Skip to main content

Release Notes for 9.6.0

CxSAST Engine

Warning

  • The Checkmarx Technical Team will handle all deployment processes.

Languages and Frameworks

In 9.6.0, all the previously supported languages and frameworks, and content delivered in engine packs 9.5.1, 9.5.2, 9.5.3, 9.5.4, and 9.5.5 are still supported.

Lua (Technical Preview)

In 9.6.0, we added support for Lua language in SAST, including the following features:

  • Variables: Global, Local, and Table fields.

  • Statements: Blocks, Chunks, Assignment, Control Structures, For Statement, Function Calls as Statements, Local Declarations and To-be-closed Variables.

  • Expressions: Arithmetic Operators, Bitwise Operators, Coercions and Conversions, Relational Operators, Logical Operators, Concatenation, The Length Operator, Precedence, Table Constructors, Function Calls, and Function Definitions.

  • Standard Libraries: Modules.

OpenResty (Technical Preview)

In addition to Lua language support, version 9.6.0 also includes support for OpenResty and the following:

PHP

PHP language support was rewritten and is available as a Technology Preview.

To ensure enhanced accuracy and better results, a thorough review of all queries was conducted while implementing the new PHP support.

As a result, several queries underwent various modifications: some were renamed, while others were deprecated and are no longer recommended for use. Additionally, changes were made to the source code for certain queries, and the severity levels of some queries were updated. These changes are aimed at optimizing the PHP support and providing improved results.

Warning

Please be aware that the introduction of the new PHP support brings a significant disruption, as the old PHP support will no longer be available.

It's also important to note that this upgrade will lead to changes in your current PHP results.

Before upgrading to version 9.6.0, it is advisable to consult the updated documentation and release notes to understand the specific changes made to each query and how they might affect your application and results.

As with any significant update, it is recommended to thoroughly test your application after the upgrade to ensure compatibility with the new PHP support and to identify any potential issues that may arise due to the upgrade. Adequate preparation and testing can help mitigate disruptions and ensure a smooth transition to the enhanced PHP support provided.

Notice

To read and understand the Change Source section, follow these guidelines:

  1. Lines with a "+" symbol: These lines represent new code that has been added to the query.

  2. Lines with a "-" symbol: These lines indicate code that has been removed from the query.

By examining the lines with "+" and "-" symbols, you can track the specific modifications made to the query, including new code added and code removed.

This information is useful for understanding the changes introduced.

Notice

Technology Preview features provide early access to upcoming product innovations, enabling you to test functionality and provide feedback during the development process. However, these features are not fully supported, might not be functionally complete, and are not intended for production use.

As Checkmarx considers making future iterations of Technology Preview features generally available, we will attempt to resolve any issues that customers experience when using these features.

Swift

Swift language support has been updated to version 5.7, including the following features:

  • SE-0290: Unavailability Condition

  • SE-0335: Existential any

  • SE-0315: Support Type placeholders (formerly, “Placeholder types”)

  • SE-0345: if let shorthand for shadowing an existing optional variable

  • SE-0346: Lightweight same-type requirements for primary associated types

  • SE-0347: Type inference from default expressions

  • SE-0309: Unlock existentials for all protocols

  • SE-0336: Distributed Actor Isolation

  • SE-0326: Multi-statement closure parameter/result type inference

  • SE-0350: Regex Type and Overview

  • SE-0351: Regex builder DSL

  • SE-0354: Regex Literals

  • SE-0355: Regex Syntax and Run-time Construction

  • SE-0357: Regex-powered string processing algorithms

Kotlin Queries Alignment

To align Java and Kotlin, both JVM languages, several queries were incorporated and updated within Kotlin support to improve consistency and compatibility between the two languages when scanning.

