Sonar Maven 插件无法使用密码作为 Maven 参数连接到 Oracle DB

Posted

技术标签:

【中文标题】Sonar Maven 插件无法使用密码作为 Maven 参数连接到 Oracle DB【英文标题】：Sonar Maven Plugin fails to connect to Oracle DB using password as Maven Parameter 【发布时间】：2020-10-04 20:27:29 【问题描述】：

我想通过 Maven 为我的 PL/SQL 项目运行分析。我使用这个版本的插件：

<groupId>org.sonarsource.scanner.maven</groupId>
<artifactId>sonar-maven-plugin</artifactId>
<version>3.4.0.905</version>

使用mvn sonar:sonar 运行良好，直到连接到数据库以检索数据字典信息。运行mvn -X sonar:sonar 后，我得到以下堆栈跟踪：

[DEBUG] 13:26:02.222 Unable to decrypt property sonar.plsql.jdbc.password
org.sonatype.plexus.components.sec.dispatcher.SecDispatcherException: org.sonatype.plexus.components.cipher.PlexusCipherException: java.lang.ArrayIndexOutOfBoundsException
    at org.sonatype.plexus.components.sec.dispatcher.DefaultSecDispatcher.decrypt (DefaultSecDispatcher.java:121)
    at org.sonarsource.scanner.maven.bootstrap.PropertyDecryptor.decrypt (PropertyDecryptor.java:56)
    at org.sonarsource.scanner.maven.bootstrap.PropertyDecryptor.decryptProperties (PropertyDecryptor.java:45)
    at org.sonarsource.scanner.maven.bootstrap.ScannerFactory.createGlobalProperties (ScannerFactory.java:76)
    at org.sonarsource.scanner.maven.SonarQubeMojo.execute (SonarQubeMojo.java:103)
    at org.apache.maven.plugin.DefaultBuildPluginManager.executeMojo (DefaultBuildPluginManager.java:137)
    at org.apache.maven.lifecycle.internal.MojoExecutor.execute (MojoExecutor.java:210)
    at org.apache.maven.lifecycle.internal.MojoExecutor.execute (MojoExecutor.java:156)
    at org.apache.maven.lifecycle.internal.MojoExecutor.execute (MojoExecutor.java:148)
    at org.apache.maven.lifecycle.internal.LifecycleModuleBuilder.buildProject (LifecycleModuleBuilder.java:117)
    at org.apache.maven.lifecycle.internal.LifecycleModuleBuilder.buildProject (LifecycleModuleBuilder.java:81)
    at org.apache.maven.lifecycle.internal.builder.singlethreaded.SingleThreadedBuilder.build (SingleThreadedBuilder.java:56)
    at org.apache.maven.lifecycle.internal.LifecycleStarter.execute (LifecycleStarter.java:128)
    at org.apache.maven.DefaultMaven.doExecute (DefaultMaven.java:305)
    at org.apache.maven.DefaultMaven.doExecute (DefaultMaven.java:192)
    at org.apache.maven.DefaultMaven.execute (DefaultMaven.java:105)
    at org.apache.maven.cli.MavenCli.execute (MavenCli.java:956)
    at org.apache.maven.cli.MavenCli.doMain (MavenCli.java:288)
    at org.apache.maven.cli.MavenCli.main (MavenCli.java:192)
    at sun.reflect.NativeMethodAccessorImpl.invoke0 (Native Method)
    at sun.reflect.NativeMethodAccessorImpl.invoke (NativeMethodAccessorImpl.java:62)
    at sun.reflect.DelegatingMethodAccessorImpl.invoke (DelegatingMethodAccessorImpl.java:43)
    at java.lang.reflect.Method.invoke (Method.java:498)
    at org.codehaus.plexus.classworlds.launcher.Launcher.launchEnhanced (Launcher.java:289)
    at org.codehaus.plexus.classworlds.launcher.Launcher.launch (Launcher.java:229)
    at org.codehaus.plexus.classworlds.launcher.Launcher.mainWithExitCode (Launcher.java:415)
    at org.codehaus.plexus.classworlds.launcher.Launcher.main (Launcher.java:356)
Caused by: org.sonatype.plexus.components.cipher.PlexusCipherException: java.lang.ArrayIndexOutOfBoundsException
    at org.sonatype.plexus.components.cipher.PBECipher.decrypt64 (PBECipher.java:193)
