March 2024 Summaries

Technical debt is a significant issue in software development, resulting from short-term decisions that compromise long-term sustainability. It accumulates interest over time, leading to more complex code, slower development speed, and lower quality. Sonar offers proactive solutions for managing technical debt by integrating seamlessly into the development lifecycle, promoting clean coding practices, automated code reviews, and gated quality assurance. By adopting these strategies, teams can maintain consistent code quality, accelerate development speed, and build software that is resilient, reliable, and scalable in an ever-evolving digital landscape.

The Digital Operational Resilience Act (DORA) is an EU regulation that aims to enhance IT security and operational resilience of financial institutions. Applicable from January 17, 2025, DORA mandates harmonized rules for operational resilience across financial entities and their third-party service providers. The act covers five main areas: ICT Risk Management, Digital Operational Resilience Testing, Reporting on ICT-related incidents, Information and intelligence sharing, and oversight of third-party providers. Financial institutions can leverage Sonar solutions to navigate the code quality aspects of DORA compliance and fortify their digital resilience and security by integrating code quality and security into the earliest stages of software development.

ECMAScript (ES) modules are a new standard format for packaging JavaScript code for reuse. There has been a shift from CommonJS to ES modules, but some issues have arisen along the way. One such issue was accessing the current module's directory path. In an ES module, instead of using __dirname or __filename, you can now use import.meta.url. This provides access to the directory path of the current module and allows for file system traversal relative to where your code is located. The way to access this information has evolved over time, from CommonJS's implementation to the latest update in ES modules.

In this article, a developer explains how they used SonarCloud to triage and identify vulnerabilities in an open-source project called Erxes. They discovered two intentionality issues that impacted the security of the software. The first issue was a path traversal vulnerability where user input was not correctly sanitized or escaped, allowing attackers to read arbitrary files on the file system. The second issue was an authentication bypass vulnerability where any user could become an admin on an Erxes instance just by sending a special header. These vulnerabilities were fixed in subsequent updates of the software. The author emphasizes the importance of using tools like SonarCloud and securing communication between microservices to prevent security vulnerabilities from reaching production environments.

Code refactoring is often prompted by cleanup efforts, dependency upgrades, obsolete feature flags, or platform migrations, and can require extensive follow-up changes to restore successful builds and tests. Available tools range from fast lexical utilities such as grep and sed, which handle text patterns but lack full language awareness, to syntactic tools such as ast-grep that parse code structures but do not incorporate type information. Typed AST tools, including tsmorph, ErrorProne, and OpenRewrite, support semantically safer transformations such as type migrations and security fixes, although they are language-specific and may not manage build configurations or cross-project dependencies. Build-system-aware IDE tools like IntelliJ IDEA, ReSharper, and Eclipse JDT combine type analysis with project structure but can be resource-intensive, tightly coupled to IDE environments, and difficult to automate in headless CI systems. LLM-based tools such as GitHub Copilot, Tabnine, and Sourcegraph Cody may incorporate broader code context and documentation, but their outputs can be inconsistent or inaccurate and require human review. Selecting a refactoring approach therefore depends on the task’s required power, performance, automation needs, and user experience.

Profile-Guided Optimization can reduce latency and datacenter costs by 10–30% for server applications, but unlike JIT-compiled languages such as Java and JavaScript, statically compiled languages including Go, Rust, and Swift require profiles to be explicitly collected and supplied during later builds. A continuous production PGO workflow collects and aggregates low-overhead sampling profiles from deployed services, then uses them in subsequent builds to optimize frequently executed paths through techniques such as improved code layout. Effective deployment requires a scalable platform for profile storage and aggregation, careful selection among tools such as perf, pprof, and eBPF based on accuracy, permissions, overhead, portability, and language support, and compiler tuning to avoid harmful effects such as excessive inlining and larger binaries. PGO is further complicated by inconsistent compiler and dependency versions, monorepo considerations, and longer deployment times caused by fresh profiles invalidating build caches, particularly for urgent hotfixes. Gitar is exploring a PGO-as-a-service offering for Go and Rust production environments to help organizations automate these processes and lower infrastructure costs.

Sonar introduces #CleanCodeTips, a program designed by Developer Advocates, Community Managers, and Product Developers. The initiative aims to demystify modern software development complexities and provide practical tips for writing consistent, intentional, adaptable, and responsible code. The program includes weekly tweets with infographics, video tutorials, blogs, and Ask Me Anything sessions with industry experts. Sonar's Developer Advocates include Peter McKee, Jonathan Vila, Phillip Nash, Nafiul Islam, and Ben Dechrai.

Mailspring, a popular email client application, has been found to have several vulnerabilities in versions before 1.11.0, enabling an attacker to execute arbitrary code when a victim replies to or forwards a malicious email. The underlying vulnerability has not been fixed as of today. These security issues can be exploited by using mutation Cross-Site Scripting (mXSS) and bypassing mitigations such as sandboxed iframe and Content Security Policy. An attacker could escalate the impact from XSS to Remote Code Execution (RCE) through various methods, including an outdated Electron V8 vulnerability or CSS exfiltration. Developers are advised to avoid interfering with data after sanitization, follow official Electron security documentation, and ensure proper configuration of mitigation steps like CSP.

PCI DSS 4.0 is a globally recognized security standard that outlines requirements for organizations handling cardholder data, set to replace PCI DSS 3.2.1 on March 31, 2024. Key changes in the new version include retaining the existing Defined Approach and introducing a Customized Approach, adding 64 new requirements, strengthening authentication methods, and improving cloud security measures. To ensure compliance with PCI DSS 4.0, organizations should adopt a layered approach that combines static code analysis with other security practices such as secure coding training, dynamic application security testing (DAST), penetration testing, and regular security reviews. SonarQube Enterprise Edition provides coverage of PCI DSS application security vulnerabilities, automates coding standards enforcement, conducts regular code reviews, trains developers on secure coding practices, and generates detailed reports for compliance assessment.

NullAway is an open-source Java static-analysis tool that uses pluggable type-system annotations such as @Nullable and @NonNull to detect unsafe null dereferences before runtime, addressing the widespread problem of NullPointerExceptions in languages that permit null references. By requiring explicit annotations for values that may be null and enforcing checks before such values are dereferenced, it can prevent many null-related failures in first-party code while relying on inference to reduce annotation needs for local variables. The approach adapts null-safety concepts used by languages such as Kotlin, Rust, and Swift to existing languages like Java, and NullAway has been deployed at organizations including Uber, where it checks most Java code. Its emphasis on speed—adding roughly 15% overhead compared with standard javac compilation—allows developers to receive feedback during local builds rather than waiting for CI, a practical requirement for broad adoption. The post also previews future discussion of onboarding existing codebases, handling unannotated third-party libraries and API contracts, applying related ideas to Go, and using pluggable type systems for checks beyond nullability.

This article discusses the challenges of writing and reading boilerplate code in Java for handling objects of unknown types, which can be verbose, complex, and prone to errors. It introduces new features since Java 14 that help improve this situation, such as pattern matching for instanceOf cases and switch expressions. These enhancements reduce code repetition, increase readability, and minimize the risk of errors by eliminating the need for intermediate assignments. The article also highlights the importance of maintaining low cognitive complexity in code to ensure its understandability and maintainability.