SonarSource

The wrong regex can cause your app to overflow the stack and crash but detecting the condition doesn't have to be hard.

Avoid Stack Overflows By Writing Regexes Properly

Eliminating complexity & ensuring correct boundaries in your Java regular expressions.

Getting Regex Boundaries Right: A How-To Guide

Regular expressions are a powerful tool with a steep learning curve and plenty of opportunities to make mistakes - particularly in character classes.

Regexes or Regular Expressions And The Common Mistakes Programmers Make While Using Them

The rise of developer-led security doesn't put security professionals out in the code; it frees them to do more meaningful work.

Developer-Led Code Security Will Dominate the SAST Market

There are two basic classes of code security issues: the ones you can know for certain are a problem, and the ones that depend on context and need human review.

Developer-led Security: Hotspots Continue To Maintain Engagement

Developers don't have time for false positives, so SonarSource makes sure that when SonarQube or SonarCloud raises an issue, you know there's something to fix.

Why we Prefer "Reasonable" False Negatives to Raising False Positives 

Developer-led Code Security takes the pain out of SAST analysis

SAST Analysis: No Angst Edition

Hey SonarQube and SonarCloud users! You now have a tool to own Code Security! 

Review and Improve Your Code Security Analysis in SAST

As developers, there always comes a time when we find a bug in production and wonder how it passed all our quality checks. The truth is that we can never be sure our code is bug free. We can only choose the tools and workflows which will find the most bugs without slowing us down too much.

The Ultimate Guide To Hassle Free Bugs Fixing In Premium Python Projects By SonarCloud 

Author Robert Collier said that "Success is the sum of small efforts repeated day in and day out." That's especially true when it comes to security. 

For secure code, maintainability matters

Libraries and system utilities form the foundations on which larger projects are built. So it's critical to make sure they, in particular, are secure. That's why we recently introduced five new rules for C++ and C to detect broken authentication and access control in *nix systems. The new rules fall into three categories: account validity, granting permissions, and changing directories. 

Lay a strong foundation by writing secure C and C++ utilities

When writing a rule for static analysis, it’s possible that in some cases, the rule does not give the results that were expected. Unfortunately, naming a false positive is often far easier than fixing it. In this post, I’ll discuss how the different types of rules give rise to different types of false positives, which ones are easier to fix than others, and how you can help. I’ll end with insight into how issues that are false positives can still be true indicators that the code needs to change.

False positives Are Considered Enemies, But Can They Be Your Friends?

Security is an eternal race between the techniques and technologies of attackers and those of the defenders. Today, I'm proud to announce a step forward for defenders with a new rule to detect a literal race condition: TOCTOU (or TOCTTOU) vulnerabilities, known in long-form as Time Of Check (to) Time Of Use. 

How To Win The Race Against TOCTOU Vulnerabilities in C & C++

As a tech startup, you don’t have to reach everyone. You just need to reach your people, the ones who get your product, the ones whose problems you solve.

The Tech Startup’s Guide to First-Time Advertising (TL;DR: Go Niche!)

Replace vague error messages with specific, actionable feedback that helps users solve problems.

Refactoring 031 - Removing OOPs

Discover how HackerNoon's contextual ads outperform traditional platforms, delivering 5x more clicks by reaching 2M+ engaged tech readers. Book a call.

Generate Quality Leads ASAP: HackerNoon's Content-Relevant Niche Ads FTW

In this paper, researchers present an IntelliJ plugin designed to seamlessly integrate Gamekins’ gamification elements into the IDE.

An IDE Plugin for Gamified Continuous Integration: Gamification Elements of Gamekins

Discover the ins and outs of Spring Scheduler, covering annotations, examples, cron expressions, fixed delays, and more for task automation in spring. 

Mastering Scheduling and Tax Execution in Spring Boot

Welcome to another edition of Hack marketing diaries by team HackerNoon! This time, we wanna share our learnings and observations on surveillance capitalism.

How to Advertise to Your Target Audience without Creeping Them Out

Surveillance capitalism… How about we not make that our business model? 

Targeted Ads: Ad Placements by Content Relevancy

Although LLMs can help developers to be more productive, prior empirical studies have shown that LLMs can generate insecure code.

Generate and Pray: Using SALLMS to Evaluate the Security: Conclusion & References

Learn how to detect and address dead store code smells with expert tips.

Code Smell 240 - Dead Store Code 

Most of these smells are just hints of something that might be wrong. Therefore, they are not required to be fixed per se… (You should look into it, though.)

How to Find the Stinky Parts of Your Code [Part XLVI]

Here, I recommend reading articles about TDD (Test-Driven Development) and BDD (Behavior-Driven Development), which can evolve from this stage.

Just Go Ahead and Test Your Project - Part 1

SonarSource S.A. designs and develops software solutions. The Company offers quality management software products. SonarSource serves customers in Switzerland.

SONARSOURCE

sonarsource.com

Since 2008

SonarSource's Related Companies

Representing this company? Click here to claim and customize this page!

Reviews About SonarSource

SonarSource WIKI

Apply to get your Tech Company News Page live on HackerNoon.com today!

Light-Mode

Classic

Newspaper

Dark-Mode

Neon Noir

Minty

HN StartUps