SONARHTML-170 Suppress S5256 false positives on Razor layout tables

[erwan-leforestier-sonarsource]

Summary

S5256 (tables should have headers) raises false positives on Razor layout pages, where the <table> sits in the layout and the <th> rows are injected by @RenderBody, @RenderSection, or @Html.Partial/@Html.RenderPartial from a child view. This PR adds a symmetric exemption to the existing Thymeleaf fragment-insertion logic.

Changes

• TableWithoutHeaderCheck.startDocument pre-scans .cshtml/.vbhtml files for TextNodes containing Razor fragment-rendering expressions (@RenderBody, @RenderSection, @RenderPage, @Html.(Render)?Partial(Async)?, with or without await); every <table> ancestor of such a node is exempted from S5256.
• Reusable helpers added to Helpers: isRazorFile(HtmlSourceCode) and containsRazorFragmentRendering(String).
• New unit tests + .cshtml / .vbhtml / .html fixtures covering the FP cases and the non-suppression invariants (real bug in a Razor file, Razor-looking text in a plain .html file).

Functional Validation

Attached: SONARHTML-170-fv.zip

Unzip and run:

./run.sh

Expected output is in expected-output.txt. The README shows the before/after comparison so you can reproduce the difference directly.

⚠️⚠️ This is not ready for review ⚠️⚠️

[sonarqubecloud]

Agentic Analysis: Early Results

Agentic Analysis and Context Augmentation are available on your project. Here are some issues that could have been prevented. Follow the links to learn how to put them into action.

13 issue(s) found across 3 file(s):

Rule	File	Line	Message
Web:S5256	sonar-html-plugin/src/test/resources/checks/TableWithoutHeaderCheck/razor-tokens-in-plain-html.html	2	Add "	" headers to this "". Web:S5256 sonar-html-plugin/src/test/resources/checks/TableWithoutHeaderCheck/razor-tokens-in-plain-html.html 6 Add " " headers to this "". Web:S5256 sonar-html-plugin/src/test/resources/checks/TableWithoutHeaderCheck/razor.cshtml 2 Add " " headers to this "". Web:S5256 sonar-html-plugin/src/test/resources/checks/TableWithoutHeaderCheck/razor.cshtml 7 Add " " headers to this "". Web:S5256 sonar-html-plugin/src/test/resources/checks/TableWithoutHeaderCheck/razor.cshtml 17 Add " " headers to this "". Web:S5256 sonar-html-plugin/src/test/resources/checks/TableWithoutHeaderCheck/razor.cshtml 22 Add " " headers to this "". Web:S5256 sonar-html-plugin/src/test/resources/checks/TableWithoutHeaderCheck/razor.cshtml 26 Add " " headers to this "". Web:S5256 sonar-html-plugin/src/test/resources/checks/TableWithoutHeaderCheck/razor.cshtml 30 Add " " headers to this "". Web:S5256 sonar-html-plugin/src/test/resources/checks/TableWithoutHeaderCheck/razor.cshtml 34 Add " " headers to this "". Web:S5256 sonar-html-plugin/src/test/resources/checks/TableWithoutHeaderCheck/razor.cshtml 39 Add " " headers to this "". Web:S5256 sonar-html-plugin/src/test/resources/checks/TableWithoutHeaderCheck/razor.cshtml 48 Add " " headers to this "". Web:S5256 sonar-html-plugin/src/test/resources/checks/TableWithoutHeaderCheck/razor.vbhtml 2 Add " " headers to this "". Web:S5256 sonar-html-plugin/src/test/resources/checks/TableWithoutHeaderCheck/razor.vbhtml 7 Add " " headers to this "". Analyzed by SonarQube Agentic Analysis in 3.6 s

[erwan-leforestier-sonarsource]

Functional validation bundle: see attached SONARHTML-170-fv.zip below.

Unzip and run ./run.sh — it compiles a small standalone reproducer against the bundled patched plugin JAR and applies, for each fixture, both the legacy and the new Razor-aware logic. Expected output is in expected-output.txt.

Fixture	Legacy	Patched
_Layout.cshtml	1 FP	0
_LayoutWithSection.cshtml	1 FP	0
_PartialHost.cshtml	2 FP	0
RealBug.cshtml	1	1 (sanity: real bug still raised)
RazorTokensInPlainHtml.html	1	1 (sanity: literal text in .html not suppressed)

[hashicorp-vault-sonar-prod]

SONARHTML-170

[github-actions]

Ruling Report

✅ No changes to ruling expected issues in this PR

[sonarqube-next]

Quality Gate passed

Issues
0 New issues
0 Fixed issues
0 Accepted issues

Measures
0 Security Hotspots
0 Dependency risks
100.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube