Release Notes - 2.3

2.3.19-funcrel

Fixes/Bugs

Customer Ticket Id	Customer Details
57017	Fixes missing services from some jsp files
56936	Repairs incorrect urls for some HTTP resources when an “if” statement without “endif” is encontered in evaluation
	Repairs badly formed urls (which contain bad characters)
	Merges resource services with same url/parent/type
	Removes multiple resource services with same name in some jsp files containing forms with "html:hidden" tags present in them.
	Skips analysis of some 3rd party library files.
	Fixes the caller of some resource services
	Removes links from a same caller in a js file to multiple functions present in asp/aspx/jsp files
57000	Fixes missing violations or bad positions on several metrics for 1020198 - Avoid using IE conditional comments and 1030104 - Avoid using CSS selector hacks (CSS)
	Fixes missing violations present at file level, for all rules
	Fixes false violations for 1020104 - "Avoid hardcoded passwords (Javascript)".
57544	Removes warning in CMS Assessment Model about rule 1030100 - Avoid using IE filters and -ms-filter (CSS)
	Fixes missing links for function calls in jsp files with "<%" preprocessing placed between 2 pairs of attribute/value
	Removes multiple resource services with same url when urls are sent through a "XMLHttpRequest" object.
	Remove false violations for rules on css when css code is present in html files in "<!– … –>" comments

Enhancement/Improvements

Customer Ticket Id	Customer Details
	Allows to pass heuristics in evaluation (technical).
	Updates name of functions defined as params['cartContents'] = function() {…} which should not be "params"

2.3.18-funcrel

Fixes/Bugs

Customer Ticket Id	Customer Details
	Creates PATCH, instead of POST resource services when "patch" is used as method.
56355	Fixes resource service URLs resolution when evaluation passed through a "try…catch" block
	Fixes links from jsp files to functions present in other jsp files is some cases when several functions with same names exist.
	Skips analysis of some 3rd party library files.
	Fixes analysis of html or jsp files containing "< –" inside a string which may be seen as a begining of comment.
	Fixes links from jsp files to functions in other jsp files when the call is preceded by "."
	Fixes caller of resource services in some rare cases.
56384	Fixes the parsing of html like files containing a generated `<script>` part with a very long line (analysis could take a very long time or crash).
56690	Fixes missing resource service object from Kendo, and from "location.href=…"
56714	Fixes missing Link from HTML to Javascript when reference to js file in the html file is prefixed with a non existing directory.
56123	Improves accuracy of rules: 1020150 - Avoid using window.event, 1020056 - Avoid using Javascript Document.all collection, 1020118 - Avoid using ActiveXObject/window.external, 1020156 - Avoid using window.createPopup, 1020170 - Avoid using XDomainRequest, 1020162 - Avoid using document.selection, 1020160 - Avoid using document.documentMode.

New Support

Customer Ticket Id	Customer Details
	Adds support of *.es6 source files
	1020186 - Avoid using `<font>` element
	1030100 - Avoid using IE filters and -ms-filter (CSS)
	1020184 - Avoid using Meta X-UA-Compatible header
	1020198 - Avoid using IE conditional comments.
	1020196 - Avoid using outdated / quirks-mode DOCTYPE
	1020194 - Avoid using presentational HTML attributes (bgcolor, border, align, valign, nowrap)
	1020192 - Avoid using `<big>` element
	1020190 - Avoid using `<marquee>` / `<blink>` elements
	1020188 - Avoid using `<center>` element
	1020188 - Avoid using `<center>` element,
	1030102 - Avoid using zoom for Layout (CSS)
	1030104 - Avoid using CSS selector hacks: * html, *+html (CSS)
	1030106 - Avoid using property name hacks (_property, *property) (CSS)
	1030108 - Avoid using CSS hack values (\9, \0/) (CSS)
	1030110 - Avoid using Vendor Prefix without Standard Fallback (CSS)
	1030112 - Avoid using IE-only gradient (CSS)
	1020180 - Avoid missing default in switch statements (Javascript)
	1020182 - Avoid using break statement in FOR loops (Javascript)
	1020176 - Avoid empty catch blocks (Javascript)
	1020178 - Avoid empty finally blocks (Javascript)

Enhancement/Improvements

Customer Ticket Id	Customer Details
	Renamed as 1020142 - Avoid using deprecated properties of navigator object and better check the rule increasing the number of obsolete properties

