February 2020 Summaries

The Hibernate ORM framework provides a uniform interface and syntax for interacting with relational databases, but it also introduces potential security risks due to its limitations in preventing HQL Injection attacks. The use of the `doubleQuotes` function in `SqlUtil.java` can be exploited by an attacker to inject malicious SQL code into the database, potentially leading to Remote Code Execution vulnerabilities. Additionally, vulnerabilities have been found in other systems such as LogicalDoc and OpenBravo ERP, which allow an attacker to inject HQL code and execute arbitrary SQL queries on the underlying database. The article provides a "cheat sheet" table that summarizes the exploits and shows how they can be used to break out of the HQL syntax and inject into the SQL query. Overall, the article highlights the importance of proper input validation and sanitization in preventing HQL Injection attacks.

Taint analysis is a technique used to identify every source of user data in a system and follow each piece of data all the way through to ensure it gets sanitized before being used. In large systems, this can be challenging as finding all sources of user data and intervening before use is hard. Taint analysis helps protect data by tracing user-tainted data from its source to sinks and raising alarms when data is used without sanitization. This technique is available in SonarCloud for free on open-source projects and in SonarQube commercial editions as part of a larger SAST offering, with plans to expand to include additional programming languages later in 2020.

In the public package managers, copyleft licenses are relatively rare, but their presence varies across ecosystems and package sizes. The largest package managers have a median percentage of copyleft around 8-10%, with some smaller ecosystems like Clojars and CRAN having significantly higher percentages. On the other hand, mobile-oriented package managers like CocoaPods and SwiftPM have very permissive licenses. When looking at the top packages in large repositories, the presence of copyleft licenses is generally lower, but still significant, with about 10% of the most depended packages being under some form of copyleft license. The distribution of copyleft types also varies across ecosystems, with network copyleft being a small portion and weak copylefts being more prevalent in some cases. Overall, these numbers provide a useful anchor for further discussion on the state of copyleft licenses in open source software.