CodeSonar for C/C++ Release 27.0: Release Notes ----------------------------------------------- - `Notes on Upgrading `_ - `What's New `_ .. _cs27_upgrading: Notes on Upgrading ~~~~~~~~~~~~~~~~~~ The minimum CodeSonar version for a direct upgrade to CodeSonar 27.0 or later is 7.2p0. **If you have a hub that is running CodeSonar 7.1p0 or earlier, contact** `CodeSonar support `__ **for assistance in upgrading.** If you have made changes to any of your CodeSonar configuration files, you *must* upgrade those files as part of the upgrade process, and for some of them the procedure includes steps that must be carried out before CodeSonar is upgraded. - See **MANUAL: Upgrading Configuration Files** for instructions. - If you are upgrading a CodeSonar installation that will be used by someone else: - Determine the most appropriate person to upgrade the general template and compiler template configuration files. This will depend on local factors such as who usually makes changes to these files. **CodeSonar for Binaries has been baselined: CodeSonar 9.2 was its final release.** Use CodeSonar 9.2 to perform binary analyses going forward. **The ``codesonar activate`` subcommand has been removed.** It is no longer needed. **CodeSecure, Inc. has merged into AdaCore, and product branding has changed accordingly.** Points to note when upgrading: - On Windows, the default installation directory is now ``...\AdaCore\CodeSonar``, and the installer records its settings under the Software\\AdaCore\\CodeSonar registry key. The installer will detect an existing CodeSecure-era or GrammaTech-era installation and offer to uninstall it. - The Java plugin API package has been renamed from com.codesecure.cs to com.codesonar.cs; update import statements in Java plugin sources. - The C API function cs_codesecure_home_directory() has been renamed cs_install_directory(). **Windows device-driver installation has moved from hookcs.exe to codesonar.** hookcs.exe --install and --uninstall no longer exist; use codesonar uninstall-driver and codesonar install-driver instead. Scripts that follow the instructions given in the 3.5 and 3.6 release notes must be updated: where those notes gave the single invocation ``hookcs.exe --uninstall --install``, the replacement is two commands, and the uninstall must come first — installing over an existing registration leaves the registered driver in place. The new subcommands exist on every platform and succeed without doing anything where there is no driver, so a portable script need not test the platform. **Configuration files that are not encoded in UTF-8 are now diagnosed.** CodeSonar has always treated configuration file text as UTF-8, but ill-formed bytes were passed through silently. Such a file now raises a Bad Configuration File Setting alert, naming the file and the first line on which invalid bytes appear, and every line containing those bytes is ignored rather than used — so a setting that previously took effect by accident will no longer do so. Plain ASCII is UTF-8, so only configuration files holding non-English text are affected; re-save any such file as UTF-8. A byte-order mark at the start of a configuration file is now ignored instead of being taken as part of the first parameter name. See File encoding. If you have previously installed the CodeSonar plug-in for Visual Studio or CodeSonar plug-in for Eclipse, upgrade those installations after upgrading CodeSonar. **Existing "Use of catch" warnings get a new fingerprint on upgrade.** The warning now includes the enclosing procedure where one exists (see `Warning Class Changes `_), and procedure identity is part of the fingerprint, so most existing "Use of catch" warnings are re-keyed as new findings. Triage state attached to the old fingerprint (assigned, annotated, or marked expected) does not carry over to the new one. **Source file patches from one directory are now applied in ascending order of patch file name, compared byte by byte.** Where two patches apply to the same region of a file, the result no longer varies between machines or locales. **The header patch for arm_neon.h as shipped with GCC 9.3 is now applied.** Analyses of ARM code built with GCC 9.3 may report differently. **A ``std::vector`` built from a braced initializer list now has a known size.** The header patch for libstdc++'s bits/stl_vector.h has been updated. Analyses of C++ code that constructs vectors this way may report differently: overruns of the vector's storage that were previously missed are now reported, and null pointer dereferences of data() are not. **Missing Parentheses (LANG.STRUCT.PARENS) now reports operands it previously missed.** An operand that is a compile-time constant, or that needs an implicit conversion, is now reported. A project that enables this class may therefore see new warnings after upgrading, on code that has not changed. Every MISRA, AUTOSAR, CERT C, and JPL preset that maps this class enables it. .. _cs27_major_new: What's New ~~~~~~~~~~ +-----------------------------------------------------------+-----------------------------------------------------------+ | Version Numbering | Versions are now *year*.\ *point* with no patch | | | component, so this release is 27.0 rather than a | | | successor to | | | 9.2. Within a year, **.0** is the Initial Release for | | | early | | | evaluation, **.1** the Production Release for commercial | | | deployment and **.2** the Corrective Release for bug | | | fixes | | | and maintenance. Wavefronts and continuous releases, | | | available | | | on request to carry a fix or feature ahead of the next | | | release, | | | carry a suffix such as 27.0w. | +-----------------------------------------------------------+-----------------------------------------------------------+ | `CodeSonar | A new edition that analyzes Ada using a bundled GNAT SAS | | for Ada `_ | engine. See **MANUAL: Build and Analysis for Ada | | | Projects**. | +-----------------------------------------------------------+-----------------------------------------------------------+ | `C/C++ Parser Upgrade `_ | The bundled EDG C/C++ front end has been updated from | | | version | | | 6.7 to version 6.9, broadening language coverage, | | | improving | | | compiler compatibility, and fixing code that previously | | | failed to parse. | +-----------------------------------------------------------+-----------------------------------------------------------+ | AdaCore Branding | CodeSecure, Inc. has merged into AdaCore. Product | | | branding, | | | installer metadata, documentation, and support contact | | | points now | | | refer to AdaCore. See `Notes on | | | Upgrading `_ | | | for renamed installation paths and API packages. | +-----------------------------------------------------------+-----------------------------------------------------------+ | Default HTTP Session Timeout | The default HTTP session timeout for newly created hubs | | | is | | | now 60 minutes (previously 15 minutes). You can change | | | this | | | setting on the HTTP tab of | | | the Admin Settings | | | page. | | | Existing hubs are not affected. | +-----------------------------------------------------------+-----------------------------------------------------------+ | `Warning Classes `_ | There are modified warning classes for C/C++ and Java, a | | | new | | | Java warning class, and deleted Kotlin warning classes. | +-----------------------------------------------------------+-----------------------------------------------------------+ | Visual C++ Standard Library | Analysis of code built with Visual C++ 2010 or Visual C++ | | Models | 2015 (before Update 3) no longer reports spurious | | | uninitialized-variable warnings on copies of a | | | default-constructed std::istreambuf_iterator. | +-----------------------------------------------------------+-----------------------------------------------------------+ | Use of catch / Modification of | Analysis using the "Use of catch" | | Standard Namespaces Performance | (LANG.STRUCT.EXCP.CATCH) or "Modification of Standard | | | Namespaces" (LANG.STRUCT.DECL.SNM) warning classes was | | | previously very slow. The performance of both has been | | | improved. | +-----------------------------------------------------------+-----------------------------------------------------------+ | `API Changes `_ | There are some changes to C/C++ ASTs, and the plug-in API | | | can | | | now attach annotations to reported warnings. | +-----------------------------------------------------------+-----------------------------------------------------------+ | codesonar rename_roles.py | This is a new ``codesonar`` | | | subcommand for renaming one or more hub roles listed in a | | | CSV | | | file, using the hub HTTP API. See codesonar | | | rename_roles.py. | +-----------------------------------------------------------+-----------------------------------------------------------+ | codesonar set_user_roles.py | This is a new ``codesonar`` | | | subcommand for adding or removing a hub role from one or | | | more hub | | | users, using the hub HTTP API. See codesonar | | | set_user_roles.py. | +-----------------------------------------------------------+-----------------------------------------------------------+ | MCP Server Configuration | The CodeSonar MCP | | Control | server can now restrict the AI agent's analyses to a | | | project directory you nominate, and its configuration | | | files to | | | directories you permit, using --project-dir and | | | --conf-dir. --allow-build-command approves a build | | | command in advance, which an agent whose client cannot be | | | prompted requires in order to run an analysis at all. See | | | **MANUAL: What These Options Control**. | +-----------------------------------------------------------+-----------------------------------------------------------+ | Bundled curl | CodeSonar now uses curl 8.21.0, which picks up the fixes | | | for | | | the security advisories published against the 8.14.1 it | | | replaces. | | | Separately, the bundled curl is now built with support | | | for HTTP | | | and HTTPS only; the other protocols it used to carry, and | | | NTLM | | | authentication, are no longer compiled in, so advisories | | | against | | | those protocols no longer apply to the bundled build | | | whether or | | | not upstream has fixed them. | +-----------------------------------------------------------+-----------------------------------------------------------+ | MCP Progress Reporting | The CodeSonar MCP | | | server now reports progress while a CodeSonar command it | | | spawned is running, so a client that asks for progress is | | | told | | | the work is continuing. Clients commonly | | | abandon a tool call that has said nothing for long | | | enough, which | | | could end a long analysis or a large warning listing | | | before it | | | finished. | +-----------------------------------------------------------+-----------------------------------------------------------+ | ``WARNING_FILTER`` state:=/finding:= Actions | ``WARNING_FILTER`` rules can now | | | set a warning's State and Finding, in addition to | | | Priority | | | and Owner. See ``WARNING_FILTER``. | +-----------------------------------------------------------+-----------------------------------------------------------+ Details ------- .. _cs27_ada_edition: CodeSonar for Ada ~~~~~~~~~~~~~~~~~ CodeSonar analyzes Ada using ``GNAT SAS``, AdaCore's static analysis tool for Ada. A CodeSonar for Ada installation bundles it, so no separate installation is needed. To include an Ada component, extend your CodeSonar-facing build with one or more invocations of ``codesonar ada_scan.py``, naming the GNAT Project file (``.gpr``) to analyze, then run the build/analysis as usual. - You do not need to build the project with gprbuild, or to observe any Ada compilation step, in order to analyze it. - codesonar ada_scan.py takes the project file rather than a list of source files. The Ada source files are derived from the project itself, together with the runtime and library units it refers to; the naming rules in the project's ``Naming`` package are honored. - GNAT SAS warnings are exported in SARIF and imported into the CodeSonar project. Each GNAT SAS check corresponds to one of CodeSonar's built-in Ada warning classes. - An Ada parser program, run alongside GNAT SAS, supplies procedure information and cross-references, which populate the Procedures tab and the cross-reference and code-search navigation. CodeSonar for Ada carries no C or C++, Java or C# analyzers, and no Windows build wizard, plug-in for Eclipse or plug-in for Visual Studio. Use Build and Analysis for Ada Projects, which is a command-line workflow. The tier 3 scanners — Go, JavaScript, Python, and Rust — are unaffected. One consequence of moving a configuration or a script from another edition: the ``java`` and ``dotnet`` compiler models are not registered, and naming one reports which edition provides it rather than reporting it as unknown. CodeSonar for Ada does not require a license key: there is none to obtain, install, or renew. The configuration tool omits its Generate a license entry, and the License Key Utilization page omits its Request a new license key link. Analyzing a project that contains both C/C++ and Ada requires a CodeSonar for C/C++ installation, as CodeSonar for Ada does not include the C/C++ front end. Run the build/analysis from the C/C++ installation. It bundles no gnatsas, so codesonar ada_scan.py looks for one on ``PATH``; put the gnatsas/bin directory of your CodeSonar for Ada installation there, or name the program with ``-gnatsas``. .. _cs27_edg: C/C++ Parser Upgrade ~~~~~~~~~~~~~~~~~~~~ The bundled EDG C/C++ front end has been updated from version 6.7 to version 6.9, spanning two upstream releases. This broadens language coverage, improves compiler compatibility, and fixes code that previously failed to parse. - Constructs that previously provoked a generic parse error are now diagnosed specifically. The new parser warning classes name the features involved, among them C++20 alias template deduction, the C++23 explicit object parameter, C++26 structured binding packs, and the C23 ``#embed`` directive and ``_BitInt`` types. - Header patches that existed only to work around parser limitations have been removed where the parser now handles the construct itself. For example, the patches supplying a ``__fp16`` typedef are gone, because the parser now supports ``__fp16`` directly in GCC mode. See `Customer Tickets Fixed `_. New C/C++ parser warning classes ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ There are many new warning classes corresponding to C/C++ parser warnings and parser errors. For a full list, see C/C++ Parser Warning Classes. As with the existing parser warning classes, these are enabled by default for C and C++, and a factory setting for ``WARNING_FILTER`` discards warning instances that correspond to parser errors, so errors from the parse log are not duplicated as CodeSonar warnings. Deleted C/C++ parser warning classes ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ The following warning classes have been removed because the underlying parser diagnostics no longer exist. A ``WARNING_FILTER`` rule naming one of these mnemonics no longer matches anything. +------------------------------------------------+-----------------+------------------------------------------------+ | Deleted Warning Class | Mnemonic | Notes | +================================================+=================+================================================+ | Header Unit Creation Failure | PARSE.HUCF | | +------------------------------------------------+-----------------+------------------------------------------------+ | IFC Bad Function Definition | PARSE.IFCBFD | | +------------------------------------------------+-----------------+------------------------------------------------+ | IFC Bad Function Parameter Counts Multiple | PARSE.IFCBFPCMM | | | Multiple | | | +------------------------------------------------+-----------------+------------------------------------------------+ | IFC Bad Function Parameter Counts Multiple | PARSE.IFCBFPCMS | | | Single | | | +------------------------------------------------+-----------------+------------------------------------------------+ | IFC Bad Function Parameter Counts Single | PARSE.IFCBFPCSM | | | Multiple | | | +------------------------------------------------+-----------------+------------------------------------------------+ | IFC Bad Function Parameter Wrong Chart | PARSE.IFCBFPWC | | +------------------------------------------------+-----------------+------------------------------------------------+ | Unsupported Header Unit Feature | PARSE.UHUF | | +------------------------------------------------+-----------------+------------------------------------------------+ | volatile Increment/Decrement Deprecated | PARSE.VIDD | Replaced by two classes that distinguish the | | | | two operators: | | | | volatile | | | | Increment Deprecated (PARSE.VID) and volatile | | | | Decrement | | | | Deprecated (PARSE.VDD). | +------------------------------------------------+-----------------+------------------------------------------------+ Removed ~~~~~~~ Deleted Configuration File Parameters ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ The following configuration file parameters for CodeSonar for Binaries has been removed. Each is ignored if it is still present in an existing configuration file. =========================================== ======================================================= Deleted Parameter Notes =========================================== ======================================================= ``BINARIES_TO_ANALYZE``, Binary front-end options. ``BINARIES_TO_ANALYZE_AND_SHOW``, ``BINARY_FRONTEND_OPTIONS_PREPEND``, ``BINARY_FRONTEND_OPTIONS_APPEND``, ``BINARY_STACK_DEPTH_COMPUTATION``, ``X86_FLAGS_PREPEND``, ``X86_FLAGS_APPEND`` ``BINARY_SEARCH_BOUND``, Binary-analysis overrides of ordinary analysis options. ``BINARY_MAX_MODIFIED_VALUES``, ``BINARY_EXPLORE_MORE_LOOP_PATHS``, ``BINARY_TAINT_SEARCH_BOUND``, ``BINARY_TAINT_MAX_MODIFIED_VALUES``, ``BINARY_TAINT_MAX_EXPRESSION_COMPLEXITY``, ``BINARY_GLOBAL_BUFFER_OVERRUNS``, ``BINARY_MIN_REACHABLE_FROM_ROOTS``, ``BINARY_MAX_REACHABLE_FROM_LIBRARIES`` ``BINARY_BACKEND_OPTIONS``, Binary and decompiler options. ``BINARY_ANALYZE_LINKER_OUTPUT``, ``DECOMPILER_MODE`` Anonymous Usage Statistics Upload for collected anonymous usage statistics is now *always disabled* =========================================== ======================================================= Deleted API Functions ^^^^^^^^^^^^^^^^^^^^^ The following plug-in API entities, used only by binary analysis, have been removed. +-----------------------------------------------------------+-----------------------------------------------------------+ | Deleted | Notes | +===========================================================+===========================================================+ | cs_language_is_machine_code() | Machine-code languages are no longer supported. | | cs::language::is_machine_code() | | +-----------------------------------------------------------+-----------------------------------------------------------+ | cs_ea | Effective-address type used only by binary analysis. | | cs::effective_address | | +-----------------------------------------------------------+-----------------------------------------------------------+ | cscm.ParseConfiguration.binaries_to_analyze | Compiler-model plug-in binary options. | | cscm.ParseConfiguration.binaries_to_analyze_and_show | | | cscm.ParseConfiguration.x86_flags_prepend | | | cscm.ParseConfiguration.x86_flags_append | | +-----------------------------------------------------------+-----------------------------------------------------------+ | cs.amc | Python API classes for the abstract-memory-configuration, | | cs.amc_analysis | calling-context and value-set interfaces, all used only | | cs.amc_context | by binary | | cs.amc_context_iterator | analysis. | | cs.amc_context_iterator_mixin | | | cs.amc_iterator | | | cs.amc_iterator_mixin | | | cs.amc_valuation | | | cs.calling_context | | | cs.value_set | | +-----------------------------------------------------------+-----------------------------------------------------------+ | cs.procedure_name_to_model_vector | Python API classes that are no longer generated, the only | | cs.string_pair | entry points taking or returning them having been removed | | cs.xtype_render_style | with | | | binary analysis. | +-----------------------------------------------------------+-----------------------------------------------------------+ Warning Classes ~~~~~~~~~~~~~~~ New Warning Classes ^^^^^^^^^^^^^^^^^^^ Six of the eight new C/C++ warning classes are categorized under MISRA C++ 2023, and three under MISRA C 2023 and MISRA C 2025. Each warning class page lists every standard that the class is categorized under. ===== ========================================== ============================== \ New Warning Classes Mnemonic ===== ========================================== ============================== C/C++ \ Discarded LANG.CAST.DISCARD Explicit Type Conversion \ Inappropriate Use LANG.TYPE.IUOEV of Enumeration Value \ Member LANG.FUNCS.MFMRQ Function Missing Ref-qualifier \ Multiple CONCURRENCY.LOCK.MUCV Uses of Condition Variable \ Negative MISC.NEGWCHAR Wide Character Value \ Smart Pointer LANG.FUNCS.SPRAWCTOR Constructed From Raw Pointer \ Struct or Union LANG.TYPE.NOTHIDDEN Implementation Not Hidden \ Use LANG.MEM.ADVANCED of Advanced Memory Management Java \ Potential JAVA.CONCURRENCY.LOCK.NESTED Deadlock via Nested Synchronization (Java) C# \ Potential CSHARP.CONCURRENCY.LOCK.NESTED Deadlock via Nested Synchronization (C#) ===== ========================================== ============================== The CERT-C mapping tables in CERT Checks and CERT Broad Mappings now list warning classes in separate columns for C and C++, and mark which CERT-C rules the SEI CERT C++ Coding Standard lists as also applying in C++. The new Java and C# warning classes are disabled by default. The Java class also applies to Kotlin code targeting the JVM when it is analyzed with ``cs-java-scan``. .. _cs27_wcs: Warning Class Changes ~~~~~~~~~~~~~~~~~~~~~ C/C++ Warning Classes ^^^^^^^^^^^^^^^^^^^^^ .. _cs27_mod_ccpp_wcs: Modified C/C++ Warning Classes '''''''''''''''''''''''''''''' ====================== ====================== ================================================================= Modified Class Changes ====================== ====================== ================================================================= Basic LANG.TYPE.BASIC Plain ``char`` is now exempt, in accordance with newer Numerical Type Used MISRA specifications. Missing LANG.STRUCT.MRS ``main`` is now exempt where a language standard defines Return Statement reaching its closing brace as returning 0: C++, and C99 and later. Under C90 the exit status is instead indeterminate, so ``main`` is still reported there, as are entry points that no standard describes, such as ``wmain`` and ``WinMain``. Object Defined LANG.STRUCT.DEF.ODH Inline variables (C++17) are now exempt. in Header File Missing LANG.STRUCT.PARENS Now correctly reported for an operand that is a compile-time Parentheses constant or one needing an implicit conversion. A C++ ``static_cast``, ``dynamic_cast``, ``reinterpret_cast``, ``const_cast``, or functional-notation cast operand remains correctly exempt, since none of them require their operand to already be parenthesized. Use of LANG.STRUCT.EXCP.CATCH Now reports the enclosing procedure when the catch handler is catch inside one, matching the existing behavior of Use of throw. See `Notes on Upgrading `_. Pointed-to Type LANG.TYPE.CBCONST False positives where something writes through a pointer or Could Be const reference stored into an aggregate member of pointer-to-non-``const`` type, including a lambda's captures, are no longer reported. Where the member is a pointer to ``const`` the report is unchanged. In exchange the class now has false negatives: no such pointer is reported, even where nothing writes through it, as for a lambda that only reads through its capture. The same applies to a pointer whose address is stored into such a member, as when a pointer variable is captured by reference. Member Function LANG.TYPE.MFCBCONST False positives where a member function modifies the object Could Be const through a ``this`` captured by a lambda are no longer reported. In exchange the class now has false negatives: a member function that defines a lambda capturing ``this``, whether written out or implied by ``[&]`` or ``[=]``, is not reported even where the object is never modified — including a by-value capture (``[*this]``), whose lambda cannot modify the original object at all — and regardless of how else the function uses the object. Modification LANG.STRUCT.DECL.SNM A namespace-alias-definition written inside a function body of Standard Namespaces is no longer reported. Such an alias names nothing in the enclosing namespace, so writing one in, for instance, an out-of-line member of a ``std::hash`` specialization does not modify ``std``. An alias written directly in ``std`` or ``posix`` is still reported. ====================== ====================== ================================================================= Java Warning Classes ^^^^^^^^^^^^^^^^^^^^ Modified Java Warning Classes ''''''''''''''''''''''''''''' ============== ========================= ====================================================== Modified Class Changes ============== ========================= ====================================================== Double-Checked JAVA.CONCURRENCY.LOCK.DCL Now also mapped to CWE-543, in addition to CWE-366 and Locking (Java) CWE-609. ============== ========================= ====================================================== Kotlin Warning Classes ^^^^^^^^^^^^^^^^^^^^^^ The following existing warning classes now have corrected Kotlin language support, so that Kotlin source analyzed via cs-java-scan is checked consistently for these classes. ======================= ========================== ========================================================= Modified Class Changes ======================= ========================== ========================================================= Password JAVA.HARDCODED.PASSWD.FILE Now also checked for Kotlin source (previously in Property File (Java) Java-only). Double-Checked JAVA.CONCURRENCY.LOCK.DCL Now also applies to Kotlin (previously Java and C# only), Locking (Java) including the common companion-object singleton idiom. ======================= ========================== ========================================================= Several other existing warning classes (Cross Site Scripting, Cross Site Scripting In Error Message Web Page, DOS Injection, Format String Injection, Inadequate Salt, Open Redirect, and Unsafe Base64 Encoding, all *(Java)*) gained Kotlin language support that remains disabled by default, matching their existing Java default. Deleted Kotlin Warning Classes '''''''''''''''''''''''''''''' +--------------------------------------+-------------------------------------+--------------------------------------+ | Deleted Warning Class | Mnemonic | Notes | +======================================+=====================================+======================================+ | Potential Deadlock via ReentrantLock | KOTLIN.CONCURRENCY.LOCK.NESTED.RL | Subsumed by the new Potential | | (Kotlin) | | Deadlock via Nested Synchronization | | | | (Java) warning class, | | | | which analyzes Kotlin-on-JVM | | | | bytecode. | +--------------------------------------+-------------------------------------+--------------------------------------+ | Potential Deadlock via Synchronized | KOTLIN.CONCURRENCY.LOCK.NESTED.SYNC | Subsumed by the new Potential | | (Kotlin) | | Deadlock via Nested Synchronization | | | | (Java) warning class, | | | | which analyzes Kotlin-on-JVM | | | | bytecode. | +--------------------------------------+-------------------------------------+--------------------------------------+ | Potentially Unsynchronised Singleton | KOTLIN.CONCURRENCY.SINGLETON | Subsumed by the modified | | (Kotlin) | | Double-Checked | | | | Locking (Java) warning class, which | | | | analyzes Kotlin-on-JVM | | | | bytecode. | +--------------------------------------+-------------------------------------+--------------------------------------+ Configuration Parameters ~~~~~~~~~~~~~~~~~~~~~~~~ No configuration parameters were added or removed in this release. The following existing parameters have changed. Modified configuration parameters ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ =========================== ================================================================================== Parameter Change =========================== ================================================================================== ``WARNING_FILTER`` Two new actions, ``state:=`` and ``finding:=``, set a matching warning's State and Finding. Previously a rule could set only Priority and Owner. ``MOVED_FROM_UV_WHITELIST`` The factory setting has a new entry, ^std:.\*:\_Fwd_list_node_base:. Uninitialized Variable warnings are no longer issued for moved-from objects of that libstdc++ type, which underlies std::forward_list. Analyses of C++ code that moves from a ``std::forward_list`` may report differently. =========================== ================================================================================== .. _cs27_api: API Changes ~~~~~~~~~~~ New API Result Codes ^^^^^^^^^^^^^^^^^^^^ Two new ``cs_result`` codes: - CS_ERROR_IO_DELETE, set when a file cannot be deleted. - CS_ERROR_MALFORMED_PATCH_FILE, set when a patch file is not a well formed unified diff. See Source file patches. AST Class Changes ^^^^^^^^^^^^^^^^^ New unnormalized C/C++ AST classes: - cc:ctp-dependent-constant, a template parameter constant that wraps a non-dependent constant to cause it to be treated as template-dependent. - cc:ctp-concat-string-literals. - cc:pack-index-expr, a pack indexing expression. Modified unnormalized C/C++ AST classes: - ``cc:variable`` has new :is-inline attribute - ``cc:vla`` has new :sfid and :line attributes - ``cc:routine-type`` has new :ref-qualifier attribute Renamed and consolidated attributes. A plug-in that reads the old names must be updated. - ``cc:class-struct-union`` replaces :friend-routines and :friend-classes with a single :friends list, which also includes befriended templates. - ``cc:variable`` attribute :is-parameter-pack is renamed :is-pack. Plug-in Warning-Reporting API ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ The plug-in warning-reporting API can now attach *warning annotations* to a reported warning. Every warning-report entry point—the C functions csonar_report_warning() and its csonar_report\_*_warning() siblings, and the corresponding cs::warningclass report() / report_return_warning() methods—now takes a list of annotations (cs_warning_annotation_t in C, cs::warning_annotation in C++). Each annotation records a change to a warning report's priority, state, finding, or owner, along with an author, a timestamp, and an optional comment. The annotations form a timeline of report changes and appear as separate entries in the warning's change history in the hub GUI. Passing an empty list leaves the report unchanged. Plug-in AST Traversal Example ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ The Python astchecker.py module, shipped as an unsupported example, has been improved. It now runs much faster, avoiding redundant work as it traverses the AST. A plug-in that used it to match normalized ASTs must register those matchers with the new add_nast_matcher() rather than add_matcher(). Hub HTTP API ^^^^^^^^^^^^ When editing a project, project tree, launchd group, or role through the hub HTTP API, the old\_\ *field*\ \_hash request fields are now optional, as they already were on the analysis-editing endpoints. A client that omits them overwrites whatever is stored. Configuration Tool ~~~~~~~~~~~~~~~~~~ When ``codesonar config`` is used to enable the hub cluster's analysis cloud, it now also enables distributed parsing (``REQUEST_REMOTE_PARSE_SLAVES``) alongside distributed analysis (``REQUEST_REMOTE_ANALYSIS_SLAVES``), and applies the chosen analysis-parallelism level to ``PARSE_SLAVES`` as well as ``ANALYSIS_SLAVES``. Previously, the parse-phase options were left at their defaults, so parsing was never distributed to the analysis cloud, and the chosen parallelism level did not apply to the parse phase. Docker Image Build ~~~~~~~~~~~~~~~~~~ The Dockerfile.in template used to build a CodeSonar analysis Docker image now accepts a CSO_SRC build argument. Set it to the relative path, from the Docker build context root, of the CodeSonar installation being packaged. This lets the CodeSonar installation live in a subdirectory of the build context alongside the rest of your compiler toolchain, instead of requiring it to sit at the context root. .. _cs27_customer_tickets: Customer Tickets Fixed ~~~~~~~~~~~~~~~~~~~~~~ +---------------------------------------------------------------------------------------+------------------+---------+ | NAME | NUMBER | NOTES | +=======================================================================================+==================+=========+ | False positive "Pointed-to Type Could Be const" | #7434, CS0042416 | *fixed* | | (LANG.TYPE.CBCONST) and "Member Function Could Be | | | | const" (LANG.TYPE.MFCBCONST) warnings in C++ code that uses | | | | lambdas, and in C or C++ code that initializes an aggregate from | | | | a pointer. In exchange, false negatives: those constructs are no | | | | longer reported even where the report would be correct. See `Modified C/C++ Warning | | | | Classes `_ . | | | +---------------------------------------------------------------------------------------+------------------+---------+ | An analysis using the ``astchecker.py`` example plug-in | #7449, CS0042646 | *fixed* | | module, or a plug-in derived from it, could take far longer than | | | | the same analysis without it — hours rather than minutes on | | | | projects with deeply nested C++ templates. If your plug-in | | | | matches normalized ASTs, register those matchers with | | | | ``add_nast_matcher()`` rather than ``add_matcher()``; | | | | patterns against the unnormalized AST need no change, and a | | | | matcher left registered the old way silently stops matching. | | | +---------------------------------------------------------------------------------------+------------------+---------+ | On Windows, an MCP tool call such as list_warnings could deadlock and never | #7409, CS0043069 | *fixed* | | return. | | | +---------------------------------------------------------------------------------------+------------------+---------+ | False positive Data Race warnings for accesses protected | #7453, CS0043306 | *fixed* | | by FreeRTOS ``vTaskEnterCritical()`` | | | | and ``vTaskExitCritical()`` critical | | | | sections. In exchange, a false negative: every critical section is | | | | modeled as the same lock, so a race between two different ones is | | | | not reported. | | | +---------------------------------------------------------------------------------------+------------------+---------+ | Requesting cloud-analysis or remote parse slaves could fail | #7285, CS0043123 | *fixed* | | with an internal server error (``AssertionError``) when the | | | | requesting machine's operating-system account had no | | | | resolvable display name, for example, a numeric user id with no | | | | ``passwd`` entry, as can occur on some cloud instances. The | | | | request now succeeds, and the launch daemon is listed under its | | | | user id (or Windows SID). | | | +---------------------------------------------------------------------------------------+------------------+---------+ | In C++ code that declares a ``const`` object of a class | #7263 | *fixed* | | with empty base classes — for example, the C++17 overload-set | | | | idiom that inherits several empty function-object types — | | | | the analysis could evaluate that object's members to the wrong | | | | values. Warnings that depend on those members could be missed, or | | | | reported where they should not have been. | | | +---------------------------------------------------------------------------------------+------------------+---------+ | False positive ``LANG.STRUCT.DEF.ODH`` warning for C++17 | #7181, CS0042973 | *fixed* | | inline variables defined in header files, which C++17 permits. In | | | | exchange, a false negative: a project using this class as a blanket | | | | rule against data definitions in headers no longer gets those | | | | reports. | | | +---------------------------------------------------------------------------------------+------------------+---------+ | False positive ``LANG.TYPE.BASIC`` (Basic Numerical Type | #7129, CS0042877 | *fixed* | | Used) warning for plain ``char``, which newer MISRA | | | | specifications exempt. In exchange, a false negative: plain | | | | ``char`` is exempt unconditionally, including under an older | | | | specification that does not grant the exemption. | | | +---------------------------------------------------------------------------------------+------------------+---------+ | Kotlin analysis via ``cs-java-scan`` could abort with a | #7276, CS0043032 | *fixed* | | SARIF conversion error for certain warning classes: Cross Site | | | | Scripting, Cross Site Scripting In Error Message Web Page, DOS | | | | Injection, Format String Injection, Inadequate Salt, Open | | | | Redirect, Password in Property File, and Unsafe Base64 Encoding | | | | (all *(Java)*, also checked for Kotlin). | | | +---------------------------------------------------------------------------------------+------------------+---------+ | Analysis could abort with an internal error when the | #7316 | *fixed* | | ``LANG.STRUCT.SE.COND`` (Condition Contains Side Effects) | | | | check encountered certain valid C++ constructs in a condition, | | | | including a g++ pointer-to-member extension and several C++20 | | | | features. | | | +---------------------------------------------------------------------------------------+------------------+---------+ | False negative ``LANG.STRUCT.PARENS`` (Missing | #7347 | *fixed* | | Parentheses) warning for an operand that is a compile-time | | | | constant or needs an implicit conversion. A C++ | | | | ``static_cast``, ``dynamic_cast``, | | | | ``reinterpret_cast``, ``const_cast``, or | | | | functional-notation cast operand remains correctly exempt. | | | +---------------------------------------------------------------------------------------+------------------+---------+ | Analysis could abort with an internal error when parsing a | #7383, CS0042952 | *fixed* | | C++ class that inherits an overloaded assignment operator via a | | | | using-declaration from a dependent base class. | | | +---------------------------------------------------------------------------------------+------------------+---------+ | The C/C++ front end could crash on a class template instance | #7396, CS0043205 | *fixed* | | one of whose constructors has a C++20 trailing | | | | ``requires``-clause. The affected file was retried and then | | | | dropped from the analysis, which still reported success, so | | | | results for that file were silently missing. Applies to | | | | analyses that set ``RETAIN_UNNORMALIZED_C_AST = Yes``, which | | | | many presets do, among them the AUTOSAR and MISRA taxonomy | | | | presets and the CERT C and C++ presets. | | | +---------------------------------------------------------------------------------------+------------------+---------+ | On Windows, an analysis using ``-remote-archive`` | #7327, CS0043129 | *fixed* | | together with ``-foreground`` or ``-wait`` always | | | | failed. Separately, ``-remote-archive`` could fail | | | | intermittently on any platform. | | | +---------------------------------------------------------------------------------------+------------------+---------+ | False positive ``LANG.STRUCT.SE.INIT`` (Side Effects in | #7446, CS0043028 | *fixed* | | Initializer List) warning for capture-free lambda definitions; | | | | side effects elsewhere in the same initializer list are still | | | | reported. Also fixed a false negative: an immediately-invoked | | | | lambda in an initializer list is now recognized as a call, so this | | | | class and six others that check aggregate initializers may report | | | | where they did not before. | | | +---------------------------------------------------------------------------------------+------------------+---------+ | ``codesonar analyze -wait`` returned as soon as the hub | #7480 | *fixed* | | reported the analysis finished, which is before the analysis | | | | process itself is done. A command run next could therefore start | | | | while ``-remote-archive`` was still transferring the project | | | | files. When the analysis runs on the same machine, the wait now | | | | also covers that process's shutdown. | | | +---------------------------------------------------------------------------------------+------------------+---------+ | False positive Unreasonable Size Argument warning on a | #7146, CS0042689 | *fixed* | | fortified string or memory call (``__builtin_*_chk``) in code | | | | built with ``_FORTIFY_SOURCE``. A size your own code passes is | | | | still checked. | | | +---------------------------------------------------------------------------------------+------------------+---------+ | Parsing Qt headers with an ARM GCC compiler model could fail | #7235, CS0043024 | *fixed* | | with ``invalid redeclaration of type name "__fp16"``. The header patches that | | | | supplied that | | | | typedef has been removed. | | | +---------------------------------------------------------------------------------------+------------------+---------+ | False positive Missing Return Statement (LANG.STRUCT.MRS) | #7239, CS0042416 | *fixed* | | warning for ``main()`` under language standards that define | | | | reaching its closing brace as returning zero. | | | +---------------------------------------------------------------------------------------+------------------+---------+ | The ``$schema`` URL embedded in generated SARIF | #7249, CS0043048 | *fixed* | | documents pointed at a location that returned a 404. Generated | | | | SARIF now uses a durable link. | | | +---------------------------------------------------------------------------------------+------------------+---------+ | The MCP server now always runs analyses with | #7278, CS0043069 | *fixed* | | ``-no-services``, so an analysis no longer stalls on the | | | | Windows service authentication prompt. Its run_analysis tool also accepts | | | | ``clean``, ``name``, ``presets``, | | | | ``no_default_presets``, ``conf_files``, | | | | ``properties`` and ``srcroot``. | | | +---------------------------------------------------------------------------------------+------------------+---------+ | When an automatic processor failed to start, the hub log | #7282, CS0043128 | *fixed* | | recorded an ``AttributeError`` instead of the reason for the | | | | failure. | | | +---------------------------------------------------------------------------------------+------------------+---------+ | On Windows, ``codesonar mcp_server.py`` could fail with Please run 'codesonar | #7288, CS0043069 | *fixed* | | activate' to activate | | | | your CodeSonar installation on an installation that was | | | | already activated. | | | +---------------------------------------------------------------------------------------+------------------+---------+ | The ``BASE_IMAGE`` comment in the Windows Dockerfile | #7326, CS0043196 | *fixed* | | described the requirements for a Linux-based image. | | | +---------------------------------------------------------------------------------------+------------------+---------+ | Renaming hub roles, or adding or removing a role across many | #7341, CS0042511 | *fixed* | | users, could be done only one user at a time in the GUI or by | | | | calling the hub HTTP API directly. The new codesonar rename_roles.py and codesonar | | | | set_user_roles.py subcommands do | | | | both from a CSV file. | | | +---------------------------------------------------------------------------------------+------------------+---------+ | Enabling Modification of Standard Namespaces | #7382, CS0042952 | *fixed* | | (LANG.STRUCT.DECL.SNM) or Use of catch (LANG.STRUCT.EXCP.CATCH) | | | | made analysis very slow on heavily templated C++ code, such as | | | | code that uses Eigen3. | | | +---------------------------------------------------------------------------------------+------------------+---------+ | The manual did not describe how to upgrade a hub running in | #7432, CS0043200 | *fixed* | | the CodeSonar Hub Docker image. | | | +---------------------------------------------------------------------------------------+------------------+---------+