SonarSource/sonarqube · info

############################################################…

Error message

####################################################################################################################

What it means

PluginConsentVerifier.addWarningInSonarDotLog emits a highly visible three-line banner in sonar.log (line 79 is the '###...' highlighter line) whenever any plugin is detected. SonarQube prints it because plugins are not provided by SonarSource and are installed at the administrator's own risk; the administrator must acknowledge the risk in the UI once.

Solutions

1. Log in as a SonarQube administrator and accept the plugin risk acknowledgment in the notification shown in the UI
2. If no plugins are intended, remove JARs from extensions/plugins and restart
3. For scripted environments, acknowledge once via the admin web service/UI so the banner stops appearing

// only ship plugins you actually need; before startup verify:
File pluginsDir = new File("extensions/plugins");
boolean hasPlugins = pluginsDir.exists() &&
  Objects.requireNonNullElse(pluginsDir.list((d, n) -> n.endsWith(".jar")), new String[0]).length > 0;
if (hasPlugins) scheduleAdminConsentStep();

When it happens

Trigger: SonarQube starts (PluginConsentVerifier.start) with at least one plugin JAR present in extensions/plugins, before the administrator has acknowledged the plugin risk notice.

Common situations: First install of any third-party plugin; upgrade/migration carrying over plugins; automation/test environments where the consent flag was never recorded.

Related errors

• Plugin(s) detected. Plugins are not provided by SonarSource…
• Plugin [ ] is blacklisted and is being uninstalled
• Plugin [ ] is ignored because entry point class is not…
• Plugin [ ] is ignored because its base plugin [ ] is not…
• Plugin [ ] is ignored because the required plugin [ ] is…

AI-assisted analysis of SonarSource/sonarqube@184c821202 (2026-09-09). Data as JSON: /api/errors/b12f4602d7708609. Report an issue: GitHub.

Appendix: source

Thrown at server/sonar-webserver-api/src/main/java/org/sonar/server/plugins/PluginConsentVerifier.java:79

        dbClient.propertiesDao().deleteGlobalProperty(PLUGINS_RISK_CONSENT, session);
        session.commit();
      }
    }
  }

  private static PropertyDto defaultPluginRiskConsentProperty() {
    PropertyDto property = new PropertyDto();
    property.setKey(PLUGINS_RISK_CONSENT);
    property.setValue(NOT_ACCEPTED.name());
    return property;
  }

  private static void addWarningInSonarDotLog() {
    String highlighter = "####################################################################################################################";
    String msg = "Plugin(s) detected. Plugins are not provided by SonarSource and are therefore installed at your own risk."
        + " A SonarQube administrator needs to acknowledge this risk once logged in.";

    LOGGER.warn(highlighter);
    LOGGER.warn(msg);
    LOGGER.warn(highlighter);
  }

  @Override
  public void stop() {
    // Nothing to do
  }

}

View on GitHub (pinned to 184c821202)