Page Comparison

Fixed an issue that caused inconsistent behavior with the Download System Logs management in HA (high availability) environments. The issue occurred when using non-default log locations. 

Fixed an error which caused a REST API GET request for a non existent projectName and teamId to return a HTTP 200 OK Success response with an empty body, instead of a HTTP 404 - Not found response.

Fixed an error which caused REST API GET Projects requests to be case sensitive, causing API requests to fail. Now the API GET Projects requests are case insensitive.

Fixed a number of issues in Access Control that were related to User Creation.

Fixed the Result Viewer page so that all instances of a selected word are highlighted in the code.

Fixed the “Group By” option in the Results Viewer so that it works for all columns.

Fixed an issue in a particular incremental scan which caused a failure in the Results Service (indicated by a ResultsSavingStatus error in the log) preventing the completion of the scan.

Fixed an issue that caused the scanning to fail and the client-log.log to record the following error message: "System.ArgumentException: An item with the same key has already been added." 

Fixed an issue so that now a Docker image can be deployed on Linux without root privileges.

Added an option for changing the time zone in the Docker image on Linux.

The default AWS Docker ulimits value has been increased to allow the CxSAST engine to work properly.

The nullish coalescing operator (??) is now supported when scanning JavaScript.

The XML report has been enhanced with additional information regarding the ‘Queries Details’ and ‘Source Code’.

Queries Details now contains:

• Risk: What might happen?
• Cause: How does it happen?
• General Recommendations: How to avoid it?
• Source Code Examples.

Source Code now contains:

• Num of LOCs (number of lines of code): Before and after the vulnerable line.
• Method Scope: Brings the entire method of the vulnerable line.
• File: Brings the entire file that has the vulnerable line.

For these new features, configuration keys were added to the CxComponentConfiguration table in the CxSAST database.

• To activate the Queries Details feature, set the AddQueryMetaDataToXmlReport configuration key to “true”. 
• To activate the Source Code feature, set the XmlReportSourceLinesRange configuration key to a number larger than 0.

Fixed an issue which prevented the name of the plugin, which triggered the scan, from being displayed in the ORIGIN column on the Scans page.

Fixed an error which prevented the results of full and incremental scans from merging together.

Fixed an issue which prevented downloading logs from the WebPortal, where the location of the logs were changed from their default log location.

Fixed an issue where team-level query overrides are sometimes saved under incorrect teams.

Fixed an issue which prevented the Post Scan Action from creating reports when the system was configured for LDAP environments.

Fixed an issue which occurred when scanning zip files containing more than 65535 files.

Fixed an issue that occurred when scanning C# files, which involved the GetHoldByText method call, that prevented the scan flow and definition from being located and displayed.

Fixed an issue which resulted in the loss of the entire scan because of a single file timeout.

Fixed an issue that occurred when scanning JavaScript files, which caused the parsing process to time out, leading to the loss of many scan results.

Fixed an exception in the logs caused by a System.FormatException in the AST2DOM stage.

Users moving to cloud hosted environments, without direct access to the CxSAST database, can now obtain information about project branching and deletion using CxSAST REST API calls.

The following additions are related to project branches:

• The IS_BRANCHED attribute, for indicating if the project was branched from another project (the source/original project).
• The ORIGINAL_PROJECT_ID attribute, with information about the source/original project. If IS_BRANCHED = False, the value for ORIGINAL_PROJECT_ID is NULL.
• The BRANCHED_ON_SCAN_ID attribute, with information about the scan ID of the source project. If IS_BRANCHED = False, the value for BRANCHED_ON_SCAN_ID is NULL.
• A list of related target projects, if the source/original project is the source of multiple branched projects.

The following additions are related to deleted projects:

• The isDeprecated attribute enables the CxSAST REST API to retrieve deleted projects.
• In the response body, the new "isDeprecated" field indicates if the project is deleted or not, where True means it is deleted and False means it is still active.

Fixed an issue in the LDAP Settings section of Access Control that prevented users from scrolling through the "Cx Role - LDAP Group DN" mapping entries list in the Advanced Role Mapping window.

To enable users to add single LDAP role mappings to existing sets of LDAP role mappings, a PATCH method was added to the LDAPRoleMappings Access Control REST API.

Fixed a comma-separated string issue that affected the Okta SAML (Security Assertion Markup Language) integration with Access Control. The issue prevented the IdP (Identity Providers) Authorization and Team Attribute Mapping feature from assigning users to multiple teams. Now it is possible to specify multiple teams names, using comma separators, so that new users are automatically associated with multiple teams.

Fixed an issue that occurred when parsing PHP language code. Text with HTML tags containing single quote marks prevented the retrieval of the DOM (Document Object Model), which in turn caused the scan to fail.

Fixed an issue that caused some characters, which were typed by users into the scan comments, to be replaced by HTML encoded characters. In some cases, the HTML characters caused the Results Viewer page to lock.

Fixed an issue in the Results Viewer which prevented the total number of active results from being immediately updated after some results are marked as "Not Exploitable".

Fixed an issue that caused a discrepancy between the CxEngine logs and the user interface (UI) status. The logs indicated that the scanning was completed, but the UI status indicated that the scanning was still in progress. The result was that the CxManager aborted the scan and the scan results were not saved.

Scan results can be marked to indicate one of the following result states: “To Verify”, “Not Exploitable”, “Confirmed”, “Urgent” or “Proposed Not Exploitable”. In addition, custom result states can also be defined by the user. Previously, users only required permissions for marking scans as "Not Exploitable".  Now dedicated permissions are requested for each result state, including the user-defined states.

For more information, see the updated Results Summary section in Navigating Scan Results (v9.3.0 and up), and the updated descriptions for the Results Updater and Results Verifier roles in CxSAST / CxOSA Roles and Permissions (v9.0.0 and up).

For details regarding how to create custom result states, see Adding Custom Result States.

Limitations:

• This feature does not apply to OSA vulnerabilities. The behavior for OSA remains the same as before installing this Hotfix.
• If the 'Manage Result State And Assignee' permission was checked before installing this Hotfix, after the Hotfix installation the result states permissions of the new roles will not be checked. 
• OSA restricted scans cannot be performed. 

• A new configuration key (AllowChangeExecutablesFolder) has been added to the CxSAST database that determines whether or not the destination folder can be changed. The configuration key can only be accessed by the CxSAST administrator
• Security fix, click this link for additional information.

Fixed the displayed scan result state in OData to be aligned with the Web Portal UI.

Triggering a new scan from the plugins will no longer require “create  project” or “edit project” permissions.

Improved Engine stability when dealing with large scans.

Fixed an issue where some URL’s have been overwritten during upgrades.

Fixed a problem related to the scan request.

Improved data synchronization in High Availability (HA) mode.

Tomcat was replaced with Apache Tomcat version 8.5.64.

Some fixes in this Hotfix require CP16 (9.3). For more information, see Content Pack Version - CP.9.3.0.16034 (CSharp, VBNet).

Improved C# queries by fixing flows that did not go through a method declaration.

Several improvements in C# queries for better result accuracy.

Added a definition to the ESC function in Java.

Improvements in JavaScript parsing support.

Improvements in TypeScript parsing support.

Fixed the Japanese translation for "Not Exploitable" and "Propose not exploitable" result states.

Allow customers that use SCA to enable an SCA widget to replace the content of the existing OSA widget, so that it is now possible to display CxSCA scan results in the summary page of CxSAST. For more information, see Displaying CxSCA Scan Results in CxSAST.