Blog post

Protect your code against injection vulnerabilities with SonarQube Cloud!

Alexandre Gigleux photo

Alexandre Gigleux

Product Manager

TL;DR overview

  • SonarQube Cloud is expanding into the SAST market with native cloud-based static application security testing capabilities, bringing automated vulnerability detection directly into cloud-native CI/CD workflows without additional tooling.
  • Unlike traditional SAST tools that require separate deployment and configuration, SonarQube Cloud SAST integrates security analysis into the same platform developers use for code quality, providing a unified view of bugs, code smells, and security vulnerabilities.
  • The cloud-based delivery model means teams can activate SAST with no infrastructure setup, benefiting from continuous updates to security rules as new vulnerability patterns are identified.
  • SonarQube Cloud SAST supports popular programming languages and maps findings to OWASP Top 10, CWE Top 25, and SANS Top 25 for compliance and security reporting.

These days, no one can deny that security matters. Every week on the news, you see stories about web attacks, and the theft of sensitive customer data from companies compromised by a data breach. The reasons for these attacks range from passwords left on a sticky note to complex vulnerability exploits.

Detecting injections

Since 2010, the OWASP organization, which defines the famous OWASP Top 10 standard, considers that the biggest security problem applications are suffering from is the possibility to perform injection attacks.

OWASP A1 - Injection:

Injection flaws, such as SQL, NoSQL, OS, and LDAP injection, occur when untrusted data is sent to an interpreter as part of a command or query.

The attacker’s hostile data can trick the interpreter into executing unintended commands or accessing data without proper authorization.

These last few months at SonarSource we have developed an engine dedicated to the security domain based on the technique call "taint analysis". Basically, we track whether your input variables have been sanitized by the time they reach a piece of code (a sink) that can be used to perform an attack. We don't pretend to cover all the possible sinks but that will be enhanced over the time so we can participate in this effort to eradicate the "Injection" from the OWASP Top 10 standard.

This new engine is part of SonarQube Cloud and is targeting 6 common injection problems for Java and C#:

What's next?

We want to detect more injection problems on more languages such as PHP! Additionally, we want to raise issues on low-hanging fruit related to the security domain such as: use of weak encryption algorithms, debug options left in production code, misconfigured cookies, etc.

Coming with that, we will soon provide a dedicated security space so you can easily check your compliance with OWASP Top 10 and SANS Top 25 standards. Stay tuned!