September 2026 change log

Feature Add

Java

• java-permissive-cors-annotation-ide
  • Created new rule to detect permissive Cross-Origin Resource Sharing (CORS) configurations in Spring applications where any origin is trusted (CWE-942):
    • Triggers when the Spring @CrossOrigin annotation sets its origins, value, or originPatterns attributes to the wildcard *, exposing endpoints to cross-origin data theft and unauthorized actions
    • Also fires when those attributes are left at their permissive default

Bug Fixes / Enhancement

Go

• go-hardcoded-secrets-basic-ide

  • Enhanced to reduce false positives while preserving credential detection:
    • Stopped flagging filenames ending in .pem, .key, .crt, or .pub, algorithm-identifier prefixes like ssh- and ecdsa-, distinguished-name strings such as CN=, and template placeholders
    • No longer treats metadata field names such as name, url, file, path, type, host, and port as secrets
    • Continues to detect literal credential terms including password, secret, token, and pass, along with common weak and default credential values

• go-hardcoded-secrets-library-ide

  • Enhanced to reduce false positives while narrowing to security-sensitive inputs:
    • Stopped matching non-secret HTTP headers such as X-Forwarded-Host and Content-Type, so only security-sensitive headers like Authorization, X-Api-Key, and Cookie are flagged
    • No longer flags struct field declarations without values or descriptive string-slice labels
    • Ignores test, fake, dummy, and placeholder credential values so example credentials no longer trigger findings

• go-csrf-missing-protection-ide

  • Enhanced to expand Cross-Site Request Forgery detection (CWE-352):
    • Added detection for gorilla/csrf with the disabled secure cookie flag via csrf.Secure(false)
    • Enhanced detection for gorilla/mux POST routes using HandleFunc().Methods() that lack CSRF protection
    • Added coverage for net/http handlers checking r.Method == http.MethodPost without proper CSRF protection

• go-os-command-injection-hb

  • Enhanced to expand OS command injection detection:
    • Added detection for command injection through shell interpreters covering bash, sh, zsh, and other common shells in exec.Command() calls
    • Enhanced source coverage to detect user input from bufio.NewReader(os.Stdin), database row scans, and command output capture from exec.Command().Output() and CombinedOutput()
    • Fixed incorrect CWE classification from CWE-95 (Eval Injection) to CWE-78 (OS Command Injection) for exec.Command() detection

• go-path-traversal-hb

  • Enhanced to recognize additional safe path-confinement idioms and reduce false positives:
    • Now recognizes the safe confinement idiom that combines path.Clean() with filepath.Join() and strings.Trim() to confine file access to a fixed base directory, and no longer flags it
    • Added the filepath.FromSlash(filepath.Clean()) variant paired with filepath.Join() as a recognized safe construction

• go-path-traversal

  • Enhanced to recognize additional safe path-confinement idioms and reduce false positives:
    • Recognizes the safe confinement idiom that cleans input with path.Clean() and confines it to a fixed base directory via filepath.Join() with strings.Trim()
    • Extended safe-construction recognition to the filepath.FromSlash(filepath.Clean()) variant and to cases where the base path is a const, so these constructions are no longer flagged

• go-file-read-taint

  • Enhanced to recognize additional safe path-confinement idioms and reduce false positives:
    • Recognizes the safe confinement idiom that cleans input with path.Clean() and confines it to a fixed base directory via filepath.Join() with strings.Trim()
    • Extended safe-construction recognition to the filepath.FromSlash(filepath.Clean()) variant and to cases where the base path is a const, so these constructions are no longer flagged

JavaScript

• javascript-code-injection-hb

  • Enhanced to focus detection on genuine code injection points:
    • Dropped detection of DOM manipulation points (document.write(), document.writeln(), innerHTML, outerHTML, insertAdjacentHTML()), which belong to cross-site scripting rather than code injection
    • The rule now focuses squarely on genuine code injection points such as eval(), setTimeout(), setInterval(), and Function

