CodeSonar Release 4.5, patchlevel 1: Release Notes

• Notes on Upgrading
• What's New
• Details
• Customer Tickets Fixed

Notes on Upgrading

When you upgrade your hub, you will be prompted to set the password for the special Administrator hub user account when the hub restarts. This will replace the previous Administrator password. You can reuse your previous Administrator password if it meets the hub password requirements specified in the Settings: Password Policy tab.

What's New

Details

IPv6 Support

CodeSonar now supports IPv6. If you are running CodeSonar on a system that supports IPv6 addressing, the following changes apply.

• CodeSonar commands that include a hub location can now specify the host as an IPv6 address.
• The analysis search language accepts IPv6 addresses in address terms.
• The CodeSonar configuration tool will use IPv6 addresses to identify hub hosts, for example in the table of known hubs.
• Command output will use IPv6 addresses to describe interfaces for hub and database operations.

Examples in this manual have been updated to include IPv6 addresses.

GUI

There is one new page type, and a number of existing page types have been modified.

New GUI Page Type

There is one new page type: Python Console. In consequence:

• The Analysis page now has an API Console item, replacing the previous Scheme Console item.
• The SCHEME_WEB_CONSOLE configuration option has been replaced by a new WEB_CONSOLE option.

GUI Changes

There are several GUI changes for additional functionality.

Floating Point Handling

There are significant improvements in CodeSonar's handling of floating point arithmetic and a number of new library models for floating point operations. In consequence:

• False negatives on paths that depend on floating point arithmetic are reduced.
• There are two new floating-point-related warning classes: Float Division by Zero and sqrt on Negative Value.
• There is a new extension API function csonar_trigger_f().
• Configuration parameter PRETEND_FLOAT_IS_INT is no longer necessary and has been removed.

Distributed Analysis

Control over aspects of a distributed analysis is now finer-grained: the analysis process is controlled by separate sets of configuration parameters in analysis mode vs daemon mode; similarly analysis-mode slaves are controlled by a different set of configuration parameters to daemon-mode slaves.

The analysis may be remote-requesting in analysis mode, daemon mode, both, or neither.

Relevant configuration parameter changes are as follows.

Compiler Models

There are several changes to CodeSonar compiler models.

• It is now possible to author compiler models in Python.
• There are three new compiler models:
  • Keil C51
  • Renesas ccrx
  • TASKING TriCore, PCP, and C166/ST10 compilers
• STk compiler models are no longer supported. If you have previously implemented a custom STk compiler model and need assistance converting it to C++ or Python, contact CodeSecure.

Warning Classes

There are a number of changes to CodeSonar warning classes.

• Several new warning classes.
• Classes now have category mappings for ISO/IEC TS 17961 "C Secure Coding Rules Technical Specification" where appropriate.
• Changes to default enabling for Java warning classes.
• Changes to the DISA STIG category marking format.

New warning classes

Many of these have a focus on security holes that can be introduced - maliciously or mistakenly - by an insider. These 'insider threat checks' can be enabled with the new insider and insider_more presets.

Others arise out of improved handling for floating point arithmetic and modeling for floating point library functions.

New category type: TS17961

CodeSonar now contains mappings for ISO/IEC TS 17961 "C Secure Coding Rules Technical Specification".

• The close mapping is shown on page ISO/IEC TS 17961 Checks.
• The broad mapping is shown on page Broad Mapping: ISO/IEC TS 17961.
• The ts17961 preset enables all non-DIAG.* warning classes with at least one mapping to a ISO/IEC TS 17961 rule.

Changes to default enabling for Java warning classes

Previously, all Java warning classes associated with a particular third party Java tool were enabled once that tool was enabled (JAVA_ENABLE_FINDBUGS=Yes, JAVA_ENABLE_PMD=Yes, JAVA_ENABLE_THREADSAFE=Yes).

From this version of CodeSonar, Java warning classes with "Style" significance are disabled by default. They can be enabled by applying the java_style preset to the CodeSonar build/analysis, or selectively enabled with WARNING_FILTER allow rules. As always, classes that are enabled by default can be disabled with WARNING_FILTER discard rules

See Java Warning Classes for full lists of default-enabled and default-disabled warning classes for each tool.

Changes to DISA STIG category marking

"Finding ID" identifiers do not persist across versions of the Defense Information Systems Agency (DISA) Application Security and Development Security Technical Implementation Guide (STIG), so we have adjusted the DISA STIG category types to specify version and release.

