February 2024 Summaries

The White House Office has urged the technical community to adopt memory safe programming languages and code analysis techniques, aiming to enhance security in technology systems. Memory safety vulnerabilities are coding errors that can lead to severe bugs affecting stability, productivity, application performance, and software security. Memory-safe languages such as C#, Java, Python, Go, Rust, and Swift prevent developers from introducing these vulnerabilities. The report also recommends formal methods like static code analysis and measurability of software for mitigating risks. Organizations should incorporate rigorous analysis methods into their development workflow to ensure the quality of output. Memory-safe languages are crucial in reducing tech debt, preventing security incidents, and improving application availability.

Profile-Guided Optimization (PGO) uses runtime profiling data to help compilers focus optimizations on frequently executed code paths, potentially reducing application latency and infrastructure capacity costs by 10–30% without source-code changes. It primarily improves processor instruction-fetch efficiency by addressing front-end stalls caused by instruction-cache and TLB misses and branch mispredictions, which can consume 20–45% of cycles in production workloads. In Go 1.21 and later, PGO can specialize virtual method calls based on common runtime types, remove indirect dispatch overhead, enable inlining, and support further optimizations such as loop transformations and future code-layout improvements. Tests cited in the material showed a 7.5% gain on a go-json regular-expression benchmark and a 3.6% improvement on the I/O-intensive 1-billion-row challenge. Although PGO can provide benefits with limited developer involvement, automating its deployment in production environments remains complex, with large companies such as Google, Meta, and Uber among those that have implemented similar workflows.

An XSS vulnerability was found in OpenNMS, a popular enterprise-grade monitoring solution. The issue is tracked as CVE-2023-0846 and allows an unauthenticated attacker to inject a JavaScript payload into the admin dashboard by exploiting another vulnerability in the application. This can lead to arbitrary code execution on the OpenNMS server once an admin views the dashboard. The vulnerabilities were fixed in OpenNMS 31.0.4.

The text discusses how transparent communication is crucial for timely delivery in outsourced software development projects. It highlights the challenges faced due to poor communication and emphasizes the importance of establishing clear project requirements, code quality standards, and regular progress updates. The article suggests tactics such as fostering feedback-driven continuous improvement, leveraging reporting to monitor development activities, and focusing on proactive risk management to ensure successful collaboration between internal and outsourced teams.

Sonar has achieved ISO27001:2022 certification for its information security management system (ISMS), demonstrating a commitment to preventing cyber events and reducing risk. The latest version of the standard includes new controls for areas such as Threat Intelligence, cloud services, and Secure coding. This achievement reflects Sonar's dedication to quality and security, providing customers with confidence in their ability to protect sensitive data.

This article discusses the creation of objects in Java, focusing on immutable objects which are easier to maintain and safer for multithreaded applications. Two approaches to creating such objects are presented: Builders and Withers. The Builder approach involves using an inner class to build a new instance while the Wither approach creates a new instance with each property change. Both methods can be made more efficient by using libraries that generate code or reduce boilerplate. Additionally, Java 16 introduced Records, which are struct definitions focused on immutability and reducing boilerplate code. The choice between Builders and Withers depends on the specific requirements of an application, while Records are recommended for representing data with an immutable state.

Sonar's Vulnerability Research Team discovered multiple XSS vulnerabilities in the popular Content Management System (CMS) Joomla. The issue, tracked as CVE-2024-21726, affects Joomla’s core filter component and can be exploited by attackers to gain remote code execution by tricking an administrator into clicking on a malicious link. The underlying PHP bug is an inconsistency in how PHP's mbstring functions handle invalid multibyte sequences. This issue was fixed with PHP versions 8.3 and 8.4, but not backported to older PHP versions. Joomla released version 5.0.3/4.4.3, which mitigates the vulnerability.

Feature flags enable developers to experiment, personalize user experiences, roll out features safely, and mitigate production issues by dynamically turning code paths on or off without redeploying software, making them especially useful for mobile applications and SaaS companies. However, flags that remain after a feature is fully deployed or abandoned create technical debt through dead code, additional configuration states, testing complexity, reduced code-coverage reliability, and potentially slower mobile clients. Misconfigured or long-unexercised flag-controlled code can also cause serious incidents, illustrated by losses at Knight Capital and the Ariane V88 crash. Although teams often address stale flags through manual cleanup efforts, proper removal requires locating every use, simplifying dependent logic, removing unreachable code, updating tests, reviewing changes, and coordinating production releases. The passage argues that this work is automatable, citing Uber’s Piranha refactoring tool, which removed thousands of flags and more than half a million lines of code, and presents Gitar’s program-analysis and AI-based automation tools as a solution for stale flags, dead code, and obsolete dependencies.

The introduction of new Set functions in JavaScript is set to enhance its functionality. These include union, intersection, difference, symmetricDifference, isSubsetOf, isSupersetOf, and isDisjointFrom. While the ES2015 version of JavaScript Sets focused on creating, adding to, removing from, and checking membership, these new functions allow for operations between sets such as finding common elements or determining differences. The proposal for these methods is currently at stage 3 in TC39's process with Chrome 122 (February 2024) and Safari 17 (September 2023) having shipped implementations of these methods. Polyfills are available for older JavaScript engine support, allowing developers to upgrade to spec-compliant implementations of these functions.