• javascript-os-command-injection-hb

  • Enhanced to improve precision and performance:
    • Improved detection precision by using exact variable-name matching for command-execution functions
    • Fixed false positives from database-related variables containing command keywords
    • Optimized performance to handle larger files while maintaining OS command injection detection coverage

• javascript-llm-prompt-injection

  • Enhanced to expand LLM prompt injection coverage:
    • Added three new LLM API sinks: OpenAI Responses API (responses.create), Cohere v2 (chat), and Vercel AI SDK (generateText)
    • Removed DOMPurify.sanitize, substring, slice, and replace from the sanitizers list because they do not neutralize prompt injection attacks (e.g., truncation or newline stripping alone is insufficient)

Kotlin

• kotlin-crypto-insecure-iv

  • Enhanced to broaden coverage of insecure cryptographic initialization vectors:
    • Broadened coverage of insecure IVs passed to IvParameterSpec() and GCMParameterSpec(), including IVs derived from string transformations via .toByteArray()
    • Added IVs built from ByteArray() initializer blocks and from concatenated byte arrays, while still allowing securely generated IVs from SecureRandom.nextBytes()

• kotlin-csrf-protection

  • Enhanced to cover an additional form of disabling CSRF protection (CWE-352):
    • Now recognizes the implicit lambda form csrf { it.disable() }, alongside the existing named-parameter form csrf -> csrf.disable() and the nested-call form

• kotlin-hardcoded-credentials

  • Enhanced to expand detection and reduce false positives:
    • Added detection for hardcoded credentials in Kotlin function default parameters and credential-named variable assignments
    • Fixed case-insensitive matching for getter function names to properly exclude legitimate credential accessor methods like getPassword() and fetchToken()
    • Enhanced filtering to exclude OAuth configuration values like client_secret, grant_type, and authorization_code, which caused false positives

• kotlin-hardcoded-secrets-library-ide

  • Enhanced to expand hardcoded credential coverage:
    • Added hardcoded credentials passed to Redis authentication points (jedis.auth(), JedisPool, JedisCluster, and redis:// connection URIs), PasswordAuthentication, and HTTP Authorization headers set via addHeader() and headers.append()
    • Added credential-named variables assigned hardcoded literal strings when passed to authentication and writer methods

• kotlin-insecure-tls-version

  • Enhanced to broaden coverage of insecure TLS/SSL protocol versions:
    • Broadened coverage of insecure TLS/SSL versions, including OkHttp tlsVersions() calls using deprecated versions such as TlsVersion.TLS_1_0, TlsVersion.TLS_1_1, and TlsVersion.SSL_3_0
    • Added insecure protocols configured through Apache SSLContextBuilder().useProtocol() and SSLContextBuilder().setProtocol()

• kotlin-jwt-none-algorithm

  • Enhanced to broaden coverage of JWTs signed with the NONE algorithm:
    • Broadened coverage of JWTs signed with the NONE algorithm via signWith(SignatureAlgorithm.NONE) and its string-based variant SignatureAlgorithm.valueOf("NONE")
    • Added the NONE algorithm passed indirectly through a variable, conditional expression, function parameter, or constructor before reaching signWith(), and empty signing keys set via setSigningKey("")

• kotlin-null-pointer-dereference

  • Enhanced to broaden nullable-dereference coverage while honoring null guards:
    • Added detection for null-pointer dereferences via the !! not-null-assertion operator and dereferences on nullable val/var values, covering field access, method calls, and invocations
    • Now honors null-guard patterns such as requireNotNull(), checkNotNull(), and if (x == null) return, so safely guarded dereferences are left alone
    • Retired the narrow member-specific logic (add(), put(), size(), toString(), toUpperCase(), exists()) in favor of broader nullable-dereference coverage

