| Authentication
|
Third-party authentication mechanisms such as LDAP can be
applied to a CodeSonar hub. |
| Access Control |
The hub Administrator can restrict access to the information
stored on the hub on a per-user basis. Full Role Based Access
Control (RBAC) will be available in CodeSonar 4.2. |
| Configuration Tool |
CodeSonar now provides a command line tool for performing
configuration tasks such as setting up a hub or obtaining a
signed license. For details, see The CodeSonar Configuration
Tool. |
| Distributed Analysis |
For all parallel CodeSonar analyses, the analysis master can
accept any manually-started analysis slave process, regardless of
the process location or owner, provided that the slave process
has access to the address on which the analysis master is
listening (and that the other conditions for accepting a
manually-started slave process are met). In this sense, all
parallel analyses can be distributed across multiple machines if
the listening address for the analysis master permits it. For
details, see Distributed
Analysis. |
| Warning Classes
|
A large number of new warning classes, many of them in
support of the MISRA
C:2012 and MISRA C:2004 guidelines.
Warning class category information is now available in CSV files.
See the Warning Categories
page for details
and links. |
| Warning Clustering
|
New notions of warning
cluster and cluster
representative. |
| Browse Sequences |
Where possible, the CodeSonar GUI will provide warning
browse sequences A warning browse sequence facilitates
stepping through Warning Reports for the warnings in a
recently-viewed table without needing to navigate back and forth
to the table. Similarly, the GUI will provide file browse
sequences that facilitate stepping through Source Listings.
For full details, see Warning and File Browse
Sequences. |
| Automatic Warning
Assignment
|
When automatic assignment is enabled and a user makes changes
to a warning that has never previously been modified, that user
will be made the Owner of the warning unless their modifications
include setting an Owner. |
| Configuration Presets |
Configuration
presets are named combinations of configuration parameter
settings that can be applied directly in the CodeSonar
build/analysis command. CodeSonar ships with a number of
ready-to-use presets. |
| Taint Path Checking
|
The propagation of taint to a specified value along a
specified path can be examined in the CodeSonar GUI. |
| GUI Changes
|
Several new GUI page types, and new functionality on a number
of existing pages. |
| New Build/Analysis Flags |
-clean, -preset, -conf-file |
| Java Build/Analysis |
Options -sourcepath and -auxclasspath can now be specified
more than once. |
| Path Normalization |
CodeSonar now also stores stores a normalized file path for
files; searches that involves file and directory paths are now
carried out with respect to the normalized forms. Unnormalized
paths no longer undergo specific downcasing on Windows (although
they may be downcased by Windows tools). There are new API functions to retrieve normalized
forms. |
| codesonar
relocate
|
If you have analyzed a project and then moved the analysis
files, run codesonar relocate to inform the hub of
their new location. Task: Relocate Analysis
Files provides a detailed usage example. |
| Score
|
Score is a new property of a warning
instance. |
| Significance
|
Significance is a new property of a warning
class. |
| Metrics
|
There are a number of new built-in metrics. |
| Configuration Parameters
|
There are a number of new and modified configuration
parameters; two parameters have been removed. |
| API Changes
|
Changes to Extension API, Plug-In API, General
Purpose API. |
| AST Changes
|
There are new and modified AST classes. |
| Eclipse Plug-In Changes |
The Warnings
tab has new Score and Significance columns, and no longer has
a Rank column. |
| GUI Internationalization |
A selector in the standard GUI header allows users to select
the (human) language in which warning report
annotations are rendered. GUI links to warning class
documentation will navigate to documentation in the
appropriate language (where available).
There are currently two available languages: English (en) and
Japanese (ja). The default
language selection is specified by the Administrator. |
| New OSes Supported |
We have added CodeSonar support for two operating systems:
- NetBSD 6.1.4 (x86-64 only; 64-bit build tools only)
- FreeBSD 10.0 (x86-64 only; 64-bit build tools only. See
note on FreeBSD
/ make.)
|
| CWE Version |
This version of CodeSonar uses CWE version 2.8, published
July 31, 2014. |
| Other Improvements |
- Reduced false negatives in the taint analysis (but taint
analysis is now more expensive).
- taint tracking in the GUI
- Many bug fixes and result quality improvements.
- Updated versions of many third-party modules.
- Some performance improvements for the parsing phase.
- Many compiler models are now implemented in C++ instead
of Scheme.
(Support for user-authored C++ compiler models will be added
in a future release.)
- Visualization data is no longer eagerly copied to the hub
when performing analyses, but instead is pulled from the
analysis machine on demand. This dramatically reduces the
workload on the hub end, and can therefore reduce analysis
time significantly in some cases.
- Support for opening ports in the Windows firewall during
installation.
- Increased tolerance for network connection problems
between the hub and the license server (only applicable for
floating licenses).
- Improved clang compatibility.
