Release Notes for Engine Pack (EP) 9.5.5 Patches

Performance enhancements were added to include Handlebars when scanning JavaScript source code.

Enhancements were made to the VB6 parsing mechanism to prevent exceptions when the source code includes Enum, Attribute, and Option statements.

Enhancements were made to the CPP parsing mechanism to prevent exceptions while creating the DOM.

Enhancements were made to the following JavaScript queries to prevent false positives:

Enhancements were made to the following C++ queries to prevent false positives:

Enhancements were made to the following Java queries to prevent false positives:

Improvements were made to the following C# query to prevent false positives:

Enhancements to the following Java queries to prevent false positives:

The JavaScript_High_Risk\Client_DOM_XSS query has been enhanced to prevent false positives and false negatives.

Enhancements to the following C# queries to prevent false positives:

Improvements in JSP support have been made to prevent scans from getting stuck when JavaScript code is included within JSP files.

Enhancements to the following JavaScript queries to prevent false negatives:

Several improvements on RPG parsing.

Improvement in the Python query for Python_High_Risk\SQL_Injection to prevent false negatives and false positives

Improvements in the following Python High queries to prevent false positives:

.Net Core upgraded to version 6.0.24

Several improvements in VB6 parsing.

Improvements in C# support to prevent NullReferenceException errors.

C/C++, RPG, and COBOL support has been improved to prevent parsing issues.

Improvements in Dapper library support to prevent false positives for SQL injection.

Improvements in C# support to prevent exceptions while running the queries.

Improvements in Go support to prevent OutOfMemory exceptions.

Improvements in JSP support have been made to prevent scans from getting stuck when JavaScript code is included within JSP files.

Improvements in VB6 parsing.

Improved the Java query Java_Medium_Threat\Missing_HSTS_Header to prevent false positives.

Improved JavaScript, JSP, and Python support to prevent parsing issues.

Improvements in the engine now ensure consistent results when scanning the same source code with varying CPU counts.

Several improvements were implemented in CxAudit when overriding queries.

Improved the JavaScript query JavaScript_Server_Side_Vulnerabilities\SQL_Injection to prevent false negatives.

Improved the Java query Java_High_Risk\LDAP_Injection to prevent false negatives.

Improved Scala language support to prevent an error causing the scans to fail.

Improved Apex query Apex_Force_com_Critical_Security_Risk\Stored_XSS to prevent False Positives.

Improvements in Apex language to prevent scans from failing when source code includes multiple single-line comments.

Improvements in Java language to prevent stuck scans when the package names include special characters.

Improvements in JavaScript language to prevent parsing issues.

Improved Python query Python_High_Risk\Reflected_XSS_All_Clients to prevent False Negatives.