• kotlin-weak-password-encoder

  • Enhanced to identify weak password encoders by construction (CWE-261):
    • Now identifies weak password encoders by construction, covering NoOpPasswordEncoder, StandardPasswordEncoder, MessageDigestPasswordEncoder, ShaPasswordEncoder, Md5PasswordEncoder, and LdapShaPasswordEncoder, including the NoOpPasswordEncoder.getInstance() static factory
    • Added Md5PasswordEncoder to the recognized weak encoder classes
    • Retired the prior usage-based approach that traced .encode() and .encodePassword() back to construction, which missed weak encoders used as fields, @Bean return values, or fluent config

• kotlin-path-traversal-hb

  • Enhanced to improve performance and accuracy:
    • Optimized performance to handle larger files while preserving path traversal detection coverage for PlatformFile APIs
    • Improved accuracy in identifying sanitized PlatformFile operations

• kotlin-path-traversal-ide

  • Enhanced to reduce false positives:
    • Fixed false positives on Kotlin loadTemplate() calls that were incorrectly flagged as path traversal vulnerabilities when used for legitimate template loading operations
    • Resolved incorrect detection of Kotlin expect class declarations that were being matched as potential file access patterns despite performing no actual file operations

PHP

• php-csrf-missing-protection-ide
  • Enhanced to cover an additional Laravel CSRF bypass pattern:
    • Added detection for Laravel CSRF protection bypass when VerifyCsrfToken is imported with an alias and subclassed with non-empty except arrays

Python

• python-cdk-internet-access-enabled-for-sagemaker-notebook

  • Enhanced to fix detection gaps and reduce false positives:
    • Fixed detection gaps by expanding import patterns to accept both direct imports and alias imports for CfnNotebookInstance
    • Reduced false positives from props-spread calls by adding exclusions when the source dictionary explicitly sets direct_internet_access to Disabled

• python-cdk-msk-broker-logging

  • Enhanced to expand MSK broker logging detection:
    • Added support for plain aws_msk module imports followed by aws_msk.CfnCluster() calls
    • Fixed false negatives when logging_info was configured through helper functions instead of direct LoggingInfoProperty calls

• python-cdk-msk-broker-to-broker-tls

  • Enhanced to expand MSK broker-to-broker TLS detection:
    • Added detection for MSK clusters with TLS disabled using raw CloudFormation dictionary configurations
    • Fixed false negatives where in-cluster encryption settings passed through intermediate variables before reaching CfnCluster() constructor calls

• python-cdk-ec2-instance-termination-protection

  • Enhanced to expand coverage across CDK construct levels:
    • Fixed false negatives by extending detection to the CfnInstance class in addition to Instance, covering both high-level and CloudFormation-level CDK constructs
    • Added suppression for instances that explicitly enable termination protection via add_property_override("DisableApiTermination", True)

• python-cdk-elb-tls-https-listeners-only

  • Enhanced to expand ELB TLS/HTTPS listener detection:
    • Added detection for ELB listeners configured without TLS/HTTPS when using namespace-style CDK imports (aws_cdk.aws_elasticloadbalancingv2)
    • Fixed false negatives for CfnListener constructs created via aliased module imports
    • Extended coverage to detect missing TLS configuration across both Application and Network Load Balancer listener types

• python-cdk-neptune-cluster-encryption-at-rest

  • Enhanced to expand Neptune encryption-at-rest detection:
    • Fixed false negatives by adding detection for Neptune clusters created via namespace-style CDK imports (aws_cdk.aws_neptune)
    • Extended coverage to catch CfnDBCluster constructs with storage_encrypted=False using aliased module imports

• python-cdk-redshift-cluster-maintenance-settings

  • Enhanced to expand Redshift maintenance-settings detection:
    • Fixed false negatives by supporting namespace-style CDK imports (aws_cdk.aws_redshift) for Redshift cluster detection
    • Removed incorrect flagging of allow_version_upgrade=None
      • only False is now flagged, since None defaults to AWS-managed upgrade behavior

