September 2020 Summaries

SonarCloud has recently added support for mono-repositories in Azure DevOps Services and GitHub, a feature requested by some users on the Community forum, allowing organizations to store multiple projects within a single large repository. This new feature enables users to configure one Quality Gate per project, receive multiple Quality Gate results, and read project-labeled messages from SonarCloud, providing a more efficient way to manage code quality and security for complex projects. To take advantage of this feature, each SonarCloud project must have a unique project key, which can be configured using a pattern including the organization name, project name, and internal reference to the project within the monorepo. The support is currently available only for GitHub and Azure DevOps Services repositories, and users can import or convert existing projects to take advantage of this new feature, which aims to bring more accuracy to code quality and security decisions.

Pandora FMS, an open-source IT infrastructure monitoring software, has been found to have several critical security vulnerabilities that allow remote attackers to execute arbitrary code on servers. The most severe vulnerability is a SQL injection attack that can bypass authentication and grant access to the entire server. This vulnerability was discovered through a thorough analysis of the code and its security mechanisms, which highlighted potential pitfalls in the use of sanitization functions and the handling of user input. A patch has been released by the vendor, but it is essential for users to update their installations as soon as possible to prevent further attacks.

A false positive is a result of static analysis that indicates an issue with the code, but it is not actually a real problem. The type and origin of the false positive vary, including semantic false positives related to Rice's theorem, specification false positives from rules like Code Smell, and bugs causing false positives due to implementation issues. Avoiding false positives is important as excessive reporting can lead to decreased tool effectiveness over time. However, it is challenging to eliminate them completely due to the limitations of static analysis techniques. To help minimize false positives, users can report them to improve the product, take a closer look at the code as a hint that there might be an issue, and engage with the community for discussion and feedback.