Skip to main content

Engine Pack Version 9.6.4

CxSAST Engine

Languages & Frameworks

All supported code Languages & Frameworks versions are on the dedicated page here.

New SAST Engine - Fast Scan

Execution Time Optimization

Fast Scan incorporates an enhanced configuration to optimize execution time for Kotlin, Go, Scala, Python, Dart, PHP, and Rust languages.

Scanned Languages

Fast Scan mode is designed to scan the primary languages.

For subsequent language groups, the primary language for scanning is determined based on the criteria:

  • JVM languages:(Java, Scala, Kotlin, and Groovy) -only the language with the higher number of files is selected. In case of a tie, the order of choice is Java, Groovy, Scala, Kotlin;

  • IOS composed projects: (Swift and ObjC) - only the language with more files is selected. In case of a tie, the order of choice is Swift, ObjC;

  • Flutter projects: only the language with more files is selected. In case of a tie, the order of choice is Java, Swift, ObjC, CPP, Kotlin, and Dart;

  • Scripting Languages only projects: only the language with the higher number of files is selected. In case of a tie, the order of choice is JavaScript, VbScript, and Plsql.

C++

This version includes significant enhancements for C++ language support:

  • Update to the most recent version of ANTLR (version 4.13.1).

  • Improvements have been made to support various expressions, particularly reference declarations and pointers.

  • Parsing issues associated with more recent C++ syntax have been addressed.

  • Added support for .pc extension (pro*C files) to enhance C++ parsing (Note: SQL queries are ignored).

  • Added code to distinguish ObjC files that were previously misidentified as C files.

Notice

To fully leverage C++ support, ensuring accurate code parsing by defining any custom macros is important.

The C++ parser cannot adequately support macros throughout the program unless properly defined.

JavaScript

This engine pack introduces enhancements in JavaScript language parsing resulting from the update to the ANTLR version 4.13.1.

Rust

The Rust support has been improved by adding additional queries.

The following queries are available as part of this version:

  • Rust_Medium_Threat

    • Empty_Password_In_Connection_String

    • Hardcoded_Password_in_Connection_String

    • Password_In_Comment

    • SSRF

    • Unrestricted_Delete_S3

    • Unrestricted_Read_S3

    • Unrestricted_Write_S3

    • Use_Of_Hardcoded_Password

  • Rust_Low_Visibility

    • Missing_Password_Field_Masking

Notice

Technology Preview features provide early access to upcoming product innovations, enabling you to test functionality and provide feedback during development. However, these features are not fully supported, might not be functionally complete, and are not intended for production use.

As Checkmarx considers making future iterations of Technology Preview features generally available, we will attempt to resolve any issues customers experience when using these features.

RPG

This version introduces the support of fully free format.

Presets

OWASP API Top 10 2023

A new preset and category for the OWASP API Top 10 2023 is available out-of-the-box with this Engine Pack.

New return codes

Notice

In the upcoming version 9.6.5, the following use cases which have the return code denoted as “-1“ will be replaced by a new return code:

  • No code changes - new return code will be 58

  • Empty files - new return code will be 59

  • Error on the setup of the logs - new return code will be 61

  • Project not found - new return code will be 62

  • Error on file extension initialization (includes files having no extension defined) - new return code will be 63

  • Error on queries deserialization (a step that occurs before queries compilation) - new return code will be 64

  • Error on queries compilation - new return code will be 65

  • Error on queries execution - new return code will be 66

  • Error on the license validation - new return code will be 67

  • Error while scanning (such as parsing, Resolver) - new return code will be 68

To ensure a seamless transition and prevent potential errors, we strongly recommend the following:

  • Carefully review your existing pipelines and workflows.

  • Identify whether there are any configurations or dependencies currently relying on the current error code.

Making the necessary configuration adjustments before upgrading to version 9.6.3 is essential. By making these changes, you'll be able to avoid any disruptions caused by the change in error code and ensure the continued smooth operation of your processes.