New Queries

  • Kotlin_Low_Visibility

    • Use_of_Unsafe_JNI

  • Kotlin_Medium_Threat

    • Cleartext_Submission_of_Sensitive_Information

    • DoS_by_Sleep

    • Excessive_Data_Exposure

    • Frameable_Login_Page

    • Hardcoded_password_in_Connection_String

    • Improper_Locking

    • Missing_HSTS_Header

    • Missing_Secure_In_Code

    • Parameter_Tampering

    • Privacy_Violation

    • Reliance_on_Cookies_without_Validation

    • SSRF

    • Unsafe_Object_Binding

  • Kotlin_Spring

    • Spring_ModelView_Injection

Updated Queries

  • Kotlin_High_Risk

    • Deserialization_of_Untrusted_Data

  • Kotlin_Medium_Threat

    • Use_of_Hardcoded_Cryptographic_Key

Scala Queries Alignment

To align Java and Scala, both JVM languages, several queries were incorporated and updated within Scala support. Users can now experience greater consistency and compatibility between the two languages when scanning.

New Queries

  • Scala_High_Risk

    • Expression_Language_Injection_MVEL

    • Expression_Language_Injection_SPEL

  • Scala_Medium_Threat

    JWT_Use_Of_Hardcoded_Secret

    • Excessive_Data_Exposure

    • JWT_Lack_Of_Expiration_Time

    • JWT_No_Signature_Verification

    • JWT_Sensitive_Information_Exposure

    • JWT_Use_Of_Hardcoded_Secret

    • Spring_ModelView_Injection

    • Stored_Command_Injection

    • Unvalidated_Forwards

  • Scala_Low_Visibility

    • JWT_Excessive_Expiration_Time

    • JWT_Use_Of_None_Algorithm

    • Use_of_Unsafe_JNI

Updated Queries

  • Scala_Medium_Threat

    • Stored_External_XML_Entities_XXE

    • Use_of_Hardcoded_Cryptographic_Key

Removal of deprecated queries from Presets

The actions announced on the latest version are being postponed to the upcoming versions.

Beginning in the next version, 9.6.2, the following actions are planned:

  • Deprecated queries will be removed from the engine.

  • Queries from presets can be removed according to compliance standards updates.

  • All the changes will be properly communicated in advance in the Engine Pack release notes.

Warning

When performing the initial cleaning action (9.6.2), we undertake the removal of old queries and presets that have been deprecated for an extended period. This removal is a permanent, and once deleted, there is no rollback option to restore it.

This means that after upgrading to the version where queries and presets have been removed, downgrading to the previous version will not add back the queries or presets that were previously available. The removal is irreversible.

However, starting from version 9.6.2 and onward, any deletion that can occur is reversible and can be rolled back with the previous engine pack.

To ensure a smooth transition between versions and maintain essential functionalities, it is essential to thoroughly review release notes and documentation before upgrading to a version that involves removing queries or presets.

Actions to be executed in the upcoming version 9.6.2:

  • Deprecated queries are going to be removed from the presets according to the following list:

    (Query Id, Query Name)

  • In addition, the presets Default and Default 2014 will be removed according to the following rules:

    • If the preset is unrelated to any projects, it will be removed.

    • If the presets are related to a project, they won´t be removed.

Core

Regarding Core content and improvements, 9.6.0 includes all the previous content in engine packs 9.5.1 through 9.5.5 and a 20% performance improvement in incremental scans.

M&O Service 

For M&O users, please note this version does not support M&O and you will not be able to upgrade your SAST version and the deployment process will be aborted. We are currently working on developing innovative enhancements. Please reach out to your TAMs to learn more.

CxSAST Application

New REST APIs

API Returning Information From The Audit Trail

The goal is to create several APIs to retrieve audit information from the database. The information concerns actions such as Create/Update/Delete/Import/Export on the presets, results, roles, and teams tables.

Request definition:

Included in version 5 of API (SAST 9.6)

request created:

  • REST API - sast/presets/auditTrail

  • REST API - sast/results/auditTrail

  • REST API - sast/roles/auditTrail

  • REST API - sast/teams/auditTrail

Add a REST API endpoint for all the historical actions taken from the pathid

The goal is to get the result path action history using scanId and path id to display via REST API.

Types of scans to consider for SOAP request compatibility:

  • Scan finished

Request definition:

Included in version 5 of API (SAST 9.6)

request: GET sast/scans/{scanId}/actionResults/{pathId}/labels

REST API for Query info

Added a REST API that provides the following information for a given preset-

  • Query Id

  • Query Name

  • Query Language

  • Query Source

Request definition :

Included in version 5 of Rest API (SAST 9.6)

Request :

GET /sast/presetDetails/{id}

Azure DevOps TFS using PAT

Added ability to connect to a source control system using ADO TFS.

