January 2023 Summaries

The SonarLint tool was used to analyze data and identify the top 5 most common TypeScript issues, with the fifth issue being optional property declarations. Optional object properties can be declared using either a union type or an optional property syntax, but both approaches have different implications for how the properties should be used in the code. The use of both `?` and `undefined` syntax is considered confusing and should be avoided, as it communicates nothing to other developers about how the interface should be used. To avoid this issue, developers can default to using the optional property syntax and use union types with caution. This lint rule will alert developers if they make a mistake in their code. The analysis also highlights the importance of choosing one approach over the other when declaring optional object properties.

This summary highlights the security vulnerabilities discovered in OpenEMR, a widely used open-source software for electronic health records and medical practice management. The vulnerabilities were identified through a combination of code analysis and testing, which revealed three critical issues: unauthenticated file read, authenticated local file inclusion, and authenticated reflected XSS. These vulnerabilities allow remote attackers to execute arbitrary system commands on an OpenEMR server, steal sensitive patient data, and potentially compromise the entire infrastructure. The OpenEMR maintainers promptly addressed these vulnerabilities by releasing patches for version 7.0.0, which include a combination of security measures such as sessions and CSRF checks, sanitization of user-controlled parameters, and encoding of important characters to prevent XSS. It is essential for users of OpenEMR to update to the fixed versions to ensure the security and integrity of their data.

Sonar is constantly evolving its code analyzer to help developers write Clean Code by detecting severe code vulnerabilities in modern open-source applications. The company's dedicated research team finds and inspects vulnerabilities to improve the product and report them to vendors, while also publicly sharing their findings with the developer community. In 2022, Sonar identified over 50 severe vulnerabilities in popular applications across various software categories, including web frameworks, CMS, mail solutions, supply chain attacks, developer tools, and monitoring solutions. These vulnerabilities were found through a combination of research and audits, and include issues such as stored XSS vulnerabilities, prototype pollution vulnerabilities, and argument injection vulnerabilities. Sonar also participated in the Pwn2Own hacking contest and was nominated for several Pwnie Awards, recognizing its contributions to the security community. The company's research team engages with the developer community through conferences, talks, and online publications, sharing knowledge and insights on software security best practices.

Developers have a strong desire for continuous learning and new challenges, with 72% saying they're drawn to their careers by the prospect of new experiences. Many developers code outside of work as a hobby, with 73% of them enjoying it. For companies, encouraging developers to strengthen their coding skills can improve overall quality, innovation, and talent retention. However, finding quick access to why issues appear in their code can be challenging due to gaps in knowledge or unclear context. This is where `Sonar` comes in, providing clear context and specific education on coding issues, allowing developers to focus on growing their skills while minimizing time spent on figuring out the root cause of an issue. With automated code reviews, quick fixes, and access to an active community focused on Clean Code, Sonar helps developers pursue their passion for coding and grow their skills in a more accessible and efficient way.

The pitfalls and errors discussed in this article, which can be encountered when writing React code, include subtle defects such as render non-boolean values, comments inside JSX expressions, and rendering a lot of nothing. To detect these issues before they create obscure bugs, tools like SonarLint can help by providing warnings and explanations for the detected problems. Additionally, Eslint has rules available to detect some of these issues, but may require additional setup or configuration. By using SonarLint and Eslint, developers can write clean code and prevent issues from arising in the first place.

A critical command injection vulnerability was discovered in the Cacti IT monitoring solution, allowing unauthenticated attackers to run arbitrary commands under the same user as the web server process is running. The vulnerability affects Cacti version 1.2.22 and below and has a CVSS score of 9.8. An authentication bypass vulnerability was also found, which allows attackers to access remote_agent.php without authorization. Both vulnerabilities were mitigated with patches that ensure proper validation and escaping of user input. The discovery highlights the importance of security on all layers and emphasizes the need for security considerations to be integrated into development practices.