Vulnerability checker
Relying on third-party software in your projects can become a source of vulnerable dependencies and vulnerable APIs.
To prevent vulnerability issues, use the vulnerability checker tool available in the Qodana for JVM, Qodana for Android, Qodana for .NET, Qodana for Python, Qodana for Go, Qodana for PHP and Qodana for JS (only npm packages) linters on the Ultimate Plus license. Based on the information from the vulnerability checker, you can take immediate action to address vulnerabilities.
The vulnerability checker does not send information about packages to the JetBrains server in a clear textual form. It sends only hashed names of packages. We never log or process hashes we do not have in our database. Thus, we do not analyze your proprietary or confidential packages.
Visit the Subscription Options and Pricing page to learn more about available Qodana licenses. You can also request a demo.
Vulnerable dependencies and APIs
A vulnerable dependency is a third-party library or package in your project that has known security vulnerabilities. To detect vulnerable dependencies, the package checker employs the OSV and Mend.io tools.
A vulnerable API refers to the active usage of specific functions, classes or methods within a dependency that are known to be vulnerable. To detect vulnerable APIs, the vulnerability checker uses the Package Checker plugin and reports reachable usage of vulnerable APIs in vulnerable dependencies, which refers to public methods and other parts of the vulnerable API's interface that are directly affected by the vulnerability and are actively used by your code.
For example:
org.apache.logging.log4j:log4j-core:2.14.1 is vulnerable to CVE-2021-44832.
The return DataSourceConnectionSource.createConnectionSource(jndiName) vulnerable API call causes a remote code execution (RCE) attack when an attacker has control of jndiName.
How the vulnerability checker works
The vulnerability checker uses the following inspections:
Inspection | Description |
|---|---|
Vulnerabilities in Gradle, Maven, NPM, PyPI and Go dependencies | |
Usages of Vulnerable APIs in imported dependencies for JVM-based projects | |
Usages of Vulnerable APIs in imported dependencies for .NET projects, enabled by default | |
Potential security errors related to .NET projects | |
Usages of Vulnerable APIs in imported dependencies for Go projects | |
Usages of Vulnerable APIs in imported dependencies for JavaScript projects | |
Usages of Vulnerable APIs in imported dependencies for Python projects |
To analyze your code using the vulnerability checker, in the YAML configuration of Qodana, enable inspections from the table above. For example, for the VulnerableLibrariesLocal inspection it will be:
Addressing vulnerabilities
To address vulnerabilities, update the dependency or package to a version that fixes the vulnerability. If a fixed version is not yet available, or updating the dependency is not possible, then you should switch to alternatives.
To identify vulnerable APIs, we continuously analyze public dependencies on the server side to enrich vulnerability data with the affected methods and functions. This data becomes part of the specific Qodana analysis when the relevant dependency is detected, and it is used to highlight vulnerable API calls in your code.