October 2022 Summaries

C++ developers need to understand categories of types such as Resource Managers that directly manage a resource. There are three sub-categories of Resource Manager: Scoped, Unique and General. Scoped Managers are non-copyable and non-moveable, with custom constructors for acquiring resources and deleted copy and move operations. Unique Resource Managers implement move construction and/or move-assignment, while General Resource Managers are both copyable and value-like, adding indirection to the resource they manage. The "Rule of DesDeMovA" provides a way to create non-copyable, non-moveable types with custom destructors by deleting the move-assignment operator. Understanding these categories and rules can help developers write more efficient and effective code.

The company, Sonar, attended the Hexacon 2022 event in Paris to share knowledge and learn about the latest security research. The team found talks on various topics such as SAML vulnerabilities, enterprise backup solutions, and iOS device security, which helped them stay updated with the latest research and drive their innovative technology forward. They also presented several vulnerabilities they identified in the Zimbra webmail software, including a simple Stored Cross-Site Scripting vulnerability and a remote code execution bug in Amavis, a component dedicated to post-processing incoming emails. The team believes that presenting the details of these vulnerabilities is crucial to the security industry, as threat actors are still exploiting them despite being patched. Sonar looks forward to attending future events like OffensiveCon and Hexacon 2023.

SonarCloud, SonarLint, and SonarQube are tools for software development that help detect bugs and errors in code. This article is part of a series focused on common pitfalls and errors when writing React code using JavaScript or TypeScript. It covers issues with React Hooks, such as infinite loops caused by setting state in the top-level component, and bugs like the "tree falling in the forest" paradox where the state update is not actually updating the component's state due to incorrect usage of the `!` operator. The article also highlights how SonarLint can detect these issues early on and provide explanations for why they happen, helping developers prevent problems before they occur.

SonarQuebe 9.7 is now available, focusing on speed of analysis and introducing new features such as Python rules for tests, AWS CDK, and path-sensitive bug detection, alongside other enhancements including faster JavaScript/TypeScript PR, COBOL analysis, GitHub security reporting, and OWASP ASVS reports, with improved SAML configuration and PII deletion.

The static analysis engine of a software solution detected three critical vulnerabilities in the Melis Platform, an open-source suite with business-oriented features, including an e-commerce component and a CMS. The vulnerabilities exist due to deserialization issues in the Laminas framework, which is used by Melis Platform. These vulnerabilities can be exploited using "popchain" techniques, where attackers create a chain of classes that lead to arbitrary code execution or other severe consequences. The engine's support for popular PHP frameworks and its ability to perform taint analysis make it effective in detecting such vulnerabilities. A patch has been released to fix the issue, and users are urged to upgrade their instances to 5.0.1 and above to benefit from these patches.

The technology industry is embracing AI-based coding tools, which have raised concerns among maintainers about their impact on maintenance work. Many maintainers perceive that these tools will increase the quality of code they produce, but also create new challenges such as increased maintenance burden and the need for more scrutiny to identify issues with the generated code. Despite some reservations, a good number of maintainers are optimistic about the possibilities of AI-based coding tools, seeing them as useful for generating boilerplate code and simplifying mundane tasks. However, many express concerns about reviewing and accepting contributions created using these tools, with almost two-thirds of maintainers saying they'd be less willing to do so. The usefulness of information from automated pull requests for vulnerability remediation is also a topic of debate among maintainers, with some finding the information not very useful at all. Overall, while there are valid concerns about AI-based coding tools, many maintainers see potential benefits and believe that creators of these tools should prioritize reducing maintenance work rather than increasing it.

The tech world emphasizes finding tools and building knowledge to streamline activities under pressure of high expectations, leading to real-time issues and past project problems resurfacing. Cutting corners and overlooking minor issues can lead to a buildup of problems that cost more than just money, highlighting the importance of clean code practices.

The C++ programming language has a set of rules, known as RAII (Resource Acquisition Is Initialization), which manage resources such as memory through special member functions like copy and move constructors, destructors, and assignment operators. The Rule of Three was coined in 1991 to cover most cases, but with the introduction of move semantics in C++11, it was upgraded to the Rule of Five. The Rule of Zero, introduced more recently, suggests that if no special member functions are user-defined, the compiler provides default implementations for all of them. This rule prefers a case where no special member functions need to be defined, particularly when managing pure value types or resources managed by specialized classes like smart pointers.

SonarCloud is a tool that helps developers deliver Clean Code consistently and efficiently, without disrupting their existing development workflow. It offers several key features, including pull request decoration, which provides early feedback on code quality through a report called "decoration" that highlights issues such as reliability, security, maintainability, code coverage, and code duplications. Additionally, SonarCloud provides clear remediation guidance to help developers fix issues, a Go/No-Go Quality gate that determines whether code is ready to be merged, the Clean as You Code methodology for tackling technical debt, and IDE integration with SonarLint, which catches issues on-the-fly and provides real-time feedback. By using these features, developers can make informed decisions about their code, learn new coding rules, and elevate their game while ensuring consistency throughout their entire development workflow.

A critical vulnerability was discovered and responsibly disclosed to help secure the PHP supply chain. The vulnerability allows gaining control of Packagist, a central component used by the PHP package manager Composer to determine and download software dependencies. Virtually all organizations using PHP code are affected, with over 100 million requests potentially compromised every month. The maintainers of the public instance were patched within hours, but users integrating Composer as a library should upgrade to version 1.10.26 or later for security patches. A similar vulnerability was discovered last year and fixed in a similar manner. Supply chain attacks are becoming increasingly common, exploiting the fact that modern software is built on top of third-party components without clear visibility of all downloaded packages. This vulnerability highlights the importance of maintaining secure supply chains and encourages developers to review their dependencies regularly.