SonarQube 10.4 has released 48 new rules and one updated rule to help developers write clean code in React applications. The latest update focuses on avoiding deprecated methods, bad practices, and writing accessible applications. New rules include checking for deprecated APIs, usage of unknown properties and attributes, and ensuring accessibility features such as keyboard events, ARIA roles, and language attributes. Using SonarQube or its related tools can help developers maintain consistent, intentional, adaptable, and responsible code in their React projects.

A software engineer recounts a career-long focus on improving developer productivity through faster, more reliable build systems, beginning with parallelizing Android unit tests at Lookout and reducing CI time from nearly an hour to 15 minutes. At Uber, the author addressed limitations in Android’s Gradle tooling, helped migrate Android projects to Buck and a monorepo, and created OkBuck to simplify the transition while emphasizing usability alongside performance. Broader migrations across Uber consolidated hundreds of repositories into platform-specific monorepos, supported by automation for preserving history, updating build configurations, and resolving dependencies, as well as systems for incremental CI, merge queues, flaky-test management, remote environments, and automated code-quality improvements. These efforts improved developer sentiment, enabled company-wide changes such as a rapid Log4j upgrade, and reinforced lessons about parallelism, caching, observability, automated migration tooling, incremental CI/CD, and managing test flakiness. The author concludes by introducing Gitar, a new effort with colleagues to provide a unified developer experience as a service.

SonarQube is transitioning from its Web API V1 to a new API V2 due to limitations and consistency issues in the former. The new API aims to improve discoverability, adhere to REST guidelines, and support HATEOAS for better programmatic discovery. It will leverage Spring WEB MVC framework and follow an incremental delivery approach during migration. Deprecated endpoints will follow SonarQube's general deprecation policy, with the complete set of API V2 endpoints expected in version 11.X LTS. The new API aims to enhance interoperability between SonarQube and SonarCloud by ensuring both products adhere to the same API contracts for their API V2 endpoints.

The National Institute for Standards and Technology (NIST) has established the U.S. Artificial Intelligence Safety Institute Consortium (AISIC), aiming to create safe and trustworthy AI systems. Sonar, a leading Clean Code company, is participating in this effort alongside other major players in AI development. AISIC will bring together various stakeholders in the AI field to establish a sustainable foundation for responsible AI development. Ensuring code quality and security is crucial in this framework, as AI-generated code often contains bugs and errors. Sonar's expertise can help address these challenges and contribute to the safe development of AI technologies.

The global IT outsourcing market is expected to grow to $1.149 billion by 2032, offering strategic advantages such as lower costs and increased delivery speed. However, navigating the outsourcing landscape requires awareness of potential risks. This article discusses five critical risks of outsourcing software development: quality assurance concerns, data security and confidentiality issues, communication challenges, lack of control and oversight, and hidden costs and budget overruns. Tactics to reduce risk in delivered software include establishing clear standards for writing code, leveraging advanced SAST capabilities, scheduling regular meetings, creating detailed budgets, and fostering transparency in discussions. By addressing these risks, organizations can forge successful and collaborative partnerships that help sustain the performance of their software.

Researchers have identified a dangerous coding pattern called Desanitization that can lead to numerous impactful XSS vulnerabilities in prominent software. This pattern involves potentially harmful user input being sanitized and then altered afterward, negating the sanitization process and making the input dangerous again. An example of this is a Cross-Site Scripting (XSS) vulnerability found in osTicket, an open-source helpdesk software used by companies to provide solutions to customers seeking help. The issue has been fixed in osTicket versions v1.18.1 and v1.17.5.

SonarQube 10.4 release introduces faster scan times, improved integration with GitLab, and smoother upgrades. The Clean as You Code methodology is showcased through pull request decorations and branch summaries that display resolved issues before merging. Scan times are optimized by downloading only required analyzers. Easy onboarding for GitLab has been introduced, automating user setup and maintenance. A new deprecated web API log improves upgrade experience. SonarQube's integration with SonarLint is simplified, allowing users to fix issues directly in their IDE. Support for Helm Charts and various language updates are also included in the release.

In 2023, Sonar's teams worked on improving their SAST benchmarks coverage, including Juliet C# 1.3 from the National Institute of Standards and Technology of the USA. The SecureString test case in Juliet C# showcases an issue where sensitive data is written unprotected in an unsafe location. Microsoft discourages using SecureStrings due to various security vulnerabilities. However, when properly used, they can add some additional security to an application. The idea of tracking sensitive data usage inside a program could represent a nice addition to Sonar's engines.

Gitar aims to build a modern software development platform that combines advanced code analysis, AI, and integrated developer tooling to improve productivity, reliability, quality, cost efficiency, and developer sentiment. Drawing on its founders’ experience developing internal tools at Uber, the company argues that fragmented tools often work individually but create friction as engineering organizations scale, contributing to slow builds, flaky tests, declining code quality, technical debt, debugging challenges, inconsistent environments, and rising infrastructure costs. Its vision centers on opinionated “golden paths” that unify fast and reliable builds, tests, IDEs, linters, CI, managed cloud development environments, automated maintenance, always-green repositories, production-informed performance analysis, and lifecycle observability. Gitar proposes that AI should be deeply tailored to software development, enabling early problem detection and accurate automated fixes rather than serving as an add-on, while centrally managed environments and tooling performance metrics help keep development workflows reproducible, efficient, and responsive to developer needs.