August 2026 change log

Bug Fixes / Enhancement

C#

• csharp-sql-injection-hb

  • Enhanced to expand SQL injection coverage (CWE-89) with additional input sources and vulnerable execution points:
    • Added Request.Params.Get() and Request.Cookies[...].Value as user-controlled input sources
    • Added OdbcCommand, OleDbCommand, SqlDataAdapter, and string concatenation/interpolation in CommandText assignments as vulnerable sinks
    • Added Enterprise Library (GetSqlStringCommand, ExecuteDataSet), NHibernate (CreateSQLQuery), EF Core (FromSqlRaw), and MySqlHelper execution methods as additional sinks

• csharp-csrf-disabled-ide

  • Enhanced to expand Cross-Site Request Forgery detection (CWE-352) to cover additional ways IgnoreAntiforgeryTokenAttribute can be applied:
    • Covers object initializer syntax, generic method call forms, and ordered filter registration overloads

Go

• go-path-traversal-hb

  • Enhanced to expand path traversal detection (CWE-22) with additional input sources, sinks, and corrected sanitizer handling:
    • Adds URL-decoded paths (url.PathUnescape), string-manipulated request paths (strings.TrimPrefix), and multipart form file uploads (FormFile().Filename) as user-controlled input sources
    • Adds os.ReadFile and os.WriteFile as vulnerable file operation sinks
    • Removes filepath.Join, filepath.Clean, and filepath.Dir as standalone sanitizers (they do NOT prevent path traversal on their own); only filepath.Base is retained as a true sanitizer

• rule-hardcoded-credentials

  • Enhanced to broaden hardcoded credential detection to cover additional connection APIs:
    • Detects hardcoded credential URLs passed to amqp.Dial, nats.Connect, redis.DialURL, url.Parse, and SetURL
    • Detects hardcoded credentials embedded in URL format strings built with fmt.Sprintf
    • Detects hardcoded values assigned to credential-named variables such as nkey, seed, SecretKey, AuthKey, connStr, dsn, pw, keyAuth, and authHeader
    • Detects NATS connect protocol strings and route/leaf URI variables with embedded passwords

Java

• java-csrf-missing-protection-ide
  • Enhanced to cover an additional pattern for disabling Spring Security CSRF protection:
    • Detects the split form where a CsrfConfigurer is stored in a local variable before .disable() is called, rather than chained inline

JavaScript

• javascript-csrf-missing-protection

  • Enhanced to detect two additional patterns for missing or bypassed CSRF protection:
    • ApolloServer configurations where CSRF prevention is explicitly disabled via csrfPrevention: false
    • doubleCsrf(csrf-csrf) configurations where state-changing HTTP methods are excluded from CSRF enforcement via ignored methods

• javascript_llm_unbound_consumption

  • Enhanced to broaden coverage for missing token output limits across JavaScript and TypeScript LLM integrations:
    • Adds coverage for LangChain chat model constructors (ChatOpenAI, ChatAnthropic, ChatBedrock, ChatGoogleGenerativeAI, ChatMistralAI), Vercel AI SDK (generateText, streamText, generateObject, streamObject), Groq, Together AI, AWS Bedrock Converse API, Google @google/genai, Ollama, Mistral, Genkit, and Cohere v2
    • Recognizes max_completion_tokens (OpenAI o-series) and max_output_tokens (OpenAI Responses API) as valid output caps
    • Recognizes num_predict as an output cap for Ollama

Kotlin

• kotlin-csrf-protection

  • Enhanced to cover additional Spring Security 6 patterns for disabling CSRF protection:
    • Detects the AbstractHttpConfigurer::disable method reference used in Spring Security 6 servlet configurations
    • Detects the split form where a CSRF configurer is stored in a variable before .disable() is called

• kotlin-path-traversal-hb

  • Enhanced to expand path traversal (CWE-22) coverage across Kotlin file and I/O APIs:
    • Adds File and Files API methods outputStream(), inputStream(), writeText(), writeBytes(), readBytes(), newInputStream(), newOutputStream(), and FileOutputStream() as vulnerable output points
    • Adds Ktor PartData.FileItem.originalFileName and Spring @RequestParam, @PathVariable, and @RequestHeader annotated parameters as user-controlled input sources
    • Fixes rule message formatting so that FilenameUtils.normalize() renders as inline code

• kotlin-insecure-bean-validation

  • Enhanced to improve performance by:
    • Reducing scan latency on large Kotlin codebases with detection behavior unchanged

