Qodana Code Quality platform detects and flags programming errors such as bugs, security vulnerabilities, anomalous code, dead code and the like. Now it adds Taint analysis support too.

Today's news is that JetBrains is adding a new automated Taint analysis feature to Qodana that minimizes the attack surface by introducing inspections that scan the code and highlight the potential vulnerability. PHP developers already have the opportunity to try it out in early preview and it will be extended to other languages in due course.

First, however, for those not yet familiar with Qodana let's discover what it has on offer. In JetBrains Qodana - More Than Just A Linter we discovered that Qodana goes beyond a linter's qualifications.

Of course, at its core Qodana is a collection of linters which provide project analysis locally or in any CI with every linter providing two types of output:

JSON files separately described per each linter
Web reports for interactive results investigation and configuration adjustment

In particular note that Qodana can "provide project analysis locally or in any CI" . As such developers can have the same universal set of inspections across their JetBrains IDEs as well as their CI pipeline, including JetBrains Space, TeamCity, GitHub Actions, Jenkins, and GitLab CI.

The next step was for Qodana to get into the Cloud. In JetBrains Qodana Moves To The Cloud we observed that move:

JetBrains' integrated code quality platform moves from locally hosted development environments to the cloud. Why is that great?

Before this move to the cloud, Qodana could provide project analysis locally or in any CI by being run as a Docker image. The newly introduced cloud-based Qodana is focused on team work and performance across an organization.

With no need for spinning up Docker images, it has the advantage that it collects data from all the different linters spread across the organization in a single repo. As such running the analysis on the concentrated data provides a holistic view on the wider code quality and deeper insights on a team performance scale. It goes without saying that this functionality is especially helpful for managers that supervise large teams of developers.

Now you get all that plus Taint mode too, beginning with PHP and looking quickly to expand to other languages too.

With this functionality, developers can defend programs against taints, malicious inputs from external users and hackers who can use the taints in the code to destroy the system, hijack credentials, and other data, and change the system’s behavior.

Jetbrains says. . .

But let's understand first what Tainted data is with a little help from Perl.

Perl had always a built-in "taint mode" which when enabled it considered all data coming from an external source as untrusted. This was very useful in checking for SQL injections since if a command involving the tainted data was issued, the program would exit with an error.

But it was not just SQL injection;Tainted data wouldn't be also used in system commands and the likes. The only way to continue was to un-tain the data by validating it against regular expressions.

Of course manually doing taint analysis is not effective enough. As such with Qodana, JetBrains automated this process. The new Taint analysis minimizes the attack surface by leveraging inspections that scan the code and highlight the potential vulnerability.

At the same time it provides a full visual dataflow graph of the taint flow, hence revealing to the developers the full picture of the vulnerable flow in order to help them understand the attack surface on a high level.

The feature is available for PHP developers in the Early Preview, with the ability to open the issue in PhpStorm to address it on the spot. More languages are coming in the near future too.

More Information

Qodana

Related Articles

JetBrains Qodana - More Than Just A Linter

JetBrains Qodana Moves To The Cloud 

To be informed about new articles on I Programmer, sign up for our weekly newsletter, subscribe to the RSS feed and follow us on Twitter, Facebook or Linkedin.

Comments

Make a Comment or View Existing Comments Using Disqus

or email your comment to: comments@i-programmer.info