- If the user's build system fails (and exits with
non-zero), the analysis state will now be "Native Build
Failed" instead of "Parsing Over"
(command-line build/analysis only).
- Potential mixups when using multiple hubs can now be
detected more explicitly
- Attempts to use the empty string as a project name will
now result in a sensible error message
|
| Future Warning |
In a future CodeSonar version, the C API will change from
providing functions that operate on compilation unit based
positions to providing functions that operate on file based
positions. In particular, functions that take or return cs_uid/cs_unitline/cs_offset will be replaced
with versions taking or returning cs_sfid/cs_line/cs_file_offset, or removed if no longer
necessary. The corresponding changes will be made in the APIs provided for other
languages. If you are writing new plug-ins based on location
information, structure your code to make it easy to replace any
calls to such functions. There will be no release in which both
kinds of function are supported. |
If your organization already has infrastructure for authenticating
users, you can use a hub authentication plug-in to configure
the CodeSonar hub to use the same infrastructure for hub
authentication. The new GUI Authentication Services and
Edit Authentication
Service pages provide functionality for viewing, modifying,
adding, and removing authentication services.
See Authentication and User Accounts: Access Control for full
details.
The Administrator can set access controls for ordinary users with
respect to several kinds of information:
Full Role Based Access Control (RBAC) will be available in
CodeSonar 4.2.
There are a number of GUI changes in this version of
CodeSonar.
| Account Editor
|
New access control functionality.
|
| Admin Settings
|
Changes to several tabs.
- Hub Settings.
- New settings: Default Language, Allow users to change
email by default, Allow users to change password by
default, Allow Anonymous Browsing?, Use Visibility
Settings to Enforce Access Control.
- Modified
setting: the setting previously called "Server
Logs and SQL Console Accessible To" is now called
Command URLs and SQL Accessible To and covers additional
URLs and SQL functionality.
- Other Links: new options Backup Database, Authentication Services,
Bulk Add Users,
Analysis
Cloud.
|
| Advanced Search
|
Changes to Warnings
tab:
- New Fields: Score, Significance.
- Format Changes:
- Owner and Class Name fields are now checklists.
- Class Name, Class Name Contains, Categories, and
Significance are grouped in a new "Class"
section.
- Removed Field: Rank.
|
| Analysis: Procedures
|
Additional available table columns: File Path, Directory,
Line Number, Language. |
| Analysis:
Warnings
|
Additional available table columns: Score (including
score
coloring), Cluster,
Significance,
Line
Content. |
| Analysis
Search Results
|
Additional available table column: Linking
Started.
The availability of 'overwrite' functionality for saving
a search is now managed by the new access control mechanism. |
| Code Search
Results
|
The availability of 'overwrite' functionality for
saving a search is now managed by the new access control mechanism. |
| Explore Callers
|
Two additional page modes are
now available, supporting the new taint
path checking functionality.
- Taint mode offers taint propagation checking.
- Taint+Warning mode offers taint propagation
checking in warning context.
The URL scheme for this page type has changed: all URLs now
begin with /contexts/explore/explore/[...]
We previously documented Explore Callers (Warning) and
Explore Callers (Source) on separate GUI reference pages; they
are considered to be two modes (Warning,
Ordinary) of the "Explore Callers" page type
and are documented as such.
|
| File Search
Results
|
The availability of 'overwrite' functionality for
saving a search is now managed by the new access control mechanism.
New table columns: Analysis Name
, Analysis
ID, Analysis
Description, Project, Project
Description |
| Home
|
Additional available table column: Linking
Started. |
| Manage Saved
Searches
|
The availability of deletion functionality is now managed by
the new access control
mechanism. |
| Metric Report
|
Additional available columns for procedure-granularity
tables: File Path, Directory, Line Number, Language.
The availability of 'overwrite' functionality for saving
a search is now managed by the new access control mechanism. |
| Procedure
Search Results
|
Additional available table columns: File Path, Directory,
Line Number, Language.
The availability of 'overwrite' functionality for saving
a search is now managed by the new access control mechanism. |
| Project
|
Additional available table column: Linking
Started. |
| Project
Search Results
|
Additional available table column: Linking
Started.
The availability of 'overwrite' functionality for saving
a search is now managed by the new access control mechanism. |
| Search Callers
|
Two additional page modes are
now available, supporting the new taint
path checking functionality.
- Taint mode offers taint propagation checking.
- Taint+Warning mode offers taint propagation
checking in warning context.
The URL scheme for this page type has changed: all URLs now
begin with /contexts/explore/search/[...]
|
| Sign In
|
Because email addresses are no longer required to be unique,
they cannot be provided for identification at sign-in: a username
is required.
The availability of "Forgot Password" functionality is
now managed by the new access
control mechanism. |
| Source Listing
|
Clicking a line number no longer offers navigation to the
Explore Callers
page: all path exploration options are offered through the
information
window.