    at org.sonatype.plexus.components.cipher.DefaultPlexusCipher.decrypt (DefaultPlexusCipher.java:72)
    at org.sonatype.plexus.components.sec.dispatcher.DefaultSecDispatcher.decrypt (DefaultSecDispatcher.java:96)
    at org.sonarsource.scanner.maven.bootstrap.PropertyDecryptor.decrypt (PropertyDecryptor.java:56)
    at org.sonarsource.scanner.maven.bootstrap.PropertyDecryptor.decryptProperties (PropertyDecryptor.java:45)
    at org.sonarsource.scanner.maven.bootstrap.ScannerFactory.createGlobalProperties (ScannerFactory.java:76)
    at org.sonarsource.scanner.maven.SonarQubeMojo.execute (SonarQubeMojo.java:103)
    at org.apache.maven.plugin.DefaultBuildPluginManager.executeMojo (DefaultBuildPluginManager.java:137)
    at org.apache.maven.lifecycle.internal.MojoExecutor.execute (MojoExecutor.java:210)
    at org.apache.maven.lifecycle.internal.MojoExecutor.execute (MojoExecutor.java:156)
    at org.apache.maven.lifecycle.internal.MojoExecutor.execute (MojoExecutor.java:148)
    at org.apache.maven.lifecycle.internal.LifecycleModuleBuilder.buildProject (LifecycleModuleBuilder.java:117)
    at org.apache.maven.lifecycle.internal.LifecycleModuleBuilder.buildProject (LifecycleModuleBuilder.java:81)
    at org.apache.maven.lifecycle.internal.builder.singlethreaded.SingleThreadedBuilder.build (SingleThreadedBuilder.java:56)
    at org.apache.maven.lifecycle.internal.LifecycleStarter.execute (LifecycleStarter.java:128)
    at org.apache.maven.DefaultMaven.doExecute (DefaultMaven.java:305)
    at org.apache.maven.DefaultMaven.doExecute (DefaultMaven.java:192)
    at org.apache.maven.DefaultMaven.execute (DefaultMaven.java:105)
    at org.apache.maven.cli.MavenCli.execute (MavenCli.java:956)
    at org.apache.maven.cli.MavenCli.doMain (MavenCli.java:288)
    at org.apache.maven.cli.MavenCli.main (MavenCli.java:192)
    at sun.reflect.NativeMethodAccessorImpl.invoke0 (Native Method)
    at sun.reflect.NativeMethodAccessorImpl.invoke (NativeMethodAccessorImpl.java:62)
    at sun.reflect.DelegatingMethodAccessorImpl.invoke (DelegatingMethodAccessorImpl.java:43)
    at java.lang.reflect.Method.invoke (Method.java:498)
    at org.codehaus.plexus.classworlds.launcher.Launcher.launchEnhanced (Launcher.java:289)
    at org.codehaus.plexus.classworlds.launcher.Launcher.launch (Launcher.java:229)
    at org.codehaus.plexus.classworlds.launcher.Launcher.mainWithExitCode (Launcher.java:415)
    at org.codehaus.plexus.classworlds.launcher.Launcher.main (Launcher.java:356)
Caused by: java.lang.ArrayIndexOutOfBoundsException
    at java.lang.System.arraycopy (Native Method)
    at org.sonatype.plexus.components.cipher.PBECipher.decrypt64 (PBECipher.java:181)
    at org.sonatype.plexus.components.cipher.DefaultPlexusCipher.decrypt (DefaultPlexusCipher.java:72)
    at org.sonatype.plexus.components.sec.dispatcher.DefaultSecDispatcher.decrypt (DefaultSecDispatcher.java:96)
    at org.sonarsource.scanner.maven.bootstrap.PropertyDecryptor.decrypt (PropertyDecryptor.java:56)
    at org.sonarsource.scanner.maven.bootstrap.PropertyDecryptor.decryptProperties (PropertyDecryptor.java:45)
    at org.sonarsource.scanner.maven.bootstrap.ScannerFactory.createGlobalProperties (ScannerFactory.java:76)
    at org.sonarsource.scanner.maven.SonarQubeMojo.execute (SonarQubeMojo.java:103)
    at org.apache.maven.plugin.DefaultBuildPluginManager.executeMojo (DefaultBuildPluginManager.java:137)
