Checking the code you wrote: static analysis
This is part 6 of the series "Protect Your Own Service Yourself — Self-Defense Security in the Age of AI." Do the checks you can yourself; when it's hard, EarthLink Network can run the assessment for you, and fix the gaps you can't fix on your own. Series contents Anyone can attack now, with AI — check your own site first What attackers now hold: when AI runs the attack itself Before you start:…
Static analysis is the process of reading source files and flagging code written in a risky way. It reads through every file using the same standard and can catch weaknesses that outside testing may miss, such as features not yet visible or admin-only functionalities. However, it cannot see what only appears at runtime, such as whether the server sends the right security headers.
There are three main groups of static analysis tools based on how they find weaknesses: matching rules, tracking data flow, and AI-powered code review. Rule-based tools carry hundreds of rules and compare each file against them, making them great for finding known bad patterns. Data flow tracking tools follow a value from where it enters to where it is used, which helps catch issues like unfiltered user-controlled values reaching a database query.
AI-powered code review tools, like Strix, can understand the logic behind the code and spot reasoning errors that rules can't.
In the example provided, promptflow's code was scanned using Semgrep with two different rule sets: a security rule set (p/security-audit) and a JavaScript rule set (p/javascript). The security rule set found no issues, but the JavaScript rule set flagged a potential open redirect vulnerability in a line of code that decides where to send a user after login. An open redirect is a classic security flaw that can be exploited to lure users onto fake login pages. This finding was not caught by the security rule set.
The flaw was found by tracing the code and identifying a check that let a slash followed by any character (`/\`) through, even though it should have been blocked. The JavaScript rule set flagged this vulnerability, while the security rule set did not. This highlights the importance of using multiple rule sets and methods to ensure comprehensive code security checks.
After finding vulnerabilities, it's crucial to sort out false positives and run the checks again on a schedule to stay on top of potential security issues. In this case, the CodeRabbit AI reviewer caught the open redirect vulnerability when fixing the code.
Written by urgent.news from Dev.to's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
