v2.4.11

No rule updates. Created a new VSIX to enable use in Visual Studio 2022.

v2.4.7

No material updates to the scanner or rules. Closes the expired signing certificate for the VSIX file in the marketplace #68.

v2.4.6

Closes #63.

v2.3.0.0

NuGet package enhancement only. The core rules engine remains the same. This release upgrades the parser utility for stopping automated builds. See details below.

Framework Enhancements

• Parser utility shipped with the NuGet package was upgraded with a new --errors switch that takes a list of rule ids. If a rule id is found in the results, the parser returns an exit code of 1. This exit code can be used to stop a build if offending rules are found.

System Requirements

• .NET Compiler API version 2.9
• Puma Scan Visual Studio extension requires Visual Studio v15.8 or higher

v2.2.0.0

Version 2.2.0.0 adds a few rules targeting .NET Core APIs:

Framework Enhancements

• SEC0120: Missing Authorize Attribute
• SEC0121: CORS ACAO Wildcard
• SEC0122: JWT Signature Validation Disabled

System Requirements

• .NET Compiler API version 2.9
• Puma Scan Visual Studio extension requires Visual Studio v15.8 or higher

Release-2.1.0.0

The version 2.1.0.0 is a release enhances the overall scanning framework with the following:

• Puma.Security.Rules converted to netstandard2.0, which paves the way for us to run the analyzers in VSCode and inside a Docker container

• Visual Studio Extension support for VS2019

System Requirements

• .NET Compiler API version 2.9
• Puma Scan Visual Studio extension requires Visual Studio v15.8 or higher

PREVIEW-2.1.0.0

v2.1.0.0 Preview

Version 2.1.0.0 is a preview release that enhances the overall scanning framework with the following:

• Puma.Security.Rules converted to netstandard2.0, which paves the way for us to run the analyzers in VSCode and inside a Docker container

• Visual Studio Extension support for VS2019

The NuGet package is not ready for preview, as we are still encountering issues referencing dependencies. That will be released in a coming version.

System Requirements

• .NET Compiler API version 2.9
• Puma Scan Visual Studio extension requires Visual Studio v15.8 or higher

Patch-2.0.0.1

v2.0.0.1

Version 2.00.1 uses the .NET Compiler API version 2.9. To use this version, you must be running at least Visual Studio 2017 v15.8. For more details, see the Roslyn NuGet Packages Wiki.

Patch release to:

• correctly limit the extension package to Visual Studio 15.7+.
• fix bug in the Code Block Analyzer to handle a more robust set of scenarios.

System Requirements

• .NET Compiler API version 2.9
• Puma Scan Visual Studio extension requires Visual Studio v15.8 or higher

Release-1.0.7

v.1.0.7

Puma Scan v1.0.7 runs the Roslyn API version 1.3.2, which is supported by Visual Studio 2015 Update 2+ and all Visual Studio 2017 versions. This is the last Puma Scan version that supports Visual Studio 2015. For more details, see the Roslyn NuGet Packages Wiki.

Bug fix to improve performance issues that caused Visual Studio builds to hang when encountering unexpected syntax nodes in SEC0025, SEC0026, and SEC0028.

Git Issues Closed:

• Issue 40

System Requirements

• .NET Compiler API version 2.3
• Puma Scan Visual Studio extension requires Visual Studio 2015 Update 3 or higher

Release-2.0

v.2.0

Version 2.0 upgrades the Puma Scan analyzers to the current Roslyn API version 2.8.2. To use this version, you must be running at least Visual Studio 2017 v15.7. For more details, see the Roslyn NuGet Packages Wiki.

Framework enhancements

• New code block analyzer base class
• Consolidation of analyzers

New rules

• SEC0115 - Insecure Random Number Generator
• SEC0116 - Path Tampering: Unvalidated File Path
• SEC0117 - LDAP Injection Path Assignment
• SEC0118 - LDAP Injection Directory Searcher
• SEC0119 - LDAP Injection Filter Assignment
• SEC0031 - Command Injection: Process.Start
• SEC0032 - Command Injection: ProcessStartInfo