https://ai.stackspot.com/docs/assets/js/e3c12010.5ab38834.js

1"use strict";(globalThis.webpackChunkdocs_ai=globalThis.webpackChunkdocs_ai||[]).push([[1954],{2834(e,t,i){i.r(t),i.d(t,{assets:()=>o,contentTitle:()=>c,default:()=>p,frontMatter:()=>r,metadata:()=>n,toc:()=>l});const n=JSON.parse('{"id":"use-cases/app-security","title":"Application Security","description":"How to detect code vulnerabilities and apply automatic fixes with StackSpot AI.","source":"@site/versioned_docs/version-v1.0.0/use-cases/app-security.md","sourceDirName":"use-cases","slug":"/use-cases/app-security","permalink":"/docs/use-cases/app-security","draft":false,"unlisted":false,"tags":[],"version":"v1.0.0","sidebarPosition":4,"frontMatter":{"title":"Application Security","sidebar_position":4,"description":"How to detect code vulnerabilities and apply automatic fixes with StackSpot AI."},"sidebar":"sidebar","previous":{"title":"Sales Assistant with Agents","permalink":"/docs/use-cases/agents-sales"},"next":{"title":"CI/CD Pipeline","permalink":"/docs/use-cases/ci-cd"}}');var s=i(1684),a=i(506);const r={title:"Application Security",sidebar_position:4,description:"How to detect code vulnerabilities and apply automatic fixes with StackSpot AI."},c=void 0,o={},l=[{value:"<strong>Detect code vulnerabilities and apply automatic fixes with StackSpot AI</strong>",id:"detect-code-vulnerabilities-and-apply-automatic-fixes-with-stackspot-ai",level:3},{value:"<strong>Code vulnerability fix examples</strong>",id:"code-vulnerability-fix-examples",level:3},{value:"<strong>Example 1. SQL Injection vulnerability in the Java language</strong>",id:"example-1-sql-injection-vulnerability-in-the-java-language",level:4},{value:"Example 2. Hard-coded credentials vulnerability in the Java language",id:"example-2-hard-coded-credentials-vulnerability-in-the-java-language",level:4},{value:"Example 3. Cross-Site Scripting (XSS) vulnerability in the Python language",id:"example-3-cross-site-scripting-xss-vulnerability-in-the-python-language",level:4},{value:"Example 4. XML external Entity (XXE) vulnerability in the Python language",id:"example-4-xml-external-entity-xxe-vulnerability-in-the-python-language",level:4},{value:"Example 5. Creating a public bucket with a risk of data leakage in the Terraform language",id:"example-5-creating-a-public-bucket-with-a-risk-of-data-leakage-in-the-terraform-language",level:4},{value:"<strong>Video &amp; Blog</strong>",id:"video--blog",level:2}];function d(e){const t={a:"a",h2:"h2",h3:"h3",h4:"h4",img:"img",li:"li",ol:"ol",p:"p",strong:"strong",ul:"ul",...(0,a.R)(),...e.components},{Youtube:i}=t;return i||function(e,t){throw new Error("Expected "+(t?"component":"object")+" `"+e+"` to be defined: you likely forgot to import, pass, or provide it.")}("Youtube",!0),(0,s.jsxs)(s.Fragment,{children:[(0,s.jsx)(t.h3,{id:"detect-code-vulnerabilities-and-apply-automatic-fixes-with-stackspot-ai",children:(0,s.jsx)(t.strong,{children:"Detect code vulnerabilities and apply automatic fixes with StackSpot AI"})}),"\n",(0,s.jsxs)(t.p,{children:["Application vulnerabilities can lead to unauthorized data access, information manipulation, service interruptions, and hackers executing arbitrary code. This example demonstrates ",(0,s.jsx)(t.strong,{children:"using StackSpot AI to detect and fix application vulnerabilities automatically"}),"."]}),"\n",(0,s.jsx)(t.p,{children:"The steps below show how to detect and fix common code vulnerabilities using StackSpot AI:"}),"\n",(0,s.jsxs)(t.ol,{children:["\n",(0,s.jsxs)(t.li,{children:["\n",(0,s.jsxs)(t.p,{children:["Create a ",(0,s.jsx)(t.a,{href:"/docs/quick-commands/create-custom-quick-command",children:(0,s.jsx)(t.strong,{children:"Quick Command"})}),". This feature helps you centralize and orchestrate a series of command prompts, use a knowledge base, and call external APIs."]}),"\n"]}),"\n",(0,s.jsxs)(t.li,{children:["\n",(0,s.jsxs)(t.p,{children:["You can input information and code vulnerability fix snippets into a  ",(0,s.jsx)(t.a,{href:"/docs/knowledge-source/ks",children:(0,s.jsx)(t.strong,{children:"Knowledge Source"})}),". This step is optional, as the prompt will often be sufficient. You can use this option for specific cases or zero-day vulnerabilities."]}),"\n"]}),"\n",(0,s.jsxs)(t.li,{children:["\n",(0,s.jsxs)(t.p,{children:["Provide a ",(0,s.jsx)(t.strong,{children:"base of customized company parameters"}