Deprecation

Customer Ticket Id	Customer Details
	Deactivates rule: 1020166 - Avoid using navigator.appName === "Microsoft Internet Explorer" (Javascript)

2.3.17-funcrel

Fixes/Bugs

Customer Ticket Id	Customer Details
	Fixes resolutions related to following Traceback error present in the log file.
55994	Fixes missing resource service related to Kendo framework using datasource
56237	Fixes duplicate resource services (same url) in some cases when Kendo framework is used.
56010	Fixes missing resource service related to Kendo framework
55946	Fixes analysis crash when parsing some js files
	Avoids analyzing client libraries
56123	Improves accuracy of rule : 1020152 - Avoid using window.showModalDialog() (Javascript).
	Fixes missing violations for all quality rules about javascript code in html, jsp… files
56152	Fixes analysis crash when analyzing some jsp files

2.3.16-funcrel

Fixes/Bugs

Customer Ticket Id	Customer Details
55131	Fixes missing resource services for url calls inside a self-invoking function positioned just after a statement without the ending ";"
	Repairs resource service urls where "${my_var}" is not replaced with "{}" or the variable value.
	Repairs resource service urls containing "<s:if …"
	Repairs resource service urls containing "<bean:write name="…" property="…"/>"
	Repairs resource service urls containing "<#if checked=="checked">&deleteFilter=true</#if>"
	Repairs resource service urls containing "<wiki:Link jsp='…' format='url'/>"
	Repairs resource service urls containing "<html:rewrite page="…"/>"
	Repairs resource service urls starting with "data:" such as "data:application/" or "data:image/"
	Avoids analyzing client libraries
	Fixes include links on files containing IBM Net.Data code when caller file has same basename as called file

New Support

Customer Ticket Id	Customer Details
	Adds new rule: 1020112 - Avoid setting an event handler like onclick, onmouseover, onsubmit… using element.setAttribute()
	Adds new rule: 1020114 - Avoid using navigator.vibrate() (broadly unsupported on desktop; fading)
	Adds new rule: 1020116 - Avoid proto and legacy getter/setter methods
	Adds new rule: 1020118 - Avoid using ActiveXObject / window.external (IE-only)
	Adds new rule: 1020120 - Avoid using DOM Mutation Events (DOMNodeInserted, DOMSubtreeModified, …)
	Adds new rule: 1020122 - Avoid using Event.initEvent() / initMouseEvent() / initUIEvent()
	Adds new rule: 1020124 - Avoid using String.prototype.substr()
	Adds new rule: 1020126 - Avoid using arguments.callee / Function.prototype.caller
	Adds new rule: 1020128 - Avoid using document.domain for same-site relaxation
	Adds new rule: 1020130 - Avoid using document.execCommand() (clipboard/rich-text)
	Adds new rule: 1020132 - Avoid using document.write()
	Adds new rule: 1020134 - Avoid using escape() / unescape()
	Adds new rule: 1020136 - Avoid using event.keyCode / which / charCode
	Adds new rule: 1020138 - Avoid using event.returnValue
	Adds new rule: 1020140 - Avoid using navigator.getUserMedia
	Adds new rule: 1020142 - Avoid using navigator.userAgent parsing for feature gates
	Adds new rule: 1020144 - Avoid using requestFullscreen(Element.ALLOW_KEYBOARD_INPUT)
	Adds new rule: 1020146 - Avoid using synchronous XMLHttpRequest (async = false)
	Adds new rule: 1020148 - Avoid using vendor-prefixed requestAnimationFrame (webkit, moz, ms, o)
	Adds new rule: 1020150 - Avoid using window.event
	Adds new rule: 1020152 - Avoid using window.showModalDialog()
	Adds new rule: 1020154 - Avoid using attachEvent
	Adds new rule: 1020174 - Avoid using VBScript blocks
	Adds new rule: 1020156 - Avoid using window.createPopup
	Adds new rule: 1020158 - Avoid using element.currentStyle
	Adds new rule: 1020160 - Avoid using document.documentMode
	Adds new rule: 1020162 - Avoid using document.selection/createTextChange
	Adds new rule: 1020164 - Avoid using outerHTML
	Adds new rule: 1020166 - Avoid using navigator.appName == "Microsoft Internet Explorer"
	Adds new rule: 1020168 - Avoid user-agent based IE detection
	Adds new rule: 1020170 - Avoid using XDomainRequest
	Adds new rule: 1020172 - Avoid using innerText