There is a now a separate category type for each DISA STIG version/release for which CodeSonar has mappings (previously there was only one category type: DISA) . DISA STIG categories have the form DISA-ver:id, where id is a Finding ID from the STIG and ver indicates the STIG version. As of this release there are two possible values for ver, giving two category types:

• The disa preset enables all non-DIAG.* warning classes with at least one mapping to any DISA STIG version.
• New presets disa_latest, disa_4r3, disa_3r10 have been introduced to provide a finer degree of control.
• If you have saved searches or WARNING_FILTER rules that include conditions intended to identify DISA STIG-related warning classes, you may need to adjust them.
  • A condition based on string "DISA:" will no longer match anything. Change to "DISA-" if you want to match any DISA version/release, or the precise category type (for example, "DISA-4r3:") if you only want to match one of them.
  • A condition based on string "DISA" will match DISA STIG categories from all releases/versions for which CodeSonar has mappings. If you want to match to only one of these, use the precise category type (for example, "DISA-4r3:").
  • A condition based on an old-style category such as "DISA:V-16808" will no longer match anything. Update to the new format: in this case, "DISA-3r10:V-16808".

Configuration Parameters

There are new, modified, and deleted configuration parameters.

New Configuration Parameters

Modified Configuration Parameters

Deleted Configuration Parameters

API Changes

There are substantial changes to the CodeSonar API.

• The C++ and Python implementations of the CodeSonar API are now out of beta.
• There are several new API functions and types.
• There are many modified API functions and types. These include extensions to types used for cross-referencing ("xref").
• There are changes to the set of C header files. There are some new headers, and some types and functions have moved from one header to another.
  There has also been some reorganization of C++ API headers. We recommend always including the entire C++ API with #include "csonar_api.hpp", in which case reorganizations will not require any action on your part.
• There are several deleted API functions and types, falling into two groups.
  • Deleted functions and types related to the removal of "compilation unit line" and "compilation unit offset" as mechanisms for identifying code locations.
  • Deletions related to extensions to types used for cross-referencing ("xref").
• Documentation longer distinguishes between "Plug-In API" and "General Purpose API".

C++ and Python APIs are out of beta

The C++ and Python implementations of the CodeSonar API are now out of beta.

• Full documentation is included in this manual: C++, Python.
• The Plug-In Tutorial and AST Tutorial now have additional C++ and Python variants.

New API Functions and Types

There are several new API functions and types.

Modified API functions and types

There are many modified API functions and types.

Cross-referencing Type Changes

Cross-referencing "kind", "role", and "kind-role" types have been expanded to allow finer discrimination.

Notes:

• For general information about the CodeSonar cross-referencing infrastructure, see Name Cross-References.
• Cross referencing types are represented in the various API implementations as follows.

  API Implementation	Representation	Kind	Role	Kind-Role
  C++	static member of class...	xr_kind	xr_role	xr_kind_role
  Python	attribute of class...	xr_kind	xr_role	xr_kind_role
  C	enum symbol in...	__cs_xr_kind	__cs_xr_role	__cs_xr_kind_role
  Scheme	symbol in set returned by...	xref-kinds	xref-roles	xref-kind-roles

C Header File Changes

There are several new C API headers, as shown in the following table.

Several C API headers have been split with some of their previous content going to new headers

Deleted API Functions and Types

The following API elements have been deleted. These deletions fall into two categories.

• Deletions related to the removal of "compilation unit line" and "compilation unit offset" as mechanisms for identifying code locations. Line numbers and offsets are now always with respect to source file instances.
  For functions that performed operations other than conversion between different code location units, we have provided links to the functions that provide the same operations with respect to source file instances.
• Deletions related to extensions to types used for cross-referencing ("xref").

ASTs

There are many changes related to C/C++ ASTs.

• Two new AST classes (one normalized, one unnormalized).
• A large number of modifications to normalized and unnormalized C/C++ AST classes.
• Several additions and deletions in the sets of C/C++ AST ordinals.
• Several changes to C/C++ AST helper enumerations.

New C/C++ AST Classes

There is one new unnormalized C/C++ AST class and one new normalized C/C++ AST class.

• New unnormalized C/C++ AST class: cc:attribute-arg-expression
• New normalized C/C++ AST class: c:unavailable

Modified C/C++ AST Classes

C/C++ AST Ordinal Changes

C/C++ AST Helper Enumeration Changes

Customer Tickets Fixed

codesonar: Analysis initialized.
codesonar: Live progress and results are visible at:
codesonar: apage_url