CodeSonar Release 8.1, patchlevel 0: Release Notes

• Notes on Upgrading
• What's New
• Customer Tickets Fixed

Notes on Upgrading

The minimum CodeSonar version for direct upgrade to CodeSonar 7.0 or later is 4.1p0. If you have a hub that is running CodeSonar 4.0p2 or earlier, contact CodeSecure support for assistance in upgrading.

If you have made changes to any of your CodeSonar configuration files, you will need to upgrade those files as part of the upgrade process.

• See Upgrading Configuration Files for instructions.
• For some configuration files, the procedure includes steps that must be carried out before CodeSonar is upgraded.
• If you are upgrading a CodeSonar installation that will be used by someone else:
  • Determine the most appropriate person to upgrade the general template and compiler template configuration files.
    This will depend on local factors such as who usually makes changes to these files.

If you have previously installed the CodeSonar plug-in for Visual Studio or CodeSonar plug-in for Eclipse, upgrade those installations after upgrading CodeSonar.

What's New

Details

Warning Classes

There are several new C/C++ warning classes.

There are also a large number of new warning classes corresponding to third party analyzer results.

New C/C++ Warning Classes

New warning classes for Go, Kotlin, JavaScript, Python, Rust, and TypeScript

Since its introduction in CodeSonar 5.0, the SARIF importer for CodeSonar has created new warning classes on an as-needed basis when importing SARIF files into a CodeSonar project.

CodeSonar 8.1 extends this by adding a large number of built-in warning classes corresponding to the results available from several third party analyzers.

New Warning Category Kinds

There are several new warning category kinds:

• MisraC2023
• MisraC++2023,
• DISA-5r3,
• several new category kinds for third-party analyzers

New MisraC2023 Category Kind: MISRA C:2023 Guidelines

Warning categories with IDs of the form MisraC2023:topic.num or MisraC2023:C.topic.num correspond to rules and directives, respectively, in the MISRA C:2023 Guidelines.

New MisraC++2023 Category Kind: MISRA C++:2023 Guidelines

Warning categories with IDs of the form MisraC++2023:topic.num.num correspond to rules in the MISRA C++:2023 Guidelines.

New DISA-5r3 Category Kind: DISA Application Security and Development STIG

Warning categories with IDs of the form DISA-5r3:id.num correspond to findings in the Defense Information Systems Agency (DISA) Application Security and Development Security Technical Implementation Guide (STIG), Version 5, release 3 (STIG release date July 26, 2023).

New category kinds for third-party analyzers

There are several new category kinds corresponding to third party analyzers. Each of the new warning classes corresponding to third party analyzer results is assigned one category of one of these kinds. They are designed to facilitate mapping from CodeSonar warning classes back to the original analyzer documentation.

For more information, see Warning Categories: Third party analyzers.

Including Third-Party Analysis Results

There is substantially improved support for integrating third-party analysis results with a CodeSonar project. This includes extended functionality for importing SARIF files, and detailed instructions for working with third-party analyzers.

• Including Tier 3 Components in a CodeSonar Project
• Analyzer-specific instructions:

  Language	Third party analyzer	Instructions for adding source code and analyzer results to a CodeSonar project
  Go	Staticcheck	Including Go Components in a CodeSonar Project
  JavaScript	ESLint	Including JavaScript and TypeScript Components in a CodeSonar Project
  Kotlin	detekt	Including Kotlin Components in a CodeSonar Project
  Python	Pylint	Including Python Components in a CodeSonar Project
  Rust	Clippy	Including Rust Components in a CodeSonar Project
  TypeScript	ESLint with typescript-eslint	Including JavaScript and TypeScript Components in a CodeSonar Project

• A large number of new built-in warning classes have been added to classify results from several third party analyzers. See New warning classes corresponding to third party analyzer results, above, for a summary with links to detailed information.
• A detekt analyzer binary is shipped with CodeSonar on most platforms. The binary will be built for the same target as your CodeSonar installation, but is always located under %CSONAR%\win32-fetcher\.

New Terminology

We introduce the notions of language tier and CodeSonar-facing build.

Importing SARIF Files and Source Files

There are a number of changes to the functionality for importing SARIF files and for importing files that cannot be included in the CodeSonar project by other means.

• The command names have changed.
• A codesonar import_sarif.py invocation can now specify source files to be imported when the SARIF is imported, through the new -include-sources and -exclude-sources options.
  This means that an accompanying codesonar add_source_files.py invocation is no longer required.
• Three subcommands have new options:
  • codesonar import_sarif.py
  • codesonar add_source_files.py
  • codesonar python_scan.py
• Warning class names for warnings imported from SARIF results are now generated from the name property of each rule object as follows.
  • For SARIF produced by CodeSonar, warning class name exactly matches name.
  • For SARIF produced by certain third party analyzers, CodeSonar provides analyzer-specific SARIF import handling, including customized schemes for producing warning class names from SARIF name values. For more information, see the following: detekt.
  • For SARIF from any other source, warning class name exactly matches name.

New command names

Command option changes

Metric Description Changes

The description values for several metric classes have changed. The tags for these classes have not changed.

Configuration Changes

There are several new configuration presets and several presets have been modified. There is also one new configuration parameter.

New Presets

Modified Presets

New configuration parameters

There are two new configuration parameters:

New GUI Alerts

There are three new GUI alert kinds.

• Two new yellow alerts.
  • num Dropped Warnings
  • Multiple Versions of Source File
• One new blue alert.
  • Reduced Warning Detail

API Changes

There are several changes to the CodeSonar Plug-in API.

• Warning reporting: when specifying a location, the "end column" is now exclusive (previously inclusive). Locations are specified in the various API implementations as follows.
  • C++: class locations_node.
  • Python: class locations_node
  • C: struct cs_locations_node_t
• ASTs: unnormalized AST class cc::attribute-arg has new attributes :sfid and :line
• Projects: there are several new operators and methods that operate on projects.
• Languages: there are many more available values for describing source and machine languages, and some existing values have changed.

API: Projects

There are several new operators and methods that operate on projects.

API: Language changes

The internal representation now has many more available values for describing source and machine languages. In addition, some of the previously-existing values have changed: if you have plug-in code that uses these values, you will need to update it.

[*] The META_ prefix indicates a file that was directly imported into the CodeSonar project.

• For C, C++, Java, C#, and binary languages there is both a META_ language value and a value that indicates the file was included using the standard language-specific mechanism.
• For all other languages, there is only a META_ language value.

For example, suppose you have a C file myfile.c.

• If CodeSonar observes the compilation of myfile.c, its language is recorded as EDGCP_C.
• If myfile.c is imported into the project with codesonar add_source_files.py or codesonar import_sarif.py, its language is recorded as META_C.

Customer Tickets Fixed