Changelog

Track the evolution of Code Pathfinder with detailed release notes and updates.

Release v0.0.31

v0.0.31November 5, 2024
View on GitHub

What's new?

This release has query support for BreakStmt, ContinueStmt, YieldStmt, IfStmt, DoStmt, WhileStmt, ForStmt statements in source code (java) ☕ 🎉

Read latest blog post about detecting Webview vulnerabilities using Code-Pathfinder

What's Changed

Full Changelog: https://github.com/shivasurya/code-pathfinder/compare/v0.0.30...v0.0.31

Release v0.0.30

v0.0.30October 17, 2024
View on GitHub

What's Changed

Full Changelog: https://github.com/shivasurya/code-pathfinder/compare/v0.0.29...v0.0.30

Release v0.0.29

v0.0.29October 15, 2024
View on GitHub

This release has exciting new features such as CI command to scan source code for vulnerabilities within CI/CD ♾️ pipeline, docker support, GitHub Action support. 🎉

What's New?

  1. Code-Pathfinder is now available in docker hub. Give it a try by pulling shivasurya/code-pathfinder:stable-latest 🐳
  2. GitHub Action is now supported and you can start scanning source code. 🎉
# add as step to github action yaml file
    - name: Code-Pathfinder SAST Scan
            uses: shivasurya/code-pathfinder@main
            with:
              command: 'ci'
              project: '.'
              output-file: 'output.json'
              output: 'json'
              ruleset: 'cpf/java'
  1. Code-Pathfinder now supports CI command to scan for vulnerabilities in source code. ♾️
$ pathfinder ci --project /src/code-pathfinder/test-src --ruleset cpf/java --output json --output-file output.json
...
Executing in CI mode ♾️

Checkout Code-pathfinder rules registry here

MS Dhoni Tenor (1)

What's Changed

Full Changelog: https://github.com/shivasurya/code-pathfinder/compare/v0.0.28...v0.0.29

Release v0.0.28

v0.0.28October 7, 2024
View on GitHub

This release adds exciting new features such as support for querying ClassInstanceExpr where you could search for objects created with class. We have featured new blog post about codepathfinder. I have published various code pathfinder rules targeting generic java application

Code-Pathfinder Rules

  • Usage of RC2/RC4 cipher
  • Usage of deprecated DefaultHTTPClient
  • Usage of SHA1 hash functions
  • Usage of insecure Random functions for cryptographic purposes
  • Usage of Blowfish crypt methods
  • <More to come in next releases covering OWASP Top 10>

What's New?

Chore

Full Changelog: https://github.com/shivasurya/code-pathfinder/compare/v0.0.27...v0.0.28

Release v0.0.27

v0.0.27September 24, 2024
View on GitHub

This release gives a huge boost to query structure and support by adding predicate support and SELECT entity keyword in code-pathfinder queries parity to CodeQL. 🚀

  1. You can now declare predicates within the CQL query and invoke them within the query. It improves re-usability and puts us in better place to implement class and predicates in future release 🏅

    predicate isPublicOrProtected(method_declaration md) {
    md.getVisibility() == "public" || md.getVisibility() == "protected"
}

FROM method_declaration AS md
WHERE isPublicOrProtected(md)
SELECT md, "Listing all public or protected methods"

  2. You can now use SELECT keyword to pick specific one from the bunch of result. ⛏️

    FROM method_invocation AS mi
WHERE mi.getName() == "setJavaScriptEnabled" && "true" in mi.getArgumentName()
SELECT mi, "Enabling JavaScript execution in a WebView can result in cross-site scripting attacks."

What's New?

Chore

Full Changelog: https://github.com/shivasurya/code-pathfinder/compare/v0.0.26...v0.0.27

Showing 21-25 of 30 releases
Previous
5 / 6
Next

Stay Updated

Watch our GitHub repository to get notified about new releases.

Star on GitHub