Release Notes - SonarCFamily - Version 6.14 - HTML format

Bug

  • [CPP-2698] - S5813: Activate the rule
  • [CPP-2701] - Debug messages for non-project files should be preserved in cache
  • [CPP-2710] - S2637: sync rule implementation with the RSPEC
  • [CPP-2739] - S5832 S5982: fix rule enabling/disabling

New Feature

  • [CPP-2320] - Rule S5547: Cipher algorithms should be robust
  • [CPP-2571] - Rule S4830: Server certificates should be verified during SSL/TLS connections
  • [CPP-2578] - Rule S5527: Server hostnames should be verified during SSL/TLS connections
  • [CPP-2580] - Rule S4423: Weak SSL and TLS protocols should not be used
  • [CPP-2581] - Rule S5542: Encryption algorithms should be used with secure mode and padding scheme
  • [CPP-2584] - Rule S4426: Cryptographic keys should be robust
  • [CPP-2585] - Rule S5332: Using clear-text protocols is security-sensitive
  • [CPP-2726] - Run only C++ rules that are relevant to the C++ standard version being analyzed
  • [CPP-2727] - Add an internal property to set C++ standard version for issue detection
  • [CPP-2728] - Add tags to rules description representing the C++ standard version from which they start to run
  • [CPP-2729] - Document newly introduced rule tags since-c++XX

Task

  • [CPP-2685] - Rules S5527 S4830: Implement check for Botan as a project level rule
  • [CPP-2686] - Rules S4423 S5542 S4426 S5547: handle Botan framework
  • [CPP-2687] - Rule S5527: OpenSSL, symbex
  • [CPP-2694] - Rules S4426 S5542 S5547 implement detection for Crypto++
  • [CPP-2695] - OpenSSL Rule S4423: Weak SSL and TLS protocols should not be used
  • [CPP-2700] - Rules S4830 S5547 S4426 S5542 handle OpenSSL framework
  • [CPP-2706] - AST-only part of Rule S5332: Using clear-text protocols is security-sensitive
  • [CPP-2709] - libcurl-specific part of the Rule S5332: Using clear-text protocols is security-sensitive
  • [CPP-2711] - Rules S4830 S5527 S4423 Implement check for libcurl

Improvement

  • [CPP-1943] - Highlight 'final' and 'override' contextual keywords
  • [CPP-2489] - Make S3471 and S1016 play nice with each others
  • [CPP-2704] - Use case insensitive comparison for pchThroughHeader
  • [CPP-2713] - S5408 should also detect constexpr variables declared inline
  • [CPP-2731] - S5952: Give more information to the user about the issue
  • [CPP-2732] - S1764: Add a message on secondary locations
  • [CPP-2735] - S5319: Add a message on the secondary location
  • [CPP-2738] - Filter out irrelevant and duplicate issues from analysis results in SonarLint mode

False-Positive

  • [CPP-2274] - Improve S886 implementation by using the mutation analyzer
  • [CPP-2374] - S2234: Fix false-positives with operators
  • [CPP-2472] - S994 & S995 & S5350: Exclude variables with types coming from macro expansions
  • [CPP-2560] - Rule S6069: "sprintf" should not be used
  • [CPP-2604] - S5008: Ignore uses of void* through a typedef
  • [CPP-2736] - OneStatementPerLine (S122): FP with incomplete loc for temporary expressions
  • [CPP-2737] - S1116: Fix false-positives with " if constexpr" in template instantiation
  • [CPP-2740] - S5495 S1238: fix false-positives with intentional copies
  • [CPP-2741] - S3230: fix false-positives with multiple constructors intializing the same field to different value
  • [CPP-2743] - S1481: Fix false-positives with SLVS header files
  • [CPP-2752] - S5817 & S994 & S995: Support structured binding
  • [CPP-2757] - S4334: Fix false-positives on a lambda capture with an initializer
  • [CPP-2759] - S1172: fix false-positives with virtual functions in template classes

False Negative

  • [CPP-2754] - MutationAnalyzer: Improve tracking in case of lambdas

Edit/Copy Release Notes

The text area below allows the project release notes to be edited and copied to another document.