★ wanayoo — archive 1999 https://github.com/security-code-scan/security-code-scan/releasesNouvelle recherche | Portail wanayoo
Skip to content

/ security-code-scan

Latest release
  • 3.5.3
  • 8b6740d
  • Verified
    This commit was created on GitHub.com and signed with a verified signature using GitHub’s key.
    GPG key ID: 4AEE18F83AFDEB23 Learn about signing commits
  • Compare
    Choose a tag to compare
    Search for a tag
3.5.3
Latest release
  • 3.5.3
  • 8b6740d
  • Compare
    Choose a tag to compare
    Search for a tag
  • Verified
    This commit was created on GitHub.com and signed with a verified signature using GitHub’s key.
    GPG key ID: 4AEE18F83AFDEB23 Learn about signing commits

@JarLob JarLob released this May 17, 2020 · 50 commits to master since this release

Release Notes

3.5.3

  • Removed EntityFramework "Interpolated" sinks that caused false positives.
  • Added configuration entry for Web Config analyzer to allow filtering file names.
Assets 6
  • 3.5.2
  • 27172ee
  • Verified
    This commit was created on GitHub.com and signed with a verified signature using GitHub’s key.
    GPG key ID: 4AEE18F83AFDEB23 Learn about signing commits
  • Compare
    Choose a tag to compare
    Search for a tag
3.5.2
  • 3.5.2
  • 27172ee
  • Compare
    Choose a tag to compare
    Search for a tag
  • Verified
    This commit was created on GitHub.com and signed with a verified signature using GitHub’s key.
    GPG key ID: 4AEE18F83AFDEB23 Learn about signing commits

@JarLob JarLob released this May 8, 2020 · 54 commits to master since this release

Release Notes

3.5.2

Bugfix release.

  • Fix MissingMethodException "Method not found: 'YamlDotNet.Serialization.IDeserializer YamlDotNet.Serialization.DeserializerBuilder.Build()'" if incompatible version of YamlDotNet is loaded by the process.
Assets 6
3.5.0

@JarLob JarLob released this Feb 27, 2020 · 69 commits to master since this release

Release Notes

3.5.0

  • Better taint analysis in implicit string conversions case.
  • Out of range exception fix.
  • New SQL injection and Path Traversal sinks.

Thanks @watfordgnf and @indy-singh for the contributions!

Assets 6
3.4.0

@JarLob JarLob released this Jan 3, 2020 · 82 commits to master since this release

Release Notes

3.4.0

  • XSS analyzer was rewritten. Additional sanitizers were added.
  • Added ReportAnalysisCompletion option to output a message that the analysis did run.
  • Bugfixes and improvements.
Assets 6
3.3.0

@JarLob JarLob released this Sep 13, 2019 · 109 commits to master since this release

Release Notes

3.3.0

  • Better C# 7 handling
  • CSRF analyzer configuration made more flexible.
    Configuration file schema version has changed to 2.0, so if you had custom config settings, you’ll need to adjust to the schema and bump your file name from config-2.0.yml to config-2.1.yml or change from Version: 2.0 to Version: 2.1 if it was added to a project.
  • Bug fixes.

Thanks @kevin-montrose for the contributions!

Assets 6
3.2.0

@JarLob JarLob released this Apr 20, 2019 · 143 commits to master since this release

Release Notes

3.2.0

Bugfix release.

  • Fixes using SCS as nuget. #117
  • One click code fixes were removed until a separate assembly is created. #71
Assets 6
3.1.0

@JarLob JarLob released this Apr 4, 2019 · 147 commits to master since this release

Release Notes

3.1.0

The release adds support for VS2019 and bug fixes. Also:

  • Adds multiple XSS sinks for WebForms (thanks Andrei!)
  • Changes in SCS configuration file doesn't require to restart Visual Studio anymore.
  • Warnings are suppressed for generated code.
  • Adds .NET Core cookie analyzer.
Assets 6
3.0.0

@JarLob JarLob released this Dec 3, 2018 · 167 commits to master since this release

Release Notes

3.0.0

This is a major release that introduces configurable taint sources, sanitizers and validators. Configuration file schema version has changed to 2.0, so if you had custom config settings, you'll need to adjust to the schema and bump your file name from config-1.0.yml to config-2.0.yml or change from Version: 1.0 to Version: 2.0 if it was added to a project.
With the introduction of taint sources and taint entry points warning are shown only for the tainted data. Unknowns are reported only in the Audit Mode.
Multiple improvements and fixes were done to Taint, Anti-CSRF token, XSS, SQL injection, Path traversal, XPath injection, Certificate validation analyzers.
New LDAP injection detection was added.
An issue was fixed that could surface as Session Terminated unexpectedly. Disabling 'Security Code Scan' might help prevent....

I would like to thank all contributors to this and previous releases. Also to everyone who has reported issues or feature requests.

Assets 6
  • 2.8.0
  • 15eb9af
  • Verified
    This commit was created on GitHub.com and signed with a verified signature using GitHub’s key.
    GPG key ID: 4AEE18F83AFDEB23 Learn about signing commits
  • Compare
    Choose a tag to compare
    Search for a tag
2.8.0
  • 2.8.0
  • 15eb9af
  • Compare
    Choose a tag to compare
    Search for a tag
  • Verified
    This commit was created on GitHub.com and signed with a verified signature using GitHub’s key.
    GPG key ID: 4AEE18F83AFDEB23 Learn about signing commits

@JarLob JarLob released this Jul 23, 2018 · 333 commits to master since this release

Release Notes

2.8.0

Important: This release targets full .NET framework and may not run on Unix machines. Although as tested it runs fine in microsoft/dotnet 2.1 docker container on Linux, still for Unix based Continuous Integration builds it is better to use SecurityCodeScan.VS2017 NuGet package, that targets netstandard.

Added external configuration files: per user account and per project. It allows you to customize settings from built-in configuration or add your specific Sinks and Behaviors. Global settings file location is %LocalAppData%\SecurityCodeScan\config-1.0.yml on Windows and $XDG_DATA_HOME/.local/share on Unix.
An example of user's config-1.0.yml with custom Anti CSRF token:

CsrfProtectionAttributes:
  -  HttpMethodsNameSpace: Microsoft.AspNetCore.Mvc
     AntiCsrfAttribute: MyNamespace.MyAntiCsrfAttribute

For project specific settings add SecurityCodeScan.config.yml into a project. Go to file properties and set the Build Action to AdditionalFiles:

image

An example of SecurityCodeScan.config.yml with custom sink function (method that shouldn't be called with untrusted data without first being sanitized):

Version: 1.0
Sinks:
  UniqueKey:
    Namespace: MyNamespace
    ClassName: Test
    Member: method
    Name: VulnerableFunctionName
    InjectableArguments: [0]
    Locale: SCS0001

Audit Mode setting (Off by default) was introduced for those interested in warnings with more false positives.

Assets 6
2.7.1

@JarLob JarLob released this May 22, 2018 · 354 commits to master since this release

Release Notes

2.7.1

Couple of issues related to VB.NET fixed:

  • VB.NET projects were not analyzed when using the analyzer from NuGet.
  • 'Could not load file or assembly 'Microsoft.CodeAnalysis.VisualBasic, Version=1.0.0.0...' when building C# .NET Core projects from command line with dotnet.exe
Assets 4
You can’t perform that action at this time.