Release Notes - 2.1


2.1.0-beta1

Fixes/Bugs

Customer Ticket Id Technical Details Customer Details
Handle cases where banned APIs where called by fields or inside initialisation blocks. Improve accuracy of rule 1039044 "Avoid usage of BannedAPI when using ESAPI library".
Limit rule to Javadoc comments /** … */. Improve accuracy of rule 1039046 "Always use {@code} to wrap code statements or values such as null".
Handle cases where PBEParameterSpec was instancied by a field. Improve accuracy of rules 1039018 "Avoid using cryptography hash with predictable salt (JEE)" and 1039022 "Avoid using Insecure PBE Iteration Count".

Enhancement/Improvements

Customer Ticket Id Technical Details Customer Details
Replace executable jars by source jars Updated internal librairies. No impact on results.
Skip analysis of cookie rules when method call is not found. Workaround for a bug in internal library. No impact on results.
Skip analisys of _jspService methods Workaround for a bug in old versions of JEE Analyzer which produced an harmless Traceback. No impact on results.

2.1.0-alpha1

Rules

Rule Id New Rule Details
1039120 TRUE Avoid weak password requirements (JEE)
1039118 TRUE Avoid enabling directory listing (JEE)
1039116 TRUE Ensure setting origins when using @CrossOrigin Spring annotation
1039114 TRUE Avoid predictable initialization vector (JEE)
1039112 TRUE Avoid mutable fields inside a class with JCIP @Immutable annotation
1039110 TRUE Ensure initializing cryptographic key generators (JEE)