Notice

Note - Azure DevOps TFS repository would be accessible only using PAT.

Updating SAST Web Portal Online Help Links

Includes the following updates:

Supportability and Usability Improvements

  • The Checkmarx logo available in the User Interface has been updated according to the most recent company branding.

  • Added a more visible button to view vulnerability details on the scan results page.

  • Scan Cancellation: You can now cancel your own scans that are not complete or were accidentally initiated without requiring the permissions for deleting completed scans.

  • Swagger Link: Link to Swagger docs added to the SAST user interface.

  • Previously, this configuration allowed you to define a comment as mandatory when the Result State changed to Not Exploitable. In 9.6.0, you can also define a comment as mandatory when the Result State is changed to Proposed Not Exploitable.

  • Define Engine Limit: You can now limit an engine to take scans of specific teams, projects, and jobs.

  • Filter for Grid: Added a filter feature. You can apply a filter to the grid by specifying it in the URL, while the address bar updates accordingly.

  • Saved UI Settings in Database: Your user interface settings will be saved in the database instead of in cookies to prevent problems due to limited save sizes and enable you to maintain their settings whenever logging in.

  • Added an option to Delete scans older than (X days) for more flexibility in data retention.

  • Notification for Offline Engine:Added an email alarm function that notifies you when an engine is offline - this is especially helpful when managing many engines.

  • Enhance the license expiration details and HID information, in case it has been changed and requires attention (HID might be dynamic when dealing with VMs in the cloud environment).

  • Scans Queue Improvements:Scans without available engines are waiting in queue with an informative message instead of failing.

  • Mandating Custom Fields:Added the option to configure whether a project's custom field is mandatory during creation or editing. Legacy custom fields (created before 9.6.0) are kept optional, but they can be edited and marked as mandatory. When creating a new project, mandatory project custom fields must be defined. A warning message is displayed if they are not defined, and you cannot save the project. When editing a project, if a custom field is labeled mandatory, you will be requested to redefine custom fields that are now mandatory.

  • The UI now enforces a full scan after 5 consecutive incremental scans for improved results to enhance accuracy in incremental scans.

  • Results Viewer Enhancements:Results Viewer has been enhanced and includes more details, like the number of results for each severity level ( High, Medium, Low), in the Results tree.

  • The Include files and folders have been added alongside the existing Exclude option, simplifying situations where most files and folders need to be excluded.

  • Scans no longer fail when triggering REST APIs where the parameters do not match the project settings, like where zip files are uploaded to a source control project (SVN) and vice-versa.

  • A new entry,MaxRequestsPerMinute, with a default value of 100 was added to the WebAPI web.config. Upgrading with this default value may result in significant API failures for enterprise clients. To maintain the previous behavior of unlimited requests, the value must be set to 0.

Dynamic Engines

Dynamic Engines are used in creating and destroying engines using docker containers or VMs in all types of cloud networks. This lets you work with the scans dynamically and lets the K8S manage the deployment in real-time. You can take full advantage of their hardware, maximize the use of their machines (when not in use, the resources can be used for other purposes) and easily scale up the system when adding or replacing machines.

APIs Changes
REST API v5.0

The following APIs were changed to return a new output called IsMandatory:

  • [GET] GENERAL/customFields

  • [GET] GENERAL/projects

  • [GET] GENERAL/projects/{id}

The API [PUT] GENERAL/projects/{id} has been updated to return an error in case not all the mandatory custom fields are defined.

Result Viewer column filter by not contains

Results Viewer has been improved and now includes a new allowed filter: not contains.

In addition, the following screens also take advantage of the new filter:

  • Dashboard -> Project States

  • Dashboard -> Failed Scans

  • Projects & Scans -> Queue

  • Projects & Scans -> Projects

  • Projects & Scans -> Projects -> View Project Scans

  • Projects & Scans -> All Scans

  • Projects & Scans -> All Scans -> Open Result Viewer

  • Settings -> Scan Settings -> Preset Manager

  • Settings -> Scan Settings -> Pre & Post Scan Actions

  • Settings -> Scan Settings -> Source Control Users

  • Settings -> Application Settings -> Installation Information

  • Settings -> Application Settings -> Issue Tracking Settings

Enhanced Failed Scans and Project State dashboards

The Failed Scans dashboard screen has been improved with:

  • a new Team Name column that allows you to consult the team responsible for each project.

