September 2023 Summaries

The text discusses the issue of regular expression denial of service (ReDoS) vulnerabilities in JavaScript projects. It explains how ReDoS occurs when a regular expression engine takes too long to evaluate, causing a server or interface to hang or crash. The article provides examples of vulnerable regular expressions and their effects on user input validation and parsing. To fix ReDoS issues, it suggests limiting the expression's complexity, using atomic groups, taking multiple passes with simpler regular expressions, and avoiding regular expressions altogether if possible. It also mentions tools like regex101.com, Regexper, and eslint-plugin-regexp that can help detect and prevent ReDoS vulnerabilities in codebases.

SonarCloud discovered a critical Zip Slip vulnerability in OpenRefine, which can be exploited by tricking a user into importing a malicious project file, allowing an attacker to execute arbitrary code on the user's machine. The vulnerability was fixed with version 3.7.4. SonarCloud provides valuable guidance on how to mitigate this kind of vulnerability and prevent common pitfalls. The vulnerability is caused by inadequate path validation when extracting archives, which may allow attackers to overwrite existing files or extract files to unintended locations. OpenRefine's auto-reload feature can be leveraged by attackers to execute arbitrary code. To fix the vulnerability, it needs to be ensured that all files are extracted under the intended base folder, and using the `toPath` method effectively prevents files from being written outside the intended folder. SonarCloud helps developers detect and fix security vulnerabilities, including this one, providing comprehensive information for each raised issue.

The Open Source Summit conference was hosted at Bilbao Palacio Euskalduna in Spain from September 18th to 21st, with over 1,500 attendees. The event featured talks on AI, OSPO best practices, security, and DevOps, with Sonar as a sponsor. At the booth, conversations focused on Clean Code methodology and tooling, such as SonarLint, which helps developers commit confident code already analyzed and fixed. Sonar's commitment to the open-source ecosystem was also highlighted, with over 87,000 projects analyzed by SonarCloud for free. The impact of poor-quality software was emphasized, with costs exceeding $2 trillion, and the importance of using methodologies and tooling that can be used in a low-friction approach was stressed. The conference saw great interactions between Sonar and attendees, showcasing the benefits of Clean Code and the company's commitment to supporting the open-source ecosystem.

The critical security vulnerability discovered in TeamCity allows unauthenticated attackers to execute arbitrary code, compromising the integrity of software releases and impacting all downstream users. The vulnerability was fixed with TeamCity version 2023.05.4, which removes a wildcard expression that enables bypassing authentication checks for requests ending with "/RPC2". This exploitation could have been carried out due to an oversight in global request interceptors being considered as part of the exposed attack surface.

We used popular Java SAST benchmarks to track progress and transparency in our SAST capabilities. We published scores for three top-performing benchmarks: OWASP, SecurityShepherd, and WebGoat, along with ground truths and instructions on how to reproduce the results. Our approach involved selecting projects based on popularity, vulnerability, test cases, and vendor neutrality. The scores demonstrate a high True Positive Rate (TPR) of 90% and a low False Discovery Rate (FDR), indicating accurate detection of security issues. We provide ground truths and ignored-findings.json files to facilitate replication of the results and encourage human review of detected Security Hotspots. Our goal is to bring transparency and help companies make informed decisions about their SAST solutions.

SonarLint telemetry has identified common issues in Java projects, including commented out code, TODO tags left in source code, duplicated string literals, high cognitive complexity of functions, and unused elements that need to be removed from the codebase. These issues can impact software security, performance, maintenance, team collaboration, and readability, but many are easy to address with minimal effort. By implementing these best practices, developers can improve the intentionality, consistency, adaptability, and maintainability of their code, reducing the likelihood of errors and making it easier to refactor and evolve the codebase over time.

Cognitive Complexity is a measure used by Sonar to help developers understand how complex and hard-to-read their code has become over time. It's calculated based on the number of loops, branching statements, and nesting within the code, which increase complexity as they are added. The model takes into account that some constructs, like useful design patterns, do not increase complexity and can be ignored in the scoring. Sonar provides a way to visualize this complexity through its tools, such as SonarLint or SonarQube, allowing developers to identify areas of their code that need improvement. By understanding Cognitive Complexity, developers can write more maintainable and easier-to-understand code, making it better for both themselves and their team in the future.

The Sonar Research team discovered a critical code vulnerability in Tutanota's web-based clients, which could allow attackers to steal decrypted emails and impersonate victims. The vulnerability was caused by a parser differential between the browser and Linkify library used by Tutanota, allowing an attacker to inject arbitrary HTML into the DOM of the application. Additionally, attackers could bypass the Content Security Policy (CSP) by controlling a file on the file system and using inter-process communication (IPC) calls to download and run malicious executable files. The vulnerability was fixed within two days of being reported, and the Tutanota team implemented additional hardening measures to prevent similar vulnerabilities in the future. To avoid such issues in code, it is recommended to use client-side sanitization with a state-of-the-art sanitizer, not modify or re-parse HTML after sanitization, and implement proper security mechanisms such as CSP and IPC call blocking.

The new Long Term Support JDK version, JDK 21, was released on September 19th as a general availability (GA) release, marking a two-year cycle since the previous LTS version, JDK 17. This new version offers several key features and improvements, including code snippets in Java API documentation, sequenced collections with consistent methods across collections, record patterns for testing instance of record classes, pattern matching for switch statements to reduce boilerplate code, virtual threads for improving concurrency and performance, and disallowing dynamic loading of agents to improve security. By using JDK 21 LTS, developers can ensure stable, secure, and efficient software by locking in support for the next eight years.