Automated scrolling to function definitions has been
de-animated. |
| User Settings
|
The availability of functionality for changing password and
email is now managed by the new access
control mechanism. |
| Visualization Tool |
Several changes.
- Two additional visualization modes are now available,
supporting the new taint path checking
functionality.
- Taint mode offers taint propagation
checking.
- Taint+Warning mode offers taint propagation
checking in warning context.
- The "Warning Path" panel has been renamed to
Check Paths.
- Directory-granularity metrics are
now available. Their values are displayed in the Info Panel
when a directory node is selected, and each is available for
metric visualization in the Display Panel.
- The metric display settings have been simplified: users
are no longer required to specify how values should be mapped
into the selected color space.
|
| Warning Report
|
Automated scrolling to the warning location has been
de-animated. |
| Warning
Search Results
|
Additional available table columns: Score (including
score
coloring), Cluster,
Significance,
Line
Content.
The availability of 'overwrite' functionality for saving
a search is now managed by the new access control mechanism. |
| Feature |
Changes |
| Charting
|
The set of colors used for charts has been changed to improve
the degree of contrast between adjacent chart elements. |
| Information
Window
|
A number of changes.
- Forward
and back buttons are now available.
- The "def" tab has been renamed to
"code".
- For tainted values, the "info" tab now contains
a message noting the presence of taint and links to several
mechanisms for exploring its origin.
|
| Source Interaction
|
A number of changes.
- Changes to the pop-up menu
on identifiers.
- Taint-related functionality is no longer included in
this menu. Instead, it is in the information
window.
- By default, the "Go to
definition" item will display the definition in
the information window. Click the
 icon next to the item to
instead display the definition in the current browser
tab, or  to display it in a new
tab.
|
| Saving Searches |
The availability of 'overwrite' functionality is now
managed by the new access control
mechanism. |
| Search Languages
|
All search languages: The sql
field-name is only available if Command URLs and SQL Accessible
To is set to Anyone.
Warning
search language:
- New field-names score,
significance, cluster, clustered, line_content, line_content_xml, new_warning.
- The interpretation of rank-based terms has been amended to
provide more intuitive results. (The same interpretation is
used for the new score
field-name.) For details, see Warning
Search Language: rank and score terms.
|
| Tables
|
Standard browser functionality can be used to open the new GUI
page in a new tab or window. If a link is opened with
Ctrl-click or Shift-click, the corresponding table row will be
highlighted until another table row is clicked.
A marker will be displayed in a table column heading if the
rows are currently sorted by that column:  (descending) or
 (ascending).
The sub-menu for adding new columns is now labeled
Show (previously it was
"More Columns"). There is a new All item in this menu: select it to show
all table columns. For warning tables there is also a new
Notes item in this sub-menu,
replacing the Show Notes/Hide
Notes item that was previously present in the top-level
menu.
|
| Visibility Filters
|
The Administrator can use the new access control mechanism to specify that
ordinary users cannot change their visibility settings. |
Consequences are as follows.
The CWE mapping assignments for some warning classes have changed,
as shown in the following table.
There are also some new file-granularity metrics.
The following classes have one or more new fields.
The following classes have one or more new fields.
The following enums have one or more changes.
| 2231 |
Bug reports may be hard to read if colorblind |
fixed |
| 8659 |
IGNORED_COMPILATIONS -> Boost regex |
IGNORED_COMPILATIONS now takes a Boost regular
expression |
| 8885 |
Mark "last clicked" warning in table |
If a link is opened with Ctrl-click
or Shift-click, the corresponding table
row will be highlighted until another table row is clicked. |
| 9224 |
License errors after refreshing license on hub |
fixed |
| 9987 |
False Positive: #if without #endif if matching #if directive
is preceded with tab character |
fixed |
| 10318 |
False Positive: buffer overrun with use of
dynamic_cast<Derived*>(pBase) |
fixed |
| 10452 |
clarification needed: OSX with case sensitive HFS+ formatted
partition |
See note on working around a case-sensitive OS X file
system. |
| 10670 |
visual cue for table sort order |
A marker will be displayed in a table column heading if the
rows are currently sorted by that column: (descending) or
(ascending). |
| 10762 |
Java: Bad Error Message on usage "cs-java-scan X -
sourcepath Y" |
fixed |
| 10785 |
Japanese warning class documentation: automatically display
depending on environment |
fixed |
| 10859 |
False Negative: Specific Buffer Overrun |
fixed |
| 11959 |
ascii codec can't decode byte 0x8b in position 0: ordinal
not in range |
fixed |
| 11977 |
Explain how to write assertions for the analysis |
See new manual section CodeSonar and assert(). |
| 12183 |
Add Eclipse functionality to specify project name |
fixed |
| 12254 |
Some datarace warnings not detected with MP analysis |
fixed |
| 12917 |
Update cl compiler model to handle /FU flag (CLI mode) |
fixed |
| 13624 |
FORCE_ENVIRONMENT = Yes causes android build to fail |
fixed |