Release Notes - 2.0


2.0.4-funcrel

Fixes/Bugs

Customer Ticket Id Customer Details
Improve accuracy of rule 1039044 "Avoid usage of BannedAPI when using ESAPI library".

Enhancement/Improvements

Customer Ticket Id Customer Details
Updates embedded libraries.

2.0.3-funcrel

Fixes/Bugs

Customer Ticket Id Customer Details
Improve accuracy of rules 1039018 "Avoid using cryptography hash with predictable salt (JEE)" and 1039022 "Avoid using Insecure PBE Iteration Count"
Improve accuracy of rule 1039046 - "Always use {@code} to wrap code statements or values such as null"

2.0.2-funcrel

Resolved Issues

Customer Ticket Id Details
52170 Removed error "KeyError: -1" with traceback. No functional changes.

Other Updates

Details
Upgraded internal library (java_string.1.2.31).

2.0.1-funcrel

Other Updates

Details
Updated embedded libraries.

2.0.0-funcrel

Note

No changes compared to 2.0.0-beta1. Latest beta version promoted to functional release.

2.0.0-beta1

Rules

Rule Id New Rule Details
1039108 TRUE Avoid leaving temporary files in directory (JEE)
1039106 TRUE Avoid disabling the automatic HTML escaping for Spring
1039104 TRUE Avoid creation of temporary file with insecure permissions (JEE)
1039102 TRUE Ensure SameSite option is enabled when creating session (JEE)
1039100 TRUE Avoid creating cookie without setting SameSite option (JEE)
1039066 FALSE Repaired missing violation for rule "Avoid creating cookie with an overly broad path (JEE)" when calling jakarta.servlet.http.Cookie.setAttribute(…), jakarta.servlet.http.HttpServletResponse.addHeader(“Set-Cookie”, …), jakarta.servlet.http.HttpServletResponse.setHeader(“Set-Cookie”, …), javax.servlet.http.HttpServletResponse.addHeader(“Set-Cookie”, …), javax.servlet.http.HttpServletResponse.setHeader(“Set-Cookie”, …). Added support for classes com.google.gwt.user.client.Cookies, jakarta.ws.rs.core.Cookie, jakarta.ws.rs.core.NewCookie, jakarta.servlet.SessionCookieConfig, java.net.HttpCookie, javax.ws.rs.core.Cookie.Cookie, javax.ws.rs.core.NewCookie.NewCookie, javax.servlet.SessionCookieConfig, org.apache.commons.httpclient.Cookie, org.apache.http.impl.cookie.BasicClientCookie.
1039064 FALSE Repaired missing violation for rule "Avoid having cookie with an overly broad domain (JEE)" when calling jakarta.servlet.http.Cookie.setAttribute(…), jakarta.servlet.http.HttpServletResponse.addHeader(“Set-Cookie”, …), jakarta.servlet.http.HttpServletResponse.setHeader(“Set-Cookie”, …), javax.servlet.http.HttpServletResponse.addHeader(“Set-Cookie”, …), javax.servlet.http.HttpServletResponse.setHeader(“Set-Cookie”, …). Added support for classes com.google.gwt.user.client.Cookies, jakarta.ws.rs.core.Cookie, jakarta.ws.rs.core.NewCookie, jakarta.servlet.SessionCookieConfig, java.net.HttpCookie, javax.ws.rs.core.Cookie.Cookie, javax.ws.rs.core.NewCookie.NewCookie, javax.servlet.SessionCookieConfig, org.apache.commons.httpclient.Cookie, org.apache.http.impl.cookie.BasicClientCookie.
1039026 FALSE Removed false positives for rule "Avoid creating cookie without setting httpOnly option (JEE)" when calling jakarta.servlet.http.Cookie.setAttribute(…), jakarta.servlet.http.HttpServletResponse.addHeader(“Set-Cookie”, …), jakarta.servlet.http.HttpServletResponse.setHeader(“Set-Cookie”, …), javax.servlet.http.HttpServletResponse.addHeader(“Set-Cookie”, …), javax.servlet.http.HttpServletResponse.setHeader(“Set-Cookie”, …). Added support for classes com.google.gwt.user.client.Cookies, jakarta.ws.rs.core.Cookie, jakarta.ws.rs.core.NewCookie, jakarta.servlet.SessionCookieConfig, java.net.HttpCookie, javax.ws.rs.core.Cookie.Cookie, javax.ws.rs.core.NewCookie.NewCookie, javax.servlet.SessionCookieConfig, org.apache.commons.httpclient.Cookie, org.apache.http.impl.cookie.BasicClientCookie.
1039024 FALSE Removed false positives for rule "Avoid using unsecured cookie (JEE)" when calling jakarta.servlet.http.Cookie.setAttribute(…), jakarta.servlet.http.HttpServletResponse.addHeader(“Set-Cookie”, …), jakarta.servlet.http.HttpServletResponse.setHeader(“Set-Cookie”, …), javax.servlet.http.HttpServletResponse.addHeader(“Set-Cookie”, …), javax.servlet.http.HttpServletResponse.setHeader(“Set-Cookie”, …). Added support for classes com.google.gwt.user.client.Cookies, jakarta.ws.rs.core.Cookie, jakarta.ws.rs.core.NewCookie, jakarta.servlet.SessionCookieConfig, java.net.HttpCookie, javax.ws.rs.core.Cookie.Cookie, javax.ws.rs.core.NewCookie.NewCookie, javax.servlet.SessionCookieConfig, org.apache.commons.httpclient.Cookie, org.apache.http.impl.cookie.BasicClientCookie.

