CodeSonar Release 6.1, patchlevel 0: Release Notes

• Notes on Upgrading
• What's New
• Customer Tickets Fixed

Notes on Upgrading

The database upgrades for CodeSonar 6.1 are significant.

• Upgrading a large database may take several days.
• If your hub uses a character encoding other than ASCII or UTF-8, we strongly recommend that you back up your hub before upgrading.

If you have made changes to any of your CodeSonar configuration files, you will need to upgrade those files as part of the upgrade process.

• See Upgrading Configuration Files for instructions.
• For some configuration files, the procedure includes steps that must be carried out before CodeSonar is upgraded.
• If you are upgrading a CodeSonar installation that will be used by someone else:
  • Determine the most appropriate person to upgrade the general template and compiler template configuration files.
    This will depend on local factors such as who usually makes changes to these files.
  • Notify the other user that they will need to upgrade their general project and project-compiler configuration files for all projects.

Previous versions of some CodeSonar integrations are incompatible with this release of CodeSonar. You will need to upgrade the following integrations to use them with this release of CodeSonar.

• The CodeSonar Jira Server Integration versions 2.04 and earlier are incompatible with this release of CodeSonar. A subsequent version of the plug-in will be compatible with this version of CodeSonar.
• The CodeSonar / GitLab integration versions 1.1 and earlier are incompatible with this release of CodeSonar. A subsequent version of the plug-in will be compatible with this version of CodeSonar.

What's New

Details

C# Analysis [64-bit Windows only]

The CodeSonar C# analysis has been restored in this release, but differs in several important respects from the C# analysis available in versions 5.4 and earlier.

• The C# analyses previously performed by "Standalone CodeSonar" (previously Julia) are now fully integrated into CodeSonar and there is no longer a separate tool. All build and analysis for C# code is now invoked directly through CodeSonar.
• The cs-dotnet-scan command syntax and options have changed. See the Build and Analysis for C# Projects page for full details, including a number of example command lines.
• There are many new warning classes for C# .
• Many of the changes to configuration parameters in this release are directly related to the changes in the C# analysis.
• The direct integration for FxCop has been removed. FxCop is no longer invoked by the C# build/analysis.

Note: While the C# build and analysis can be performed on 64-bit Windows machines only, analysis results can be submitted to a hub running on any platform.

Python 3

All uses of Python in CodeSonar have been upgraded to Python 3. In particular:

• The hub now uses Python 3.
  • Upgrading your hub to CodeSonar 6.1p0 will generally take longer than it has for other version upgrades. Large hubs may take several days.
  • Hubs will more readily accommodate non-English character sets.
  • Management report metavariable syntax has changed for some metavariables.
• The Python executable shipped as $CSONAR/codesonar/bin/cspython is now a Python 3 executable.
• Example Python scripts for the various scripting tasks have been upgraded to Python 3: use Python 3 to run example scripts (either your own copy or the $CSONAR/codesonar/bin/cspython executable.
• The CodeSonar Python API has been upgraded to Python 3. See API: Modified, below, for more information.

Warning Classes

There are many changes to the set of warning classes.

