JavaScript is not currently enabled, but is required for full CodeSonar manual search and browse functionality.
If you are viewing this file in your hub's Web GUI, enable JavaScript in your browser: you will also need it for GUI functionality.
If you opened this file directly from disk, your browser may be directly suppressing JavaScript functionality: certain browsers perform this suppression on local files (but not files delivered by web servers) for security reasons.
| CodeSonar® 9.0p0 Hot Tips | CONFIDENTIAL | CodeSecure Inc |
The minimum CodeSonar version for direct upgrade to CodeSonar 7.0 or later is 4.1p0. If you have a hub that is running CodeSonar 4.0p2 or earlier, contact CodeSecure support for assistance in upgrading.
If you have made changes to any of your CodeSonar configuration files, you will need to upgrade those files as part of the upgrade process.
| Hybrid Cloud | This release introduces CodeSonar SaaS (Software as a Service) as an additional deployment model. |
|---|---|
| New codesonar analyze options |
Two new options.
|
| New codesonar install-launchd options | Use the -launchd-home and -launchd-quota options to specify the location and maximum permitted size, respectively, of the launch daemon's Home Directory. |
| New Windows Build Wizard field | Use the Analysis field on screen 1 to choose between local-managed and remote-managed analysis, and to specify a remote launch daemon for the latter. |
| CodeSonar Plug-In for Eclipse Changes |
There are several changes to the CodeSonar Project
Properties dialog.
|
| RBAC Changes | There are three new permissions, and the permission requirements for various operations have changed. |
| Incrementality Note |
The new remote-managed analysis variant can be invoked to
update and analyze a project based on an incremental build of
the underlying software project. However, the remote-managed
analysis phase does not currently take full advantage of
incrementality:
|
| Java Build/Analysis Changes | The Java analysis will now submit warnings to the hub for
ordinary and sourceless artifacts without corresponding source
code, unless specifically instructed otherwise. There are two new cs-java-scan options: -import-require-source and -java-source-level. |
| C# Build/Analysis Changes | The C# analysis will now submit warnings to the hub for
ordinary and sourceless artifacts without corresponding source
code, unless specifically instructed otherwise. There is one new cs-dotnet-scan option: -import-require-source. |
| HIS Metrics | There are five new built-in metrics and a new preset to enable those metrics. |
| GUI Changes | Various pages have additional functionality; RBAC permission requirements for accessing some pages and functionality have changed. |
| Warning Classes |
There are many new warning classes.
|
| Roslyn-detected
C# warnings (Experimental) |
There is new, experimental C# analysis functionality that invokes the .NET Compiler Platform (Roslyn) analyzers from Visual Studio and issues a CodeSonar warning for each rule violation detected by an analyzer. |
| CWE | This version of CodeSonar uses CWE v4.8, released June 28, 2022. |
| TASKING Compiler Model | The tasking compiler model (for modeling the behavior of the TASKING TriCore, PCP, and C166/ST10 compilers) is now available on Windows and Linux platforms (previously Windows only). |
| Configuration Presets | There are several new presets for selectively enabling various of the new Roslyn-detected C# warning classes, and one for enabling the five new Hersteller Initiative Software (HIS) metrics (see HIS Metrics, below, for more information). |
| Configuration Parameters | There are several new configuration parameters. |
| API Changes | There are a small number of new API functions. |
| AST Changes | There are two new unnormalized C/C++ AST classes. |
| SARIF Output for Warning Search Results |
For warning searches whose scope is a single
analysis, warning search results can now be output in SARIF
format.
|
| VS Code Extension | An extension for Microsoft Visual Studio Code (VS Code) will be available at the Visual Studio Marketplace shortly. The extension will allow you to view the results of a single analysis or compare the results of two analyses in VS Code. |
| Deprecation Notices |
Support for Internet Explorer is deprecated as of this release.
The HTML5 Visualization Tool visualization feature will be deprecated at
the end of 2023. |
| Release Status | For full information about release status for all current and past CodeSonar versions, see the Supported Product Versions page on the CodeSecure support site. |
This release introduces CodeSonar SaaS (Software as a Service) as an additional deployment model.
With CodeSonar SaaS:
Users with on-premise CodeSonar deployments can also take advantage of the remote-managed analysis capability.
This manual provides a Quick Start (CodeSonar SaaS) page.
This release introduces a distinction between remote-managed and local-managed analysis. Previously all analyses were local-managed.
An analysis that specifies a remote analysis launch daemon with the new -remote analysis-launchd option (or via the corresponding Windows Build Wizard or Eclipse Plug-In functionality) will be remote-managed.
In remote-managed analyses the project analysis directory is located with the remote analysis launch daemon. This is not necessarily on the build machine, and for SaaS analyses is on an external network. New features provide visibility and control over the project analysis directory though the hub, for both remote-managed and local-managed analyses.
