Python 1.6 - Release Notes

1.6.0-alpha7

Details
Removed redundant parent links from external objects.
Fixed having the added/deleted objects when analysis unit is deleted and added again, even when the analyzed source is not changed. The internal GUID calculation has beend modified for objects: AWS S3 buckets, AWS DynamoDB databases and AWS DynamoDB tables. During the update to a new version, the old GUIDs of those objects will be migrated to new ones.

Rule Id	New Rule	Details
1021124	TRUE	Avoid uncontrolled format string (Python)
1021118	TRUE	Avoid disabling CSRF Protection in fastapi_jwt_auth
1021120	TRUE	Avoid mixing trusted and untrusted data in HTTP requests (Python)
1021122	TRUE	Avoid cookie poisoning
1021088	FALSE	Shorten name to "Avoid uncontrolled sleep calls (Python)"

Rule Id	New Rule	Details
1021116	TRUE	Avoid logging sensitive data (Python)
1021114	TRUE	Ensure the Strict-Transport-Security header (HSTS) is set up for FastAPI (Python)
1021112	TRUE	Avoid OS command injection (Python)

Summary	Details
Support type annotations (type hints)	Statements and function definitions containing type annotations are now correctly parsed.

Details
Minor updates in the documentation of various quality rules: References, total counts, ....

Rule Id	New Rule	Details
1021108	TRUE	Avoid unsafe access to object attributes
1021106	TRUE	Avoid server-side request forgery (Python)
1021104	TRUE	Avoid file path manipulation (Python)
1021102	TRUE	Avoid parsing XML data without restriction of XML External Entity Reference (XXE) (Python)
1021074	FALSE	Corrected scope of the rule. Violations should be visible now in Python artifacts.
1021110	TRUE	Avoid using regular expression vulnerable to ReDoS (Python)
1021096	FALSE	Removed web service requests as second order injection sources.
1021094	FALSE	Removed web service requests as second order injection sources.

Summary
Corrected performance issues (too many evaluations) during quality rule analysis during analysis of return statements inside web service operation handler methods

Rule Id	New Rule	Details
1021100	TRUE	Avoid URL redirection to untrusted site
1021098	TRUE	Avoid HTTP header injection
1021096	TRUE	Avoid second order LDAP injection
1021094	TRUE	Avoid cross-site scripting (persistent)
1021092	TRUE	Avoid reflected cross-site scripting
1021090	TRUE	Avoid using insufficient random generator

Customer Ticket Id	Details
42086	Fixes the traceback error "TypeError: sequence item 4: expected str instance, NoneType found" with certain type hint annotations.

Details
Corrects the resolution of variables when overridden with different types.

Rule Id	New Rule	Details
1021082	TRUE	Avoid LDAP injection (Python).
1021084	TRUE	Avoid XPath injection (Python).
1021078	FALSE	When the parameter is a constant, no violation is raised.
1021088	TRUE	Avoid uncontrolled sleep calls to prevent DoS attacks (Python).
1021044	FALSE	Enhance rule on SQL injection with new expression evaluator.

Summary	Details
Support for special method __call__	Method calls on instantiated objects are correctly resolved to their __call__ special method.

Customer Ticket Id	Details
40975	Fixes the error messages found during the analysis of the Nameko framework.

Details
Introduction of new object Python Static Initializer for modelization of class-body code. See https://doc.castsoftware.com/display/TECHNOS/Python+1.6#Python1.6-Pythonstaticinitializers.

Rule Id	New Rule	Details
1021078	TRUE	Avoid deserialization injection (Python)
1021080	TRUE	Avoid resource injection (Python)

Summary	Details
Support f-strings	Evaluation of f-strings is partially supported. Not support if one of ('=', '[', '.', '-') exists in the string.
Support parenthesized context managers	Python 3.10 allows the use of parentheses in "with" statements: the extension now supports this.