2.0.0-alpha1

Rules

Rule Id New Rule Details
1039014 FALSE Improved support for rule "Avoid using Cipher with no HMAC to ensure data integrity"
1039012 FALSE Support of jakarta.servlet package for rule "Avoid using referer header field in HTTP request"
1039008 FALSE Support of jakarta.servlet package for rule "Avoid thrown Exceptions in servlet methods"
1039002 FALSE Improved support for rule "Avoid using deprecated SSL protocols to secure connection"
1039052 FALSE Support of jakarta.servlet package for rule "Avoid Http Session without expiration"
1039050 FALSE Improved suppport for rule "Add @Override on methods overriding or implementing a method declared in a super type"
1039044 FALSE Improved support for rule "Avoid usage of BannedAPI when using ESAPI"
1039030 FALSE Improved support for rule "Avoid using DefaultHttpClient constructor"
1039028 FALSE Improved support for rule "Avoid weak encryption providing not sufficient key size (JEE)"
1039026 FALSE Support of jakarta.servlet package for rule "Avoid creating cookie without setting httpOnly option (JEE)"
1039024 FALSE Support of jakarta.servlet package for rule "Avoid using unsecured cookie (JEE)"
1039020 FALSE Improved support for rule "Avoid using javax.crypto.NullCipher"
1039016 FALSE Deprecation of rule "Avoid Unvalidated URL Redirect"
1039074 FALSE Improved support for rule "Avoid using Apache ActiveMQ 5.x before 5.13.0"
1039072 FALSE Improved support for rule "Avoid using jYAML to deserialize YAML (JEE)"
1039070 FALSE Improved support for rule "Avoid using URL.equals(Object obj) or URL.hashCode()"
1039068 FALSE Support of jakarta.servlet package for rule "Avoid using the Non-Serializable Object Stored in Session"
1039066 FALSE Support of jakarta.servlet package for rule "Avoid creating cookie with an overly broad path (JEE)"
1039064 FALSE Support of jakarta.servlet package for rule "Avoid having cookie with an overly broad domain (JEE)"
1039058 FALSE Deprecation of rule "Avoid generating key with insufficient random generator in cookies"
1039056 FALSE Improved suppport for rule "Avoid insecure use of YAML deserialization when using SnakeYaml (JEE)"

Performance

Summary
The execution time of version 2.0.x has been improved compared to version 1.5.x. Depending on the source code analysed, the extension com.castsoftware.jeerules can be executed up to 5 times faster.