November 2023 Summaries

Sonar provides code analysis technology that helps developers and development teams to manage the quality and security of their software, defining "Clean Code" as consistent, intentional, adaptable, and responsible code. Recently, it has added two significant innovations: enhanced static analysis capability for discovering hidden security issues in user code and zero-configuration, automatic analysis of C and C++ projects independent of the compiler used. Digital transformation projects have created a security challenge, and Sonar's approach addresses code quality and security together and at the same time, promoting a holistic approach to achieve the best security posture. Omdia sees clear business opportunities for Sonar in this growing market where organizations should address code characteristics holistically from development onwards.

Visual Studio Code's NPM integration has two newly discovered vulnerabilities that can be exploited even when the Workspace Trust security feature is enabled, allowing attackers to inject arbitrary commands and access configuration files. The vulnerabilities were addressed by Microsoft in Visual Studio Code 1.82.1, which includes improved validation of package names and separation of options from positional arguments. However, some experts worry about the ease with which these issues can be bypassed and the potential for future security patches to introduce new vulnerabilities. They also suggest that Workspace Trust should not be relied upon as a sole security measure when dealing with potentially malicious material or high security requirements. The experience of security-conscious users could be improved by allowing them to not trust any project by default, and third-party security researchers may be less incentivized to look for Workspace Trust bypasses without monetary rewards.

Sonar is excited to bring you the latest SonarQube release with significant security enhancements and new Clean Code changes, including Secrets Detection at the source and a new Quality Gate that prevents issues from entering newly developed code, stronger security features, Easy Onboarding for GitHub users, Operational Improvements & Language Updates, and more. The release includes several operational improvements to enhance user experience. If you're still on an older version of SonarQube, it's recommended to upgrade to 9.9 LTS before upgrading to 10.3.

The summary highlights the discovery of three vulnerabilities in popular third-party Visual Studio Code (VSCode) extensions: GitLens and GitHub Pull Requests and Issues, both with millions of installs. The vulnerabilities are related to Markdown injection, which allows attackers to inject malicious code into VSCode's UI. These vulnerabilities can be exploited by users interacting with the affected extensions in untrusted workspaces or through specific actions such as clicking on links or installing extensions. The fixes for these vulnerabilities have been implemented by the respective extension developers, and the affected versions have been updated to prevent exploitation. The discovery of these vulnerabilities emphasizes the importance of security in third-party extensions and highlights the need for users to stay up-to-date with the latest version of VSCode and its extensions.

You can start a 14-day free trial for private projects and repositories, which includes all SonarCloud features. To maximize the benefits, it's essential to approach the trial with a clear plan. The process involves integrating with your development environment, setting up your organization in SonarCloud, choosing your plan, selecting the repository you want to analyze, running your first analysis, exploring SonarCloud, creating quality profiles and quality gates, diving deep into issues, exploring PR analysis, and getting familiar with SonarCloud's core concepts. During the trial period, you'll have access to all SonarCloud features and functionalities, email notifications for when your credit card will be charged, and SonarLint IDE integration. Additionally, you can add unlimited members to your private organization and get community support.

Sonar is a proud member of the Linux Foundation, an organization committed to helping companies and developers identify and contribute to open-source projects. The Linux Foundation Executive Director Jim Zemlin sat down with Sonar Founder and co-CEO Olivier Gaudin to discuss Clean Code, open source development, and genAI. Olivier highlights the importance of education and tooling in bringing awareness to high-quality tools like Sonar's Clean Code solution. Adopting Sonar's Clean as You Code approach helps reduce technical debt by establishing a standard expectation across organizations for clean code. The growing popularity of genAI has increased developer productivity but also raises concerns about relying too much on AI-generated code, making code review tools essential to avoid common pitfalls.

The authors of this publication presented their research on the security of Visual Studio Code (VSCode), a popular code editor, at DEF CON 31. They found several attack surfaces in VSCode's architecture and identified vulnerabilities in various components, including exposed network services, protocol handlers, workspace settings and local data, workspace trust, and Cross-Site Scripting (XSS). The authors highlighted the importance of security in developer tools and emphasized that many tools are not built with security in mind. They also discussed their experience reporting vulnerabilities to Microsoft's Security Response Center and noted that even built-in extensions can be out of scope for bug bounty awards. The publication aims to educate users about the risks associated with VSCode and provide guidance on how to protect themselves.

The text discusses the performance of Sonar's C# SAST engine in comparison to three benchmark projects: FlowBlot.NET, Juliet Test Suite, and Custom Configuration. The benchmarks were chosen based on their relevance and availability in the .NET ecosystem. The results show that Sonar's True Positive Rate (TPR) is close to 90% and its False Discovery Rate (FDR) is lower than 10%. The ground truths used for these benchmark projects are made available, allowing users to replicate the results and gain a better understanding of Sonar's security analyzers. The goal of sharing these results is to bring transparency and help companies make informed decisions about their SAST solutions.

Secrets in code can be exposed, leading to unauthorized access and security incidents. This is why developers should handle secrets carefully and never hard-code them into source code or commit them to version control systems. Instead, they should be stored securely using secret management tools and accessed through secure methods, such as environment variables. Sonar provides secrets detection features that can help detect if secrets are leaked in the code, both in the IDE and Continuous Integration pipeline.