• python-cdk-redshift-require-tls-ssl

  • Enhanced to expand Redshift TLS/SSL enforcement detection:
    • Added detection for Redshift clusters missing TLS/SSL enforcement when created via namespace-style CDK imports
    • Extended coverage to CfnCluster constructs using aliased aws_redshift module references

• python-cdk-sagemaker-notebook-missing-encryption

  • Enhanced to expand SageMaker notebook encryption detection:
    • Fixed false negatives by adding detection for SageMaker notebook instances created via namespace-style CDK imports (aws_cdk.aws_sagemaker)
    • Extended coverage to CfnNotebookInstance constructs missing kms_key_id when using aliased module imports

• python-cdk-sns-topic-ssl-publish-only

  • Enhanced to expand SNS SSL publish-policy detection:
    • Added detection for SNS topics missing SSL-enforced publish policies when using namespace-style CDK imports and bare Topic() constructors
    • Fixed suppression logic to correctly validate SSL policy conditions - now verifies both the Effect and Bool value to avoid wrongly suppressing insecure configurations
    • Extended coverage to detect missing SSL enforcement in both PolicyDocument and CfnPolicy resource-bound guards

• python-cdk-sqs-queue-ssl-requests-only

  • Enhanced to expand SQS SSL request-policy detection:
    • Added detection for SQS queues missing SSL-enforced request policies when created via namespace-style CDK imports and bare Queue() constructors
    • Fixed suppression guards to verify enforcing idioms (Deny+false or Allow+true) rather than matching any SecureTransport condition regardless of effect
    • Extended resource-bound suppression to distinguish function-scoped, assigned, and bare forms to prevent cross-resource suppression

• python-cdk-open-search-slow-logs-to-cloud-watch

  • Enhanced to expand OpenSearch slow-log detection:
    • Added detection for AWS CDK OpenSearch domains created via module-alias imports that were previously missed
    • Fixed compliant-exclusion logic to use the correct API parameters slow_search_log_enabled and slow_index_log_enabled for proper logging validation
    • Enhanced detection to catch domains with reversed parameter order in LoggingOptions

• python-code-injection-hb

  • Enhanced to expand code injection source coverage for Flask:
    • Added detection for Flask request form data flowing into code execution points via request.form.get(), request.form.getlist(), and request.form.keys() methods
    • Extended coverage to include Flask request headers and cookies as injection sources through request.headers.get(), request.headers.getlist(), and request.cookies.get() methods
    • Added detection for query parameter injection via request.query_string and request.get_query_parameter()

• python-csrf-disabled-ide

  • Enhanced to expand Flask-WTF CSRF detection:
    • Added detection for Flask-WTF CSRF protection disabled via WTF_CSRF_ENABLED and WTF_CSRF_CHECK_DEFAULT configuration settings
    • Added detection for csrf.exempt() calls that bypass CSRF protection
    • Enhanced accuracy by excluding legitimate test configurations where TESTING = True

• python-os-command-injection-hb

  • Enhanced to expand OS command injection detection:
    • Added MCP (Model Context Protocol) tool-handler parameters as sources of untrusted input for command injection detection
    • Fixed subprocess.run(shell=True) not being detected due to an overly broad exclusion pattern that incorrectly suppressed the dangerous shell=True variant

• unsafe-cloudpickle-load

  • Enhanced to fix testability and improve detection:
    • Replaced two combining pattern: blocks (import cloudpickle
      • $VAR = cloudpickle.load($FILE)) that produced combinatorial overlapping matches - including matches anchored on the import line - which made the rule untestable. It now uses pattern-inside: import cloudpickle as a scope guard with a direct cloudpickle.load(...) match, emitting exactly one finding per load call
    • Fixed missed detections from the old assignment-only pattern, which only matched $VAR = cloudpickle.load(...) and skipped direct calls like return cloudpickle.load(fh). The new cloudpickle.load(...) pattern catches both assigned and direct calls