New C/C++ Warning Classes

New Java Warning Classes

Modified Java Warning Classes

• The class formerly named "== Always Fails (Java)" has been renamed to Impossible reference comparison (Java). Its mnemonic is still JAVA.REDUNDANT.EQF.
• The following classes are now disabled by default.
  • Unsafe Base64 Encoding (Java) (now requires JAVA_ANALYSIS_PEDANTIC_MODE=Yes)
  • clone Subclass of Non-clonable (Java) (now requires JAVA_ANALYSIS_STRICT_MODE=Yes)
• Several of the new configuration parameters in CodeSonar 6.1p0 control checking behavior for one or more Java warning classes. See the configuration parameter documentation for details.
  • JAVA_ANALYSIS_CONCURRENCY_CALLS
  • JAVA_ANALYSIS_CONCURRENCY_GUARDS_MODE
  • JAVA_ANALYSIS_DEEP_NULLNESS_CONSERVATIVE_CHECK
  • JAVA_ANALYSIS_FAST_DEEP_CHECK
  • JAVA_ANALYSIS_FIELD_SENSITIVE
  • JAVA_ANALYSIS_FIELD_VISIBILITY
  • JAVA_ANALYSIS_INITIALIZATION_CHECK
  • JAVA_ANALYSIS_MERGE_CREATION_POINTS
  • JAVA_ANALYSIS_PEDANTIC_MODE
  • JAVA_ANALYSIS_REQUIRE_ANDROID_MANIFEST
  • JAVA_ANALYSIS_STRICT_MODE
  • JAVA_ANALYSIS_TRUST_DATABASE
  • JAVA_ANALYSIS_TRUST_DEVICE
  • JAVA_ANALYSIS_TRUST_ENVIRONMENT
  • JAVA_ANALYSIS_TRUST_EXTERNAL_STREAMS
  • JAVA_ANALYSIS_TRUST_USER_INPUT

New C# Warning Classes

There are many new C# warning classes, representing full integration of the Julia tool into CodeSonar.

• The classes have been given new names and mnemonics as part of the integration.
  • Mnemonics for all C# warning classes are of the form CSHARP.*.
  • Names for all C# warning classes end with "(C#)".
• In several cases, multiple Julia 'warnings' have been combined into a single CodeSonar warning class.
  The following table shows the previous Julia checker and warning names corresponding to each warning class.
• Where Julia warnings that were issued by both BasicInjection and Injection checkers have been combined into a single CodeSonar warning class, the degree of checking performed is controlled by new configuration parameter CSHARP_ANALYSIS_ADVANCED_INJECTION.

Configuration Parameters

There are several new configuration parameters, and one modified configuration parameter.

New Configuration Parameters

Modified Configuration Parameter

Configuration Presets

There are several new configuration presets.

The new presets are as follows.

EDG Upgrade

CodeSonar now uses EDG version 6.2, released February 10, 2021.

There are new front end options available:

• --cs_alignas, --cs_no_alignas
• --cs_char_t_keywords, --cs_no_char_t_keywords
• --cs_constexpr, --cs_no_constexpr
• --cs_no_declspec
• --cs_decltype, --cs_no_decltype
• --cs_noexcept, --cs_no_noexcept
• --cs_no_relaxed_constexpr
• --cs_no_static_assert
• --thread_local_storage, --no_thread_local_storage

Management Reports

• New predefined management report templates
• Template metavariable syntax change

New predefined management report templates

There are several new predefined management report templates.

• AUTOSAR C++ 2014 Report. Analysis-scoped, contains charts and tables describing the analysis warnings whose classes are closely mapped to AUTOSAR AP 17-03 rules.
• CERT-C Report. Analysis-scoped, contains charts and tables describing the analysis warnings whose classes are closely mapped to rules and recommendations in the SEI CERT C Coding Standard.
• CERT-C++ Report. Analysis-scoped, contains charts and tables describing the analysis warnings whose classes are closely mapped to rules and recommendations in the SEI CERT C++ Coding Standard.
• CERT Java Report. Analysis-scoped, contains charts and tables describing the analysis warnings whose classes are closely mapped to rules and recommendations in the SEI CERT Oracle Coding Standard for Java.
• DISA v3r10 Report. Analysis-scoped, contains charts and tables describing the analysis warnings whose classes are closely mapped to 'findings' in the DISA Application Security and Development STIG version 3, release 10.
• DISA v4r3 Report. Analysis-scoped, contains charts and tables describing the analysis warnings whose classes are closely mapped to 'findings' in the DISA Application Security and Development STIG version 4, release 3.
• ISO IEC TA 17961 Report. Analysis-scoped, contains charts and tables describing the analysis warnings whose classes are closely mapped to one or more ISO/IEC TS 17961 rules ("C Secure Coding Rules Technical Specification").
• JPL Report. Analysis-scoped, contains charts and tables describing the analysis warnings whose classes are closely mapped to JPL rules.
• MISRA C 2004 Report. Analysis-scoped, contains charts and tables describing the analysis warnings whose classes are closely mapped to MISRA C:2004 rules.
• MISRA C 2012 Report. Analysis-scoped, contains charts and tables describing the analysis warnings whose classes are closely mapped to MISRA C:2012 rules.
• MISRA C++ 2008 Report. Analysis-scoped, contains charts and tables describing the analysis warnings whose classes are closely mapped to MISRA C++:2008rules.
• Power of 10 Report. Analysis-scoped, contains charts and tables describing the analysis warnings whose classes are closely mapped to "Power of Ten" rules.

