Injection vulnerabilities

How to fix injection vulnerabilities using SonarQube for Eclipse.

Injection vulnerabilities are also known as injection flaws or taint vulnerabilities; the names are often used interchangeably (ie: injection flaws, injection vulnerabilities, and taint vulnerabilities). They are issues raised by specific security-related rules in SonarQube (Server, Cloud) and remain a top concern. Common types include SQL Injection, Deserialization, and Command Injection vulnerabilities. See the server related documentation for more details about this type of rule:

• Security-related rules in SonarQube Cloud

• Security-related rules in SonarQube Cloud

Injection vulnerabilities are unique issues because of how data and information flow within your application. This flow becomes a problem when a user controls the data input into the application (source), and that data is not validated or sanitized before it is used by sensitive functions (sink). This lack of validation or sanitization is what allows a potential attacker to manipulate the data flow for malicious purposes.

Because injection vulnerabilities (i.e., taint vulnerabilities) often involve code in multiple files and functions, SonarQube for IDE can only raise them after a full project analysis. This is why taint vulnerabilities are pulled from SonarQube Server or SonarQube Cloud after a project analysis.

Prerequisites

• Running SonarQube for IDE in connected mode with SonarQube Cloud or a SonarQube Server commercial edition is required. See the pages on Connected mode and Connected mode setup for more details.

• Your project should be analyzed regularly, ideally by your CI server.

Limitations

• Only taint vulnerabilities in open files are shown in the IDE.

• SonarQube for IDE does not support short-lived branches therefore, when running in connected mode with SonarQube Cloud, you must work with Branch analysis setup; SonarQube Server does not distinguish between long- and short-lived branches.

  • SonarQube for Eclipse follows a logic pattern as defined in the Branch awareness article to sync the branch analysis on SonarQube (Server, Cloud) with the local analysis, including the synchronization of taint vulnerabilities, in your IDE.

• You’re limited by your SonarQube (Server, Cloud) plan restrictions regarding lines of code limits and branches you can analyze.

How to display injection vulnerabilities

1. Complete your Connected mode setup and bind your project to SonarQube (Server, Cloud).

2. If the SonarQube Taint Vulnerabilities view is not already open, go to Eclipse Window > Show View > Other… > SonarQube and select SonarQube Taint Vulnerabilities.

3. The view should display the list of taint vulnerabilities that are present on open files.

If you don’t see the data flow displayed in the code editor for injection vulnerabilities, make sure that code minings are enabled in the Preferences > Java > Editor > Code Minings menu.

How to fix your taint vulnerabilities

Because the detection of taint vulnerabilities requires that you run in connected mode, any changes you make to the code must be analyzed by your instance of SonarQube (Server, Cloud). Here are two options to resolve taint vulnerabilities displayed by SonarQube for IDE:

• After you fix the taint vulnerability in your IDE, commit your code to the server and rerun the analysis on SonarQube (Server, Cloud). The new status (of the vulnerability) will be reflected in your IDE.

• Go to the issue in SonarQube (Server, Cloud) and mark it as Accept or False positive. The new status will be updated locally in less than one minute.

When running in connected mode with SonarQube Server 10.4 or newer, Won’t Fix becomes Accept.

See the Fixing issues page for complete details about fixing issues, including the Fixing security hotspots and injection vulnerabilities article, in SonarQube for Eclipse.