  • a new link to the Project Name that redirects you to the Project State page filtered by the selected project.

The following CxPortal displays were improved and now show the DATE in seconds in addition to hours and minutes:

  • Dashboard -> Projects State (Last Scan Date)

  • Dashboard -> Failed Scans (Scan Date)

  • Projects & Scans -> Queue (Queued Date)

  • Projects & Scans -> Projects (Last Scanned)

  • Projects & Scans -> All Scans (Scan Date & Scan Complete)

  • Projects & Scans -> All Scans -> Click on Open Viewer for any scan (Detection Date)

  • Projects & Scans -> Projects -> Click on View Project Scans for any project (Scan Date & Scan Complete)

Both dashboards for Failed Scans and Projects State are improved and now use all the available space in the window screen to avoid scrolling down the list to view the data.

Multi-select severity and Result State in the results filter in the viewer

Starting in 9.6.0, it's possible to filter the scan results in the Result Viewer by applying multiple severities and states at once.

The following screens have also been affected by this change:

  • Dashboard -> Project States

  • Dashboard -> Failed Scans

  • Projects & Scans -> Queue

  • Projects & Scans -> Projects

  • Projects & Scans -> Projects -> View Project Scans

  • Projects & Scans -> All Scans

  • Projects & Scans -> All Scans -> Open Result Viewer

  • Settings -> Scan Settings -> Preset Manager

  • Settings -> Scan Settings -> Pre & Post Scan Actions

  • Settings -> Scan Settings -> Source Control Users

  • Settings -> Application Settings -> Installation Information

  • Settings -> Application Settings -> Issue Tracking Settings

Thousands Separator

Large numbers without separators are difficult to read quickly, and the SAST GUI does not include separators between thousands or millions. Therefore, we changed how the Scan Size is displayed to include a thousand separator defined in the operating system configurations and shown in the following option path:

  • Settings | Application Settings | Engine Management → Scan Size

LOC(number) should be represented using a thousand separators

Large numbers without separators are difficult to read quickly, and the SAST GUI does not include separators between thousands or millions. Therefore, we changed how the LOC is displayed to include a thousand separator defined in the operating system configurations and shown in the following option path:

  • Projects and Scans -> All scans (LOC field )

Access the CxSAST Reporting Service through the CxPortal

A new button allowing access to the CxSAST Reporting Service User Interface is now visible in CxPortal (next to the CodeBashing button).

  • If Reporting Service is not installed, the button is unavailable in the CxPortal.

  • If Reporting Service is installed:

    • Once you log in to the CxPortal, a button to access Reporting Service becomes available;

    • By clicking on the button, you are redirected to the CxSAST Reporting Service User Interface;

    • A login is not requested when accessing the CxSAST Reporting Service User Interface;

    • When the CxSAST Reporting Service UI is displayed, your actions are determined by the Reporting Service permissions assigned to you.

To enable this feature, CxReportingService 3.0.2 must be installed.

CxSAST Access Control

  • Multi-factor Authentication

  • IP Restrictions - an allowed list of permitted IPs can be set, and all others will be blocked.

  • A password complexity policy mechanism has been added where the users can define several security levels, password length and structure, password expiration period, trusted browsers, manage lockout period in case of locked users, and more.

  • Audit Trail (DB) and logs now show more detailed information about user activity.

PHP Rewrite Update (v9.6.0)

Overview

This page showcases the different PHP language upgrade scenarios on version 9.6.0.

Note

Every query and general query was updated to use the latest query best coding practices and avoid false positives.

Warning

  • It’s important to note that all the query customizations (and/or overrides) should be revalidated after upgrading.

  • Most of the results are new since the queries were improved. Similarly, the inputs, outputs, and sanitizers are different; these changes will generate different similarity IDs resulting in new results.

