April 2024 Summaries

Software plays a crucial role in businesses today, and fast delivery of high-quality software is essential to stay competitive. However, current software development processes rely heavily on unit testing, which only checks functionality and not code quality. Poor-quality code can lead to technical debt, security vulnerabilities, and poor customer experience. Clean Code, consisting of secure, reliable, and maintainable code, is the foundation for high-quality software. Static code analysis is a method used in software development to evaluate source code without executing it, identifying potential errors, vulnerabilities, and compliance issues. It ensures the delivery of high-quality software by preventing issues later in the DevOps workflow or application lifecycle. Both unit testing and static analysis are necessary for delivering the best possible applications in today's competitive business environment.

PolyglotPiranha, a PLDI 2024 research project, aims to improve automated maintenance of large, multilingual codebases by bridging the gap between simple syntactic rewriting tools and complex language-specific transformation frameworks. Lightweight tools such as Comby and ast-grep are fast and accessible but struggle with cascading refactorings that require multiple dependent edits, while imperative tools such as OpenRewrite and jscodeshift are highly expressive but require specialized language and build-system knowledge. PolyglotPiranha organizes lightweight rewrite rules into directed graphs, allowing rules to pass captured information, such as a deleted method’s name, to subsequent rules and to constrain follow-up cleanups to relevant code scopes. This approach supports controlled, multi-step refactorings, such as deleting an annotated method, replacing its calls, and simplifying the resulting expressions, while remaining compatible with multiple matching syntaxes including Comby, tree-sitter queries, concrete syntax, and regular expressions.

Inheriting a legacy codebase can be daunting due to inconsistent coding styles, unused code, duplicated functionality, and outdated practices. However, refactoring or rewriting from scratch can be time-consuming and challenging. A middle ground approach is to gradually build test coverage for critical functionalities and adopt a Clean as You Code strategy. Leveraging DevOps principles, such as continuous integration and deployment (CI/CD), automation for testing and integration, and incremental changes, can streamline code management and set the foundation for continuous improvement.

NullAway is a Java null-safety checker that uses @Nullable annotations and non-null defaults to prevent null dereferences, but migrating large unannotated codebases is difficult because annotations can propagate through fields and method signatures, produce iterative compiler errors, create false positives for invariants the type system cannot express, and require widespread cross-team code reviews. To address this, Uber and UC Riverside developed the open-source NullAwayAnnotator, which automates onboarding by repeatedly analyzing NullAway errors, exploring alternative chains of annotations through bounded backtracking, and selecting changes that minimize unresolved errors rather than blindly marking values nullable. The tool accelerates this search with program-structure graph coloring, accounts for build-target and downstream dependency boundaries, and suppresses remaining unresolved locations so annotation-only, behavior-preserving changes can be merged automatically. At Uber, it was used to annotate more than 160 production targets covering over 1.3 million lines of code, leaving an average of 6.32% of each target unchecked, while enabling future changes outside suppressed areas to receive null-safety guarantees.

Modern polyglot applications often require refactoring across languages such as Java, Kotlin, Swift, Objective-C, Go, and TypeScript, making simple text-search tools insufficient for tasks like stale feature-flag removal. Cross-language changes can cause cascading rewrites, including replacing method calls, simplifying boolean expressions, removing redundant conditionals and unreachable code, deleting unused parameters, and cleaning imports; although compilers may eliminate dead code in generated output, leaving it in source code increases technical debt and maintenance costs. The discussion argues that AST-based tools are preferable to build-system-based approaches because they can provide lightweight, syntax-level, reusable cleanup rules without separate implementations for each language. It highlights Uber’s PolyglotPiranha, alongside Meta’s Codemod and Semgrep, as a cross-language rewrite tool that represents refactorings as ordered match-and-replace rule graphs and iteratively applies rules until no further changes are possible. PolyglotPiranha supports 10 languages, is built on tree-sitter, and aims to automate large-scale migrations, dependency updates, security fixes, and deep code cleanup while allowing many rules to be shared across related languages.

SonarQube's 10.5 release introduces support for Java 21, C++23, and TypeScript 5.4. The update also simplifies onboarding for monorepos in GitHub and GitLab, Maven projects, and GitHub Actions. Security rules and maintainability best practice rules for Kubernetes and Helm Charts have doubled. Additionally, TensorFlow AI library support has been added to the platform. SonarQube now offers accessibility rules for HTML and sustainability rules for Java. The update also extends cleaning capabilities to the entire mainframe ecosystem, including COBOL code and Job Control Language (JCL).

