Introduction

Many times I have heard developers saying that why we need Nexus IQ (Nexus Lifecycle) scanning when we already did SonarQube code scan. And if we're doing both, then why do we need a third tool to scan the code. Well! various tools scan different aspects of the code.

In this competitive era and fast deploy code to market, we need automation not only around testing and deployment but also for code review and security. Nothing can replace the manual code review process, however, it takes time and sometimes availability of developers is challenging. Here, the code analysis tool comes to the rescue. These tools could scan from different aspects and report bugs to improve code quality, code security, code performance, etc.

Type of Tools

To simplify it, we could categorize these tools into 2 high-level categories:

1. Static code analysis tools
2. Dynamic code analysis tools

1. Static code analysis tools

These tools perform analysis on the application's source code without executing/running the code on a platform. In other words, a bot goes line by line of source code to find any bug as defined by preconfigured policies/rules. It could be compared to manual code review, but the review is done by a bot. Mostly, code quality, coding standard aspects are targeted to be scanned. The biggest name in static code analysis tool is SonarQube, which performs analysis for the code quality, programming language standard, code security, and test coverage based upon predefined rules. Also, it supports many languages 20+. Apart from it, here are a few more, FindBug (Open Source, not maintained anymore, Java only), Veracode (20+ languages are supported).

2. Dynamic code analysis tools

Also called Dynamic Application Security Testing (DAST), this category of tools, performs code analysis on an executing program and finds out bugs based upon predefined rules/policies. They rely on how a program reacts to the input (input is defined per the penetration tests) when a program is running on a platform. Tools in this category scan the security aspect of the code. Few most popular tools are Netsparker, Acunetix, Contrast Security

Apart from these static and dynamic tools, another quite widely used tool is Nexus Lifecycle/IQ (long list of languages).

Nexus Lifecycle report
Image Credit - https://help.sonatype.com/iqserver/reporting/application-composition-report/reviewing-a-report#ReviewingaReport-Overview

Nexus Lifecycle scans the dependent components of any application to flag any vulnerability present in the dependent component/module. *Why do we need to scan dependent components? because accidents aren't always caused by the driver themselves; it can also occur due to other drivers *. In the same way, if the dependent module has a vulnerability, it makes the application vulnerable as well.

All of these tools also enable us to shift our mindset towards shift left approach, where we get faster feedback on code quality, security, etc. Some of the tools provide integration into the CI-CD pipeline, some could be used as pre-hook to scan code even before the developer could check in the code in the source control.

The SonarLint plugin can be added to the IDE and it could flag the issue right at the time logic is being coded. Similar to SonarLint, there is IDE plugin for NexusIQ as well.

If you have reached here, then I did a satisfactory effort to keep you reading. Please be kind to leave any comments or ask for any corrections. Happy Coding!

My other blogs:

• What is WAI-ARIA and why we need it?
• React Application Testing Strategy