In a typical open office space, tension prevails despite pleasant surroundings, due to looming deadlines and cluttered calendars. Software developers, equipped with best practices, write reliable and secure code, yet struggle with continuous learning and adapting to evolving threats. The number of security vulnerabilities discovered has increased significantly, with 18,300 reported in 2019, a 10.8% rise from the previous year. Continuous learning is key to employee retention and performance, with 78% of developers surveyed expressing strong correlation between job satisfaction and opportunities for growth. SonarQube supports developers by providing real-world code issues feedback, automating tedious workflows, and enhancing skills, leading to increased loyalty and reduced turnover rates.

We recently looked at how you can get some of the benefits of TypeScript in our JavaScript code base. If you've been through that process, then TypeScript is already helping to keep some type issues out of your JavaScript. But, because it is acting on JavaScript, TypeScript will not be able to infer as much as it would like to. The good news is that we can give TypeScript more hints about the types that flow around our JavaScript application without changing the project to TypeScript. Adding more types using JSDoc and/or declaration files can provide this information, helping TypeScript understand your JavaScript better, which in turn helps IDEs make better suggestions and tools like SonarQube apply rules to source code. By giving more type information, you can still use JavaScript while benefiting from some of the features of TypeScript, such as better error messages and type checking, making it easier for developers to maintain and extend your application.

The Sonar Research team discovered critical code vulnerabilities in multiple encrypted email solutions, including Proton Mail, Skiff, and Tutanota. The vulnerabilities were found in the web clients of these services, which allowed attackers to steal emails and impersonate victims if they interacted with malicious messages. The team found a Cross-Site Scripting (XSS) vulnerability in Skiff's web client that made it possible for attackers to bypass the service's sanitization process and insert arbitrary HTML into the page. This vulnerability was exploited by sending an email with an attachment that caused a blob URL to be created, which was then used to send a follow-up email with a link that opened the blob URL in a new tab, allowing the attacker to bypass the Content Security Policy (CSP) and execute arbitrary JavaScript in the context of the Skiff web application. The vulnerability was fixed by moving the sanitizer pass after all modifications to ensure the final HTML is safe, and the team provided recommendations for avoiding similar issues in code, including sanitizing on the client instead of the server, using state-of-the-art sanitizers, and not modifying data after sanitization.

Deeper SAST is a new advanced detection analysis tool announced by SonarSource that can find hidden security issues in code and addresses the limitations of traditional SAST tools. This tool analyzes both the code written by developers and the dependencies used in their projects, providing a more holistic view of potential security vulnerabilities. Clean Code is defined as consistent, intentional, adaptable, and responsible code, which is essential for achieving a state of cyber hygiene. Deeper SAST supports organizations in achieving this state of Clean Code by identifying issues that make the code unclean, including security issues, programming errors, and lack of secure coding practices. The tool's differentiation lies in its alignment with market needs and its focus on engineering-level hygiene during development. With the emergence of advanced AI like ChatGPT, SonarSource sees an opportunity to provide more comprehensive code review services, as more code is being written and reviewed by non-developers.

Writing a JavaScript project with TypeScript can provide several benefits, including type safety, improved tooling, and enhanced bug detection. To get started, you can configure your editor to use TypeScript to analyze your code, or enable TypeScript checking for all JavaScript files in your project. This can be done by adding a comment to the top of each file, enabling the "Check JS" setting in VS Code, or using tools like SonarLint and SonarQube. By introducing TypeScript into your project, you can take advantage of its type inference, highlight runtime bugs, and improve the reliability of your application. Additionally, you can fix missing types, add further types to make your JavaScript safer, and integrate TypeScript with other tools to gain more insight into how types flow around your application.

The latest release of SonarQube, version 10.2, offers significant enhancements to improve code quality, security, and operational workflows. This update introduces support for MISRA C++ 2023 rules, which will enhance the security robustness of mission-critical applications. Additionally, SonarQube 10.2 includes features such as automatic synchronization with GitLab dashboards, enhanced cloud secrets detection, and improved support for PHP super-global arrays. The software also introduces a new Learn as You Code (LaYC) feature to facilitate quick issue resolution and skill enhancement. Furthermore, the update includes various language-specific enhancements, including faster incremental analysis for Python, Java/Kotlin, and PHP, as well as improved support for AcuCOBOL and Azure Resource Manager templates. Overall, SonarQube 10.2 aims to simplify, secure, and accelerate code quality journeys.

The Sonar Research team discovered critical code vulnerabilities in multiple encrypted email solutions, including Proton Mail, Skiff, and Tutanota. These services provide end-to-end encryption, making communications safe in transit and at rest. However, the researchers found that attackers could steal emails and impersonate victims if they interacted with malicious messages. Nearly 70 million users were at risk on Proton Mail alone. The vulnerabilities were discovered through a thorough audit of the web clients' security, which revealed that the encryption happens in the web client, making it vulnerable to direct attacks. The researchers found a Cross-Site Scripting issue that allowed attackers to steal decrypted emails and impersonate victims. They also identified other severe vulnerabilities in Skiff and Tutanota Desktop. Proton Mail was fixed shortly after the report was submitted, with no signs of in-the-wild exploitation. The researchers recommend avoiding modifying data after sanitizing it, not re-parsing HTML after sanitizing it, and using state-of-the-art sanitizers to prevent similar issues in the future.