Release Notes - 1.1

1.1.4-funcrel

Fixes/Bugs

Customer Ticket Id	Technical Details	Customer Details
	Removes duplicated violations on AED (more precisely: in KB) in case of violations having their path starting on the same line and ending on the same line (that could be different of the starting line). Internally have precise information: each step of the violation path has a full bookmark (starting line, starting column, ending line, ending column). But the KB loses the column information, so we need to have an extra operation to remove duplicate violations for the KB.	Removes duplicated violations.
	Removes some violations computed by the internal "TaintedInput analyzer" if they contain several times the same method call in its violation path.	Removes duplicated violations. May impact all quality rules computed by the Security Analyzer.
	Fix a wrong detection of a loop in case of if/break in a do/while (java only)	Improves accuracy of rule: 1025056 'Avoid running SQL queries inside a loop'.
	Fix the counts visible in AED	Improves accuracy of rule: 1025056 'Avoid running SQL queries inside a loop'.

New Support

Customer Ticket Id	Technical Details	Customer Details
51345	Support of CWE-261: Weak Encoding for Password for JEE and .NET	Adds new rule: 1025064 'Avoid weak encoding'.

Enhancement/Improvements

Customer Ticket Id	Technical Details	Customer Details
	Improved support of io.jsonwebtoken	Improves accuracy of rule: 1025026 'Avoid disabling the expiration time requirement of a JWT token'.
	New support of Spring WebRequest	Improved support of JEE environment, affecting all rules of type "tainted input".
	New support of Microsoft.ServiceBus	Improved support of .NET environment, affecting all rules of type "through API requests".
	New support of com.google.common.html (sanitization)	Improves accuracy of 8408 'Avoid reflected cross-site scripting (non persistent)', 8410 'Avoid cross-site scripting (persistent)' and 8482 'Avoid cross-site scripting through API requests'.
	Removes false positives and duplicated violations	Improves accuracy of rule: 8416 'Avoid use of a reversible one-way hash'.
	Improved support of reflection injection targets using the blackboxing on the fly	Improves accuracy of rules: 8440 'Avoid reflection injection', 1025008 Avoid second order reflection injection' and 8502-'Avoid reflection injection through API requests'.
	Improved support of Spring Data MongoDB	Improves accuracy of rules: 8418 'Avoid NoSQL injection' and 8514 'Avoid NoSQL injection through API requests'.
	Improved support of System.Security.Cryptography, org.apache.commons.codec.digest, javax.crypto. Also renamed the quality rule and improved the documentation of the quality rule	Improves accuracy of rule: 8424 'Avoid hard-coded HMAC and cryptographic key'.
	Improved support of javax.crypto.Cipher and improved support of the algorithm detection	Improves accuracy of rule: 8414 'Avoid weak cryptographic algorithm'.
	Improved support of System.Security.Cryptography and improved support of the algorithm detection	Improves accuracy of rule: 8416 'Avoid use of a reversible one-way hash'.
	Improved support of io.jsonwebtoken	Improves accuracy of rule: 1025030 'Avoid hard-coded JWT secret keys'.
	New support of oracle.jdbc.rowset, weblogic.jdbc.rowset, com.sun.rowset	Improves accuracy of rules: 7742 'Avoid SQL injection', 8420 'Avoid second order SQL injection', 8490 'Avoid SQL injection through API requests' and 1025056 'Avoid running SQL queries inside a loop'.

1.1.3-funcrel

Other Updates

Details
This release of Security Analyzer includes a Linux-specific fix that enables the visualization of violation paths within the dashboard.

