Release Notes for Engine Pack (EP) 9.4.5 Patches

Fixed an issue, to avoid a timeout, preventing all queries from being updated/inserted correctly in the database during the upgrade process.

Improvements in Java parsing to prevent scan failures due to a Stack Overflow error.

Improvements in Java_Medium_Threat\Privacy_Violation query to consider remote inputs.

Improvements in C# parsing to prevent scans from being stuck.

Fixed an error to prevent an exception when running incremental scans for Java language.

Improvements in JavaScript queries to prevent False Positives for:

JavaScript_Medium_Threat\Missing_HSTS_Header

JavaScript_Low_Visibility\Client_JQuery_Deprecated_Symbols

Improvements in CSharp queries to prevent False Negatives for CSharp_High_Risk\Dangerous_File_Upload

Improvements in MyBatis (Java) to prevent transformation errors when scanning.

Improvements in COBOL parsing to prevent errors when the source code has the COPY statement.

Improvements in the query PLSQL_High_Risk\SQL_Injection for PL/SQL language.

Improvements to prevent a timeout when parsing COBOL source code.

For security fixes, click this link for additional information.

For security fixes, click this link for additional information.

Parsing improvements to prevent System.StackOverflowException errors when scanning.

Improvements in PHP to support trailing commas in function calls.

Improvements in MyBatis (Java) support to prevent parsing issues that caused DOM loss.

Improvements in Python queries to prevent False Positives for SQL Injection when using QuerySet in Django.

Improvements in Python queries to prevent False Positives for Python_High_Risk\Reflected_XSS_All_Clients.

Improvements in Go to prevent False Positives for Go_Insecure_Credential_Storage\ PBKDF2_Insufficient_Iteration_Count.

Improvements in CSharp queries to prevent False Positives for CSharp_High_Risk\Second_Order_SQL_Injection.

Improved the CSharp_General -> Find_XSRF_Sanitize query by adding the AutoValidateAntiforgeryToken attribute, to prevent False Positives for Cross-site request forgery (XSRF).

Improvements in CSharp queries to prevent False Positives and False Negatives for CSharp_Medium_Threat\CSRF.

Improvements in PHP support for parsing imported files.

Java support for ESAPI imports has been improved to prevent False Positives for SQL Injection.

Improvements in Python queries to prevent False Positives and False Negatives for JavaScript_High_Risk\Client_DOM_XSS.

RPG improvements to:

Improvements in the Go language support to prevent issues when scanning the source code.

Several queries were improved to prevent False Positives:

Several queries were improved to prevent False Negatives:

Docker files are updated in the Linux engine (requires Docker version 20.10.10+).

CxAudit has been improved to use the same environment variable as CxPortal that defines the Source folder.

The query CPP_Buffer_Overflow.Buffer_Overflow_Unbounded_Format has been improved to prevent a StackOverflow error.

Several queries were improved to prevent False Negatives:

Improvements in the confidence level calculation to display the proper value for scans triggered through the Linux engine.

Improvements in Java parsing to prevent FP (false positive) results for the Reflected XSS All Client query.

Improvements in JSP parsing to prevent FN results.

Improved the React parsing to prevent errors from occurring when HTML elements included keywords.

Improvements in MyBatis (Java) parsing to prevent DOM loss.

Improvements in MyBatis (Java) parsing to prevent an issue that occurred when pre-processed files included single quotes.

Fixed an issue that was causing scans to fail when scanning JavaScript code that included type predicates.