1)," (e.g., AWS account, region, naming standards, etc.)."]}),"\n"]}),"\n",(0,s.jsxs)(t.li,{children:["\n",(0,s.jsxs)(t.p,{children:[(0,s.jsx)(t.strong,{children:"Engineer the prompts"})," to ensure optimal results using the artificial intelligence software for your specific purposes."]}),"\n"]}),"\n",(0,s.jsxs)(t.li,{children:["\n",(0,s.jsxs)(t.p,{children:["Create a step to ",(0,s.jsx)(t.strong,{children:"integrate with GitHub to create a patch issue"})," for the vulnerability found automatically."]}),"\n"]}),"\n",(0,s.jsxs)(t.li,{children:["\n",(0,s.jsxs)(t.p,{children:["Finally, ",(0,s.jsx)(t.strong,{children:"publish"})," the Quick Command to a Spot."]}),"\n"]}),"\n"]}),"\n",(0,s.jsxs)(t.p,{children:["The Quick Command created searches for vulnerabilities based on the ",(0,s.jsx)(t.a,{href:"https://owasp.org/www-project-top-ten/",children:(0,s.jsx)(t.strong,{children:"OWASP Top 10"})}),", explains each vulnerability, displays the code snippet where it applies, and suggests a code fix."]}),"\n",(0,s.jsx)(t.h3,{id:"code-vulnerability-fix-examples",children:(0,s.jsx)(t.strong,{children:"Code vulnerability fix examples"})}),"\n",(0,s.jsxs)(t.p,{children:["Using a Quick Command to ",(0,s.jsx)(t.strong,{children:"test hypotheses"})," and automatically ",(0,s.jsx)(t.strong,{children:"identify and fix"})," code vulnerabilities. The screenshots demonstrate the suggested corrections for known vulnerabilities in the code."]}),"\n",(0,s.jsx)(t.h4,{id:"example-1-sql-injection-vulnerability-in-the-java-language",children:(0,s.jsx)(t.strong,{children:"Example 1. SQL Injection vulnerability in the Java language"})}),"\n",(0,s.jsx)(t.p,{children:"SQL Injection is a cyber attack that exploits vulnerabilities in a system through SQL queries. Attackers insert malicious SQL code into input fields such as web forms and URL parameters. Suppose the web application fails to validate this input. In that case, the database system may execute the malicious SQL code, allowing attackers to access, modify, or delete data or execute commands on the server."}),"\n",(0,s.jsx)(t.p,{children:(0,s.jsx)(t.strong,{children:"Before:"})}),"\n",(0,s.jsx)(t.p,{children:(0,s.jsx)(t.img,{src:"https://ai.stackspot.com/docs/img/vulne1.png",alt:"Screenshot of a java code with SQL Injection vulnerabilities"})}),"\n",(0,s.jsx)(t.p,{children:(0,s.jsx)(t.strong,{children:"After:"})}),"\n",(0,s.jsx)(t.p,{children:(0,s.jsx)(t.img,{src:"https://ai.stackspot.com/docs/img/vulne2.png",alt:"Screenshot StackSpot AI has fixed the detected vulnerability by replacing String concatenation in the code with parameter passing using Java PreparedStatement."})}),"\n",(0,s.jsx)(t.h4,{id:"example-2-hard-coded-credentials-vulnerability-in-the-java-language",children:"Example 2. Hard-coded credentials vulnerability in the Java language"}),"\n",(0,s.jsxs)(t.p,{children:["Hard-coded credentials involve ",(0,s.jsx)(t.strong,{children:"embedding authentication details"}),", such as usernames, passwords, access tokens, or API keys, directly in an application's source code. This practice is risky because anyone with access to the code, including developers, code reviewers, or attackers, can easily see these credentials. Instead, storing authentication information securely in a protected location, such as a secure configuration file or secret manager, is essential."]}),"\n",(0,s.jsx)(t.p,{children:(0,s.jsx)(t.strong,{children:"Before:"})}),"\n",(0,s.jsx)(t.p,{children:(0,s.jsx)(t.img,{src:"https://ai.stackspot.com/docs/img/vulne3.png",alt:"Screenshot Java code containing exposed credentials."})}),"\n",(0,s.jsx)(t.p,{children:(0,s.jsx)(t.strong,{children:"After:"})}),"\n",(0,s.jsx)(t.p,{children:(0,s.jsx)(t.img,{src:"https://ai.stackspot.com/docs/img/vulne4.png",alt:"Screenshot StackSpot AI has replaced the username and password fields hardcoded in the code by using AWS Secret Manager, applying the information stored in this secret."