1.1.2-funcrel

Rules

Rule Id	New Rule	Details
1025048	FALSE	The rule 'Avoid hard-coded password in connection string' is now marked as critical
8482	FALSE	Improved support for the quality rule 'Avoid cross-site scripting through API requests': support of the `OpenMRS` and `Adobe Granite` and `Apache Sling` sanitization frameworks
8410	FALSE	Improved support for the quality rule 'Avoid cross-site scripting (persistent)': support of the `OpenMRS` and `Adobe Granite` and `Apache Sling` sanitization frameworks
8408	FALSE	Improved support for the quality rule 'Avoid reflected cross-site scripting (non persistent)': support of the `OpenMRS` and `Adobe Granite` and `Apache Sling` sanitization frameworks
8508	FALSE	Improved support for the quality rule 'Avoid log forging through API requests': support of the `OpenMRS` and `Adobe Granite` sanitization frameworks
8044	FALSE	Improved support for the quality rule 'Avoid log forging': support of the `OpenMRS` and `Adobe Granite` sanitization frameworks
1025012	FALSE	Improved support for the quality rule 'Avoid second order HTTP response splitting': support of the `OpenMRS` and `Adobe Granite` sanitization frameworks
8484	FALSE	Improved support for the quality rule 'Avoid HTTP response splitting through API requests': support of the `OpenMRS` and `Adobe Granite` sanitization frameworks
7740	FALSE	Improved support for the quality rule 'Avoid HTTP response splitting': support of the type `OpenMRS` and `Adobe Granite` sanitization frameworks
1025010	FALSE	Improved support for the quality rule 'Avoid second order LDAP injection': better support of `unboundid`, `opendj`, `Spring LDAP`, `Apache Directory`, `Novell LDAP`, `System.DirectoryServices.DirectoryEntry`
8492	FALSE	Improved support for the quality rule 'Avoid LDAP injection through API requests': better support of `unboundid`, `opendj`, `Spring LDAP`, `Apache Directory`, `Novell LDAP`, `System.DirectoryServices.DirectoryEntry`
7746	FALSE	Improved support for the quality rule 'Avoid LDAP injection': better support of `unboundid`, `opendj`, `Spring LDAP`, `Apache Directory`, `Novell LDAP`, `System.DirectoryServices.DirectoryEntry`
8490	FALSE	Improved support for the quality rule 'Avoid SQL injection through API requests': better support of `ZorgInfo`
8420	FALSE	Improved support for the quality rule 'Avoid second order SQL injection': better support of `ZorgInfo`
7742	FALSE	Improved support for the quality rule 'Avoid SQL injection': better support of `ZorgInfo`
1025056	FALSE	Improved support for the quality rule 'Avoid running SQL queries inside a loop': better support of `Spring Data` and `Entity Framework`
1025056	FALSE	Enhanced the 'Avoid running SQL queries inside a loop' rule to now function inter-procedurally rather than intra-procedurally
8240	FALSE	Fixed the 'Avoid using unsecured cookie' rules which could generate false positives in rare cases (JEE only)

1.1.1-funcrel

Rules

Rule Id	New Rule	Details
1025008	FALSE	Improved support for the quality rule "Avoid second order reflection injection" (for .NET): better support of `System.Type`
8502	FALSE	Improved support for the quality rule "Avoid reflection injection through API requests" (for .NET): better support of `System.Type
8440	FALSE	Improved support for the quality rule "Avoid reflection injection" (for .NET): better support of `System.Type`
8416	FALSE	Improved support for the quality rule "Avoid use of a reversible one-way hash" (for .NET): better support of `System.Security.Cryptography`
1025010	FALSE	Improved support for the quality rule "Avoid second order LDAP injection" (for .NET): better support of `System.DirectoryServices`
8492	FALSE	Improved support for the quality rule "Avoid LDAP injection through API requests" (for .NET): better support of `System.DirectoryServices`
7746	FALSE	Improved support for the quality rule "Avoid LDAP injection" (for .NET): better support of `System.DirectoryServices`
1025016	FALSE	Improved support for the quality rule "Avoid using cookie without the HttpOnly flag" (for JEE): better support of `javax.servlet.http.HttpServletResponse`
8240	FALSE	Improved support for the quality rule "Avoid using unsecured cookie" (for JEE): better support of `javax.servlet.http.HttpServletResponse`
1025062	FALSE	Correction of the quality rule "Avoid numeric user inputs in SQL queries through API requests": added new violations that were previously identified by the quality rule "Avoid SQL injection through API requests" (8490)
1025060	FALSE	Correction of the quality rule "Avoid second order numeric user inputs in SQL queries": added new violations that were previously identified by the quality rule "Avoid second order SQL injection" (8420)
1025058	FALSE	Correction of the quality rule "Avoid numeric user inputs in SQL queries": added new violations that were previously identified by the quality rule "Avoid SQL injection" (7742)
8490	FALSE	Correction of the quality rule "Avoid SQL injection through API requests": some violations are now identified by the quality rule "Avoid numeric user inputs in SQL queries through API requests" (1025062)
8420	FALSE	Correction of the quality rule "Avoid second order SQL injection": some violations are now identified by the quality rule "Avoid second order numeric user inputs in SQL queries" (1025060)
7742	FALSE	Correction of the quality rule "Avoid SQL injection": some violations are now identified by the quality rule "Avoid numeric user inputs in SQL queries" (1025058)

New Support

Summary	Details
Apache NMS	The Security Analyzer now supports the framework Apache NMS for .NET environment. It is considered as tainted input "through API requests", affecting all rules "through API requests". As a consequence after upgrade to this release and a new analysis, additional violations may be found.

1.1.0-funcrel

Note

Moved to funcrel release. No other changes have been made.

1.1.0-beta1

Rules

Rule Id	New Rule	Details
1025056	TRUE	New rule: "Avoid running SQL queries inside a loop" has been added.

New Support

Summary	Details
Support for RabbitMQ for JEE	The Security Analyzer now supports the framework RabbitMQ for JEE environment. "through API requests" are considered as tainted input affecting all rules "through API requests". As a consequence, after upgrade to this release and a new analysis, additional violations may be found.