{"record":{"id":"b12f4602d7708609","repo":"SonarSource/sonarqube","slug":"error","errorCode":null,"errorMessage":"####################################################################################################################","messagePattern":"####################################################################################################################","errorType":"console","errorClass":null,"httpStatus":null,"severity":"info","filePath":"server/sonar-webserver-api/src/main/java/org/sonar/server/plugins/PluginConsentVerifier.java","lineNumber":79,"sourceCode":"        dbClient.propertiesDao().deleteGlobalProperty(PLUGINS_RISK_CONSENT, session);\n        session.commit();\n      }\n    }\n  }\n\n  private static PropertyDto defaultPluginRiskConsentProperty() {\n    PropertyDto property = new PropertyDto();\n    property.setKey(PLUGINS_RISK_CONSENT);\n    property.setValue(NOT_ACCEPTED.name());\n    return property;\n  }\n\n  private static void addWarningInSonarDotLog() {\n    String highlighter = \"####################################################################################################################\";\n    String msg = \"Plugin(s) detected. Plugins are not provided by SonarSource and are therefore installed at your own risk.\"\n        + \" A SonarQube administrator needs to acknowledge this risk once logged in.\";\n\n    LOGGER.warn(highlighter);\n    LOGGER.warn(msg);\n    LOGGER.warn(highlighter);\n  }\n\n  @Override\n  public void stop() {\n    // Nothing to do\n  }\n\n}\n","sourceCodeStart":61,"sourceCodeEnd":90,"githubUrl":"https://github.com/SonarSource/sonarqube/blob/184c821202192afc1c599fc912d0889b69fffa53/server/sonar-webserver-api/src/main/java/org/sonar/server/plugins/PluginConsentVerifier.java#L61-L90","documentation":"PluginConsentVerifier.addWarningInSonarDotLog emits a highly visible three-line banner in sonar.log (line 79 is the '###...' highlighter line) whenever any plugin is detected. SonarQube prints it because plugins are not provided by SonarSource and are installed at the administrator's own risk; the administrator must acknowledge the risk in the UI once.","triggerScenarios":"SonarQube starts (PluginConsentVerifier.start) with at least one plugin JAR present in extensions/plugins, before the administrator has acknowledged the plugin risk notice.","commonSituations":"First install of any third-party plugin; upgrade/migration carrying over plugins; automation/test environments where the consent flag was never recorded.","solutions":["Log in as a SonarQube administrator and accept the plugin risk acknowledgment in the notification shown in the UI","If no plugins are intended, remove JARs from extensions/plugins and restart","For scripted environments, acknowledge once via the admin web service/UI so the banner stops appearing"],"exampleFix":null,"handlingStrategy":"validation","validationCode":"// only ship plugins you actually need; before startup verify:\nFile pluginsDir = new File(\"extensions/plugins\");\nboolean hasPlugins = pluginsDir.exists() &&\n  Objects.requireNonNullElse(pluginsDir.list((d, n) -> n.endsWith(\".jar\")), new String[0]).length > 0;\nif (hasPlugins) scheduleAdminConsentStep();","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Log in as administrator once after installing plugins and accept the risk banner","Remove plugin JARs you do not use from extensions/plugins","Include the consent step in deployment runbooks for automated installs"],"tags":["plugins","sonarqube","startup","security-notice"],"backgroundTag":"plugin-consent-required","analyzedSha":"184c821202192afc1c599fc912d0889b69fffa53","analyzedAt":"2026-09-09T12:23:51.573Z","contentChangedAt":"2026-09-09T12:23:51.573Z","schemaVersion":2},"datasetVersion":"2026-09-17T15:17:12.973Z"}