Professional Edition 1.5 Release Notes

Puma Scan’s 1.5 release is an update for the Puma Scan End User, Server, and Azure DevOps Editions.

System Requirements

• End User Edition for Visual Studio Code requires Visual Studio Code for Windows, macOS, or Linux and the .net 6, .net 5, or .netcore 3.1 SDK.

• End User Edition for Visual Studio 2022 requires Visual Studio 2022 v17.0 or higher.

• End User Edition for Visual Studio 2019 requires Visual Studio 2019 v16.0 or higher.

• Server Edition requires a Windows Server with the following:

  • .NET Framework v4.7.2

  • The Build Tools for Visual Studio 2019 and 2022 are both supported. Ensure you have at least 1 of the following installed:

    • Build Tools 2022 version 17.0 or higher

    • Build Tools 2019 version 16.4 or higher

• Azure DevOps Edition requires a hosted Azure Build Pipeline using the vs2017-win2016, windows-2019 or windows-2022 build agent.

Framework Enhancements

• All rules have been updated to reflect any new namespaces in the .NET 6 framework.

• The following rules now support adding custom sinks to the solution’s .pumafile. This enables users to fine tune and customize their Puma Scan experience even further. Please see the User Guide for more information on how to define a custom sink.
  
  

  Custom Sink Supported Rules:

  • SEC0022 - Model Request Validation Disabled

  • SEC0023 - Action Request Validation Disabled

  • SEC0024 - Unencoded Response Write

  • SEC0025 - Weak Symmetric Algorithm

  • SEC0026 - Weak Cipher Mode

  • SEC0027 - Weak Algorithm: MD5

  • SEC0028 - Weak Algorithm: SHA1

  • SEC0029 - Insecure Deserialization

  • SEC0030 - Insecure Deserialization: Newtonsoft JSON

  • SEC0031 - Command Injection: Process.Start

  • SEC0032 - Command Injection: ProcessStartInfo

  • SEC0033 - Insecure HTTP Cookie Transport

  • SEC0034 - HTTP Cookie Accessible via Script

  • SEC0035 - XPathDocument External Entity Expansion

  • SEC0036 - XML Reader External Entity Expansion

  • SEC0037 - XML Document External Entity Expansion

  • SEC0104 - Unencoded WebForms Property

  • SEC0106 - SQL Injection: Dynamic LINQ Query

  • SEC0107 - SQL Injection: ADO.NET

  • SEC0108 - SQL Injection: Dynamic EF Query

  • SEC0109 - Unvalidated MVC Redirect

  • SEC0110 - Unvalidated Redirect

  • SEC0111 - Path Tampering: MVC File Result

  • SEC0112 - Path Tampering: Unvalidated File Path

  • SEC0113 - Certificate Validation Disabled

  • SEC0114 - LDAP Injection Directory Entry

  • SEC0115 - Insecure Random Number Generator

  • SEC0116 - Path Tampering: Unvalidated File Path

  • SEC0117 - LDAP Injection Path Assignment

  • SEC0118 - LDAP Injection Directory Searcher

  • SEC0119 - LDAP Injection Filter Assignment

  • SEC0120 - Missing Authorize Attribute

  • SEC0121 - CORS Allow Origin Wildcard

  • SEC0122 - JWT Signature Validation Disabled

  • SEC0123 - JWT Expiration Disabled

  • SEC0124 - Weak Cipher Mode Padding

  • SEC0125 - Weak RSA Key Length

  • SEC0126 - SQL Injection: Dynamic NHibernate Query

  • SEC0127 - XPath Injection

  • SEC0128 - LDAP Authentication Disabled

  • SEC0129 - Server-side Request Forgery

  • SEC0130 - Hard-Coded Credential

End User Edition for Visual Studio 2022

• Bug fix: An exception is thrown when opening Visual Studio without a solution or project.

End User Edition for Visual Studio Code

• Bug fix: An exception is thrown during the very first scan or license activation. Subsequent scans do not throw the exception.