December 2023 Summaries

In this blog series on SAST benchmarks, Sonar has shared its performance scores for Java, C#, and Python. The company's approach involves selecting three projects from GitHub related to SAST benchmarks for each language. Sonar considers a good SAST solution to have a True Positive Rate (TPR) of 90% and a False Discovery Rate lower than 10%. The results show promising outcomes, with TPR scores close to the target for all three languages: Java at 93%, C# at 90%, and Python at 92%. Sonar is committed to continually improving its SAST engine and providing precise and actionable results. By sharing these metrics and ground truths, the company aims to promote transparency and help businesses make informed decisions about their SAST solutions.

The past year saw significant changes in DevOps, with Generative AI and its integration into developer roles gaining traction. The use of AI coding tools became widespread among developers, and the industry is expected to evolve further in 2024. Predictions include AI transforming the future of coding, but also highlighting the need for human oversight to prevent drawbacks. Another area of focus will be cloud migration and re-architecture, with low-code and no-code programming gaining more attention. The use of post-quantum cryptography is anticipated to become more widespread as quantum computing threats grow. Additionally, there are predictions for simplified service configuration, growth in low-code - no code platforms, and the continued relevance of Java despite rumors of its demise. Overall, 2024 promises to be an exciting year for DevOps with various trends and technologies shaping the future of software development.

The threat landscape is evolving as new technologies emerge, and organizations must adapt their security measures accordingly. Supply-chain attacks are becoming a significant concern due to the increasing reliance on third-party software components. Regulatory changes are forcing security best practices to become the norm, while AI-assisted attacks are expected to become more sophisticated and automated. The use of AI-generated code is also on the rise, but it can be deceptive as it may contain bugs and security issues if not properly vetted. To stay ahead of attackers, organizations must remain proactive in their cybersecurity efforts.

We saw at Black Hat Europe that the benefits of Clean Code for software security were widely accepted by attendees, reinforcing our trust in this approach as a foundation for secure development. However, there is still much to be discussed around how to effectively integrate security tools into developer workflows without introducing unnecessary friction. Our team believes that both conventional SAST techniques and LLMs have value, but more nuance is needed to optimize their use. By leveraging Clean Code principles and our tools like SonarLint, SonarQube, and SonarCloud, developers can reduce the exploitability of security issues in code, allowing security teams to focus on design rather than just detection.

Spring is a widely used framework that provides many features to help developers create stand-alone, production-grade applications. However, it also introduces new complexities, such as transactional operations, persistent entities, and bean definitions, which can lead to bugs, misconfigurations, and security issues if not handled properly. Sonar, a tool that analyzes code quality, can detect these issues and provide warnings to developers, helping them avoid common pitfalls and improve the overall quality of their applications.

pfSense is a popular open-source firewall solution that has been discovered to have several security vulnerabilities. The most recent scan by SonarCloud found two Cross-Site Scripting (XSS) vulnerabilities and a Command Injection vulnerability in the pfSense Community Edition (CE). These vulnerabilities can be exploited by attackers to execute arbitrary code on the pfSense appliance, spy on local network traffic, or attack services inside the local network. The vulnerabilities were discovered using taint analysis, which is a type of static analysis that tracks data flow from user-controllable data sources to dangerous sinks. SonarCloud found the vulnerabilities in the status_logs_filter_dynamic.php page and the interfaces_gif_edit.php and interfaces_gre_edit.php pages. The vulnerabilities can be patched by encoding/escaping all inserted data for the context it is inserted into, using functions like json_encode() and escapeshellarg(). Netgate has published patch commits and advisories for all issues, and has released patched versions of pfSense Plus 23.09 and pfSense CE 2.7.1. It's recommended to use SonarCloud to find vulnerabilities in your open-source projects and follow the "How to fix it?" tab for each issue.

The text discusses the debate over formatting nested ternary operators in JavaScript code, with some arguing that they are clearer and easier to read when formatted in a specific way, while others believe that they can be confusing and should be avoided. The author proposes an alternative approach, suggesting that nested ternaries can be replaced with conditional statements or functions, which can make the code more readable and maintainable. They also argue that formatting nested ternary operators is not as important as making sure the code is clear and easy to understand. The text concludes by emphasizing the importance of minimizing nesting in code and prioritizing clarity over brevity.

Bad code has been a persistent issue in software development since its inception, with studies showing that correcting issues after delivery can be 100-30 times more expensive than addressing them earlier. Bad code stifles functionality by being complicated, poorly structured, or lacking documentation, and its origins are diverse and complex, including pressures of deadlines, coding knowledge, and inconsistent styles. The repercussions of bad code extend far beyond the lines written on a screen, affecting maintainability and scalability, increasing bug counts and technical debt, decreasing productivity and efficiency, and increasing costs and risks. However, addressing bad code through refactoring, code reviews, and adherence to coding standards can mitigate these impacts, fostering a healthier development environment and enhancing software quality. The pursuit of cleaner, more efficient code is an ongoing journey that requires diligence, collaboration, and continuous improvement.