Detect Security Vulnerabilities with Snyk

1. Overview

In the rapidly changing realm of software development, the assurance of robust security is an important yet often tricky task. As modern applications rely heavily on open-source libraries and dependencies, the vulnerabilities lurking within these components can pose a serious threat.

This is where Snyk comes into play, giving developers tools to detect potentially vulnerable code or dependencies automatically. In this article, we’ll explore its features and how they can be used in the context of a Java project.

2. What Is Snyk?

Snyk is a cloud-native security platform that focuses on identifying and mitigating vulnerabilities in open-source software components and containers. Before we dive into using specific features, let’s look at the main usages that will be the focus of this article.

2.1. Snyk Open Source

Snyk Open Source scans our project’s dependencies by analyzing the libraries and packages that our application relies on. It checks these dependencies against a comprehensive database of known vulnerabilities. Snyk Open Source not only points out vulnerabilities but also offers actionable remediation guidance. It suggests possible solutions to address the vulnerabilities, such as upgrading to a secure version or applying patches.

2.2. Snyk Code

Snyk Code employs static code analysis techniques to review source code and identify security vulnerabilities and other issues. It reviews the code without executing it to find potential problems by analyzing the structure, logic, and patterns in the codebase. This includes vulnerabilities originating from known security databases, as well as code quality issues such as code smells, potential logical errors, and misconfigurations.

2.3. Integration

We can integrate Snyk into a project by using the Snyk CLI on demand or by connecting it to a version control system (such as Git). This integration allows Snyk to access our codebase and perform automated scans whenever code changes are made. Alternatively, we can use a plugin for our build system (such as Gradle) to execute scans as a part of our build process.

3. Setup

Before we dive into making our projects more secure, we need to execute a few steps to set up Snyk CLI and its connection to Snyk services.

3.1. Creating Account

Snyk is a cloud-native solution. We’ll need an account to use it. At the time of writing this article, a basic Snyk account, sufficient for testing and small projects, is free.

3.2. Installing the CLI

Snyk offers a Command-Line Interface (CLI) that allows us to interact with Snyk services from a terminal. Once we install the CLI app, it will only do the job of connecting to the Snyk server, and all the hard work will happen in the cloud.

We can install the CLI globally using Node Package Manager (npm):

$ npm install -g snyk

We can also use other installation methods described in the Snyk manual.

3.3. Authenticating

Finally, we need to authenticate so that the CLI knows to which account it should connect:

$ snyk auth

4. Using CLI to Test for Vulnerabilities

Snyk CLI is a tool provided by Snyk that allows us to easily connect to the Snyk services and execute scans from the command line. Let’s look at two of Snyk’s fundamental features: dependency scan and code scan.

4.1. Dependency Scan

To run a dependency scan on our project using the Snyk CLI, we can simply type:

$ snyk test

This command will analyze your project’s dependencies and identify any problems. Snyk will provide a detailed report showing the vulnerabilities, their severity levels, and the affected packages:

[...]
Package manager:   gradle
Target file:       build.gradle
Project name:      snyktest
Open source:       no
Project path:      [...]
Licenses:          enabled

✔ Tested 7 dependencies for known issues, no vulnerable paths found.

4.2. Code Scan

We can also enable static code analysis in the settings on the Snyk page and run a scan of vulnerabilities inside our own code:

$ snyk code test
[...]

✔ Test completed

Organization:      [...]
Test type:         Static code analysis
Project path:      [...]

Summary:

✔ Awesome! No issues were found.

5. Using Gradle Integration

Instead of using Snyk CLI, we can use the Gradle plugin and run Snyk tests automatically during the build process. First, we need to add the plugin to the build.gradle file:

plugins {
    id "io.snyk.gradle.plugin.snykplugin" version "0.5"
}

Then, we can optionally provide some configuration:

snyk {
    arguments = '--all-sub-projects'
    severity = 'low'
    api = 'xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx'
}

However, defaults should be good enough in most cases. Also, we don’t need to provide an API key if we authenticated using CLI before. Finally, to run the tests, we can simply type:

$ ./gradlew snyk-test

We can also configure Gradle to run Snyk tests with every build:

tasks.named('build') {
    dependsOn tasks.named('snyk-test')
}

Mind that the free version of Snyk has a limited number of tests we can run monthly, so running tests with every build can be wasteful.

6. Conclusion

Snyk Code is a valuable tool for developers and organizations aiming to improve their application security by identifying vulnerabilities and code quality issues early in the development lifecycle. In this article, we learned how to use Snyk Open Source and Code features to scan our projects for possible security issues. Additionally, we looked into how to integrate Snyk into the Gradle build system.