2.3.15-funcrel

Fixes/Bugs

Customer Ticket Id	Customer Details
	Fixes number of code lines when html files are UTF-16 encoded
	Fixes some resolutions inside modules
	Fixes some bugs linked to strings inside backquotes (duplicated links to tables if the string contains sql for example)
	Fixes some resolutions to "require" variables (the bug could provoke some missing links)
	Skips analysis of following library "http://imakewebthings.com/waypoints"
55184	Fixes multiple links creation for one function call when several functions with same name exist in several files
	Fixes some resolutions in some cases when "this" is used alone

New Support

Customer Ticket Id	Customer Details
	Adds support of ky and ky-universal HTTP client framework
	Adds support of Undici HTTP client framework
	Adds support of IBM Net.Data framework, a Web 1.0 technology (Server-Side Web Engine (CGI)) to web-enable Db2 for i (AS/400) as well as Db2 for OS/390, and z/OS.

2.3.14-funcrel

Stability

Customer Ticket Id	Customer Details
	Fixes never ending analysis

Fixes/Bugs

Customer Ticket Id	Customer Details
	Eliminates following files from files to be skipped by analysis: "assets/js/app.js" and "assets/js/module.js"
	Repairs some resolution coming from modules inside self invoking functions

2.3.13-funcrel

Stability

Customer Ticket Id	Customer Details
54906	Fixes crash during light parsing.

Fixes/Bugs

Customer Ticket Id	Customer Details
	Fixes some links when "require" or "import" statements are present in code.
	Fixes missing links when lodash "flow" function is used.
	Fixes missing links when lodash "merge" and "cloneDeep" functions are used
	Fixes some missing links when "define([…], function () {})" is used.
54880	Fixes missing http ressources when using "kendoGrid" with dataSource defined with "new kendo.data.DataSource(…)"

2.3.12-funcrel

Fixes/Bugs

Customer Ticket Id	Customer Details
	Fixes bad evaluations in some rare cases
54582	Fixes missing http request when Kendo is used through AngularJS framework in html files
54647	Fixes missing http request when Kendo is used through AngularJS framework in html files
54592	Fixes missing http request when an url is set through `<object>`.setAttribute('action', 'my_url')

Enhancement/Improvements

Customer Ticket Id	Customer Details
	Removes BuildLog.htm (Visual Studio logs) from analysis to improve results.

2.3.11-funcrel

Fixes/Bugs

Customer Ticket Id	Customer Details
53657	Repairs missing resource services when kendo framework is used with the "nameof" razor operator.
53656	Repairs missing links from cshtml files to js code when "~" is present in "src" script attribute
53812	Repairs urls for some axios resource services when these urls where empty.
	Repairs some missing resource services when Kendo UI data source is used.
	Repairs some missing resource services when setAttribute("src", url) is called on a DOM element of "iframe" type.
	Repairs some missing urls when code is splitted between javascript and typescript.
	Repairs missing links from Apache Tiles Definitions to other Defintions and links from these definitions to struts operations through resource services.

2.3.10-funcrel

Fixes/Bugs

Customer Ticket Id	Customer Details
	Fixes missing knockout views when two views with same name are in the same file
	Fixes multiple incorrect links from .jsp files when the include statement is in a .inc file included by the .jsp file
	Fixes multiple incorrect links from .asp/.aspx files when the include statement has no corresponding case sensitivity.
	Fixes multiple incorrect links from .jsp files when include statement is done through a complex "script.src" value
	Fixes multiple incorrect links from .js files when the resolution should be local
	Eliminates resource services which have very similar urls (url part differing after ?).
	Repairs badly formed urls of some resource services.
	Fixes positions of resource services whose urls are constructed using shorthand addition.
53119	Repairs missing links from anonymous functions when anonymous function code is "builder => ({getT:f()})"
53012	Prevents analyzer from crashing in some rare cases when a variable v is initialized with a function call of this kind v.withUrl(…) (same name v, and "withUrl" containing "url" word)
	Repairs the number of parameters of some rare anonymous functions which is twice the good value.
	Repairs url evaluations when "switch" blocks are involved (it should work like "if" blocks).
	Repairs the html attribute sent to other extensions when an attribute starts with "@" (ex: @success="onSaveEdit").
	Repairs links when resolution is bad.
	Repairs the resolution inside some HTML fragments inside reactjs .js files
53343	Prevents analyzer from crashing in some cases when .aspx files contain vbscript code.
	Fixes links when there are several possibilities of a called function and this is not the "nearest" file which is selected.

