Software Engineering principles & practices (20CS44P)

Code quality and code security [week-10 theory]

Overview

• Code quality and code security aren’t the same, but they’re closely related. And in the
current cyberthreat environment, developers should care about both.
• Many developers draw a distinction between code quality and code security.
Traditionally, embedded development and QA teams focused on quality, as software
defects in embedded devices can cause life-threatening consequences. By contrast,
security was most often a concern with web and commercial applications that handle
sensitive customer data.
• However, because customers now rely heavily on interconnected web and embedded
applications, all development teams should be addressing both code quality and code
security.

Importance
Software is more or less defined by the quality of its code. This affects the safety,
security, and reliability of your codebase and therefore the operations of the software itself.
That is why high code quality is so important for most development teams, especially those
working in safety-critical systems.

The importance of code quality

• Within the software industry, there are certain coding standards that are needed for the
successful implementation of any program.
• That’s because, in order to encourage growth, most organizations need software that
works seamlessly. They can’t afford to be spending time looking for and fixing issues
with software code.
• However, ensuring the code quality is high and it remains that way is not an easy task.
• In fact, it requires almost constant monitoring and updating to ensure that code quality
standards are upheld at every junction.

The importance of code security

• Your software code is the core of your application systems; this makes it more vulnerable
to malicious malware and unauthorized users.
• Therefore, you need to check for any vulnerability and apply the relevant security
measures; else, the whole application may be endangered. This article aims to address the
essence of secure coding.
• Secure coding practices find and remove vulnerabilities that could be exploited by cyber
attackers from ending up in the finished code.
• By developing secure code, cyber attackers will find it difficult to hack the code and gain
access to applications and systems, thereby reducing data breaches.
• It’s important to ensure any software developed has checks and system in place that helps
strengthen the software and get rid of any security issues like vulnerabilities.

Dept of CSE, GPT CHN Page 1

 Software Engineering principles & practices (20CS44P)
Issues caused by poor code

• It is not readable - if a new person joins the team, it takes them an abnormally long time
to be productive - fix bugs, add features, and so on. This aspect of ‘bad’ code can be due
to several reasons, here are some of them:
• Badly organized code and poorly structured or very large control flows - the largest
control flow sequence I have seen, had a straight block of three-level nested if-then-else
blocks that ran into approximately 5000 lines, wrapped in a try-catch block
• Carelessly named classes - that do not give a clue to the reader about the intent of the
programmer
• Architectural and design issues - such as modules with too many in-coming and/or
outgoing dependencies, tightly coupled components, and so on
• Poor attention to detail on issues of scalability, security, etc. - again an architectural
issue
• It is not testable - I have always maintained that testability is one of the hardest
properties to understand and address as an architect.
Of course, by looking at the code, one can detect poor testability, due to the reason
explained in point 1(a) above. But since many of the project management and executive
management members do not have the time to engage at this level of detail, they often
miss this important non-functional ability of a system.
However, this can be easily observed from the simple activity of measuring the time
spent on testing/debugging vs the time spent on development, as the project progresses.
This might seem like a blindingly obvious metric to track, but many teams do not have
this information readily available.
• It is hard to extend - because of the combined effects of lack of readability and
testability, defined above.
How does one detect it, other than by looking at the code? If, as the project
progresses, you find that even trivial features are taking a long time to deliver, then you
have a problem of extensibility.

Tools to check code quality

List of Code Quality Tools that are used for code review and they also help in improving the
overall code quality.

1) PVS-Studio - Best for not only for finding typos, dead code, but also potential
vulnerabilities. A SAST solution that supports integration into popular IDEs CI/CD and
other platforms.
PVS-Studio is a static code analyzer that detects errors in C, C++, C#, and Java code.
Works with Windows, Linux, and macOS environments. Can be run both as a plugin and
from the command line. The analyzer works locally and from the cloud.

2) SonarQube - Best for Tracking divergence from security standards & policies and to
ensure safer code with a good number of checks and validations.
SonarQube is used for continuous inspection of Code Quality and Security. It is a
Commonly used SAST tool and supports 27 languages and integrates with the workflow
and can be run as a part of the code build or as a separate step in the code pipeline itself.