    at org.apache.maven.lifecycle.internal.MojoExecutor.execute (MojoExecutor.java:210)
    at org.apache.maven.lifecycle.internal.MojoExecutor.execute (MojoExecutor.java:156)
    at org.apache.maven.lifecycle.internal.MojoExecutor.execute (MojoExecutor.java:148)
    at org.apache.maven.lifecycle.internal.LifecycleModuleBuilder.buildProject (LifecycleModuleBuilder.java:117)
    at org.apache.maven.lifecycle.internal.LifecycleModuleBuilder.buildProject (LifecycleModuleBuilder.java:81)
    at org.apache.maven.lifecycle.internal.builder.singlethreaded.SingleThreadedBuilder.build (SingleThreadedBuilder.java:56)
    at org.apache.maven.lifecycle.internal.LifecycleStarter.execute (LifecycleStarter.java:128)
    at org.apache.maven.DefaultMaven.doExecute (DefaultMaven.java:305)
    at org.apache.maven.DefaultMaven.doExecute (DefaultMaven.java:192)
    at org.apache.maven.DefaultMaven.execute (DefaultMaven.java:105)
    at org.apache.maven.cli.MavenCli.execute (MavenCli.java:956)
    at org.apache.maven.cli.MavenCli.doMain (MavenCli.java:288)
    at org.apache.maven.cli.MavenCli.main (MavenCli.java:192)
    at sun.reflect.NativeMethodAccessorImpl.invoke0 (Native Method)
    at sun.reflect.NativeMethodAccessorImpl.invoke (NativeMethodAccessorImpl.java:62)
    at sun.reflect.DelegatingMethodAccessorImpl.invoke (DelegatingMethodAccessorImpl.java:43)
    at java.lang.reflect.Method.invoke (Method.java:498)
    at org.codehaus.plexus.classworlds.launcher.Launcher.launchEnhanced (Launcher.java:289)
    at org.codehaus.plexus.classworlds.launcher.Launcher.launch (Launcher.java:229)
    at org.codehaus.plexus.classworlds.launcher.Launcher.mainWithExitCode (Launcher.java:415)
    at org.codehaus.plexus.classworlds.launcher.Launcher.main (Launcher.java:356)
[DEBUG] 13:26:02.284 Unable to decrypt property sonar.plsql.jdbc.password
org.sonatype.plexus.components.sec.dispatcher.SecDispatcherException: org.sonatype.plexus.components.cipher.PlexusCipherException: java.lang.ArrayIndexOutOfBoundsException
    at org.sonatype.plexus.components.sec.dispatcher.DefaultSecDispatcher.decrypt (DefaultSecDispatcher.java:121)
    at org.sonarsource.scanner.maven.bootstrap.PropertyDecryptor.decrypt (PropertyDecryptor.java:56)
    at org.sonarsource.scanner.maven.bootstrap.PropertyDecryptor.decryptProperties (PropertyDecryptor.java:45)
    at org.sonarsource.scanner.maven.bootstrap.ScannerFactory.createGlobalProperties (ScannerFactory.java:76)
    at org.sonarsource.scanner.maven.bootstrap.ScannerFactory.create (ScannerFactory.java:61)
    at org.sonarsource.scanner.maven.SonarQubeMojo.execute (SonarQubeMojo.java:107)
    at org.apache.maven.plugin.DefaultBuildPluginManager.executeMojo (DefaultBuildPluginManager.java:137)
    at org.apache.maven.lifecycle.internal.MojoExecutor.execute (MojoExecutor.java:210)
    at org.apache.maven.lifecycle.internal.MojoExecutor.execute (MojoExecutor.java:156)
    at org.apache.maven.lifecycle.internal.MojoExecutor.execute (MojoExecutor.java:148)
    at org.apache.maven.lifecycle.internal.LifecycleModuleBuilder.buildProject (LifecycleModuleBuilder.java:117)
    at org.apache.maven.lifecycle.internal.LifecycleModuleBuilder.buildProject (LifecycleModuleBuilder.java:81)
    at org.apache.maven.lifecycle.internal.builder.singlethreaded.SingleThreadedBuilder.build (SingleThreadedBuilder.java:56)