• kotlin-jwt-none-algorithm

  • Enhanced to improve performance by:
    • Improving performance for large Kotlin files while fully preserving detection of JWT None algorithm vulnerabilities

• kotlin-incorrect-password-hashing

  • Enhanced to improve performance by:
    • Improving performance for large Kotlin files; direct password-to-MessageDigest detection is fully preserved
    • Note: a narrow code shape involving hardcoded passwords returned from separate private functions is no longer covered

PHP

• php-path-traversal-hb
  • Enhanced to expand path traversal (CWE-22) detection and reduce false positives on validated paths:
    • Adds move_uploaded_file(), DirectoryIterator, and SplFileObject as vulnerable file operation output points
    • Recognizes realpath(), pathinfo($path, PATHINFO_BASENAME), and str_replace() as safe path-neutralization functions, so properly validated paths are no longer flagged
    • Fixes rule message formatting so that ZipArchive, PharData, Laravel Storage, realpath(), and Storage::path() render as inline code

Python

• python-hardcoded-credentials-for-library-ide

  • Enhanced to fix 22 false negatives by expanding hardcoded credential detection to additional Python libraries:
    • Adds Atlassian (Jira, Confluence, Bitbucket), Gitlab, Grafana, Instagram, and Telegram library patterns for direct, variable indirection, and indirect list/dict credential passing
    • Expands HTTP header key detection (CSRF variants, X-Shopify-Access-Token, DD-APPLICATION-KEY, access-token) and Requests library header patterns

• python-llm-unbounded-consumption

  • Enhanced to broaden detection of unbounded LLM token consumption while reducing false positives:
    • Adds coverage for OpenAI Responses API, Bedrock Converse and Converse Stream, Mistral, Lite LLM, Cohere V2, and modern LangChain constructors
    • Recognizes max_completion_tokens as a valid token-limit parameter for OpenAI-compatible clients, so calls with a cap already set are no longer flagged
    • Fixes false positives in generic HTTP URL handling and Gemini generation_config usage

• untrusted-data-in-django-response

  • Enhanced to reduce false positives by recognizing common HTML-escaping functions as safe:
    • html.escape(), bleach.clean(), markupsafe.escape(), and Django's format_html() are now recognized as XSS mitigations, so Django responses using these functions are no longer flagged

• python-no-sql-injection

  • Enhanced to resolve timeout failures on large Python files by removing expensive structural sanitizer patterns:
    • Removes 12 deeply nested pattern-inside sanitizer blocks with $COLLECTION.$METHOD(...) matching that caused O(n) full taint-path evaluation per sanitizer check
    • Removes 2 redundant propagators (dict.get, dict()) and 8 duplicate source entries, reducing rule YAML lines while preserving all 32 detections

• python-cdk-s3-server-access-logs-disabled

  • Enhanced to expand detection of missing S3 server access logging (CWE-306) in Python CDK to cover aliased import styles:
    • Now flags s3.Bucket(...) calls (via from aws_cdk import aws_s3 as s3) that omit server_access_logs_bucket, in addition to the direct import form

• python-path-traversal-hb

  • Enhanced to expand path traversal detection (CWE-22) in Python to cover additional file-open APIs and multi-value form inputs:
    • User-controlled input flowing into codecs.open() is now flagged
    • Multi-value form inputs via request.getlist() are now covered through consolidated request-method source tracking

• python-prompt-injection-vulnerability

  • Enhanced to extend prompt injection detection to cover additional request sources and LLM output APIs, while reducing false positives on non-LLM code:
    • Added request sources: .data, .body, args.to_dict(), and cookies.get(), as well as InferenceClient.text_generation() as a vulnerable output point
    • Narrowed input tracking to reduce false positives on variables unrelated to LLM pipelines

• python-insecure-random

  • Enhanced to expand insecure randomness detection (CWE-330, CWE-338) to cover session and cookie assignment patterns:
    • Flags values from random module methods including normal variate stored in session or authentication-related dictionary keys
    • Flags insecure random values passed directly to response.set_cookie()

• dangerous-template-string

  • Enhanced to extend Server-Side Template Injection detection (SSTI/RCE, CWE-94) to cover LangChain prompt construction APIs:
    • Flags untrusted input flowing into PromptTemplate.from_template, the PromptTemplate constructor, ChatPromptTemplate.from_template, and ChatPromptTemplate.from_messages when Jinja2 template format is enabled

