April 2024 Summaries

Software plays a crucial role in businesses today, and fast delivery of high-quality software is essential to stay competitive. However, current software development processes rely heavily on unit testing, which only checks functionality and not code quality. Poor-quality code can lead to technical debt, security vulnerabilities, and poor customer experience. Clean Code, consisting of secure, reliable, and maintainable code, is the foundation for high-quality software. Static code analysis is a method used in software development to evaluate source code without executing it, identifying potential errors, vulnerabilities, and compliance issues. It ensures the delivery of high-quality software by preventing issues later in the DevOps workflow or application lifecycle. Both unit testing and static analysis are necessary for delivering the best possible applications in today's competitive business environment.

Inheriting a legacy codebase can be daunting due to inconsistent coding styles, unused code, duplicated functionality, and outdated practices. However, refactoring or rewriting from scratch can be time-consuming and challenging. A middle ground approach is to gradually build test coverage for critical functionalities and adopt a Clean as You Code strategy. Leveraging DevOps principles, such as continuous integration and deployment (CI/CD), automation for testing and integration, and incremental changes, can streamline code management and set the foundation for continuous improvement.

SonarQube's 10.5 release introduces support for Java 21, C++23, and TypeScript 5.4. The update also simplifies onboarding for monorepos in GitHub and GitLab, Maven projects, and GitHub Actions. Security rules and maintainability best practice rules for Kubernetes and Helm Charts have doubled. Additionally, TensorFlow AI library support has been added to the platform. SonarQube now offers accessibility rules for HTML and sustainability rules for Java. The update also extends cleaning capabilities to the entire mainframe ecosystem, including COBOL code and Job Control Language (JCL).

In October 2023, Sonar's Vulnerability Research Team discovered a critical code vulnerability (CVE-2023-46851) in the Apache Allura software used by SourceForge. This vulnerability could have allowed attackers to fully compromise SourceForge and spread malicious software to nearly 20 million users worldwide. The issue was fixed with Apache Allura version 1.16.0, and there were no signs of in-the-wild exploitation.

Artificial Intelligence (AI) is increasingly being adopted across businesses, with nearly half of enterprise-scale companies actively deploying it. While there are concerns about new risks from AI, it's crucial that fear and skepticism don't hinder progress. Companies should approach their AI adoption open-mindedly and prioritize quality control to minimize disruption and risk while maximizing productivity and innovation. A "trust but verify" approach is recommended, where AI output is verified with human review. This can be achieved by pairing the approach with Sonar's Clean Code solutions like SonarQube, SonarCloud, and SonarLint. AI has the potential to greatly enhance productivity by automating mundane tasks, allowing employees more time for creative thinking and problem-solving. However, it also poses risks such as creating a gap between individuals who leverage AI effectively and those who don't, leading to misalignment within teams. Furthermore, if not properly managed, the use of AI in software development could exacerbate existing issues with bad code and technical debt. To mitigate these risks, companies should approach the adoption of AI coding assistants and tools with an eye toward quality control. All code, whether human or AI-generated, must be properly analyzed and tested before being put into production. Developers should turn to AI for volume and automation of mundane tasks but must have the right checks in place to ensure their code remains a foundational business asset. Establishing safeguards is crucial when harnessing AI for good. Companies need to understand where and how AI is being used, think through their investments, and put in place easily adaptable governance as things continue to rapidly change. Trusted frameworks like NIST's Secure Software Development Framework can be a great starting point. Sonar's powerful code analysis tools - SonarQube, SonarCloud, SonarLint - enable developers to integrate with popular coding environments and CI/CD pipelines for in-depth insight into the quality, maintainability, reliability, and security of their code no matter if human or AI-generated. By taking a "trust but verify" approach across all aspects of AI use, organizations can ensure they are leveraging this technology effectively while minimizing risks.

Logging is an essential part of application development and is often overlooked. It's like an airplane's black box that helps developers understand what went wrong when something goes awry in the app. Despite its importance, logging is frequently treated as an afterthought, implemented without proper planning or understanding. Poor logging can lead to difficulties in diagnosing issues in production and hinder search capabilities of a logging backend. Sonar provides C# logging rules that help developers avoid making mistakes when logging required information. These rules cover various aspects such as message syntax and semantics, placeholder duplication, order of placeholders, manual crafting of messages, using the wrong overload, wrong logger category, unlogged exception, conventions, and consistency. Sonar also provides recommendations for setting conventions to help relieve the brain of information overload and make the code base easier to understand. Additionally, it offers guidance on performance and log file considerations, such as avoiding too much logging that can lead to performance degradation or log file overload.

The text discusses a recent hack on an open-source library called xz, where the attacker took advantage of the maintainer's trust over time to gain access to the system. The maintainer was initially unaware that he had been targeted and was even praised by the hacker for his work in advance. The hackers' ability to subvert security mechanisms was technically sophisticated, but their approach was also socially sophisticated. This incident highlights the need to pay open-source maintainers more attention and compensation to prevent such attacks in the future. The article suggests that paying maintainers is a crucial step towards creating a resilient software industry where maintainers can thrive without feeling overworked or underappreciated.

Apache Dubbo is a popular Java open-source RPC framework designed for microservices-based and distributed systems. It provides a robust communication protocol that allows services to exchange data across different networked nodes, enabling the creation of scalable, flexible, and reliable applications. However, vulnerabilities have been discovered in the framework, mainly affecting the consumer end rather than the provider. Sonar's Vulnerability Research Team has found two security issues in Apache Dubbo that could result in arbitrary object deserialization and eventually lead to remote code execution (RCE). Despite not being classified as vulnerabilities by Apache, these findings have led to updates in the documentation for users to better protect themselves.

In September 2023, Java released its latest LTS version (Java 21) which brought numerous new features aimed at improving performance and clarity in the code base. However, taking advantage of these changes can be challenging due to unfamiliarity with the new features. To assist developers, Sonar has introduced a group of new Java 21 rules that guide users from the beginning of their coding journey. These rules cover various aspects such as using built-in "Math.clamp" methods, correct ranges with Math.clamp, SequencedCollection reversed() for reverse iteration order, and more. By adopting these rules, developers can ensure proper usage of new improvements, avoid bugs, and improve code quality.