Template metavariable syntax change

Management report metavariables F, S, T should now be specified with calling syntax: {{F()}}, {{S()}}, {{T()}} (previously {{F}}, {{S}}, {{T}}, respectively). Syntax for all other documented metavariables is unchanged.

The predefined templates shipped with CodeSonar have been updated accordingly. If you have existing custom management report templates with occurrences of {{F}}}, {{S}}, or {{T}}, we recommend updating them so that you retain the expected numbering behavior: the old forms of these references will now always return zero (0).

API Changes

API: Modified

Python note. The upgrade to Python 3 includes the Python API for CodeSonar. In particular:

• Python plug-ins will now be parsed as Python 3. You may need to update your plug-ins to modify any Python 2 syntax that is not accepted by Python 3.
• The Python API now provides a __next__() method (previously next()) for all iterators.

AST Changes

There are new, modified, and deleted unnormalized C/C++ AST classes.

New Unnormalized C/C++ AST Classes

• cc:builtin-operation-expression-operands
• cc:builtin-operation-expression-type-operands
• cc:builtin-operation-has-attribute
• cc:builtin-operation-n-expression-operands
• cc:builtin-operation-n-type-operands
• cc:builtin-operation-one-expression-operand
• cc:builtin-operation-one-type-operand
• cc:builtin-operation-two-expression-operands
• cc:builtin-operation-two-type-operands
• cc:builtin-operation-type-operands
• cc:builtin-operation-type-expression-operands
• cc:co-await
• cc:co-await-with-dependent-operand
• cc:co-yield
• cc:co-yield-with-dependent-operand
• cc:compound-req-expr
• cc:concept-id-expr
• cc:constexpr-if
• cc:coroutine
• cc:coroutine-return
• cc:fold
• cc:initializer-expr
• cc:nested-req-expr
• cc:param-ref
• cc:requires-expr
• cc:void-value

Modified Unnormalized C/C++ AST Classes

Deleted Unnormalized C/C++ AST Classes

• cc:builtin-offsetof
• cc:gnu-builtin-operation
• cc:has-assign
• cc:has-copy
• cc:has-finalizer
• cc:has-trivial-copy
• cc:has-trivial-destructor
• cc:has-nothrow-assign
• cc:has-nothrow-constructor
• cc:has-nothrow-copy
• cc:has-nothrow-move-assign
• cc:has-trivial-assign
• cc:has-trivial-constructor
• cc:has-trivial-move-assign
• cc:has-trivial-move-contructor
• cc:has-user-destructor
• cc:has-virtual-destructor
• cc:intaddr
• cc:is-abstract
• cc:is-base-of
• cc:is-class
• cc:is-constructible
• cc:is-convertible-to
• cc:is-delegate
• cc:is-destructible
• cc:is-empty
• cc:is-enum
• cc:is-final
• cc:is-interface-class
• cc:is-literal-type
• cc:is-nothrow-assignable
• cc:is-nothrow-constructible
• cc:is-nothrow-destructible
• cc:is-pod
• cc:is-polymorphic
• cc:is-ref-array
• cc:is-ref-class
• cc:is-sealed
• cc:is-simple-value-class
• cc:is-standard-layout
• cc:is-trivial
• cc:is-trivially-assignable
• cc:is-trivially-constructible
• cc:is-trivially-copyable
• cc:is-trivially-destructible
• cc:is-union
• cc:is-value-class
• cc:microsoft-builtin-operation
• cc:param-ref
• cc:type-traits-builtin-operation
• cc:types-compatible-p

Customer Tickets Fixed