Release Notes - 1.4

  • 1.4.16-funcrel
    Fixes token replacement in route which led to missing link from Dotnet Get Resource Service to DotNet Get Operation
    Fixes an error in token replacement in route which led to missing DotNet Controller Action object
    Improves accuracy of 💎 1043030 - Ensure the X-Frame-Options header is setup (ASP.NET) 📝 52493
    Improves accuracy of 💎 1043086 - Avoid using Html.Raw() or HtmlHelper.Raw() 📝 52591
    Fixes token replacement in route definition which led to missing links call from Dotnet Get Resource Service to DotNet Get Operation. 📝 51711
  • 1.4.15-funcrel
    Fixes an issue causing false negative violations on code within BlockStatements for the rule 1043086 “Avoid using Html.Raw() or HtmlHelper.Raw()”. 📝 49923
    Fixes an issue causing a false positive violations for boolean values in settings for the rule 1043018 “Avoid storing passwords in the config files”. 📝 47897
    Fixes a traceback error seen in the analysis log: “TypeError: argument of type ‘NoneType’ is not iterable”.
    Fixes an issue causing false negative violations on code within BlockStatements for the rule 1043086 “Avoid using Html.Raw() or HtmlHelper.Raw()”. 💎 1043086
    Fixes an issue causing a false positive violations for boolean values in settings for the rule 1043018 “Avoid storing passwords in the config files”. 💎 1043018
  • 1.4.14-funcrel
    Fixes an issue causing broken links from Angular “Get HTTP Service” objects to “DotNet Controller Action” objects. 📝 45983
    Fixes an error: “UnboundLocalError: local variable ‘fd’ referenced before assignment”. The situations causing this error have been fixed: Contextual keyword used as identifier for member is now supported and close file properly file when exception is raised is now handled.
  • 1.4.13-funcrel
    Fixes an issue causing a mismatch of the violation count value displayed in the “Risk Investigation” view and the “Application Investigation” view in the CAST Engineering Dashboard. 📝 43765
    Fixes an issue causing missing links for REST API calls. 📝 44196
    Fixes an issue causing the incorrect creation of “CAST_DotNet_PostOperation” objects for Get, Delete and Put operations.
    Fixes an issue causing the following warning entry in the analysis log “Extension dotnetweb has encountered an issue “AttributeError: ‘NoneType’ object has no attribute ‘file’””.
    Support of OData server side for ASP.NET and ASP.NETCore.Support of OData
  • 1.4.12-funcrel
    Fixes an issue where missing “Dotnet Controller Action” objects were evident after upgrade from extension 1.4.9 to 1.4.11 and a re-analysis with the same source code. 📝 43516
    Fixes an issue where missing “Dotnet Put Operation” objects were evident. 📝 43392
    Fixes an issue where missing links were evident between “DotNet Get Resource Service” and “DotnetController Action” objects. 📝 43553
    Fixes an issue where a “Controller class” in a file scope namespace is not found, causing a missing “DotNet Controller Action” object.
  • 1.4.11-funcrel
    Fixes an issue wherein the controllers with partial class were not analyzed correctly.
    NEW Avoid using Html.Raw() or HtmlHelper.Raw() 💎 1043086
  • 1.4.10-funcrel
    Fixed the missing .NET Web operations when ApiController/Route is used. 📝 39887
    Fixed the false negative in rule (1043010): “Avoid creating cookie without setting httpOnly option (C#)” when HttpOnly property is not set. 💎 1043010
    Fixed the false negative in rule (1043022): “Avoid using unsecured cookie (C#)” when Secure property is not set. 💎 1043022
    Fixed the wrong bookmark in rule (1043012): “Avoid creating cookie without setting httpOnly option in Config file (ASP.NET)” when there are 2 tags system.web with the second without httpCookies tag inside. 💎 1043012
  • 1.4.9-funcrel
    Fixes an issue where links were missing from Angular/Typescript to .NET backend. 📝 39887
    Fixes a missing violation for the rule: “Always enable RequireSSL attribute for cookies in Config file (ASP.NET)”. Fixes an issue where, Forms-authentication cookie required an SSL. 💎 1043024
  • 1.4.8-funcrel
    Technical update to extend the XML config parser so that it can be re-used by quality rules.