Base Preset

Notice

Based on thorough tests and comparisons to internal benchmarks, we've decided to improve the base preset and fine-tune it for enhancement. Because of this, in the upcoming version 9.6.5, support for the following languages will be removed from the preset: Cobol, Go, Groovy, Perl, PLSQL, RPG, Ruby, and VB.Net.

We will focus on enhancing coverage for Java, JavaScript, C#, CPP, and Python languages. Additionally, we'll gradually include support for other languages with improved coverage and accuracy.

Removal of deprecated queries from Presets

Actions to be executed in the upcoming version 9.6.5:

  • Deprecated queries are going to be removed from the presets according to the following list:

    (Language, Query ID, Query Name)

Engine Pack Supported Code Languages and Frameworks (9.6.4)

Environment and Primary Languages

Secondary Languages

Framework

File extensions

Additional Information

6022007568

  • Java

  • J2SE

  • J2EE

  • JSP

  • JavaScript

  • VBScript

  • PL\SQL

  • HTML5

  • ATG DSP Taglib

  • GWT

  • Hibernate

  • Google Guice

  • Java Server Faces (JSF)

  • JSP

  • JSTL FMT Taglib

  • OWASP ESAPI

  • MyBatis

  • PrimeFaces

  • Spring Boot

  • Spring MVC

  • Spring

  • Struts

  • Velocity

  • .java

  • .jsp

  • .jspf

  • .jsf

  • .tag

  • .tld

  • .mf

  • .xhtml

  • .vm

  • .gradle

  • .properties

  • .jspdsbld

  • .wod

  • .xml

  • .yml

  • .yaml

Java can be configured as a unified language with Scala.

6022007571.png

  • ASP.NET

  • JavaScript

  • VBScript

  • PL\SQL

  • HTML5

  • ASP.NET Core

  • ASP.Net Core Razor

  • ASP.Net MVC framework

  • Enterprise Libraries

  • ComponentArt

  • Entity framework

  • Hibernate.Net

  • Infragistics

  • iBatis

  • Telerik

  • Dapper

  • .cs

  • .cshtml

  • .xaml

  • .vb

  • .config

  • .aspx

  • .ascx

  • .asax

  • .tag

  • .master

  • .xml

6022007574.png

  • ASP

  • JavaScript [**]

  • VBScript

  • PL\SQL

  • HTML5

  • ASP.Net MVC framework

  • .asp

  • .inc

6022007577.png

  • VB6

  • .bas

  • .vbp

  • .frm

  • .cls

  • .dsr

  • .ctl

6022007580.png

  • C

  • C++

  • C MISRA

  • C++ MISRA

  • Informix ESQL/C

  • MySQL

  • .cpp

  • .c

  • .cc

  • .c++

  • .cxx

  • .hpp

  • .hh

  • .h++

  • .hxx

  • .h

  • .ec

  • .cmake

  • .pc

  • .pro

  • .ac

  • .am

  • .txt (related to CmakeLists)

  • .ph

64d4d824681bd.svg

  • PHP

JavaScript

  • bWapp

  • CakePHP

  • OWASP ESAPI

  • Kohana

  • Symfony

  • Smarty

  • Zend

  • .php

  • .php3

  • .php4

  • .php5

  • .phtm

  • .phtml

  • .tpl

  • .ctp

  • .twig

  • .inc

  • .cgi

  • .env

  • .ini

6022007586.png

  • Apex

  • VisualForce

  • Lightning (Aura)

  • Lightning Web Components

  • .apex

  • .apexp

  • .apxc

  • .page

  • .component

  • .cls

  • .trigger

  • .tgr

  • .object

  • .report

  • .workflow

  • -meta.xml

  • .xml

This is for Salesforce APEX only.

