Skip to main content

Engine Pack Version 9.7.1

CxSAST Engine

Languages & Frameworks

All supported code Languages & Frameworks versions can be found here

APEX

The following queries have been improved:

  • FLS_Read to support WITH USER_MODE

  • FLS_* queries improved for better results and accuracy

For further details, please see here.

C++

  • Several queries have been updated for better results and accuracy. For further details, please see here.

  • Parsing improvements:

    • C++20 Construct Support: Added support for parsing C++ 20 constructs: requires and concepts:

       template<typename T>
              using Ref = T&;
              
              template<typename T>
              concept C = requires
              {
                  typename T::inner; // required nested member name
                  typename S<T>;     // required class template specialization
                  typename Ref<T>;   // required alias template substitution
              };
    • Enhanced GCC Attribute Parsing: Improved parsing of GCC attributes, ensuring propagation of inline/static and others to proper methods:

      inline __attribute__((force_inline)) ssgRoot *get_taxi_lights_root () const {  }
    • Pro*C Fake Decimal Type: Improved support of the fake decimal type defined by Pro*C:

      decimal(15,4) dbi_dcConsumption_value;   // Here
                                
      decimal(15,4) foo = (decimal(15,4)) x; // here as a cast
    • SQL Statement Handling: Enhanced parsing of SQL statements, which are now converted into empty blocks.

    • Compound Literal Support: Improved the parsing of compound literals for better code analysis:

      bar(1, (float[3]) {1, 2, 3});  // this cast is an example
    • GNU Extension for Compound Statements: Support GNU extension for compound statements:

        for (int i = 0; i < N; i++) { 
            ({ 
                double *point = &points[i*2]; 
                rtree_insert(tr, point, point, (void *)(uintptr_t)(i)); 
                assert(rtree_count(tr) == i + 1); 
            }); 
        }
    • Modifier Support: Support modifiers like __fastcall, __fastdecl, __cdecl, __stdcall, __thiscall

    • Numeric Fields: Numeric fields (int, float, double) for classes had the NoneAbstractValue by default. Now, they default to AnyAbstractValue or a numeric abstract value with an infinite range: [-inf, +inf].

    • Variable Modifiers: Support for variable modifiers after struct type:

      struct { /*...*/ } const static variable[] = { /* ... */ }; 
    • Constructor/Destructor Parsing: Improvement when parsing Constructors/Destructors with empty body:

      GtkSplashScreen::~GtkSplashScreen() { };  
    • Microsoft Exception Handling: Support Microsoft __try and __except, as aliases for try and catch

    • Long Value in Pre-Processor Directives: Enhanced the handling of long values in pre-processor directives.

    • Nested Templates: Optimized parsing of nested templates for faster processing.

    • Header Support: The inttypes.h header added to the macros database to support its built-in macros.

C#

Improved the support for positional pattern matching.

COBOL

  • The following queries have been added:

    • Best Coding Practices

      • Dynamic_SQL_Queries

      • SQL_Select_without_Where

      • Use_of_DISPLAY

    • Low

      • Debug_Enabled

  • Parsing improvements were made to improve the accuracy of results.

Java

  • Java support has been updated up to version 21.

  • The query Mongo_NoSQL_Injection has been renamed to NoSQL_Injection, which includes support for CouchBase in addition to MongoDB.

  • The query Stored_Mongo_NoSQL_Injection has been renamed to Second_Order_NoSQL_Injection, which includes support for CouchBase in addition to MongoDB.

JavaScript

Several queries have been reviewed and refactored to improve the accuracy of the results and reduce the noise by decreasing the FPs.

For further details, please see here.

Compliance Standards

The STIG preset and its corresponding category have been updated to support the version 6.1.

Critical Severity

This version includes the review of queries transitioning from High to Critical severity.

For further details, please see https://docs.checkmarx.com/en/34965-321885-critical-severity-release-plan.html