    at org.apache.maven.lifecycle.internal.LifecycleStarter.execute (LifecycleStarter.java:128)
    at org.apache.maven.DefaultMaven.doExecute (DefaultMaven.java:305)
    at org.apache.maven.DefaultMaven.doExecute (DefaultMaven.java:192)
    at org.apache.maven.DefaultMaven.execute (DefaultMaven.java:105)
    at org.apache.maven.cli.MavenCli.execute (MavenCli.java:956)
    at org.apache.maven.cli.MavenCli.doMain (MavenCli.java:288)
    at org.apache.maven.cli.MavenCli.main (MavenCli.java:192)
    at sun.reflect.NativeMethodAccessorImpl.invoke0 (Native Method)
    at sun.reflect.NativeMethodAccessorImpl.invoke (NativeMethodAccessorImpl.java:62)
    at sun.reflect.DelegatingMethodAccessorImpl.invoke (DelegatingMethodAccessorImpl.java:43)
    at java.lang.reflect.Method.invoke (Method.java:498)
    at org.codehaus.plexus.classworlds.launcher.Launcher.launchEnhanced (Launcher.java:289)
    at org.codehaus.plexus.classworlds.launcher.Launcher.launch (Launcher.java:229)
    at org.codehaus.plexus.classworlds.launcher.Launcher.mainWithExitCode (Launcher.java:415)
    at org.codehaus.plexus.classworlds.launcher.Launcher.main (Launcher.java:356)
Caused by: org.sonatype.plexus.components.cipher.PlexusCipherException: java.lang.ArrayIndexOutOfBoundsException
    at org.sonatype.plexus.components.cipher.PBECipher.decrypt64 (PBECipher.java:193)
    at org.sonatype.plexus.components.cipher.DefaultPlexusCipher.decrypt (DefaultPlexusCipher.java:72)
    at org.sonatype.plexus.components.sec.dispatcher.DefaultSecDispatcher.decrypt (DefaultSecDispatcher.java:96)
    at org.sonarsource.scanner.maven.bootstrap.PropertyDecryptor.decrypt (PropertyDecryptor.java:56)
    at org.sonarsource.scanner.maven.bootstrap.PropertyDecryptor.decryptProperties (PropertyDecryptor.java:45)
    at org.sonarsource.scanner.maven.bootstrap.ScannerFactory.createGlobalProperties (ScannerFactory.java:76)
    at org.sonarsource.scanner.maven.bootstrap.ScannerFactory.create (ScannerFactory.java:61)
    at org.sonarsource.scanner.maven.SonarQubeMojo.execute (SonarQubeMojo.java:107)
    at org.apache.maven.plugin.DefaultBuildPluginManager.executeMojo (DefaultBuildPluginManager.java:137)
    at org.apache.maven.lifecycle.internal.MojoExecutor.execute (MojoExecutor.java:210)
    at org.apache.maven.lifecycle.internal.MojoExecutor.execute (MojoExecutor.java:156)
    at org.apache.maven.lifecycle.internal.MojoExecutor.execute (MojoExecutor.java:148)
    at org.apache.maven.lifecycle.internal.LifecycleModuleBuilder.buildProject (LifecycleModuleBuilder.java:117)
    at org.apache.maven.lifecycle.internal.LifecycleModuleBuilder.buildProject (LifecycleModuleBuilder.java:81)
    at org.apache.maven.lifecycle.internal.builder.singlethreaded.SingleThreadedBuilder.build (SingleThreadedBuilder.java:56)
    at org.apache.maven.lifecycle.internal.LifecycleStarter.execute (LifecycleStarter.java:128)
    at org.apache.maven.DefaultMaven.doExecute (DefaultMaven.java:305)
    at org.apache.maven.DefaultMaven.doExecute (DefaultMaven.java:192)
    at org.apache.maven.DefaultMaven.execute (DefaultMaven.java:105)
    at org.apache.maven.cli.MavenCli.execute (MavenCli.java:956)
    at org.apache.maven.cli.MavenCli.doMain (MavenCli.java:288)
    at org.apache.maven.cli.MavenCli.main (MavenCli.java:192)
    at sun.reflect.NativeMethodAccessorImpl.invoke0 (Native Method)
