July 2024 Summaries

SonarCloud, a code quality platform, has grown significantly since its launch in 2018, analyzing over 3.6 billion lines of code across 179,000 active projects and 16,000 companies for reliability, security, and maintainability issues. To expand its offerings, SonarCloud is introducing two new plans: the Enterprise plan with advanced features such as single sign-on, enterprise hierarchy, management reporting, and support for specific languages like COBOL; and the Team plan with essential capabilities for small development teams and businesses. The new Enterprise plan delivers a range of features to empower development teams of all sizes to deliver clean code with confidence, including commercial support, dedicated SLA, and access to enterprise-specific languages. Additionally, SonarCloud will continue to offer its Free plan to support open-source projects and is now available on AWS Marketplace.

The CrowdStrike outage affected an estimated 8.5 million Windows computers worldwide, causing a global blue screen of death. The issue was attributed to a faulty update in their Falcon Sensor endpoint protection software, specifically its kernel driver, which resulted in an out-of-bounds memory read due to a null pointer dereference or possibly an uninitialized variable. This highlights the importance of thorough testing and validation of code updates, particularly for critical components like kernel drivers that interact directly with hardware and have significant system-level implications. The incident also underscores the need for early detection and mitigation of reliability and maintainability issues in software development, which can have far-reaching consequences like this outage.

The .NET team has released a set of rules for ASP.NET Core developers to help improve the quality of their code. These rules address various issues such as controller bloat, endpoint performance, metadata coherence and API documentation, model definition and validation. The rules aim to help developers avoid common pitfalls like adding unnecessary actions to controllers, using inefficient HTTP clients, and neglecting proper metadata and validation in models. By implementing these rules, developers can create more maintainable, efficient, and secure ASP.NET Web Apps.

Sonar has been ranked #1 in Static Code Analysis by G2 in the Summer 2024 Grid Report, leading in multiple segments, including Enterprise, Mid-Market, and Small Business. This recognition is based on customer requirements, ease of setup, implementation time, ease of use, and user adoption. Sonar has been helping organizations minimize risk, reduce technical debt, and derive more value from their software for over 15 years. Customers praise Sonar for its ability to evaluate code during development, provide high-quality reviews and suggestions, support multiple programming languages, and integrate with existing DevOps tool chains. The G2 Grid Report provides a competitive landscape map for the category, helping technology buyers make informed software purchasing decisions.

The new feature, AutoConfig in SonarQube 10.6, aims to simplify code analysis for C and C++ projects by automating the configuration process, eliminating the need for manual setup and compatibility with various build environments. It bridges compiler gaps by modeling compiler behavior in a generic manner, providing reliable static code analysis even in environments where conventional tools fail. AutoConfig also breaks free from environmental constraints, allowing for secure, isolated analysis environments without restructuring entire CI workflows. With its revolutionary simplicity, developers can start analyzing their C or C++ project with minimal configuration effort, making high-quality software development accessible to all domains and projects.

A missing charset attribute in an HTTP response header can lead to severe Cross-Site Scripting (XSS) vulnerabilities. Browsers use various methods to determine the character encoding, including the Content-Type header, <meta> tags, and auto-detection through Byte-Order Marks. However, when these methods fail to detect a valid charset, browsers may resort to making educated guesses or using non-strict behavior, which can be exploited by attackers. The ISO-2022-JP character encoding is particularly vulnerable due to its escape sequences that allow switching between different character sets. Attackers can use two techniques to inject arbitrary JavaScript code: "Negating Backslash Escaping" and "Breaking HTML Context". The first technique involves inserting an escape sequence in a user-controlled string, while the second technique involves controlling values in multiple HTML contexts to break the HTML document's syntax. Providing charset information is essential to prevent these vulnerabilities, and browsers should consider disabling auto-detection for the ISO-2022-JP character encoding.

Gogs, an open-source solution for self-hosting source code, has four critical vulnerabilities discovered and reported by the author. The vulnerabilities allow attackers to compromise vulnerable instances, enabling them to steal source code, plant code backdoors, wipe all code, and more. These vulnerabilities were not patched by the Gogs maintainers after being reported, leaving users vulnerable. To protect themselves, users can disable the built-in SSH server, disable user registration, apply patches provided by the author, or switch to a more actively maintained alternative like Gitea. The vulnerabilities highlight issues with Git's design for use on untrusted inputs and the importance of securing its use in such scenarios.

SonarQube is a powerful static code analysis solution that integrates seamlessly with code coverage tools, empowering developers to write cleaner, more secure, and thoroughly tested code. It measures the percentage of code executed by automated tests, providing insights into potential areas needing better test coverage. SonarQube supports reporting, monitoring, and visualizing code coverage, helping teams maintain high code quality standards. To set up code coverage in SonarQube, developers must configure a third-party tool to produce reports that can be imported into the platform. Once configured, SonarQube provides detailed guides for various programming languages, including Java, C/C++, JavaScript, Python, .NET, and PHP. The platform offers granular code coverage reports that pinpoint untested sections of code, providing actionable insights and helping teams track progress toward testing goals. By integrating coverage analysis into the development workflow, developers can ensure their codebase is well-tested and maintain high standards of quality.

This blog post introduced four unpatched vulnerabilities in Gogs, a popular open-source solution for hosting and managing source code. The vulnerabilities were discovered through an investigation of the code base of Gogs, which allows attackers to compromise vulnerable instances, enabling them to steal source code, plant code backdoors, wipe all code, and more. The most critical vulnerability, CVE-2024-39930, is an Argument Injection vulnerability in the built-in SSH server that can be exploited by sending a specially crafted environment variable. To protect against these vulnerabilities, Gogs users are advised to disable the built-in SSH server, turn off user registration, and apply patches created by the authors of this blog post. Additionally, the authors recommend switching to alternative source code hosting platforms like Gitea, which is more actively maintained and has already fixed similar vulnerabilities. The blog post concludes that the maintainers of Gogs have stopped responding to disclosures, leaving users with limited time to patch before the 90-day disclosure deadline expires.