{"id":103375,"date":"2022-02-18T09:36:49","date_gmt":"2022-02-18T07:36:49","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/github-vnedril-sistemu-mashinnogo-obucheniya-dlya-poiska-uyazvimostej-v-kode"},"modified":"2022-02-18T09:36:49","modified_gmt":"2022-02-18T07:36:49","slug":"github-vnedril-sistemu-mashinnogo-obucheniya-dlya-poiska-uyazvimostej-v-kode","status":"publish","type":"post","link":"https:\/\/prohoster.info\/en\/blog\/news\/github-vnedril-sistemu-mashinnogo-obucheniya-dlya-poiska-uyazvimostej-v-kode","title":{"rendered":"GitHub Implements Machine Learning System to Identify Vulnerabilities in Code","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"
GitHub has announced the addition of an experimental machine learning system for detecting common types of vulnerabilities in code to its Code scanning service. Currently, during the testing phase, this new functionality is available only for repositories containing code in JavaScript and TypeScript. It is noted that the use of the machine learning system significantly expands the range of detected issues, as the analysis is no longer limited to checking typical patterns and is not tied to known frameworks. Among the issues identified by the new system are errors that lead to cross-site scripting (XSS), path manipulation (for example, through the use of \u2018\/..\u2019), and the injection of SQL and NoSQL queries. <\/p>\n
The Code scanning service enables the detection of vulnerabilities at an early stage of development by scanning each 'git push' operation for potential issues. The results are attached directly to the pull request. Previously, checks were conducted using the CodeQL engine, which analyzes patterns with typical examples of vulnerable code (CodeQL allows for creating patterns of vulnerable code to identify similar vulnerabilities in the code of other projects). The new engine, utilizing machine learning, can identify previously unknown vulnerabilities since it is not constrained by iterating through code patterns that describe specific vulnerabilities. The trade-off for this capability is an increase in the number of false positives compared to checks based on CodeQL. \n Source: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"