Changes to rules flagged as critical

AIP Core 8.3.40 implements a feature improvement that is designed to reduce the number of rules provided by CAST (whether in AIP Core or in an official extension) that are flagged as critical. See 8.3.40 - Additional notes for more information about this. Impacts will be seen due to this change:

• If users are choosing the upgrade/use default Assessment Model option (in AIP Console or CAST Server Manager), then impacts will be seen:
  • less critical rules
  • weights set to 1 for some rules
  • some impacts to grades (although minor)
• If users are installing AIP Core ≥ 8.3.40 and Quality Standards Mapping extension≥ 4th October 2021 from scratch, onboarding an application and comparing the same application analyzed with a previous release of AIP Core will show differences between the two.

Improvements to the discovery engine

The AIP discovery engine has been improved in this release to better resolve references to JEE jars and .NET assemblies delivered with the application source code. This improvement may have impacts on existing analysis results if additional assemblies/jars are discovered and subsequently analyzed, which were not found using previous releases.

User Input Security

Several improvements (support for new libraries or improved support for existing libraries) have been made to the User Input Security feature. All changes may impact the results of existing analyses post upgrade to AIP Core 8.3.40 and the generation of a new snapshot. See 8.3 for more details about this improvements.