September 2022 Summaries

SonarQube is a software tool that has recognized the importance of accessibility in its products, with a focus on making them usable by everyone, regardless of abilities or disabilities. The company's journey towards accessibility began with internal awareness and efforts to improve the user experience, followed by a formal commitment to become WCAG 2.1 AA compliant for all products. A thorough audit identified issues, which were then addressed through dedicated sprints in each release cycle. As a result, SonarQube 9.6 is now more accessible than ever, with over a third of the identified issues fixed and further improvements planned for future releases. The company aims to continue this progress through ongoing audits and continuous improvement, striving to meet high accessibility standards and ensuring that its products remain usable by all users.

The OneDev self-hosted Git server has several high-impact vulnerabilities that can be exploited by attackers, including a Server-Side Request Forgery (SSRF) vulnerability, an Access Control Bypass leading to Remote Code Execution (CVE-2022-39205), a Docker Escape (CVE-2022-39206), and Persistent Cross-Site Scripting (CVE-2022-39207). These vulnerabilities can be combined by attackers to execute arbitrary commands on vulnerable instances, allowing them to steal or manipulate source code, build artifacts, and launch further attacks against internal infrastructure. The maintainers of OneDev have fixed the issues in version 7.3.0, but users are recommended to update to this version to benefit from their fixes. The vulnerabilities highlight the importance of validating user-controlled inputs and ensuring that authentication mechanisms are properly implemented to prevent such attacks.

At SonarSource, they value their community of programmers and celebrate Programmers’ Day with a conversation with Claire Villard, a Backend Developer at SonarCloud. Claire shares her experiences working on the cloud-based DevOps platform, which helps developers deliver Clean Code. She talks about how she focuses while writing code, typically without distractions, and works in focused 1-hour chunks. Over the past 11 years, she's noticed significant changes in programming, particularly with the rise of the Cloud and its impact on application design. Claire appreciates working at SonarSource, where decisions are made transparently and include input from impacted teams. She enjoys the technical challenges she faces and values the company's focus on security, which has become a critical aspect of her work. She finds happiness in solving problems, especially when they affect customers and see the positive impact it has on her work.

Open source software has become a cornerstone of modern application development, but its widespread adoption requires understanding and navigating the nuances of open source licenses to avoid potential legal pitfalls. Organizations must be aware of the specific obligations tied to each license to minimize compliance risks. Traditionally, licenses were tracked using manual methods, but as software supply chains have grown in complexity, machine-readable licensing standards like SPDX or CycloneDX are now being adopted to gather and analyze licensing data. The lack of explicit licensing is a significant risk, with 14% of packages having unknown licenses, while license changes can result in copyright violation consequences. Conflicting licenses between package managers and source code repositories also pose challenges, with over 82,000 packages experiencing conflicting information. Permissive vs. copyleft licenses impose different obligations, while emerging licenses like non-commercial and ethical licenses require organizations to stay informed about the evolving landscape of open source licensing. The intersection of AI and open source licensing raises unique challenges, particularly regarding intellectual property rights and compliance with existing open source licenses.

Clean Code is about maintaining software that is well-structured, readable, and maintainable, reducing maintenance time and costs, and increasing software longevity and security. It also improves developers' work environment by encouraging collective code ownership and collaboration, ultimately benefiting all stakeholders.

This vulnerability in WordPress's implementation of pingbacks allows an attacker to potentially exploit the system by manipulating URL validation, which can lead to a denial-of-service attack or further exploitation of other vulnerabilities. The vulnerability is due to the fact that the HTTP client re-parses the URL and resolves the hostname after validation, allowing an attacker to change the domain to point to a different address before sending the request. The impact of this vulnerability is considered low for most users, but it highlights a widespread vulnerable code pattern that developers should be aware of in their own codebases. WordPress maintainers have released a patch, and system administrators can take steps such as removing the `pingback.ping` handler or blocking access to `xmlrpc.php` at the web server level to mitigate this vulnerability.

SonarCloud is a tool that helps ensure Java pull requests are clean by analyzing and decorating them instantly after creation, making it easier to add new features on top of a clean code base. With SonarCloud, developers can get started in under 3 minutes and set up automatic analysis for their GitHub organization, which is entirely free for open-source projects with access to the full feature-set. Once set up, every pull request will be analyzed and decorated instantly after creation, providing instant feedback on bugs, vulnerabilities, and code smells. This enables systematic remediation of code issues, making code reviews faster and more efficient. By using SonarCloud, developers can improve their code quality and unlock features like taint analysis and code coverage reports in the future.