Release Notes - 1.5

  • 1.5.10-funcrel
    Adds support for Spring delegation in Struts configuration (Struts 1). The Struts operations that were previously missing are now created, thereby enriching the transaction graph. 📝 58343
  • 1.5.9-funcrel
    Improves the model when the execute method of a Struts action is defined in an ancestor class of the action. 📝 53915
  • 1.5.8-funcrel
    📝 52358 Updates embedded libraries.
  • 1.5.7-funcrel
    Added support for Jakarta EE 9.0+
  • 1.5.6-funcrel
    Replace the vulnerable struts2-core-2.5.20.jar with struts2-core-2.5.33.jar. 📝 44970
  • 1.5.5-funcrel
    Improvements have been implemented to resolve a situation where a Struts operation was missed during the analysis.
    Fixed an issue casuing “FileNotFoundError” exceptions in the log file.
    Fixed missing violation for “Avoid Duplicate Struts validation forms with the same name” (1042004).
    💎 1042004 Fixed missing violations for the rule “Avoid Duplicate Struts validation forms with the same name”.
  • 1.5.4-funcrel
    Fixed missing Struts Operation. 📝 38055
    Upgrade internal API. Upgrade application level API to 1.6.13.
  • 1.5.3-funcrel
    💎 1042030 The rule: “Avoid using Default exclude patterns (excludeParams) for Struts 2.3.20 (and older)” has been set as critical.
    💎 1042036 The rule: “Avoid Long request parameter names in Struts 2.0.0 - struts 2.3.4” has been set as critical.
  • 1.5.2-funcrel
    Missing Struts operation objects in the analyzed application 📝 32427
    Internal issue during parsing 📝 30184
    Internal issue during parsing 📝 33313
  • 1.5.1-funcrel
  • 1.5.0-funcrel
    This release of the extension contains a number of rule related improvements, which will have a significant impact on any existing analysis results generated with a previous release of the extension. When re-analyzing existing and unchanged source code with this new extension, you should therefore expect grade and violation changes. When using AIP Console, if you do not want this extension to be used, you should ensure that you implement an extension strategy to prevent the automatic download and installation of the extension. If you are onboarding a new application, CAST actively encourages you to use this new release to take advantage of the improvements that have been implemented.
    💎 1042010 Avoid using ParametersInterceptor with class parameter for Struts 2.3.16 (and older). Increased the Threshold.
    💎 1042012 Avoid Unused Validation Form in Struts 1.x. Increased the Threshold.
    💎 1042016 Avoid Struts action Mapping with disabled validator. Increased the Threshold.
    💎 1042022 Avoid using CookieInterceptor with Struts 2.3.16 (and Older). Increased the Threshold.
    💎 1042024 Avoid Unescaped User-controlled Input attribute in Struts 1.x and 2.x. Increased the Threshold.
    💎 1042050 Avoid using special top object in struts 2.0.0 - struts 2.3.24. Increased the Threshold.