• python-dangerous-template-string

  • Enhanced to extend template injection detection to LangChain:
    • Added detection for user input flowing into LangChain PromptTemplate.from_template(), the PromptTemplate() constructor, ChatPromptTemplate.from_template(), and ChatPromptTemplate.from_messages() methods
    • Extended template injection coverage to LangChain framework prompt templates with Jinja2 format

Ruby

• ruby-csrf-disabled-ide
  • Enhanced to expand Rails CSRF detection and reduce false positives:
    • Fixed false positives in test environments by excluding test files and test-specific Rails configurations where CSRF protection is legitimately disabled by default
    • Added detection for Rails configuration-level CSRF disabling via action_controller.forgery_protection_origin_check, default_protect_from_forgery, and allow_forgery_protection settings
    • Added detection for explicit CSRF bypass using skip_forgery_protection method calls in Rails 5.2+ applications

Scala

• scala-cross-site-scripting

  • Enhanced to expand XSS detection in Play Framework:
    • Added Cross-Site Scripting (XSS) detection where attacker-controlled input reaches raw HTML rendering via Html(...) in Play Framework applications
    • Extended coverage to inputs arriving through query params and cookies via map { ... } and form data bound with bindFromRequest().fold(...)

• scala-hardcoded-secrets-basic-ide

  • Enhanced to broaden hardcoded credential detection (CWE-798):
    • Broadened coverage to catch secrets not identified by variable name, including provider-issued token formats such as glpat-, AIza, AKIA, gh*_, xox*-, sk_live_, SG., pypi-, ya29., and JWTs
    • Added credentials embedded in connection strings (scheme://user:pass@host) and secrets passed to credential methods such as setPassword(), setApiKey(), addHeader() (Authorization/x-api-key), UsernamePasswordCredentials, and BasicAWSCredentials
    • Added camelCase and prefixed credential names such as ftpPassword, redisPassword, and clientSecret

• scala-path-traversal

  • Enhanced to expand path traversal detection (CWE-22):
    • Added path traversal detection where request-derived input reaches file reads via Files.readAllLines(...)
    • Extended recognized input vectors to include getRequestURI, Play Framework request.cookies.get(...), request.body.asFormUrlEncoded, and multipart file.filename

• scala-os-command-injection

  • Enhanced to expand OS command injection detection (CWE-78):
    • Added OS command injection coverage for request-derived input reaching shell-execution sinks Seq(...).! and Process(...) where the input source was not previously recognized
    • Extended recognized input vectors to include request headers, cookies, form body fields, and JSON body values

• scala-zip-unzip-file-path-traversal

  • Enhanced to expand zip-slip path traversal detection (CWE-22):
    • Added zip-slip path traversal detection through raw Java zip extraction APIs including ZipInputStream, ZipArchiveInputStream, and ZipFile
    • Covers unsanitized archive entry paths built with new File(...) and Paths.get(...) using entry.getName

• scala-csrf-disabled-ide

  • Enhanced to expand Spring Security CSRF detection:
    • Added detection for Spring Security CSRF disabling via the modern Customizer lambda syntax http.csrf(csrf => csrf.disable()) and method-reference patterns
    • Fixed coverage gaps for Scala shorthand lambda syntax http.csrf(_.disable())
    • Enhanced detection to catch the AbstractHttpConfigurer.disable() method-reference pattern used in newer Spring Security configurations

TypeScript

• typescript-sql-injection-hb
  • Enhanced to expand SQL injection detection and reduce false negatives:
    • Enhanced detection for SQL injection in AWS Lambda event parameters including body, queryStringParameters, and pathParameters
    • Improved parameterized query detection to better identify safe parameter variable names, reducing false positives
    • Expanded coverage beyond Express.js Request patterns to include serverless and other TypeScript application structures