql, mysql2, sqlite3, better-sqlite3, knex, MongoDB node.js, Mongoose ODM
OWASP Top 10
CWE Top 25
SANS Top 25
PCI DSS

Support for various operating systems and compilers (also for scanning code in other languages):

Windows, Linux, macOS
Clang, GCC, MSVC, ARM, QNX compilers
Intel compilers for Linux, macOS
Compilers based wholly on GCC including Linaro GCC
Wind River Diab and GCC
IAR compilers for 8051, ARM, AVR32, AVR, Renesas RL78, Renesas RX, Renesas V850, Renesas H8, and Texas Instruments MSP430
Texas Instruments compilers on Windows and macOS for ARM, C2000, C6000, C7000, MSP430, PRU

Pricing and Cost Information

Most rules detecting security issues in JavaScript code are not available in the free edition (Community Edition) of SonarQube.
Full support for JavaScript exists in the following editions: Developer Edition, Enterprise Edition, and DataCenter Edition.
Support for Security Reports and OWASP is available only in the SonarQube Enterprise edition.

SonarQube pricing depends on several parameters. For more details on the differences between editions, you can read the following article or contact us (details below).