RelatedLinks: SAST Resources and New and Changed Query Details (PDF)

Queries Scenarios

  • If you overrode a PHP query that was modified

The query and the override will be available. It is advised to revalidate the custom query.

  • If you overrode a PHP general query that was deprecated

The override will be removed.

Warning

Any query override of a deprecated general query should be backed up before the upgrade, to avoid losing the override.

Related Links: SAST Resources and New and Changed Query Details (PDF)

  • If you overrode a PHP query that was renamed (which does not use any deprecated general query)

The override will be available.

Warning

Please take into account that only queries using base.* as a prefix will be updated and renamed.

Danger

It is critical to remove all usages of renamed general queries without the base.* prefix either before or after the upgrade, but before a new scan, to avoid any issues.

Related Links: SAST Resources and New and Changed Query Details (PDF)

  • If you overrode a PHP query (which uses at least one deprecated general query)

Warning

Expect an error while compiling the query.

Danger

It is critical to remove all usages of deprecated general queries either before or after the upgrade, but before a new scan, to avoid any issues.

Related Links: SAST Resources and New and Changed Query Details (PDF)

  • If you overrode a PHP query that changed its severity and was moved to another group

No problems are expected.

Related Links: SAST Resources and New and Changed Query Details (PDF)

Query Results Scenarios

  • There are results in PHP queries (overridden or not) that were modified

Queries were modified with the focus of reducing false positives. As a side effect, the starting and ending nodes of the results in many queries now indicate the affected parameter versus the affected method when compared with the previous PHP version.

<?php
$foo = $_POST['foo'];
echo $foo;

// Before: $_POST (line2) -> echo (line 3)
// After: $_POST (line 2) -> $foo (line 3)

This kind of behavior is usual for most queries. For example, for generic database queries, the sink is the execution function parameter, not the method itself.

  • There are results in PHP queries (overridden or not) whose names were changed

The following queries were renamed while reusing the same query ID. All the results are associated with the query ID and not with its name.

Notice

Since the query ID will remain the same, then there is nothing to do here, the results will be assigned to the new query (*).

Old Query

New Query

Old Severity

New Severity

Reflected_XSS_All_Clients

Reflected_XSS

High

Reflection_Injection

Unsage_Injection

High

Stored_Reflection_Injection

Stored_Unsafe_Reflection

Medium

Improper_Control_of_Dynamically_Identified_Variables

User_Controlled_Dynamic_Variable

Medium

Inappropriate_Encoding_for_Output_Context

Insufficient_Sanitization_for_XSS

Medium

Low

Insecure_Randomness

Use_of_Non_Cryptographic_Random

Medium

Low

Notes:

  • Queries Object_Injection and Deserialization_of_Untrusted_Data were merged into Deserialization_of_Untrusted_Data. The query scope changed, and thus, query severity was increased to High. (blue star)

Warning

Results for the old Object_Injection deprecated query will disappear and new results need to be analyzed. The old Deserialization_of_Untrusted_Data results will be assigned to the new query severity.

Old Query

New Query

Old Severity

New Severity

Deserialization_of_Untrusted_Data

Deserialization_of_Untrusted_Data

Medium

High

Object_Injection

Medium

  • The following old queries were removed, and new queries were created that shared their intent.

Warning

The query ID was not recycled and as such all results of the new queries must be analyzed.

Old Query

New Query

Old Severity

New Severity

Use_of_Broken_or_Risky_Cryptographic_Algorithm

Broken_or_Risky_Encryption_Algorithm

Low

Medium

Broken_or_Risky_Hashing_Function

Medium

Outdated_Encryption_Algorithm

Information

Outdated_Hashing_Function

Information

File_Disclosure

Path_Traversal

Relative_Path_Traversal

High

Medium

Medium

Stored_Relative_Path_Traversal

Medium

Absolute_Path_Traversal

High

Stored_Absolute_Path_Traversal

High

HttpOnlyCookies

HttpOnly_Cookie_Flag_Not_Set

Medium

Medium

HttpOnly_Cookie_Flag_Not_Set_In_Config

Medium

Secure_Cookie_Flag_Not_Set

Medium

Secure_Cookie_Flag_Not_Set_In_Config

Medium

Insecure_Value_of_the_SameSite_Cookie_Attribute_In_Code

Medium

Insecure_Value_of_the_SameSite_Cookie_Attribute_In_Config

Medium

Cookie_Overly_Broad_Path

Low

Cookie_Overly_Broad_Path_In_Config

Low

File_Inclusion

Dangerous_File_Inclusion

High

Remote_File_Inclusion

Danger

It’s critical to remove or replace all usages of renamed queries without base.* prefix either before or after the upgrade, but before a new scan, to avoid any issues.

