Injection vulnerabilities

Injection vulnerabilities are also known as injection flaws or taint vulnerabilities; the names are often used interchangeably (ie: injection flaws, injection vulnerabilities, and taint vulnerabilities). They are issues raised by specific security-related rules in SonarQube Server and SonarQube Cloud and remain a top concern. Common types include SQL Injection, Deserialization, and Command Injection vulnerabilities. 

Injection vulnerabilities are unique issues because of how data and information flow within your application. This flow becomes a problem when a user controls the data input into the application (source), and that data is not validated or sanitized before it is used by sensitive functions (sink). This lack of validation or sanitization is what allows a potential attacker to manipulate the data flow for malicious purposes. 

Because injection vulnerabilities (i.e., taint vulnerabilities) often involve code in multiple files and functions, SonarQube for IDE can only raise them after a full project analysis. This is why taint vulnerabilities are pulled from SonarQube Server or SonarQube Cloud after a project analysis.

You can find the definition of injection vulnerabilities in the SonarQube Server and SonarQube Cloud glossary. 

Prerequisites

• Running SonarQube for IDE in connected mode with SonarQube Cloud or a SonarQube Server commercial edition is required. See the pages on Connected mode and Connected mode setup for more details.
• Your project should be analyzed regularly, ideally by your CI server.

Limitations

• Only taint vulnerabilities in open files are shown in the IDE.
• SonarQube for IDE does not support short-lived branches therefore, when running in connected mode with SonarQube Cloud, you must work with long-lived branches; SonarQube Server does not distinguish between long- and short-lived branches. 
  • SonarQube for VS Code follows these methods to choose which branch (in SonarQube (Server, Cloud)) to sync with its local analysis, including the synchronization of taint vulnerabilities in your IDE.
• You’re limited by your SonarQube (Server, Cloud) plan restrictions regarding lines of code limits and branches you can analyze.

How to display taint vulnerabilities

1. Set up Connected mode and bind your project to SonarQube (Server, Cloud).
2. In the standard VS Code Panel below the editor region, select the PROBLEMS panel.
3. Along with regular issues, the PROBLEMS panel displays the list of injection vulnerabilities that are found in the bound folder. SonarQube for VS Code displays injection vulnerabilities for the entire project.

How to fix your taint vulnerabilities

Because the detection of taint vulnerabilities requires that you run in connected mode, any changes you make to the code must be analyzed by your instance of SonarQube (Server, Cloud). Here are two options to resolve taint vulnerabilities displayed by SonarQube for IDE:

• After you fix the taint vulnerability in your IDE, commit your code to the server and rerun the analysis on SonarQube (Server, Cloud). The new status (of the vulnerability) will be reflected in your IDE.
• Go to the issue in SonarQube (Server, Cloud) and mark it as Accept or False positive. The new status will be updated locally in less than one minute.

See the Fixing issues page for complete details about fixing issues, including injection and taint vulnerabilities, in SonarQube for VS Code.