August 2022 Summaries

The traditional software development process can be unpredictable and stressful, with unknown code quality leading to endless roller coaster rides for release teams. However, Sonar combines the Clean as You Code methodology with practical tools like SonarLint and SonarQube or SonarCloud to help developers find and fix quality issues before they get merged, resulting in a streamlined process where only green marbles (clean code) are allowed into the build machine, making it easier to determine if an app is built with clean code and making the Go/No-Go decision straightforward. This approach systematically reverses technical debt burden, improves job satisfaction, and increases employee retention, ultimately shifting left and giving developers the means to delight customers by focusing on creativity instead of digging through old code.

The vulnerability in Visual Studio Code's URL handler, specifically the `extensions/git` module, allows attackers to craft malicious links that trick the IDE into executing unintended commands on the victim's computer. The bug is due to an argument injection vulnerability in the `git.clone` command, which can be exploited by injecting options like `--upload-pack` or other transport layers, allowing attackers to gain control over the remote repository and potentially pivot into the company's internal network. Microsoft has since patched the issue with a fix that validates the scheme of the URL against a pre-established allow list, preventing this type of attack. Developers are advised to upgrade their IDE to the latest version and exercise caution when opening foreign links.

Security researchers have identified a differential URL parsing bug in the Apache2 module mod_auth_openidc, which can lead to Open Redirect and Cross-Site Scripting vulnerabilities. The bug arises from the difference in how Apache2's internal URL parser and modern web browsers parse URLs, allowing attackers to trick users into redirecting to unintended hosts. The researchers patched the issue by adding a special case to replace any backslash with slashes, effectively preventing the parsing differential. They also demonstrated how to detect similar bugs using differential testing, which is an important step in identifying vulnerabilities in applications that use multiple parsers for the same specifications. By rejecting ambiguous input and refusing to parse it incorrectly, developers can ensure their applications are safer from such attacks.