Related Links: SAST Resources and New and Changed Query Details (PDF)

  • Many queries require the search for APIs by their name

The results now reflect the language approach to case sensitivity, in this case, the lack of it.

<?php
// This behavior is valid for both user-defined functions and language built-ins
function sayHello(){
  echo 'Hello, World!';
}
// Old & New support finds this invocation
sayHello();
// Only New support finds this invocation
sayhello();

Notice

All the queries were updated to support the PHP case sensitivity.

Group Scenarios

  • There are groups in PHP that were renamed to assert consistency in naming conventions (ex.: Php_* → PHP_* )

No problems are expected.

  • Php_Low_Visibility → PHP_Low_Visibility

  • Php_Best_Coding_Practice → PHP_Best_Coding_Practice

Flow Changes

With the new PHP support version, in some cases, more DOM nodes will be available in the flow. If any flow is missing we highly recommend increasing the LazyFlow hops limit.

  • The array support was improved

Before: The array was supported as MethodInvokeExpr, this means that any parameter will influence the return, giving origin to some FPs results.

After: The array map was fully supported as an AssociativeArray, which means that only the relevant flow for the specific key that is being used will appear.

<?php
$a = array("a" , "b");
echo $a[0]; // “a”

File Inclusion Changes

  • Previously, we had no support for include/require methods, nevertheless, we still managed to have flow and definitions for methods in different files.

Before: All files were in a shared namespace, which meant they had by omission access to all other files.

After: We resolve the file inclusion using the given argument.

<?php 
// Supported
include __DIR__ . 'filename.php';
// Unsupported
include ABS_PATH . 'filename.php';

Danger

We do not support dynamically generated filenames as they are run-time-based.

Retain Results

In our internal benchmarks, it was detected, to have a huge number of results revalidation after the upgrade. As already mentioned, most of the general queries were reviewed, which will have a big impact on the results.

Warning

t is expected 15% retainment of the results after the upgrade with a high percentage in the PHP_Best_Coding_Practice queries group.

Severity

Query Name

Average Retain Results (%)

High

Deserialization_of_Untrusted_Data RENAMED (Object_Injection)

70%

Missing_HSTS_Header

100%

Medium

User_Controlled_Dynamic_Variable

40%

Low

Reliance_on_DNS_Lookups_in_a_Decision

30%

Use_Of_Hardcoded_Password

70%

Use_of_Non_Cryptographic_Random

30%

Information

Declaration_Of_Catch_For_Generic_Exception

100%

Detection_of_Error_Condition_Without_Action

100%

Exposure_of_Resource_to_Wrong_Sphere

5%

Hardcoded_Absolute_Path

100%

Possible_Global_Variable_Overwrite

100%

Unchecked_Error_Condition

99%

Unclosed_Objects

100%

Use_Of_Namespace

98%

Use_Of_Private_Static_Variable

100%

Use_Of_Super_GLOBALS

70%

Warning

Most of the missing results are duplicated results, false positives, or query changes that affect flow results.

Action on Non-General/General and Impact on Non-General/General

The matrix below summarizes situations when a Non-General or a General query went through some change/action. The impact is reported for the results status only on the query itself and what may happen to the associated custom/overridden query. Read further below to see the effect of General on Non-General queries.

Note

The vertical and the horizontal panels describe the main action performed on a certain non-general query. The cells describe the side effects of the combination of these modifications in both results and existing custom queries related to the non-general query. Example: File_Inclusion and Remote_File_Inclusion were merged into Dangerous_File_Inclusion, it doesn’t make sense to reuse any of them so they are both removed and a new query is created.

