9.2.0 Enterprise Updates

Use_Of_Broken_Or_Risky_Cryptographic_Algorithm - Hash Passwords

Use_Of_Broken_Or_Risky_Cryptographic_Algorithm - Cryptography

Unsafe_Object_Binding

Reflected_XSS_All_Clients

Overly_Permissive_Cross_Origin_Resource_Sharing_Policy

Open_Redirect

Insecure_Cookie

Information_Exposure_Through_an_Error_Message

Heap_Inspection

Hardcoded_Cryptographic_Key

Find_XSRF_Sanitize

Find_HttpOnlyCookies

Find_HSTS_Configuration_In_Code

Find_Encrypt

Base64 Encode/Decode queries refactor

Add SHA-3 Support

Input | TIFF Image

Support Module System (JPMS)

Update Use_Of_Obsolete_Functions Query

Update Exception-related queries to support java.lang.SecurityManager Methods

Update Exception-related queries to support constructor of MBeanOperationInfo

Update Exception-related Queries

Support Optional.orElseThrow() in Relevant Queries

Support Local-Variable Type Inference (var) - Research and Initial Setup

Support Local-Variable Type Inference (var) - Populate inferred types on parsing stage

Support Local-Variable Type Inference (var) - Collect symbols using new grammar

Support Local-Variable Type Inference (var)

Support checkMemberAccess method in Relevant Queries

Update Exception-related Queries

Update Direct_Use_of_Threads for Removal of Thread.destroy() and Thread.stop() Methods

Support Nest Based Access Control in Relevant Queries

Support Nest Based Access Control in Exposure_of_Resource_to_Wrong_Sphere

Support Local-Variable Syntax for Lambda Expressions

Support for the square character for the Japanese new era

Add URLClassLoader's constructor to Exception-related queries

Add ClassgetAnnotation method to Exception-related queries

Support Unicode 11

Support the Remove of finalize methods

Support Switch as Expressions

Support for Compact Number Formatting

Support Compact Number Formatting - Parse String to Number

Improper_Exception_Handling

Find_Commands_With_Exception

Uncaught_Exceptions

Use_of_Obsolete_Functions

Find_CORBA_Deprecated_Methods

Find_Java_Awt_Deprecated_Methods

Find_Java_IO_Deprecated_Methods

Find_Java_Lang_Deprecated_Methods

Find_Java_Net_Deprecated_Methods

Find_Java_Rmi_Deprecated_Methods

Find_Java_Security_Deprecated_Methods

Find_Java_Sql_Deprecated_Methods

Find_Java_Util_Deprecated_Methods

Find_Javax_Swing_Deprecated_Methods

Vue.component() - Support Context Object

Vue instance - Support Context Object

Update CxOutputs to CxEscapedOutputs

Transform Templates in ViewDecl and View Call Dom Objects

Support X-Templates

Support Vue.js Single-File Components

Support Vue Router API in Queries

Support directive

Support tag <template>

Support Regular Markups

Support Inline Templates

Support Html files

Support filters

Support Context Objects Flattener

Support Context Objects

Support context computed Directive

Support components Invocation

Support components declaration

Support Associative Array scoped This

Update CxOutputs to CxEscapedOutputs

Support X-Templates

Support Vue Router API in Queries

Vue_DOM_XSS

Update XSS sinks

OData response affect the custom controls renderers and their connections

Sap XML Views - ToUpper() and LastAttribute invocation

Parse Fiori XML template views

Connect Control View Attributes to set methods in Control

Catch hardcoded links from SAP domains in all files

Catch ABAP system information exposed in the comments

Assigning window.location to Open Redirect and XSS

Add XHR Response as an input for Fiori apps

Add Input for event handling inputs

Add connections between getView().byId("ControlName") and the respective associative array of the Control

Add connections between a setProperty of a property of a model and the respective getProperty

CSV_Injection query

Coroutines

When Expression (Capturing when subject in a variable)

Unsigned integers

Smartcasts

Find_Integers

Updated for Kotlin 1.3

Parsing improvements to deal with Ktor specific issues (kotlinx-html)

Improvements in type inference Handling of Ktor routing to template outputs through FrameworkFactory

Creation of five new queries and identification of inputs/outputs/sanitizers for relevant queries

Support of templates (Mustache.js and kotlinx-html)

Reflected_XSS

Stored_XSS

SQL Injection

Code Injection

Connection_String_Injection

GO version supported in CxSAST is 1.8

The language support was completely rewritten

Scan time improved by ~50%

TP rate is also high, but more details to come

Open_Redirect

Missing_HttpOnly_Cookie

Missing_Secure_Cookie

Path_Traversal

SQL_Injection

Find_Members_By_Import (deprecated)

COBOL support is based on the ANSI85 dialect

It was extended to also support IBM Enterprise COBOL for Z/OS up to version 6.2

MicroFocus and ILE COBOL have partial coverage only.

It supports three formats: Tandem, Variable and Fixed

Command_Injection

Module_Injection

Reflected_XSS_All_Clients

Resource_Injection

Sql_Injection

Ignored_Error_Conditions

Path_Traversal

Information_Leak_Through_Comments

Use_Of_Hardcoded_Passwords

Possible_Module_Injection

The full support of Angular was rewritten in 9.2

Several features of Angular up to version 9 were included.

Router Directive – the RouterLinkWithHRef attribute

Router Lifecycle events

Material UI - Select - (mat-select)

Router configs with Dynamic Imports

Angular Web Workers

Dependency Injection – the ProvidedIn mode

Find_MyBatis_DB_In;

Find_MyBatis_DB_Out;

Find_MyBatis_Params_Sanitized;

Find_MyBatis_Sanitize;

Find_MyBatis_DB (depreacted)

React Navigation - In React Navigation, there are several components that can be used to navigate inside the application

AsyncStorage - This is an asynchronous, decrypted, persistent, key-value storage system for React Native.

Missing Root Or Jailbreak Check

Insecure Text Entry

Clipboard Information Leakage

Insufficient Transport Layer Security

Unencrypted Sensitive Data Storage