Company
Date Published
Author
Alexandre Gigleux
Word count
725
Language
English
Hacker News points
None

Summary

The SonarCloud JavaScript and TypeScript Security Analysis has been updated to improve its performance and accuracy. The new version can detect more execution flows, increase performance, and provide better results. The analysis engine was previously lacking a publicly available benchmark for JS/TS, but it now uses the OWASP JuiceShop project as a reference point. This project is used to demonstrate insecure code that the SonarCloud analysis can find, including 39 Security Hotspots and 28 Vulnerabilities. The analysis can detect injection vulnerabilities such as SQL Injection, XSS attacks, and NoSQL Injection, with a detection rate of 81% for injection vulnerabilities in the OWASP JuiceShop project. The analysis is designed to provide fast results, with an average scan time of under 6 minutes on a medium-sized machine. SonarCloud also offers Automatic Analysis, which can scan projects made with JavaScript or TypeScript and detect security vulnerabilities in under 8 minutes.