Actions vs. Impact

renamed

regrouped

rewritten

removed

divided / merged

renamed

results: recurrent

custom: recurrent

-

-

-

-

regrouped

results: recurrent

custom: recurrent

results: recurrent

custom: recurrent

-

-

-

rewritten

results: recurrent, new, fixed

custom: recurrent, new, fixed.

️‍️Reviewing the custom query to adapt to changes in the original query is advised.

results: recurrent, new, fixed

custom: recurrent, new, fixed.

️‍️Reviewing the custom query to adapt to changes in the original query is advised.

results: recurrent, new, fixed

custom: recurrent, new fixed.

️‍️Reviewing the custom query to adapt to changes in the original query is advised.

-

-

removed

NA

NA

NA

results: fixed (results disappear)

custom: fixed (️query and its results will disappear)

-

divided / merged

NA

NA

NA

results: fixed (results will migrate to other emerging queries, and appear as new)

custom: fixed (️query and its results will disappear)

results: recurrent, new, fixed (results will migrate to other emerging queries, and appear as new)

custom: new (there is the need to create a new custom query)

Actions on General vs Impact on Custom Non-General

The matrix below summarizes situations when a General query is used inside a Custom Non-General query. It reports the action done on top of such a General query and its impact on a Custom Non-General query that uses it.

Warning

A series of general queries were renamed due to similarity in intent. This renaming followed the following rule: Find_DB_In_* → Find_Bind_*; ex.:Find_DB_In_PDO → Find_Bind_PDO.

The following was also renamed:

  • Find_Mongo_DB_In → Find_Bind_MongoDB

  • Find_DB_Out_Oracle → Find_DB_Out_OCI

Actions vs. Impact

renamed

regrouped

rewritten

removed

divided/merged

renamed

NA

-

-

-

-

regrouped

NA

NA

-

-

-

rewritten

️ The references to this general query must be updated with the new name.

NA

results: Results may differ.

️‍️It is advised to review the non-general custom query to adapt to changes in the general query.

-

-

removed

NA

NA

NA

️ An error is expected to occur (when the general query is in use in the non-general custom query)

️ The non-general custom query must remove/replace the use of this general.

-

divided/merged

NA

NA

NA

NA

NA

Engine Pack Supported Code Languages and Frameworks (9.6.0)

Environment and Primary Languages

Secondary Languages

Framework + Version

File extensions

Additional Information

6022007568

  • Java

  • J2SE

  • J2EE

  • JSP

  • JavaScript

  • VBScript

  • PL\SQL

  • HTML5

  • ATG DSP Taglib

  • GWT

  • Hibernate

  • Google Guice

  • Java Server Faces (JSF)

  • JSP

  • JSTL FMT Taglib

  • OWASP ESAPI

  • MyBatis

  • PrimeFaces

  • Spring Boot

  • Spring MVC

  • Spring

  • Struts

  • Velocity

  • .java

  • .jsp

  • .jspf

  • .jsf

  • .tag

  • .tld

  • .mf

  • .xhtml

  • .vm

  • .gradle

  • .properties

  • .xml

Java can be configured as a unified language with Scala.

6022007571.png

  • ASP.NET

  • JavaScript

  • VBScript

  • PL\SQL

  • HTML5

  • ASP.NET Core

  • ASP.Net Core Razor

  • ASP.Net MVC framework

  • Enterprise Libraries

  • ComponentArt

  • Entity framework

  • Hibernate.Net

  • Infragistics

  • iBatis

  • Telerik

  • .cs

  • .cshtml

  • .xaml

  • .vb

  • .config

  • .aspx

  • .ascx

  • .asax

  • .tag

  • .master

  • .xml

6022007574.png

  • ASP

  • JavaScript [**]

  • VBScript

  • PL\SQL

  • HTML5

  • ASP.Net MVC framework

  • .asp

  • .inc

6022007577.png

  • VB6

  • .bas

  • .vbp

  • .frm

  • .cls

  • .dsr

  • .ctl

6022007580.png

  • C

  • C++

  • C MISRA

  • C++ MISRA

  • Informix ESQL/C

  • MySQL

  • .cpp

  • .c

  • .cc

  • .c++

  • .cxx

  • .hpp

  • .hh

  • .h++

  • .hxx

  • .h

  • .ec

  • .cmake

  • .pro

  • .ac

  • .am

  • .txt (related to CmakeLists)