New Support

Customer Ticket Id	Customer Details
	Supports .jsi source files
	Supports "useSWR" of SWR of React Hooks library for data fetching

Enhancement/Improvements

Customer Ticket Id	Customer Details
	Improves links to anonymous functions: links should start where functions are defined.
	Improves performance by skipping some libraries or build folders via the filters.json file.

2.3.9-funcrel

Fixes/Bugs

Customer Ticket Id	Customer Details
	Fixes missing Razor Method Call objects when several identical calls are present in the same file.
	Fixes missing link between two aspx files when the first one points to the second one through a local server URL.
	Fixes missing link between two .razor files when the link is in a "href" attribute.
	Repairs the url of an Ajax call present in a .js file when the url is defined through a variable initialized in a .cshtml file.
	Fixes missing include links from .cshtml files to .js files when the .js files are contained in a "wwwroot" sub folder.

New Support

Customer Ticket Id	Customer Details
	Adds support of "Backbone.sync" in http resource service creation.
	Adds support of "fetch", "create", "save", "destroy" calls in Backbone.js context for the creation of http resource services.
	Adds support of .ascx files
	Adds support of "Html.Kendo().Upload().Async(…)": links are now created to corresponding dotnet controller actions through Razor method call objects

Enhancement/Improvements

Customer Ticket Id	Customer Details
	Refines names of anonymous functions defined with an arrow: they have now a more explicit name than NONAME.
	Improves performance by skipping some libraries or build folders via the filters.json file.
	Improves resolution when "Object.defineProperties" is used.
	Improves security by removing some vulnerable documentation files.
	Adds a link from a .cshtml file created by dotnet analyzer to the .cshtml file content created by html5 one.

Performance

Customer Ticket Id	Customer Details
	Optimizes html files resolution by skipping files when they are supposed very near by their names (my_file.html and myfile–tablet.html, my_file–phone.html: only the first one is analyzed).

2.3.8-funcrel

Resolved Issues

Customer Ticket Id	Details
52019	Fixes an issue causing missing HTML5 http requests services (found through specific "fetch" client function) - this is a regression since 2.1.18.

Other Updates

Details
Fixes an issue causing links from .vue, .html… files to not be present for code inside "pug" sections.
A minor change to modify the description and name of the "HTML5 External Library" object.
The filters.json file has been updated to ensure that various external libraries are now automatically skipped during the analysis.
Integrate handling of 'request-promise', 'request-promise-any', 'request-promise-native' in HTML5 instead of nodejs.

2.3.7-funcrel

Other Updates

Details
Fixes an issue causing some call links to be missing due to file analysis order.
Fixes an issue causing some call links to callback objects to be missing when several calls are present.
Fixes a traceback error in the analysis log: "AttributeError: 'list' object has no attribute 'get_global_class'".
Added support of JavaScript decorators during JavaScript parsing (a technical update to facilitate future changes).
A minor update to ensure the "async" keyword is part of the method "ast" method.
Fixes an issue causing problems with .html, .jsp files: analysis of these file types sometimes results in an incorrect Lines of Code count.
The filters.json file has been updated to ensure that various external libraries are now automatically skipped during the analysis.

New Support

Summary	Details
Blazor support (.razor files)	Added support for the analysis of .razor files.
Support JSTL sql tag	Added support for client/server calls from JSP to Database, see Notes.

2.3.6-funcrel

Other Updates

Details
Include links between SCSS source code objects are no more present when using CAST AIP 8.4.1
Bad resolutions are present from some variables named "this.something" to variables with same name "this.something" in another file which has nothing to do with the first one
Missing links from Tapestry .tml files to Java back-end when tml files are not in the recommended directory
Bad http requests are created in some cases due to a problem with evaluation
Only one http request must be created when there are 2 calls of a function with the same url parameter.
Some call links are missing due to file analysis order
.vm files without html tags are not well parsed.

2.3.5-funcrel

Resolved Issues

Customer Ticket Id	Details
48043	Fixes an issue causing missing links between method/functions leading to missing Resource services objects.
49756	Fixes an issue causing missing links from JavaScript functions to JavaScript functions (through intermediate import).
49523	Fixes an issue causing a false negative for the rule 1020070: "Avoid hard-coded network resource names (Javascript) ". URLs are now taken into account.
49608	Fixes an issue causing an incorrect number of files to be considered for the step "match_aspx_to_vb_methods", in turn leading to missing links.
50158	Fixes an issue causing the analysis of JavaScript files to take a long time and eventually become "stuck".

