A couple huge improvements are bundled in this release including:
- Better Scala support with a couple new detectors (thanks to @MaxNad )
- New Rule: Scala Path Traversal
- New Rule: Sensitive data exposure in cookies
- New Rule: XSS detection in Play Framework
- .. and many other improvements
- Huge set of small fixes and improvements (thanks to @topolik from Liferay) #214
- New Rule: XXE with XMLStreamReader
- New Rule: Template injection with Velocity and Freemarker
- New Rule: XSS detection in Porlet
These are the major new detectors but, as usual, many false positive patterns are now supported and avoided.
Quick note on the version notation: The previous releases were made on minor version (1.4.1-1.4.6) even though they include major improvements. It was never really a big concern because no major issue required to be fixed. This may have brought some confusion to some users. The release plan is still to keep going forward and not maintain older versions. There should be no benifit to keep using an old version.
version-1.5.0 (2016-10-06)
Implemented enhancements:
- Detect template usage (template injection) #227
- Reduce the number of FP related to Trust Boundary Violation #226
- XSS in Portlet #216
- How to set findsecbugs.taint.customconfigfile through gradle? #215
- Identify weak XML parser properties that could lead to XXE #209
- Scala : XSS in twirl template #207
- Scala: XSS in Play controller #206
- XML parsing vulnerable to XXE (XMLReader) shortage #191
- Path Traversal (CWE 22) - Scala Path Traversal injection sinks #223 (MaxNad)
- Sensitive data exposure (CWE 200) - Sensitive data exposure in cookies #221 (MaxNad)
- XSS (CWE 79) - Scala - The detector can be fooled when the .as("text/html") is in uppercase #208 (MaxNad)
- Taint analysis bug fixes and improvements #214 (topolik)
- Potential fix for issue #182 (INSECURE_COOKIE detector can be fooled by creating two or more cookies) #204 (MaxNad)
- XSS (CWE 79) - Scala Play vulnerable code #203 (MaxNad)
- CWE 200 (Information Exposure) - Scala Play vulnerable code #202 (MaxNad)
Fixed bugs:
- FP: sending local broadcasts via LocalBroadcastManager #224
- False positive: ResourceBundle in JSP #213
- Out of bounds mutables in static myclass$.()V #199
- Issue #224 - Added an exception for the LocalBroadcastManager in the detector. #225 (MaxNad)
- Potential fix for issue #182 (INSECURE_COOKIE detector can be fooled by creating two or more cookies) #204 (MaxNad)
Closed issues:
- not to report null-porter dereference if there is code already throws RuntimeError #197
- Release version 1.4.6 #195
- Release 1.4.5 #159
- Fix mix-content on micro-website #229
Merged pull requests: