Engine Pack Version 9.7.1
CxSAST Engine
Languages & Frameworks
All supported code Languages & Frameworks versions can be found here
APEX
The following queries have been improved:
FLS_Read to support WITH USER_MODE
FLS_* queries improved for better results and accuracy
For further details, please see here.
C++
Several queries have been updated for better results and accuracy. For further details, please see here.
Parsing improvements:
C++20 Construct Support: Added support for parsing C++ 20 constructs: requires and concepts:
template<typename T> using Ref = T&; template<typename T> concept C = requires { typename T::inner; // required nested member name typename S<T>; // required class template specialization typename Ref<T>; // required alias template substitution };
Enhanced GCC Attribute Parsing: Improved parsing of GCC attributes, ensuring propagation of inline/static and others to proper methods:
inline __attribute__((force_inline)) ssgRoot *get_taxi_lights_root () const { }
Pro*C Fake Decimal Type: Improved support of the fake
decimal
type defined by Pro*C:decimal(15,4) dbi_dcConsumption_value; // Here decimal(15,4) foo = (decimal(15,4)) x; // here as a cast
SQL Statement Handling: Enhanced parsing of SQL statements, which are now converted into empty blocks.
Compound Literal Support: Improved the parsing of compound literals for better code analysis:
bar(1, (float[3]) {1, 2, 3}); // this cast is an example
GNU Extension for Compound Statements: Support GNU extension for compound statements:
for (int i = 0; i < N; i++) { ({ double *point = &points[i*2]; rtree_insert(tr, point, point, (void *)(uintptr_t)(i)); assert(rtree_count(tr) == i + 1); }); }
Modifier Support: Support modifiers like
__fastcall
,__fastdecl
,__cdecl
,__stdcall
,__thiscall
Numeric Fields: Numeric fields (int, float, double) for classes had the NoneAbstractValue by default. Now, they default to AnyAbstractValue or a numeric abstract value with an infinite range: [-inf, +inf].
Variable Modifiers: Support for variable modifiers after struct type:
struct { /*...*/ } const static variable[] = { /* ... */ };
Constructor/Destructor Parsing: Improvement when parsing Constructors/Destructors with empty body:
GtkSplashScreen::~GtkSplashScreen() { };
Microsoft Exception Handling: Support Microsoft
__try
and__except
, as aliases fortry
andcatch
Long Value in Pre-Processor Directives: Enhanced the handling of long values in pre-processor directives.
Nested Templates: Optimized parsing of nested templates for faster processing.
Header Support: The
inttypes.h
header added to the macros database to support its built-in macros.
C#
Improved the support for positional pattern matching.
COBOL
The following queries have been added:
Best Coding Practices
Dynamic_SQL_Queries
SQL_Select_without_Where
Use_of_DISPLAY
Low
Debug_Enabled
Parsing improvements were made to improve the accuracy of results.
Java
Java support has been updated up to version 21.
The query Mongo_NoSQL_Injection has been renamed to NoSQL_Injection, which includes support for CouchBase in addition to MongoDB.
The query Stored_Mongo_NoSQL_Injection has been renamed to Second_Order_NoSQL_Injection, which includes support for CouchBase in addition to MongoDB.
JavaScript
Several queries have been reviewed and refactored to improve the accuracy of the results and reduce the noise by decreasing the FPs.
For further details, please see here.
Compliance Standards
The STIG preset and its corresponding category have been updated to support the version 6.1.
Critical Severity
This version includes the review of queries transitioning from High to Critical severity.
For further details, please see https://docs.checkmarx.com/en/34965-321885-critical-severity-release-plan.html