In October 2023, Sonar's Vulnerability Research Team discovered a critical code vulnerability (CVE-2023-46851) in the Apache Allura software used by SourceForge. This vulnerability could have allowed attackers to fully compromise SourceForge and spread malicious software to nearly 20 million users worldwide. The issue was fixed with Apache Allura version 1.16.0, and there were no signs of in-the-wild exploitation.

Artificial Intelligence (AI) is increasingly being adopted across businesses, with nearly half of enterprise-scale companies actively deploying it. While there are concerns about new risks from AI, it's crucial that fear and skepticism don't hinder progress. Companies should approach their AI adoption open-mindedly and prioritize quality control to minimize disruption and risk while maximizing productivity and innovation. A "trust but verify" approach is recommended, where AI output is verified with human review. This can be achieved by pairing the approach with Sonar's Clean Code solutions like SonarQube, SonarCloud, and SonarLint. AI has the potential to greatly enhance productivity by automating mundane tasks, allowing employees more time for creative thinking and problem-solving. However, it also poses risks such as creating a gap between individuals who leverage AI effectively and those who don't, leading to misalignment within teams. Furthermore, if not properly managed, the use of AI in software development could exacerbate existing issues with bad code and technical debt. To mitigate these risks, companies should approach the adoption of AI coding assistants and tools with an eye toward quality control. All code, whether human or AI-generated, must be properly analyzed and tested before being put into production. Developers should turn to AI for volume and automation of mundane tasks but must have the right checks in place to ensure their code remains a foundational business asset. Establishing safeguards is crucial when harnessing AI for good. Companies need to understand where and how AI is being used, think through their investments, and put in place easily adaptable governance as things continue to rapidly change. Trusted frameworks like NIST's Secure Software Development Framework can be a great starting point. Sonar's powerful code analysis tools - SonarQube, SonarCloud, SonarLint - enable developers to integrate with popular coding environments and CI/CD pipelines for in-depth insight into the quality, maintainability, reliability, and security of their code no matter if human or AI-generated. By taking a "trust but verify" approach across all aspects of AI use, organizations can ensure they are leveraging this technology effectively while minimizing risks.

Logging is an essential part of application development and is often overlooked. It's like an airplane's black box that helps developers understand what went wrong when something goes awry in the app. Despite its importance, logging is frequently treated as an afterthought, implemented without proper planning or understanding. Poor logging can lead to difficulties in diagnosing issues in production and hinder search capabilities of a logging backend. Sonar provides C# logging rules that help developers avoid making mistakes when logging required information. These rules cover various aspects such as message syntax and semantics, placeholder duplication, order of placeholders, manual crafting of messages, using the wrong overload, wrong logger category, unlogged exception, conventions, and consistency. Sonar also provides recommendations for setting conventions to help relieve the brain of information overload and make the code base easier to understand. Additionally, it offers guidance on performance and log file considerations, such as avoiding too much logging that can lead to performance degradation or log file overload.

The text discusses a recent hack on an open-source library called xz, where the attacker took advantage of the maintainer's trust over time to gain access to the system. The maintainer was initially unaware that he had been targeted and was even praised by the hacker for his work in advance. The hackers' ability to subvert security mechanisms was technically sophisticated, but their approach was also socially sophisticated. This incident highlights the need to pay open-source maintainers more attention and compensation to prevent such attacks in the future. The article suggests that paying maintainers is a crucial step towards creating a resilient software industry where maintainers can thrive without feeling overworked or underappreciated.

In September 2023, Java released its latest LTS version (Java 21) which brought numerous new features aimed at improving performance and clarity in the code base. However, taking advantage of these changes can be challenging due to unfamiliarity with the new features. To assist developers, Sonar has introduced a group of new Java 21 rules that guide users from the beginning of their coding journey. These rules cover various aspects such as using built-in "Math.clamp" methods, correct ranges with Math.clamp, SequencedCollection reversed() for reverse iteration order, and more. By adopting these rules, developers can ensure proper usage of new improvements, avoid bugs, and improve code quality.

Apache Dubbo is a popular Java open-source RPC framework designed for microservices-based and distributed systems. It provides a robust communication protocol that allows services to exchange data across different networked nodes, enabling the creation of scalable, flexible, and reliable applications. However, vulnerabilities have been discovered in the framework, mainly affecting the consumer end rather than the provider. Sonar's Vulnerability Research Team has found two security issues in Apache Dubbo that could result in arbitrary object deserialization and eventually lead to remote code execution (RCE). Despite not being classified as vulnerabilities by Apache, these findings have led to updates in the documentation for users to better protect themselves.