6022007589.png

  • Ruby

  • Ruby on Rails

  • .rb

  • .rhtml

  • .rxml

  • .rjs

  • .erb

  • .cgi

  • .lock

6022007592.png

  • JavaScript

  • Typescript

  • Ajax

  • Angular

  • AngularJS

  • Backbone

  • Cordova / PhoneGap

  • Handlebars

  • Hapi.JS

  • JQuery

  • Knockout

  • Kony Visualizer

  • Node.js

    • Buffer

    • CryptoJS

    • ExpressJS

    • File System

    • Hapi

    • Mongodb

    • OracleDB

    • Sequelize

  • Pug (Jade)

  • React Native

  • ReactJS

  • SAPUI5

  • VueJS

  • XS (SAP)

  • RequireJS

  • .js

  • .jsx

  • .htm

  • .html

  • .json

  • .ts

  • .tsx

  • .aspx

  • .ascx

  • .xsjs

  • .xsjslib

  • .xsaccess

  • .xsapp

  • .app

  • .evt

  • .cmp

  • .hbs

  • .handlebars

  • .jade

  • .pug

  • .vue

  • .xml

  • .apexp

  • .page

  • .component

  • .cshtml

  • .jsf

  • .xhtml

  • .jsp

  • .jspf

  • .asp

  • .master

  • .php

6022007598.png

  • VBScript

  • .vbs

  • .aspx

  • .ascx

  • .asp

  • .cshtml

  • .html

  • .htm

  • .master

6022007601.png

  • Perl

  • .pl

  • .pm

  • .plx

  • .psgi

  • .cgi

6022007604.png

  • Android (Java)

  • Volley

  • .java

  • .kt

6022007607.png

  • Objective-C

  • Swift

  • .m

  • .h

  • .swift

  • .xib

  • .plist

6022007610.png

  • HTML 5

  • .html

  • .htm

6022007613.png

  • PL/SQL

  • .pls

  • .sql

  • .pkh

  • .pks

  • .pkb

  • .pck

6022007616.png

  • Python

  • JavaScript

  • VB script

  • PL\SQL

  • Django

  • Flask

  • Jinja and DTL

  • Pandas library

  • Marshmallow

  • .py

  • .gtl

  • .csv

  • .latex

  • .tex

  • .html

  • .xml

  • .txt

6022007619.png

  • Groovy

  • JavaScript

  • VB script

  • PL\SQL

  • .groovy

  • .gsh

  • .gvy

  • .gy

  • .gsp

  • .gradle

6022007622.png

  • Scala

  • Akka

  • Finagle

  • Finatra

  • .scala

  • .conf

Scala can be configured as a unified language with Java.

6022007625.png

  • GO Language

  • Protobuf

  • gin-gonic/gin

  • gorilla-mux

  • .go

  • .mod

kotlinlogo.png

  • Kotlin

  • Ktor (Server Side)

  • Vert.x (Server Side)

  • Spring

  • .kt

  • .kts

  • .mustache

  • .ftl

  • .xml

6022007508.jpg

  • Cobol

  • .cbl

  • .cob

  • .eco

  • .pco

  • .sqb

  • .cpy

6994002109.png

  • RPG

  • .rpg

  • .rpg38

  • .sqlrpg

  • .rpgle

  • .sqlrpgle

  • .dspf

6994002106.png

  • Dart

  • Flutter

  • .dart

  • .yaml

6993019381.png

  • Lua

  • OpenResty

  • .lua

  • .conf

Rust.png

  • Rust

  • .rs

Vulnerability Queries 9.6.4

All queries that are executed in version 9.6.4 are available for download  - PDF, CSV

New and updated queries in version 9.6.4 are available for download - PDF, CSV

Queries associated with predefined query presets are available for download - PDF, CSV

New and Changed Queries Details

Release Notes for Engine Pack (EP) 9.6.4 Patches

Version 9.6.4.1003 April 2024

  • Fixed a timeout error issue during the engine pack version upgrade.

Version 9.6.4.1002 March 2024

  • Improvements in Java language and frameworks parsing now include a watchdog functionality to prevent potential failures during the scan.

  • Improvements in Python support to prevent exceptions.

In this section: