GitHub's machine learning tool can detect vulnerabilities in code

Code hosting platform GitHub has just launched a brand new machine learning-based code analysis and scanning tool. This tool has the ability to automatically detect common vulnerabilities in code before they are introduced into the final stages.

Currently, the tool is in public beta testing in GitHub's JavaScript and TypeScript repos.

"With new analysis capabilities, the code scanning engine can display more warnings for four common vulnerability patterns: cross-site scripting (XSS), path injection, NoSQL injection and SQL injection," the experts said. Tiferet Gazit and Alona Hloibna of GitHub shared.

"Aggregate data shows that these four types of vulnerabilities are the cause of many recent vulnerabilities (CVEs) in the JavaScript/TypeScript ecosystem and improved code scanning to detect these vulnerabilities early in the process." development is key to helping developers write safer code."

GitHub's machine learning tool can detect vulnerabilities in code Picture 1

When a vulnerability is detected, the tool will display a warning in the "Security" tab of registered repos. The alerts are also labeled "Experimental" and are also available via the pull requests tab.

In fact, a code analysis tool called CodeQL was added to their platform by GitHub after acquiring code analysis platform Semmle in September 2019. The first beta of CodeQL was announced in May 2020 and available for everyone to test in September 2020.

During beta testing, CodeQL scanned more than 12,000 repos 1.3 million times and discovered more than 20,000 security issues, including remote code execution (RCE), SQL injection, and cross-site vulnerabilities. scripting (XSS).

CodeQL is free for public repos and available as an Advanced Security feature for GitHub Enterprise private repos.

Now, after adding machine learning, CodeQL's accuracy and code analysis capabilities will be further improved.

github vulnerability scanner

Samuel Daniel

Update 21 February 2022

You should read it

May be interested

Hackers take advantage of Microsoft Defender's 8-year-old weakness to bypass the virus detection system
hackers take advantage of the weakness of microsoft defender anti-virus software to learn the locations excluded from the scan and plant malware there.
Microsoft's source code signature control system is easily bypassed by Zloader malware
after bypassing microsoft's protection system, the zloader malware deployed and stole the personal information of thousands of victims from 111 countries.
Detecting a series of vulnerabilities can help hackers disable metal detectors at airports
researchers have discovered a series of security vulnerabilities in a network component of garrett metal detectors.
How to block Windows Defender from sending data to Microsoft
windows defender regularly sends your computer data to microsoft to analyze and improve the program. however, sometimes it also causes microsoft to have more of your personal data such as: web cookies, interactions, frequently downloaded junk data...
How to check if a URL is safe?
cybersecurity is an issue that you need to be concerned about. while surfing the web, you will sometimes be directed to links containing viruses, malware and phishing.
This is how Windows 11 and Windows 10 21H2 combat PrintNightmare, ransomware and other threats
microsoft has just released a new security base pack for windows 10 21h2 in the form of the microsoft security compliance toolkit.

GitHub's machine learning tool can detect vulnerabilities in code

You should read it

May be interested

Security solution