  • 1.4.7-funcrel
    Fixed a false violation for the rule 1101038: “Avoid OR conditions testing equality on the same identifier in SQL WHERE clauses”. 💎 1101038
  • 1.4.6-funcrel
    The rule: “Avoid storing passwords in the config files” was not taking into account the file appsettings.json (which is a .NET related file). Now this file (any file called appsettings.<x>.json) is taken into account. This changes the rule calculation and potentially additional violations may be found. 💎 1043018
  • 1.4.5-funcrel
    Fixed wrong detail check for the rule (1043082): “Avoid client provided dictionaries to have high request sizes”. 📝 37235
  • 1.4.4-funcrel
    Violation for rule (rule id: 1043066): “Always use HTTPS Redirection Middleware and HSTS Middleware in your ASP.NET Core application” even though the remediation applied. 📝 34185
    False positive for the rule (rule id: 1043074): Avoid creating unsecured HTTPS GET metadata endpoint in configuration. 📝 33785
    Net analysis warning: “Extension com.castsoftware.dotnetweb has encountered an issue” 📝 34602
    Performance issue in procedure SET_DotNETWeb_Controller.
    Always use HTTPS Redirection Middleware and HSTS Middleware in your ASP.NET Core application. 💎 1043066
    Avoid creating unsecured HTTPS GET metadata endpoint in configuration. 💎 1043074
    Add support of VB files for controllers.Add support of VB files for controllers
  • 1.4.3-funcrel
    Avoid to trigger a violation on a config file when the good config is done in csharp code 💎 1043024
    Avoid to trigger a violation on a config file when the good config is done in csharp code 💎 1043012
  • 1.4.2-funcrel
    False positive violation of the rule 1043018 - Avoid storing passwords in the config files. is wrongly flagged as a violation. 📝 33017
    “DOTNET Get Operation” objects are not created and the links to them are missing. 📝 32582
    “Avoid storing passwords in the config files” - false positive violation caused by the code “”. 💎 1043018
  • 1.4.1-funcrel
    Missing ASP.NET post/get operations from ASP.NET MVC support. 📝 31004
    Broken link since there are missing CAST_DotNet_Controller_Action objects from ActionResult. 📝 31469
    All DotNet Operation objects are missing in comparison to snapshot n-1. 📝 30752
    Extension [com.castsoftware.dotnetweb] Tracebacks reports in analyses’s logs.
  • 1.4.0-funcrel
    Missing Web API call links between JavaScript and .NET 📝 29268
    Missing link between razor service and .NET operation 📝 29266
    Clean the url routing between client and server
    Two .NET Post and Get operations are created for one single operation
  • 1.4.0-beta1
    Avoid storing passwords in the config files : search for passwords in appSettings tag added 💎 1043018
    NEW Avoid XML schemas with unbounded occurrences 💎 1043084
    NEW Avoid client provided dictionaries to have high request sizes 💎 1043082
  • 1.4.0-alpha2
    Incorrect URL in case of [controler] - this change may impact your existing analysis results (call graph resolution has been increased and object properties have changed).
    Avoid storing passwords in the config files (a missing violation was fixed - this could impact your analysis results) 💎 1043018
    NEW Avoid disabling OR not defining encryption behavior for encryption when connecting with Database 💎 1043080
    NEW Avoid debug binaries that include detailed debug information 💎 1043078
    NEW Avoid disabling custom errors mode to prevent exposure of exceptions and error data 💎 1043076
  • 1.4.0-alpha1
    NEW Avoid creating unsecured HTTPS GET metadata endpoint in configuration 💎 1043074
    NEW Avoid creating unsecured HTTPS GET metadata endpoint in code 💎 1043072
    NEW Avoid disabling the XSRF/CSRF Protection (ASP.NET Core MVC) 💎 1043070
    NEW Avoid using RequireHttpsAttribute on Web APIs that receive sensitive information 💎 1043068
    NEW Always use HTTPS Redirection Middleware and HSTS Middleware in your ASP.NET Core application 💎 1043066