Code Linting: A Shift Left Strategy to Protect Your Codebase
July 22, 2021

Nicolas Bontoux
SonarSource

Delivering clean and safe software is no longer an option for developers or the organizations they work for. Customers have little patience for buggy, error-prone apps and software that's rife with critical vulnerabilities. These sort of quality and security issues can seriously hurt a company's brand reputation and negatively impact revenues.

Security has become a particular concern for developers. The majority of software security vulnerabilities are the result of coding errors, not malicious attacks. According to a recent analysis of over 500 Github security advisories from 2019-2020, 83% of advisories were caused by coding mistakes, while only 17% "were related to explicitly malicious behavior such as backdoor attempts."

Because of these factors, developers and development teams are continuously looking for ways to achieve cleaner and safer code. As a result, static analysis tools have begun to grow rapidly in popularity.

On a basic level, code linting software analyzes source code to flag issues during the development process and helps developers find and fix typos, programming errors, syntax, and bugs.

But is it enough?

No. That's why Developers are turning to modern day linters.

Modern day linters are becoming a must-have commodity in every developer's toolbox because of their advanced capabilities. Good linting tools not only perform basic checks, but are also capable of running static analysis to detect security vulnerabilities, memory leaks, code compliance, and more, right in the development environment. With developers taking more ownership of security, these features are critical.

Support for a Shift Left Approach

Bugs in production apps can wreak major havoc, exposing sensitive user data and jeopardizing a company's revenue and reputation. Detecting and fixing these bugs in pre-production is critical to avoiding these issues. It's also much easier and cheaper to correct coding errors during pre-production than it is once an app is in production. Aside from reducing the risk of end-user impact and protecting your brand's reputation, detecting issues earlier in the software pipeline can also reduce development costs and avoid delayed projects.

Developers can achieve this by adopting a shift left approach to software development — testing code, finding errors and fixing them as early as possible, often dynamically as you code (i.e. in your IDE using a "Clean as you Code" approach). These advanced linting tools ultimately support this shift left approach, allowing developers to detect issues earlier in the development cycle. Shifting left not only allows developers to deliver clean and safe code, but also improves the overall maintainability and reliability of their codebase. Moreover, these checks can be built into a team's development toolchain — so that bugs and security vulnerabilities can be prevented before an app is deployed to production.

Beyond Identifying Errors: Helping Developers Grow

Good linting tools need to do more than just identify syntax, style, bugs, or security issues — they must provide helpful cues on what the issues are, why they are harmful, and how they should be fixed. When a linter flags that a developer has made an error, it should offer context explaining the reasoning behind the rule that was broken, information on why it should be followed, provide helpful examples, and a rundown of what can go wrong if the rule isn't followed. Developers shouldn't change code simply because a linter told them to. They should change it because they've learned to do better.

With these insights, developers can learn from their mistakes, uncover new best practices to avoid those mistakes, master new programming languages faster, and code safer and better apps in the long run. This not only improves software quality, but boosts the efficiency of an organization's entire development team. As a result, organizations can reduce technical debt and spend more developer resources building new features rather than fixing flawed code.

For developers to learn from their mistakes, instant feedback is essential. Linting tools should flag any errors or quality issues while developers are writing code, providing more of an intuitive spell-checking or grammar checking experience. This real-time feedback makes it easier for developers to recognize mistakes and remember how to prevent them in the future.

This approach also supports better code ownership. When issues are raised as a developer adds new code, it's clear that person is responsible for fixing it. This avoids the confusion common in traditional testing methods, when errors aren't flagged until long after code is written and development teams have to manually review the codebase to determine what the appropriate next step is.

Conclusion

Modern code linters play a pivotal role in the development process, enabling developers to improve code quality and security, and should serve as more than just another testing or error monitoring tool. By Offering robust real-time insights, including detailed context for every issue flagged, clear guidance on fixing those issues and best practices for avoiding them, programmers get better at their job in the long term and enterprises will reap major benefits from improved developer skills and efficiency.

Nicolas Bontoux is VP Product Marketing at SonarSource
Share this

Industry News

January 13, 2022

Infragistics announced the release of Infragistics Ultimate 21.2.

January 13, 2022

Jitterbit acquired PrimeApps, a Turkey-based innovator in low-code application development.

January 13, 2022

Mirantis announced the release of Mirantis Secure Registry (MSR) 3.0, which supports usage across any Kubernetes distribution.

January 12, 2022

DevOps Institute announced its lineup for 2022 events and webinars and plans for two new DevOps certifications.

January 12, 2022

Oxeye unveiled an open-source initiative with the introduction of Ox4Shell.

January 12, 2022

Quali Torque platform is now available to Microsoft Azure users on the Azure Marketplace.

January 11, 2022

CircleCI announced a free tier for CI/CD.

January 11, 2022

GlobalLogic, a Hitachi Group Company, announced availability of OpeNgine version 2.1.

January 11, 2022

The Application Security Division of NTT introduced the next phase of The WhiteHat Vantage Platform, Vantage Prevent, a patented solution that enables enterprises to conduct dynamic application security testing (DAST) at each phase of the development cycle and prevent exploitable vulnerabilities from reaching production.

January 10, 2022

BrowserStack announced the acquisition of Nightwatch.js, the open-source test automation framework.

January 06, 2022

BMC announced new capabilities and integrations across its BMC AMI (Automated Mainframe Intelligence) and BMC Compuware portfolios.

January 06, 2022

ShiftLeft announced that its Intelligent-SCA product added scanning and attackability analysis for JavaScript (JS) and the TypeScript (TS) language to the ShiftLeft CORE platform.

January 06, 2022

Progress announced the latest release of Progress Fiddler Everywhere, its popular web debugging proxy tool.

January 05, 2022

Solo.io announced a new open-source project, BumbleBee, that simplifies the developer experience for building, packaging, and distributing eBPF tools.

January 05, 2022

Forty8Fifty Labs and Old Street Solutions announced that they are partnering in the development and delivery of solutions that simplify the collaboration and use of Atlassian Jira and Confluence.