})}),"\n",(0,s.jsx)(t.h4,{id:"example-3-cross-site-scripting-xss-vulnerability-in-the-python-language",children:"Example 3. Cross-Site Scripting (XSS) vulnerability in the Python language"}),"\n",(0,s.jsxs)(t.p,{children:["XSS (Cross-site scripting) constitutes a significant security vulnerability in web applications. It ",(0,s.jsx)(t.strong,{children:"allows attackers to inject and execute malicious scripts"})," within a user's browser. This threat arises when untrusted data is incorporated into a web page and executed in other users' browsers. Such attacks jeopardize users' security and privacy, leading to potential consequences such as session theft, redirection to malicious websites, cookie theft, and displaying unwanted content."]}),"\n",(0,s.jsx)(t.p,{children:(0,s.jsx)(t.strong,{children:"Before:"})}),"\n",(0,s.jsx)(t.p,{children:(0,s.jsx)(t.img,{src:"https://ai.stackspot.com/docs/img/vulne5.png",alt:"Screenshot Python code vulnerable to XSS attacks."})}),"\n",(0,s.jsx)(t.p,{children:(0,s.jsx)(t.strong,{children:"After:"})}),"\n",(0,s.jsx)(t.p,{children:(0,s.jsx)(t.img,{src:"https://ai.stackspot.com/docs/img/vulne6.png",alt:"Screenshot StackSpot AI detected the Cross-Site Scripting (XSS) vulnerability and fixed the code by escaping the user_input variable."})}),"\n",(0,s.jsx)(t.h4,{id:"example-4-xml-external-entity-xxe-vulnerability-in-the-python-language",children:"Example 4. XML external Entity (XXE) vulnerability in the Python language"}

1),"\n",(0,s.jsx)(t.p,{children:"XML External Entity (XXE) is a security vulnerability in systems that process XML documents. It happens when an application processes XML entries that contain references to external entities giving attackers the ability to access system resources or perform actions that are not desired. In an XXE attack, attackers can read system files, interact with internal services, execute remote code, and cause denial of service. It can result in severe consequences, such as leaking confidential data and compromising the system."}),"\n",(0,s.jsx)(t.p,{children:(0,s.jsx)(t.strong,{children:"Before:"})}),"\n",(0,s.jsx)(t.p,{children:(0,s.jsx)(t.img,{src:"https://ai.stackspot.com/docs/img/vulne7.png",alt:"Screenshot Python code with XXE vulnerability"})}),"\n",(0,s.jsx)(t.p,{children:(0,s.jsx)(t.strong,{children:"After:"})}),"\n",(0,s.jsx)(t.p,{children:(0,s.jsx)(t.img,{src:"https://ai.stackspot.com/docs/img/vulne8.png",alt:"Screenshot: The parser is correctly passed to the tree in the corrected code.fromstring function using the 'parser' keyword argument. It ensures the use of XMLParser, with the 'resolve_entities' setting set to False, preventing the XML parser from processing external entities and reducing the risk of XXE attacks."})}),"\n",(0,s.jsx)(t.h4,{id:"example-5-creating-a-public-bucket-with-a-risk-of-data-leakage-in-the-terraform-language",children:"Example 5. Creating a public bucket with a risk of data leakage in the Terraform language"}),"\n",(0,s.jsx)(t.p,{children:"While not precisely a vulnerability, it is not recommended, except in specific cases."}),"\n",(0,s.jsx)(t.p,{children:(0,s.jsx)(t.strong,{children:"Before:"})}),"\n",(0,s.jsx)(t.p,{children:(0,s.jsx)(t.img,{src:"https://ai.stackspot.com/docs/img/vulne9.png",alt:"Screenshot Terraform code that creates a public S3 Bucket."})}),"\n",(0,s.jsx)(t.p,{children:(0,s.jsx)(t.strong,{children:"After:"})}),"\n",(0,s.jsx)(t.p,{children:(0,s.jsx)(t.img,{src:"https://ai.stackspot.com/docs/img/vulne10.png",alt:"Screenshot: StackSpot AI has removed public access to bucket S3 and restricted access policies."})}),"\n",(0,s.jsx)(t.h2,{id:"video--blog",children:(0,s.jsx)(t.strong,{children:"Video & Blog"})}),"\n",(0,s.jsxs)(t.ul,{children:["\n",(0,s.jsxs)(t.li,{children:["\n",(0,s.jsxs)(t.p,{children:[(0,s.jsx)(t.a,{href:"https://www.stackspot.com/en/blog/application-security",children:(0,s.jsx)(t.strong,{children:"For more details, please refer to the article on the StackSpot Blog"})}),"."]}),"\n"]}),"\n",(0,s.jsxs)(t.li,{children:["\n",(0,s.jsx)(t.p,{children:"Discover more about how StackSpot AI addresses application vulnerabilities in this video:"}),"\n"]}),"\n"]}),"\n",(0,s.jsx)(i,{videoId:"-ihX9zLhE9g"})]})}function p(e={}){const{wrapper:t}={...(0,a.R)(),...e.components};return t?(0,s.jsx)(t,{...e,children:(0,s.jsx)(d,{...e})}):d(e)}},506(e,t,i){i.d(t,{R:()=>r,x:()=>c});var n=i(2888);const s={},a=n.createContext(s);function r(e){const t=n.useContext(a);return n.useMemo(function(){return"function"==typeof e?e(t):{...t,...e}},[t,e])}function c(e){let t;return t=e.disableParentContext?"function"==typeof e.components?e.components(s):e.components||s:r(e.components),n.createElement(a.Provider,{value:t},e.children)}}}]);