The analysis launch daemon for a remotely-managed analysis must be set up with a home directory. The project analysis directory is stored under this home directory.
For remote analysis...
There are a number of changes to CodeSonar's Role Based Access Control.
There are three new permissions: one global (G_*) permission, and two ROLE_* permissions.
| New Permission | Notes |
|---|---|
| G_MANAGE_USERS |
Manage user accounts and permissions, but without the complete
control provided by G_ADMINISTER_USERS. This permission is designed to provide sufficient privileges to perform all SaaS hub management operations that are not provided by CodeSecure.
|
| ROLE_DELETE | Delete a role. |
| ROLE_EXISTS | See a role in menus and tables of available roles. |
There is a new built-in role: Manager. The default Manager role-permissions provide a range of user management privileges. By default, no user has the Manager role.
We introduce the notion of user control. User control over a specific hub user account requires one of the following sets of permissions.
With user control over a hub user account U, you can do the following.
Users with G_MANAGE_USERS permission can create new hub user accounts (provided they also have G_CREATE_USER permission) with the set of available template users restricted to those over which the creating user has user control. If this set is empty, the template user will be the default template user.
New roles can now be created by users with G_MANAGE_USERS permission.
When you create a new role, you must now specify a "controlling role". If you don't have G_ADMINISTER_USERS permission, you can only specify a controlling role that you are currently assigned.
The controlling role will be assigned all ROLE_* permissions for the new role
The Java analysis will now submit warnings to the hub for sourceless artifacts without corresponding source code, unless specifically instructed otherwise.
There are two new options for cs-java-scan.
The C# analysis will now submit warnings to the hub for sourceless artifacts without corresponding source code, unless specifically instructed otherwise.
There is one new option for cs-dotnet-scan.
There are five new built-in metrics, all
from the set described in
H. Kuder. HIS source code metrics. Technical Report
HIS-SC-Metriken.1.3.1-e, Herstellerinitiative Software, April 2008.
Version 1.3.1.
These metrics are not computed by default, and have procedure granularity only.
| Metric Description | Metric Tag |
|---|---|
| Number of Called Functions | CALLING |
| Number of Function Calls | STSUB |
| Number of goto Statements | GOTO |
| Number of Formal Parameters | PARAM |
| Number of Returns | RETURN |
New preset his_metrics enables these five metrics.
| GUI Page Type | Changes |
|---|---|
| Account Editor | Access to page and functionality now requires user control over the corresponding hub user account (previously G_ADMINISTER_USERS only.) |
| Analysis |
Analysis
Details section has two new parts.
|
| Analysis Cloud | New table columns Space Quota, Space Used, Disk Space Available, Home. |
| Analysis Cloud Active Jobs | New table columns Master Launchd Path, Master Launchd ID, Master Launchd Key, Slave Launchd Path, Slave Launchd ID, Slave Launchd Key. |
| Analysis Search Results |
|
| Authentication Services | When adding a new authentication service that is permitted to create new hub user accounts, users with G_MANAGE_USERS permission can choose the template user for new accounts from a restricted set as described above. |
| Bulk Add Users |
|
| Create Account | Users with G_MANAGE_USERS permission can choose the template user for new accounts from a restricted set as described above. |
| Global Role-Permissions |
|
| Project |
|
| Resource Role-Permissions | Users with G_ADMINISTER_USERS will see all hub roles in the table of roles. Otherwise, a role R will only be visible if the user has ROLE_READ R. (Previously all table rows visible to users with page access.) |
| Roles |
|
| Role Ancestors |
|
| Role Users |
|
| Settings, Admin Settings |
Analysis tab has new hub-wide auto-deletion controls for project analysis directories. |
| Users | Access now requires G_ADMINISTER_USERS or G_MANAGE_USERS permission (previously G_ADMINISTER_USERS only). |
| User Roles |
|
| Warning Search Results | If search scope is a single analysis, SARIF output is now available. |
| New C/C++ Warning Class Name | Mnemonic |
|---|---|
| Modification of Standard Namespaces | LANG.STRUCT.DECL.SNM |
| Use of catch | LANG.STRUCT.EXCP.CATCH |
| Use of throw | LANG.STRUCT.EXCP.THROW |
Warnings of these classes are detected in C# source code via the
new, experimental Roslyn-detected C# warnings
functionality.
There is a warning class for each Roslyn code quality analysis
rule.
Note: Classes are in this set not enabled by the csharp_complete, csharp_deep, csharp_pedantic, or csharp_security preset. There are separate presets for enabling various sets of Roslyn-detected classes.
There is new, experimental functionality that invokes the .NET Compiler Platform (Roslyn) analyzers from Visual Studio and issues a CodeSonar warning for each rule violation detected by an analyzer.
We divide the C# warning classes shipped with CodeSonar into two groups.
There are many new Roslyn-detected C# warning classes associated with this feature: see the list above.
Several new presets are provided to enable various subsets of the Roslyn-detected C# warning classes.
See Experimental: Roslyn-Detected C# Warning Classes for more information.
New preset his_metrics enables the five new Hersteller Initiative Software (HIS) metrics.
There are also several new presets that selectively enable various of the new Roslyn-detected C# warning classes, corresponding to rulesets in microsoft.codeanalysis.netanalyzers 6.0.0.
| New Preset | Corresponding microsoft.codeanalysis.netanalyzers 6.0.0 ruleset |
|---|---|
| csharp_roslyn_allrulesdefault | AllRulesDefault |
| csharp_roslyn_allrulesenabled | AllRulesEnabled |
| csharp_roslyn_designrulesdefault | DesignRulesDefault |
| csharp_roslyn_globalizationrulesdefault | GlobalizationRulesDefault |
| csharp_roslyn_interoperabilityrulesdefault | InteroperabilityRulesDefault |
| csharp_roslyn_maintainabilityrulesdefault | MaintainabilityRulesDefault |
| csharp_roslyn_performancerulesdefault | PerformanceRulesDefault |
| csharp_roslyn_portedfromfxcoprulesdefault | PortedFromFxCopRulesDefault |
| csharp_roslyn_reliabilityrulesdefault | ReliabilityRulesDefault |
| csharp_roslyn_usagerulesdefault | UsageRulesDefault |
There are several new configuration parameters.
| New Parameter | Purpose |
|---|---|
| ALWAYS_EXPAND_FUNCTIONS | Specify certain functions by name that should always be expanded when CALL_SITE_EXPANSIONS is not None. |
| EXPLORE_SELF_ASSIGNMENT | Specify whether or not the analysis should explore the possibility of self assignment. |
| LOOP_TAINT_TRANSFER | Specify whether or not the analysis should transfer taint to loop variables when they are compared to tainted values. |
| MAX_CLOBBERED_FIELDS | When a non-const pointer to an object escapes analysis, specifies a bound on the number of transitive fields of that object that the analysis should treat as potentially changed to an unknown value. |
| MAX_COPIED_FIELDS | Specify a bound on the number of transitive fields of a type (such as a class or struct) that the CodeSonar analysis will copy by-value when simulating a corresponding by-value copy operation in the software under analysis. |
| TAINT_BLOCK_PROPAGATION_FUNCS | Specify how a function propagates data, and the taint on
that # data, into a structured memory block. |
| TIME_LIMIT_LIVEVAR | Bounds the time that the analysis can spend figuring out live variables in a single procedure. |
There are two new API functions.
There are new C++ and Python API functions for obtaining and using for compilation unit IDs. In C, a compilation unit is already represented as an integer cs_uid.
| New Function | Purpose | ||
|---|---|---|---|
| C++ | Python | C | |
| project::find_compunit() | project.find_compunit() | n/a | Retrieve a compilation unit given its ID. |
| compunit::id() | compunit.get_id() | n/a | Get the ID for a compilation unit. |
There are two new unnormalized C/C++ AST classes:
| NUMBER | NAME | NOTES |
|---|---|---|
| CSO-985 | ti_intrinsics.h causes parse errors with some configurations from cl6x.exe | fixed |
| CSO-1032 | Function Pointer failure on member variable | fixed |
| CSO-1223 | CS 6.2p2 armcc compiler not keeping pace with later revisions of ARM compiler. V4 (RVCT) OK, V5 broken, likely V6 broken | fixed |
| CSO-1327 | IAR compiler models need to detect the IAR IDE language conformance settings | fixed |
| CSO-1531 | False Positive | fixed |
| CSO-1594 | Parse errors: TI cl2000 v20.2.4 compiler | fixed |
| CSO-1614 | Add more examples for IGNORED_COMPILATIONS regarding the targeting of directories | Additional examples added to documentation. |
| CSO-1632 | Subsequent runs without -clean do not retract warnings properly | fixed |
| CSO-1650 | Remove limitation to 255 chars of "Redundant Condition" warning message | fixed |
| CSO-1654 | Invalid cookie blocks operations | fixed |
| CSO-1656 | Hub: Exception Value:<built-in function jsondecode> | fixed |
| CSO-1684 | Update .Net compatibility mappings to support .Net Standard on .NET 6.0 | fixed |
| CSO-1685 | Side-effects of unsupported assemblies to impact the analysis of other assemblies. | fixed |
| CSO-1692 | "expression must have a constant value" parse error with Arms armcc V5.04 | fixed |
| CSO-1704 | Arm armcc V5.x "the size of an array must be greater than zero" parse error | fixed |
| CSO-1742 | Warning Processors: Input and Output Mistakes in manual | Documentation has been corrected. |
| CSO-1800 | The use of the option '-project', gives permission denied error if a slash is used for targeting the project like: '-project /project-name' | fixed |