Ruby

• ruby-path-traversal-hb
  • Enhanced to fix rule message formatting for better readability and expand coverage:
    • File.expand_path, File.basename, start_with?, and ../ now render as inline code in the customer-facing message
    • Added Rails/Rack HTTP request sources: request.path_parameters, request.query_parameters, and request.GET, and added Rails send_file path sink detection
    • Improved Pathname sanitization handling with cleanpath
      • start_with? prefix validation to prevent false positives on validated paths

Scala

• scala-log-injection-ide

  • Enhanced to resolve timeout issues on larger codebases by consolidating redundant patterns:
    • Consolidated 41+ source patterns into metavariable-regex groups, 16 individual logger sinks into a single pattern, and ~35 sanitizers down to ~25 (including unified HtmlUtils and StringEscapeUtils matching)
    • Removed redundant StringBuilder/String.format compound sink already handled by pattern-propagator; all 19 detections preserved with zero semantic changes

• scala-no-sql-injection-hb

  • Enhanced to narrow NoSQL injection coverage to reduce noise and fix timeout issues:
    • Removes BSONDocument, BSONDocument.parse, BasicDBObject, Document, and Json.parse as NoSQL injection output points
    • Removes overly broad session, flash, and cookie access patterns, replacing them with scoped matching for cookies, session, flash, and headers accessors

• scala-path-traversal-hb

  • Enhanced to remove categories of false positives that caused timeout issues:
    • Added detection for Akka HTTP path (Segment) and parameter() directives as input sources, Files.newOutputStream/newInputStream as sinks, and Play Framework sendPath()/sendFile() as traversal-vulnerable output points
    • Resolved timeout failures by removing false-positive-prone sources (message queues, HTTP clients, XML/JSON parsers, config loaders, CLI arguments) and adding getQueryString as a focused HTTP input source

• scala-simple-db-query-injection

  • Enhanced to resolve timeout issues on larger codebases:
    • Removed leading ... wildcards from 2 pattern-sanitizer blocks that caused O(n²) quadratic backtracking, improving stable threshold from 1x (1,113 lines) to 8x (8,912 lines)

• scala-sql-injection

  • Enhanced to resolve timeout issues and extend Play Framework coverage:
    • Optimized the SQL injection rule to reliably scan larger files without timeouts, ensuring consistent detection coverage across all codebase sizes
    • Directly detects user-controlled input from Play Framework's getQueryString(), body, and headers.get() without requiring a specific Action handler structure

TypeScript

• regex-injection-dos-ts-rule

  • Enhanced to expand ReDoS detection to cover more ways user input reaches RegExp:
    • Adds direct pass, type assertions, .toString(), bracket access, Express 3.x req.param(), and variable assignment flows as paths where user-controlled input can trigger catastrophic backtracking
    • Updated rule classification to CWE-20 (Improper Input Validation)

• typescript-cross-site-scripting-ide

  • Enhanced to expand XSS detection coverage (CWE-79):
    • jQuery DOM manipulation methods html, wrap, append, prepend, after, before, replaceWith, and globalEval are now flagged as XSS output points, along with jQuery selector injection
    • window.location, document.cookie, jQuery attr, axios.get, and array methods including split, slice, join, sort, filter, forEach, and map are now recognized as user-controlled input sources or propagators
    • Res.render and Object.assign to res.locals are flagged as server-side XSS output points

• typescript-csrf-missing-protection-ide

  • Enhanced to expand Cross-Site Request Forgery detection (CWE-352) to cover additional CSRF middleware configurations:
    • Detects Apollo Server configured with csrfPrevention: false
    • Detects doubleCsrf(csrf-csrf) and csurf middleware configured to skip validation on state-changing HTTP methods (POST, PUT, PATCH, DELETE)

• typescript-server-side-request-forgery-ide

  • Enhanced to add three new categories of SSRF-vulnerable output points:
    • net.Socket.connect() when the destination host is user-controlled
    • Puppeteer/Playwright APIs page.setContent(), page.evaluate(), and page.evaluateOnNewDocument(), where user-controlled content is injected into a headless browser context
    • Direct request() invocation and needle() for user-controlled URLs

• xml2json-xxe-ts-rule

  • Enhanced to extend XXE vulnerability detection (CWE-611, CWE-776) to cover additional XML parsing libraries:
    • Added coverage for node-expat (parser.parse(), parser.write()) and libxml (parseXml() with external entity expansion enabled), in addition to the existing xml2json.toJson() coverage