I-GitHub imemezele ukungezwa kwesistimu yokufunda yomshini wokuhlola kusevisi yayo yokuskena Ikhodi ukuze kuhlonzwe izinhlobo ezivamile zobungozi kukhodi. Esigabeni sokuhlola, ukusebenza okusha okwamanje kutholakala kuphela kumakhosombe anekhodi ku-JavaScript ne-TypeScript. Kuyaphawuleka ukuthi ukusetshenziswa kwesistimu yokufunda yomshini kwenze kwaba nokwenzeka ukwandisa ngokuphawulekayo ububanzi bezinkinga ezikhonjiwe, lapho kuhlaziywa ukuthi isistimu ayisakhawulelwe ekuhloleni izifanekiso ezijwayelekile futhi ayiboshiwe nezinhlaka ezaziwa kakhulu. Phakathi kwezinkinga ezikhonjwe uhlelo olusha, kushiwo amaphutha aholela ekubhalweni kwe-cross-site (XSS), ukuhlanekezelwa kwezindlela zamafayela (ngokwesibonelo, ngenkomba ethi β/..β), ukufakwa esikhundleni semibuzo ye-SQL ne-NoSQL.
Isevisi yokuskena Ikhodi ikuvumela ukuthi ubone ubungozi ekuqaleni kokuthuthuka ngokuskena umsebenzi ngamunye we-βgit pushβ ukuze uthole izinkinga ezingaba khona. Umphumela unamathiselwe ngqo kwisicelo sokudonsa. Ngaphambilini, ukuhlola bekwenziwa kusetshenziswa injini ye-CodeQL, ehlaziya izifanekiso ngezibonelo ezijwayelekile zekhodi esengozini (i-CodeQL ikuvumela ukuthi udale ithempulethi yekhodi esengozini ukuze uhlonze ukuba sengozini okufanayo kukhodi yamanye amaphrojekthi). Injini entsha, esebenzisa ukufunda komshini, ingahlonza ubungozi obungaziwa ngaphambilini ngoba ayiboshelwe ekubaleni izifanekiso zekhodi ezichaza ubungozi obuthile. Izindleko zalesi sici ziwukukhuphuka kwenani lemibono engamanga uma kuqhathaniswa namasheke asekelwe ku-CodeQL.
Source: opennet.ru