64d4d824681bd.svg

  • PHP

JavaScript

  • bWapp

  • CakePHP

  • OWASP ESAPI

  • Kohana

  • Symfony

  • Smarty

  • Zend

  • .php

  • .php3

  • .php4

  • .php5

  • .phtm

  • .phtml

  • .tpl

  • .ctp

  • .twig

  • .inc

  • .cgi

6022007586.png

  • Apex

  • VisualForce

  • Lightning (Aura)

  • Lightning Web Components

  • .apex

  • .apexp

  • .apxc

  • .page

  • .component

  • .cls

  • .trigger

  • .tgr

  • .object

  • .report

  • .workflow

  • -meta.xml

  • .xml

This is for Salesforce APEX only.

6022007589.png

  • Ruby

  • Ruby on Rails

  • .rb

  • .rhtml

  • .rxml

  • .rjs

  • .erb

  • .cgi

  • .lock

6022007592.png

  • JavaScript

  • Typescript

  • Ajax

  • Angular

  • AngularJS

  • Backbone

  • Cordova / PhoneGap

  • Handlebars

  • Hapi.JS

  • JQuery

  • Knockout

  • Kony Visualizer

  • Node.js

    • Buffer

    • CryptoJS

    • ExpressJS

    • File System

    • Hapi

    • Mongodb

    • OracleDB

    • Sequelize

  • Pug (Jade)

  • React Native

  • ReactJS

  • SAPUI5

  • VueJS

  • XS (SAP)

  • RequireJS

  • .js

  • .jsx

  • .htm

  • .html

  • .json

  • .ts

  • .tsx

  • .aspx

  • .ascx

  • .xsjs

  • .xsjslib

  • .xsaccess

  • .xsapp

  • .app

  • .evt

  • .cmp

  • .hbs

  • .handlebars

  • .jade

  • .pug

  • .vue

  • .xml

6022007598.png

  • VBScript

  • .vbs

  • .aspx

  • .ascx

  • .asp

  • .cshtml

  • .html

  • .htm

  • .master

6022007601.png

  • Perl

  • .pl

  • .pm

  • .plx

  • .psgi

  • .cgi

6022007604.png

  • Android (Java)

  • Volley

  • .java

  • .kt

6022007607.png

  • Objective-C

  • Swift

  • .m

  • .h

  • .swift

  • .xib

  • .plist

6022007610.png

  • HTML 5

  • .html

  • .htm

6022007613.png

  • PL/SQL

  • .pls

  • .sql

  • .pkh

  • .pks

  • .pkb

  • .pck

6022007616.png

  • Python

  • JavaScript

  • VB script

  • PL\SQL

  • Django

  • Flask

  • Jinja and DTL

  • Pandas library

  • .py

  • .gtl

  • .csv

  • .latex

  • .tex

  • .html

  • .xml

  • .txt

6022007619.png

  • Groovy

  • JavaScript

  • VB script

  • PL\SQL

  • .groovy

  • .gsh

  • .gvy

  • .gy

  • .gsp

  • .gradle

6022007622.png

  • Scala

  • Akka

  • Finagle

  • Finatra

  • .scala

  • .conf

Scala can be configured as a unified language with Java.

6022007625.png

  • GO Language

  • Protobuf

  • gin-gonic/gin

  • gorilla-mux

  • .go

  • .mod

kotlinlogo.png

  • Kotlin

  • Ktor (Server Side)

  • Vert.x (Server Side)

  • Spring

  • .kt

  • .kts

  • .mustache

  • .ftl

  • .xml

6022007508.jpg

  • Cobol

  • .cbl

  • .cob

  • .eco

  • .pco

  • .sqb

  • .cpy

6994002109.png

  • RPG

  • .rpg

  • .rpg38

  • .sqlrpg

  • .rpgle

  • .sqlrpgle

  • .dspf

6994002106.png

  • Dart

  • Flutter

  • .dart

  • .yaml

6993019381.png

  • Lua

  • OpenResty

  • .lua

  • .conf

In this section: