CodeSonar Release 7.2, patchlevel 0: Release Notes

• Notes on Upgrading
• What's New
• Customer Tickets Fixed

Notes on Upgrading

Upgrading a CodeSonar hub to 7.2p0 will take longer than usual.

• Schedule your hub upgrade for a time when hub downtime will not cause disruptions.
• Deleting old analysis logs (or entire analyses) will help reduce the upgrade time.

If you are upgrading a hub that is configured with an SSO SAML authentication plug-in, see the note below.

If you have made changes to any of your CodeSonar configuration files, you will need to upgrade those files as part of the upgrade process.

• See Upgrading Configuration Files for instructions.
• For some configuration files, the procedure includes steps that must be carried out before CodeSonar is upgraded.
• If you are upgrading a CodeSonar installation that will be used by someone else:
  • Determine the most appropriate person to upgrade the general template and compiler template configuration files.
    This will depend on local factors such as who usually makes changes to these files.

The minimum CodeSonar version for direct upgrade to CodeSonar 7.0 or later is 4.1p0. If you have a hub that is running CodeSonar 4.0p2 or earlier, contact CodeSecure support for assistance in upgrading.

What's New

There are significant changes to role-based access control on the hub. These changes involve default role-permission assignments for built-in roles, and affect only new hubs started with CodeSonar 7.2 or later. An important consequence is that the special Anonymous user has almost no permissions by default, so a hub using these default settings will require authentication for operations such as performing an analysis or browsing analysis results.
Existing hubs are not affected, even if they are upgraded to CodeSonar 7.2 or later.
See RBAC Changes, below, for details.

Details

New Warning Classes

RBAC Changes

There are significant changes to role-based access control on the hub. These changes involve default role-permission assignments for built-in roles, and affect only new hubs started with CodeSonar 7.2 or later. Existing hubs are not affected, even if they are upgraded to CodeSonar 7.2 or later.

In summary:

• Anyone has almost no permissions by default. This means that the special Anonymous user has almost no permissions by default, so a hub using default RBAC settings will require authentication for operations such as performing an analysis or browsing analysis results.
• Many of the default permissions previously held by Anyone are now held by User.
• Default permissions for Manager and Administrator have not changed.
• Special user Anonymous no longer has special treatment with respect to the G_SIGN_IN permission.
  • G_SIGN_IN is no longer one of the negated permissions for Anonymous.
  • G_SIGN_IN permission is now required in order to authenticate as any user, including the special Anonymous user.
• Authentication as an enabled user is now required to view hub pages, including documentation.

There is a new -permissive option to codesonar hub-start. If you specify this option when starting a brand new primary hub, default role-permission assignments for the Anyone role will be more extensive, consistent with default assignments in CodeSonar 7.1 and earlier. (The -permissive option has no effect when you use codesonar hub-start to restart an existing hub.)

For full details of the default role-permission assignments with and without the -permissive option, see Default Role-Permissions and Immutable Role-Permissions.

CodeSonar Plug-in for Visual Studio [Windows only]

There are several changes to the CodeSonar plug-in for Visual Studio.

• The CodeSonar Project Properties dialog has multiple changes.
  • New analysis management radio buttons allow you to choose between local-managed and remote-managed analysis, and to specify a remote launch daemon for the latter.
  • The Allow Services checkbox is now only available when Local Analysis is selected.
  • The Launchd Group and Launchd Key settings have been removed.
• The plug-in now uses an Edge/Chromium browser widget (previously it used an Internet Explorer widget).
• New prerequisite: the Microsoft Edge WebView2 runtime must be installed.

C# Build/Analysis Changes

There are several changes to the C# build/analysis.

• .NET 6.0 is now supported: specify -framework net6.0.
• MSBuild solution files (.sln) can now be provided as input.
  New cs-dotnet-scan options -msbuild-solution, -msbuild-location, and -msbuild-property provide access to this functionality.
• New cs-dotnet-scan option -csharp-source-level allows you to specify the language compliance level to be used in parsing C# source files.

CodeSonar Plug-in for Eclipse

There are several changes to the CodeSonar plug-in for Eclipse.

• CodeSonar 7.2p0 supports Eclipse versions 4.19 (2021-03) through 4.25 (2022-09), official/supported releases only.
• [Windows only] New prerequisite: the Microsoft Edge WebView2 runtime .
• [Windows only] New setting "Use Microsoft Edge-based Web Browser views" in the CodeSonar Preferences allows you to specify that Eclipse must use an Edge browser widget. The Edge browser widget is required for the Warning view's Code tab.

Upgrading a Hub With Existing SSO SAML Authentication Plug-In

The schema for hub Assertion Consumer Service (ACS) URLs has changed. If you are upgrading a hub that is configured with an SSO SAML authentication plug-in, you will need to edit the corresponding configuration in your SSO identity provider (for example, Keycloak or Okta) to specify the updated ACS URL.

Once you have upgraded the hub, do the following as a user with G_ADMINISTER_USERS permission.

1. Navigate to the hub Authentication Services page.
2. Scroll if necessary to view the table entry for your SSO authentication service.
3. Copy the Assertion Consumer Service URL: this is the updated URL that you will be using.
4. Sign into your identity provider as a user with administrative permissions.
5. Update the ACS URL configured for your CodeSonar integration.
   For example:
   

   Okta	Open the Configure SAML tab for your CodeSonar App Integration. Populate the Single sign on URL field with the updated ACS URL.
   Keycloak	Open the Settings page for your CodeSonar client. Populate the Master SAML Processing URL field with the updated ACS URL.

6. Save your changes.

Configuration Parameters

There are several new configuration parameters, and changes to factory settings for some parameters.

New Configuration Parameters

Modified Configuration Parameters

Customer Tickets Fixed