    at sun.reflect.NativeMethodAccessorImpl.invoke (NativeMethodAccessorImpl.java:62)
    at sun.reflect.DelegatingMethodAccessorImpl.invoke (DelegatingMethodAccessorImpl.java:43)
    at java.lang.reflect.Method.invoke (Method.java:498)
    at org.codehaus.plexus.classworlds.launcher.Launcher.launchEnhanced (Launcher.java:289)
    at org.codehaus.plexus.classworlds.launcher.Launcher.launch (Launcher.java:229)
    at org.codehaus.plexus.classworlds.launcher.Launcher.mainWithExitCode (Launcher.java:415)
    at org.codehaus.plexus.classworlds.launcher.Launcher.main (Launcher.java:356)
Caused by: java.lang.ArrayIndexOutOfBoundsException
    at java.lang.System.arraycopy (Native Method)
    at org.sonatype.plexus.components.cipher.PBECipher.decrypt64 (PBECipher.java:181)
    at org.sonatype.plexus.components.cipher.DefaultPlexusCipher.decrypt (DefaultPlexusCipher.java:72)
    at org.sonatype.plexus.components.sec.dispatcher.DefaultSecDispatcher.decrypt (DefaultSecDispatcher.java:96)
    at org.sonarsource.scanner.maven.bootstrap.PropertyDecryptor.decrypt (PropertyDecryptor.java:56)
    at org.sonarsource.scanner.maven.bootstrap.PropertyDecryptor.decryptProperties (PropertyDecryptor.java:45)
    at org.sonarsource.scanner.maven.bootstrap.ScannerFactory.createGlobalProperties (ScannerFactory.java:76)
    at org.sonarsource.scanner.maven.bootstrap.ScannerFactory.create (ScannerFactory.java:61)
    at org.sonarsource.scanner.maven.SonarQubeMojo.execute (SonarQubeMojo.java:107)
    at org.apache.maven.plugin.DefaultBuildPluginManager.executeMojo (DefaultBuildPluginManager.java:137)
    at org.apache.maven.lifecycle.internal.MojoExecutor.execute (MojoExecutor.java:210)
    at org.apache.maven.lifecycle.internal.MojoExecutor.execute (MojoExecutor.java:156)
    at org.apache.maven.lifecycle.internal.MojoExecutor.execute (MojoExecutor.java:148)
    at org.apache.maven.lifecycle.internal.LifecycleModuleBuilder.buildProject (LifecycleModuleBuilder.java:117)
    at org.apache.maven.lifecycle.internal.LifecycleModuleBuilder.buildProject (LifecycleModuleBuilder.java:81)
    at org.apache.maven.lifecycle.internal.builder.singlethreaded.SingleThreadedBuilder.build (SingleThreadedBuilder.java:56)
    at org.apache.maven.lifecycle.internal.LifecycleStarter.execute (LifecycleStarter.java:128)
    at org.apache.maven.DefaultMaven.doExecute (DefaultMaven.java:305)
    at org.apache.maven.DefaultMaven.doExecute (DefaultMaven.java:192)
    at org.apache.maven.DefaultMaven.execute (DefaultMaven.java:105)
    at org.apache.maven.cli.MavenCli.execute (MavenCli.java:956)
    at org.apache.maven.cli.MavenCli.doMain (MavenCli.java:288)
    at org.apache.maven.cli.MavenCli.main (MavenCli.java:192)
    at sun.reflect.NativeMethodAccessorImpl.invoke0 (Native Method)
    at sun.reflect.NativeMethodAccessorImpl.invoke (NativeMethodAccessorImpl.java:62)
    at sun.reflect.DelegatingMethodAccessorImpl.invoke (DelegatingMethodAccessorImpl.java:43)
    at java.lang.reflect.Method.invoke (Method.java:498)
    at org.codehaus.plexus.classworlds.launcher.Launcher.launchEnhanced (Launcher.java:289)
    at org.codehaus.plexus.classworlds.launcher.Launcher.launch (Launcher.java:229)
    at org.codehaus.plexus.classworlds.launcher.Launcher.mainWithExitCode (Launcher.java:415)
    at org.codehaus.plexus.classworlds.launcher.Launcher.main (Launcher.java:356)