Other Updates

Details
Fixes an issue causing a false negative for XSS: onmouseover action (as a result, a new rule has also been introduced 1020110 "Avoid cross-site scripting within events such as onclick, onmouseover … events (razor))"
Added support for Unirest (a HTTP client library).
The filters.json file has been updated to ensure that the dotnet.js, dotnet.debug.js, dotnet_support.js and binding_support.js files are automatically skipped (these files are generated by Microsoft for the JavaScript interop layer used in the WebAssembly runtime and provide no added value in analysis results).
An update has been implemented to create links from Tapestry ".tml" pages to the Java back-end (see the documentation).
Libraries, tests, builds or minified files/folders must be skipped
Create links from Tapestry .tml pages to Java back-end, using tapestry annotations in java classes

Rules

Rule Id	New Rule	Details
1020110	TRUE	Avoid cross-site scripting within events such as onclick, onmouseover … events (razor)
1020070	FALSE	Fixes an issue causing a false negative for the rule 1020070: "Avoid hard-coded network resource names (Javascript) ". URLs are now taken into account.

2.3.4-funcrel

Resolved Issues

Customer Ticket Id	Details
48750	Update description of rule "Avoid using Javascript Function constructor" (1020066) concerning security.
49243	Fixes a traceback message in the analysis log with Typescript extension: "AttributeError: 'str' object has no attribute 'get_name'".

Other Updates

Details
Support for "got" (Human-friendly and powerful HTTP request library for Node.js) added. See documentation example .
Fixes an issue causing "Resource service" objects to not be created when source is generated by "https://openapi-generator.tech".
Enhance link resolution for "module.exports" syntax.
The filters.json file has been updated to ensure that libraries, tests or minified/empty css files are automatically skipped.

Rules

Rule Id	New Rule	Details
1020066	FALSE	Description updated for the rule "Avoid using Javascript Function constructor".

2.3.3-funcrel

Resolved Issues

Customer Ticket Id	Details
48750	An update was made to the description section of the rule "Avoid using Javascript Function constructor" (1020066) concerning security and code injection..
48943	Fixes an issue causing service objects using "react-io" to fail to be resolved.

Other Updates

Details
An update to support inclusion of .js files in .jsp files when .js references are in parameters.
An update to support "lodash/get" for link resolution.
An update to support the analysis of the files "package-lock.json", "yarn.lock" and "npm-shrinkwrap.json" (see documentation ).
An update to support "wretch" (see documentation ).
Fixes an issue causing missing Razor method call objects.
Fixes an issue causing a missing link between Razor Method call objects and .NET controller action objects.
Fixes an issue causing missing Razor method call objects when ternary if expression is present.
Fixes an issue causing the analysis to fail.
Fixes an issue causing the analysis to run in an infinite loop.
The filters.json file has been updated to ensure that libraries, tests or minified/empty css files are automatically skipped.

Rules

Rule Id	New Rule	Details
1020066	FALSE	Description update (see 48750 above).

2.3.2-funcrel

Other Updates

Details
Fixes an error introduced in v. 2.3.1-funcrel: missing Razor method call object on "dynamodb" sample.

2.3.1-funcrel

Resolved Issues

Customer Ticket Id	Details
48589	Fixes an issue causing a missing link between WMCommonHeader.jsp file and included JSP files.

Other Updates

Details
Fixes an issue causing missing links from .asp pages to database tables when the log message "HTML5-044 A problem occurred when parsing vbscript code" is present in the analysis log..
Fixes an issue where resource service objects computed from strings containing html code with "href=" inside are often not correct.
Fixes an issue causing a missing vendor property for HTML5 SQL Query objects.

Rules

Rule Id	New Rule	Details
1020082	FALSE	Updates the rule "Avoid undocumented Functions" to change the scope to include methods and constructors as well as functions.

2.3.0-funcrel

Resolved Issues

Customer Ticket Id	Details
48221	Fixes an issue causing incorrect links to all JavaScript functions that have the same name, instead of the one referenced in the HTML5 header.

New Support

Summary	Details
Support C/S links from ASP pages using ADODB COM component	See documentation: https://doc.castsoftware.com/technologies/web/html5-js/com.castsoftware.html5/2.3/notes/#support-for-adodb-in-aspaspx-files .