Dept of CSE, GPT CHN Page 2

 Software Engineering principles & practices (20CS44P)
3) Crucible - Best for Collaboration across small to midsize teams in the code review
process. It supports integration with most commonly used Source code control systems.
Crucible is an on-premise code-review tool that helps development teams review each
other’s code, catch defects, enforce coding standards, and assist teams in adhering to best
practices for development. Owned by Atlassian, supports great integration with most of
the Atlassian tools like Jira, BitBucket, etc.

4) Codacy - Best for Individual freelance developers to large enterprises. Codacy is a Static
code analysis tool capable of identifying security issues, code duplication, coding
standards violation etc.

5) Upsource - Best for Small to medium-sized teams looking for an integrated review tool.
Upsource is a smart review tool and repository browser that offers static code analysis
through a web-based UI and dashboard.

6) Review board - Best for Teams looking for a very basic code review tool that is free and
can be hosted on premise. It’s a web-based code review tool from Apache.

7) Phabricator - Best for Freelance Software developers or small teams to manage projects,
code reviews and as a hosting repository as well. It’s an all-in-one tool for project
management as well as for code review.

8) Deepscan - Best for Javascript developers for static code quality and code reviews.
DeepScan is an advanced static analysis tool for supporting Javascript-based languages
like – Javascript, TypeScript, React, and [Link].
All these languages which can compile to Javascript are supported by DeepScan
which helps in maintaining code quality standards and checks.

9) Gerrit - Best for Teams of all sizes looking for an open-source code review tool. Gerrit
Code review is a web-based review tool that follows Git Version control.
It’s a framework that can be used by teams of all sizes to review code before it’s
merged to the main branch.

10) Veracode - Best for Teams looking for a one-stop solution for all application security
code quality needs through different types of analysis.
It’s an application security tool platform that can perform different types of code
analysis like – static & dynamic code analysis, software composition analysis, interactive
application security testing, etc.

Containerization: Container

• Containerization is the packaging together of software code with all it's necessary
components like libraries, frameworks, and other dependencies so that they are isolated in
their own "container."
• This is so that the software or application within the container can be moved and run
consistently in any environment and on any infrastructure, independent of that
environment or infrastructure’s operating system.
• The container acts as a kind of bubble or a computing environment surrounding the
application and keeping it independent of its surroundings. It’s basically a fully functional
and portable computing environment.
Dept of CSE, GPT CHN Page 3
 Software Engineering principles & practices (20CS44P)
• Containers are an alternative to coding on one platform or operating system, which made
moving their application difficult since the code might not then be compatible with the
new environment. This could result in bugs, errors, and glitches that needed fixing
(meaning more time, less productivity, and a lot of frustration).

Why container?

• Containers are a solution to the problem of how to get software to run reliably when
moved from one computing environment to another.

Here's what you need to know about this popular technology.

• Containers are a solution to the problem of how to get software to run reliably when
moved from one computing environment to another. This could be from a developer’s
laptop to a test environment, from a staging environment into production, and perhaps
from a physical machine in a data center to a virtual machine in a private or public cloud.

Dept of CSE, GPT CHN Page 4

 Software Engineering principles & practices (20CS44P)

Benefits of containers

• Less overhead - Containers require less system resources than traditional or hardware
virtual machine environments because they don’t include operating system images.
• Increased portability - Applications running in containers can be deployed easily to
multiple different operating systems and hardware platforms.
• More consistent operation - DevOps teams know applications in containers will run the
same, regardless of where they are deployed.
• Greater efficiency - Containers allow applications to be more rapidly deployed, patched,
or scaled.
• Better application development - Containers support agile and DevOps efforts to
accelerate development, test, and production cycles.

What is docker?
Docker is a open source software platform to create display and manage
virtualized application containers on a common os

Working of docker

Docker packages, provisions and runs container

• Container technology is available through the OS
• A Container packages the application with all of the libraries,
configuration files and dependencies and other necessary parts and
parameter to operate
• Docker image contains all the dependencies needed to execute the
code inside a container, so container that move between docker
environment with same os work and no change
• Docker uses resource isolation in the os kernel to run multiple
containers on same os which is different than virtual machines
which encapsulates on entire OS

Components of Docker

Docker engine: It is the underlying technology that handles the

tasks and workflow involved in building container-based application
Docker hub: is a software as a service tool that enables users to
publish and share container-based application through a common
library
Compose: is a tool to configure multi container application services

Dept of CSE, GPT CHN Page 5