我将pom.xml 中的sonar.plsql.jdbc.password 设置为$settings.servers.db-dev.password，并且此参数在我的settings.xml 文件中设置。我仔细检查了 Maven 是否读取了正确的 settings.xml 文件。

实际上，在输出的最后，我从 db 收到 logon denied 错误，这意味着插件尝试连接（它是否使用 $settings.servers.db-dev.password 作为纯文本密码？）到 db 虽然之前它未能获得密码。

所以我的问题是：

    为什么 Maven 插件不能通过参数字符串获取密码？我很好奇，因为他可以将username 作为参数字符串传递。 （我的密码是 maven 加密还是纯文本都没关系） 如果这是已知行为，那么是否有任何其他方法可以加密您的数据库密码并将其传递给声纳 maven 插件？

UPD：这是我的 pom.xml 带有服务器扩展的文章：

        <extensions>
            <extension>
                <groupId>com.github.shyiko.servers-maven-extension</groupId>
                <artifactId>servers-maven-extension</artifactId>
                <version>1.3.1</version>
            </extension>
        </extensions>

这是一个声纳配置：

        <sonar.login>$spdb-beholder.sonar.login</sonar.login>
        <sonar.host.url>$spdb-beholder.sonar.host</sonar.host.url>
        <sonar.plsql.jdbc.url>$liquibase.url</sonar.plsql.jdbc.url>
        <sonar.plsql.jdbc.user>$settings.servers.db-dev.username</sonar.plsql.jdbc.user>
        <sonar.plsql.jdbc.password>$settings.servers.db-dev.password</sonar.plsql.jdbc.password>
        <sonar.plsql.jdbc.defaultSchema>$liquibase.user.owner</sonar.plsql.jdbc.defaultSchema>
        <sonar.projectName>spdb-beholder</sonar.projectName>
        <sonar.projectKey>spdb-beholder</sonar.projectKey>
        <sonar.plsql.file.suffixes>sql,vw,pkb</sonar.plsql.file.suffixes>
        <sonar.sources>src/main/resources/migration/compiled</sonar.sources>
        <sonar.tests>src/main/resources/migration/tests</sonar.tests>
        <sonar.plsql.jdbc.driver>$liquibase.driver</sonar.plsql.jdbc.driver>
        <sonar.plsql.jdbc.driver.path>$project.build.directory/lib/ojdbc8-12.2.0.1.jar</sonar.plsql.jdbc.driver.path>
        <sonar.plsql.jdbc.driver.class>oracle.jdbc.OracleDriver</sonar.plsql.jdbc.driver.class>

