Versions Compared

Old Version 1

changes.mady.by.user Kiuwan Editor User

Saved on

compared with

New Version 2

changes.mady.by.user Kiuwan Editor User

Saved on

Key

  • This line was added.
  • This line was removed.
  • Formatting was changed.

Table of Contents

 

...

 

New version of CQM (v1.2.15) and Kiuwan Engine 

Info

A new Kiuwan’s CQM and Engine is available.

Features of this new version are:

  • New PHP security rules (10)
  • Enhanced Django (Python) security support

You can find these new rules by comparing v1.2.15 of CQM against previous version.  

A detailed description of the behavior of these new rules is available in rule’s description.

Unless you have blocked Kiuwan Engine, Kiuwan Local Analyzer will automatically upgrade it to the last version once a new analysis is run.

In order for these new rules be applicable, your Kiuwan account must be configured to allow automatic engine upgrade:

  • If you are using CQM, these new rules will automatically become active and will be applied to new analyses.
  • If you are using your own custom model, you can activate them in case you want to be applied to your code.

 

New PHP Security Rules

  • OPT.PHP.SEC.PlaintextStorageInACookieRule 
  • OPT.PHP.SEC.InsufficientSessionExpirationRule 
  • OPT.PHP.SEC.CookiesInSecurityDecision
  • OPT.PHP.SEC.CrossSiteHistoryManipulation 
  • OPT.PHP.SEC.InsufficientKeySizeRule 
  • OPT.PHP.SEC.TrustBoundaryViolationRule 
  • OPT.PHP.SEC.UncheckedInputInLoopCondition 
  • OPT.PHP.SEC.ImproperValidationOfArrayIndex 
  • OPT.PHP.SEC.UserControlledSQLPrimaryKey 
  • OPT.PHP.SEC.PotentialInfiniteLoop

Enhanced Django Python Security Support

Existing security rules for Django framework have been enhanced by supporting new sinks/sources as well as improvements in tainting propagation.

...