{"record":{"id":"8365bfc64de91156","repo":"SonarSource/sonarqube","slug":"plugin-s-detected-plugins-are-not-provided-by-so","errorCode":null,"errorMessage":"Plugin(s) detected. Plugins are not provided by SonarSource and are therefore installed at your own risk. A SonarQube administrator needs to acknowledge this risk once logged in.","messagePattern":"Plugin\\(s\\) detected\\. Plugins are not provided by SonarSource and are therefore installed at your own risk\\. A SonarQube administrator needs to acknowledge this risk once logged in\\.","errorType":"console","errorClass":null,"httpStatus":null,"severity":"info","filePath":"server/sonar-webserver-api/src/main/java/org/sonar/server/plugins/PluginConsentVerifier.java","lineNumber":80,"sourceCode":"        session.commit();\n      }\n    }\n  }\n\n  private static PropertyDto defaultPluginRiskConsentProperty() {\n    PropertyDto property = new PropertyDto();\n    property.setKey(PLUGINS_RISK_CONSENT);\n    property.setValue(NOT_ACCEPTED.name());\n    return property;\n  }\n\n  private static void addWarningInSonarDotLog() {\n    String highlighter = \"####################################################################################################################\";\n    String msg = \"Plugin(s) detected. Plugins are not provided by SonarSource and are therefore installed at your own risk.\"\n        + \" A SonarQube administrator needs to acknowledge this risk once logged in.\";\n\n    LOGGER.warn(highlighter);\n    LOGGER.warn(msg);\n    LOGGER.warn(highlighter);\n  }\n\n  @Override\n  public void stop() {\n    // Nothing to do\n  }\n\n}\n","sourceCodeStart":62,"sourceCodeEnd":90,"githubUrl":"https://github.com/SonarSource/sonarqube/blob/184c821202192afc1c599fc912d0889b69fffa53/server/sonar-webserver-api/src/main/java/org/sonar/server/plugins/PluginConsentVerifier.java#L62-L90","documentation":"The second line of the plugin-risk banner emitted by PluginConsentVerifier.addWarningInSonarDotLog at startup (called from start). It explicitly states that detected plugins are not provided by SonarSource and require an administrator to acknowledge the installation risk once logged in. Purely informational; server startup is unaffected.","triggerScenarios":"Server startup with plugins installed and the consent flag not yet set; LOGGER.warn(msg) executes in addWarningInSonarDotLog, invoked by start().","commonSituations":"Fresh SonarQube installs with plugins pre-copied; CI/container images bundling plugins; environments where administrators never visit the consent screen.","solutions":["Have an administrator log in and accept the plugin risk acknowledgment banner in the web UI","Remove unwanted plugins from extensions/plugins and restart if consent is not desired","In automated deployments, perform the acknowledgment once as part of provisioning"],"exampleFix":null,"handlingStrategy":"validation","validationCode":"boolean consentRecorded = /* check admin acknowledgment flag via UI/API */;\nif (hasPluginsInstalled() && !consentRecorded) {\n  log.info(\"Administrator must acknowledge plugin risk after first login\");\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Perform the one-time administrator acknowledgment immediately after plugin installation","Strip unused plugins from golden/CI images so the banner never appears","Document the consent step in your SonarQube provisioning automation"],"tags":["plugins","sonarqube","startup","security-notice"],"backgroundTag":"plugin-consent-required","analyzedSha":"184c821202192afc1c599fc912d0889b69fffa53","analyzedAt":"2026-09-09T12:23:51.573Z","contentChangedAt":"2026-09-09T12:23:51.573Z","schemaVersion":2},"datasetVersion":"2026-09-17T15:17:12.973Z"}