        <sonar.sourceEncoding>UTF-8</sonar.sourceEncoding>
        <sonar.language>plsql</sonar.language>
        <sonar.coverageReportPaths>$project.build.directory/coverage-sonar-reporter.xml</sonar.coverageReportPaths>
        <sonar.testExecutionReportPaths>$project.build.directory/sonar-test-reporter.xml</sonar.testExecutionReportPaths>

我还检查了这是否有效：

        <sonar.plsql.jdbc.user>$settings.servers.db-dev.username</sonar.plsql.jdbc.user>
        <sonar.plsql.jdbc.password>unencryptedpasswordfordb</sonar.plsql.jdbc.password>

它没有。所以不取决于你传入$参数是什么参数。

我发现了这篇文章：https://docs.sonarqube.org/latest/instance-administration/security/#header-6 我不太喜欢它，因为我必须在本地机器上保存密钥，因为我还要测试向 Sonar 发布的测试结果。

【问题讨论】：

首先我建议升级到最新版本的插件此外，您能否展示一下您是如何配置整个故事的？通常您通过访问令牌而不是数据库访问 SonarQube？（请详细解释）..为什么？ `通过参数字符串获取密码是什么意思？ `? 是的，我使用令牌和主机地址连接到 Sonar，它运行良好。但是在分析 pl/sql 源代码（它是一种 Oracle 数据库过程语言）时，Sonar 想要连接到 DB 以获取数据字典的内容。 “参数字符串”是指$settings.servers.db-dev.password 字符串。我会在问题中添加一些额外的信息。 我认为，docs.sonarqube.org/latest/instance-administration/security/… 不应该打扰你 - 它只是用于 sonarqube 服务器配置。通过查看 sonar-scanner-maven-plugin 的代码，每个属性，其中有名称 password，将尝试通过 mavens 密码加密基础设施解密.. 从查看源代码，我看不出，为什么即使是未加密的值也会被尝试解密 一步一步看：如果使用mvn -x sonar:sonar 运行...你能在属性列表中看到你的settings.xml 中的值，这些值被移交给插件执行吗？ @RobertKleinschmager 不，实际上。就是这样：[DEBUG] Configuration: &lt;?xml version="1.0" encoding="UTF-8"?&gt; &lt;configuration&gt; &lt;mojoExecution default-value="$mojoExecution"/&gt; &lt;session default-value="$session"/&gt; &lt;skip default-value="false"&gt;$sonar.skip&lt;/skip&gt; &lt;/configuration&gt; 恐怕server 引用只能在configuration 标记中处理，而不能在properties 部分处理。我还使用 liquibase maven 插件，它在 configuration 部分下有用户名/密码，即使使用加密的 db-password 也可以很好地与 servers 配合使用。 【参考方案1】：

maven 不支持通过$ 表达式访问服务器属性。您可以使用以下扩展名：https://github.com/shyiko/servers-maven-extension

How to get the values of server defined in the settings.xml to use them in my pom.xml?也回答了这个问题

【讨论】：

是的，我知道这个插件并且我拥有它。问题是使用这个插件我无法管理声纳连接到数据库。

以上是关于Sonar Maven 插件无法使用密码作为 Maven 参数连接到 Oracle DB的主要内容，如果未能解决你的问题，请参考以下文章

使用Jenkins Sonar插件构建成功后，Sonar没有显示代码覆盖率

sonar扫描多模块的maven项目

为啥 Maven 命令“mvn sonar:sonar”在我的“pom.xml”中没有任何插件配置就可以工作？

SonarQube 5.1.2和Maven 3.3集成

无法在项目 jraft 上执行目标 org.sonarsource.scanner.maven:sonar-maven-plugin:3.3.0.603:sonar (default-cli)：没有治

jenkins+gradle/maven+sonar+pipline