May 2025 Summaries

SonarQube Advanced Security represents a significant leap forward, extending SonarQube's powerful analysis capabilities to protect entire software supply chains. It integrates comprehensive security and quality analysis directly into the developer workflow, providing developers with actionable remediation, compliance tracking, and seamless integration with CI/CD pipelines. The solution tackles common pain points of traditional security tools, including noise, friction, and lack of integration, fostering developer adoption and enabling organizations to ship secure software faster. With its unmatched accuracy and speed, SonarQube Advanced Security empowers developers to find and fix both code quality and code security issues across their entire codebase.

SonarQube Server 2025 Release 3 introduces significant updates focused on bringing code quality and security together into a single surface area, featuring advanced security capabilities such as Software Composition Analysis (SCA) and advanced Static Application Security Testing (SAST), AI CodeFix with automated remediation suggestions, enhanced compliance standards including MISRA C++:2023 rules, new reports for CWE Top 25 2024 and OWASP Mobile Top 10, and improved language coverage including Rust and PySpark support. This release is designed to help unify tooling for secure and well-maintained code, with a particular emphasis on security advancements and AI-powered CodeFix features.

At Sonar, we strive to provide accurate bug detection for our users. Our latest advances in reliability-impacting issue detection use a cross-procedural engine that analyzes code context to find complex bugs. This new engine, named Dataflow Bug Detection (DBD) Engine, has shown significant improvements in true positive and low false positive rates compared to our previous non-cross-procedural engine. The DBD Engine is already being used in combination with the historical engine for detecting issues in Java and Python code. We plan to transition the rules slowly to reduce the impact of these changes and make the new engine widely available across all SonarQube editions. This move aims to increase developer productivity by providing more accurate and relevant bug detection, ultimately reducing the time spent on debugging and improving software stability.

The security risks of API clients, specifically Postman, Insomnia, Bruno, and Hoppscotch, were investigated in this two-part blog series. The tools' architecture using JavaScript-based cross-platform frameworks like Electron and Tauri was analyzed, highlighting the challenges of sandboxing untrusted JavaScript code. The `vm2` package, used by Bruno to sandbox code, has fundamental flaws that allow attackers to escape the sandbox. Alternative approaches, such as QuickJS compiled to WebAssembly and isolated-vm, were found to be more robust. Good practices for sandboxing untrusted JavaScript code securely include using Web Workers or a new window in browser-capable contexts, and isolated-vm in non-browser capable contexts. The maintainers of Insomnia, Postman, Bruno, and Hoppscotch acknowledged the reported security issues and released fixes.

This API client security vulnerability highlights the importance of thorough testing and validation. Popular API clients like Postman and Insomnia employ custom JavaScript sandboxing to restrict access to privileged parts of their applications, but these sandboxes are not foolproof. By leveraging Electron's built-in browser and Node.js integration, these tools provide a user-friendly GUI for testing and debugging APIs. However, scripting capabilities within these tools pose a security risk if not implemented correctly, allowing attackers to exploit vulnerabilities such as arbitrary code execution or access to sensitive system resources. To mitigate this risk, developers must be aware of the threat model of their chosen API clients and take steps to implement robust JavaScript sandboxing using available tools. The case studies of Insomnia and Postman demonstrate the importance of security in developer tools and provide guidance on implementing secure sandboxing approaches. By understanding these vulnerabilities and implementing effective countermeasures, developers can protect themselves against potential attacks and ensure a safer online experience.

The White House has issued two new AI policies that provide clear direction for federal agencies to integrate AI into their operations. These policies emphasize the importance of safeguarding public trust and mitigating risk while leveraging AI's transformative power. Federal agencies must consider seven key factors, including developing infrastructure and governance to manage risk, managing AI accountability and risk, testing and validating AI models, monitoring usage, updating internal policies, building a library of use cases, and building a skilled workforce. Additionally, SonarQube can support federal AI adoption by providing AI-Generated Code Assurance, proactive issue detection and remediation, and enforcing coding standards. By adopting these principles and tools, federal agencies can navigate the integration of AI responsibly and ensure its benefits are realized while maintaining public trust.