What's the difference between Security Hotspots and Security Issues?

(music) Pulse (chime) In this video, we’ll explain the key differences between Security Hotspots and Security Issues, and review them both in detail. Let’s get started! After watching this video, you’ll be able to explain the difference between Security Hotspots and Security Issues, describe how to determine if a Security Hotspot poses a security risk, and explain the options to remediate a Security Hotspot or a Security Issue. Let’s start with the key difference between Security Hotspots and Security Issues: Security Hotspots are code that has been flagged because it poses a potential security risk, whereas Security Issues represent confirmed vulnerabilities that require an immediate fix. Additionally, Security Hotspots require a developer to review the code to determine if the code is a vulnerability. This is because the developer needs to look at the code with the context of how it’s intended to function, to determine whether or not it poses a risk. Let's look at an example. Here, my scan results show 12 Security Hotspots detected in my code. When I click into these, I can see they are prioritized by potential risk, and I have four SQL injection hotspots. If I select one of the Hotspots, SonarQube provides the reason the code was flagged, and I can read more about the underlying SonarQube rule. In this case, the SQL query is being built dynamically, which could lead to the inclusion of untrusted values, and increases the risk of a SQL injection attack. SonarQube shows me exactly where the Hotspot is located in my code, and provides information about why it could be a risk. I can view recommended coding practices and guidance to help me assess the risk. SonarQube also provides a suggested fix, along with supporting documentation. Sonar also provides a suggested fix, along with supporting documentation. Now, I need to review this Hotspot to determine whether or not it poses a risk. This depends on the specific context I have on how the code will function. In this example, part of the dynamically-built SQL query includes a variable that could potentially be tainted with malicious input. If I’m confident the input is being properly sanitized before its use, I can mark the status as Safe. If I decide the code is a potential vulnerability, but want to fix it later, I can mark the status as Acknowledged. I can also add a comment or assign a person to fix the issue. If I choose to fix the Hotspot now, I can change the status to Fixed. Now let’s look at our Security Issues. Unlike Hotspots, Security Issues are confirmed vulnerabilities that need immediate remediation. I can filter by issue severity and category. Let’s look at this SQL injection issue. I can see the reason the code was flagged, and learn more about the underlying SonarQube rule. I can see the reason the code was flagged, and learn more about the underlying Sonar Rule. In this case, I have a database query that is vulnerable to a malicious attack. Not only does Sonar show me where the issue is located directly in my files, but I can see the entire execution flow of the code. This powerful capability helps me understand how the query is constructed, leaving it open to malicious attack. SonarQube provides an explanation of the issue, and guidance on how to address it. Sonar provides an explanation of the issue, and guidance on how to address it. It automatically detects the most relevant framework for my code. Under More info, there are links to documentation and other resources to help me learn more about the issue. To remediate the issue, you can apply SonarQube’s suggested code fix in your IDE, then commit and push your code. When you rescan your code, the issue will drop off as fixed. When Sonar rescans your code, the issue will drop off as Fixed. If you can’t fix the issue immediately, you can change its status to Accepted, meaning you plan to fix it later. If you think the analysis is mistaken, you can mark it as a False Positive. Another option is to use SonarQube’s AI CodeFix to automatically generate a fix. You can copy and paste the AI fix into your IDE, or go to view the fix directly in your IDE. This powerful, opt-in capability can fix vulnerabilities across multiple files, and even resolve Security Hotspots in the process. When SonarQube detects Security Issues or Hotspots in your code, you can choose when and how to remediate the issue. When Sonar detects Security Issues or Hotspots in your code, you can choose when and how to remediate the issue. By addressing and resolving issues as they’re detected, you can ensure you maintain a high-quality and secure codebase. See our additional videos to dive deeper into other Sonar topics! (chime)