January 2026 change log

Java

• java-missing-metrics-manager-pop

  • Enhanced to improve detection coverage by:
    • Adding import validation to ensure detection applies only to com.amazon.coral.metrics.* classes
    • Expanding method detection to catch any metrics operation (not just specific methods) while excluding try–finally patterns where pop() is guaranteed to execute in the finally block

• java-os-command-injection-ide

  • Enhanced to reduce false positives by:
    • Excluding System.setProperty() call as this only sets JVM properties and doesn't execute OS commands
    • Excluding ProcessBuilder.environment().put() calls as setting environment variables is not command argument injection

• java-cross-site-scripting-ide

  • Enhanced to improve user experience and reduce noise by:
    • Excluding write and model.addAttribute from detection patterns, as these methods are already covered by other rules, reducing duplicate results

• java-sql-injection-ide

  • Enhanced to reduce false positives by:
    • Adding comprehensive pattern detection across multiple Java frameworks (JDBC, Hibernate, MyBatis, JPA)
    • Excluding safe usage of parameterized queries and prepared statements
    • Excluding PreparedStatement usage with proper parameterization
    • Excluding validated inputs and static queries
  • Improved detection coverage for:
    • Dynamic query building and string concatenation
    • Framework-specific SQL injection vectors
    • ORM framework patterns

• java-log-injection

  • Enhanced to improve detection coverage by:
    • Adding PrintStream vulnerability detection
  • Improved user experience by:
    • Consolidating duplicate findings for the same file into a single detection with references to all affected line numbers

• file_extension_validation_rule

  • Performance optimization to prevent timeout issues by:
    • Adding preconditions filters on method calls save, read, and open to prevent timeout issue

Python

• python-path-traversal-ide

  • Enhanced to reduce false positives by:
    • Excluding Django FileField/ModelForm.save() and dynamic import sinks from path traversal rules
    • Treating secure_filename() as a sanitization function

• python-system-prompt-leakage-vulnerability

  • Enhanced to reduce false positives by:
    • Adding checks that validate actual content rather than just variable names
  • Improved detection coverage by:
    • Catching more sophisticated prompt leakage patterns including dynamic prompt selection methods
    • Using regex to identify actual AI assistant instructions and system prompts

• python-llm-vector-embedding-weaknesses

  • Enhanced to improve detection coverage by:
    • Adding context validation for pickle.dump to ensure the rule triggers only in actual RAG/ML contexts, rather than general file operations
    • Adding better flow tracking for ChromaDB patterns to properly track the flow from client creation, collection, retrieval, operation steps, providing more accurate detection

• python-llm-improper-output-handling

  • Enhanced to improve detection coverage by:
    • Restructuring patterns to properly detect LLM responses from various API patterns including Anthropic's messages.create(), generic generate_text(), and Google's generate_content()
    • Enhancing regex patterns to catch a wider variety of client variable names and AI service implementations
    • Adding subprocess.check_output to catch another common subprocess method that could be vulnerable

Kotlin

• kotlin-xml-decoder
  • Enhanced to reduce false positives by:
    • Enhancing the detector to ignore patterns for certain http client libraries
    • Modified the detector to ignore ApacheHttpClient, HttpClient, HttpAsyncClient and OkHttpClient
    • Maintains detection of actual XXE vulnerabilities in XML parsing code

JavaScript

• javascript-alert-box

  • Reclassified from Security to Best Practice:
    • Use of alert(), confirm(), and prompt() with static messages is not a security vulnerability
    • Removed CWE-200 (Information Exposure) classification - only applies when sensitive information is displayed

• javascript-csrf-missing-protection

  • Enhanced to reduce false positives by:
    • Reducing scope to only cover definitive missing CSRF for state-changing routes
    • Excluding client-side CSRF validation checks - CSRF validation is a server-side responsibility
    • Excluding Express apps that use csrf() middleware
    • Excluding Express apps with properly configured express-session cookies (sameSite: 'lax', secure: true, httpOnly: true)
    • Enhancing to detect forms submitted on Express routes without CSRF token protection

• javascript-code-injection-ide

  • Enhanced to reduce false positives by:
    • Recognizing escapeHTML() as a sanitization function for innerHTML assignments
    • Excluding setInterval() calls with object method invocations
    • Refining dynamic require() detection to only flag request-based vulnerabilities (req.*, request.*) while excluding internal module loading patterns

• javascript-missing-authorization-ide

  • Enhanced to reduce false positives by:
    • Excluding DAO patterns - this.$METHOD() calls inside UserDAO constructor context are internal DB operations, not HTTP routes

• javascript-insecure-deserialization-ide

  • Enhanced to reduce false positives by:
    • Refining sinks to target deserialization patterns with string concatenation like eval('(' + data + ')') rather than all dynamic code execution
    • Distinguishing between CWE-502 (Insecure Deserialization) and CWE-94 (Code Injection) to avoid misclassification
    • Excluding direct eval without transformation, validated inputs, and hard-coded data
  • Added comprehensive taint sources for:
    • HTTP requests, WebSocket messages, file system operations, database results, and environment variables
  • Implemented sanitizers for safe parsing methods:
    • JSON.parse, yaml.safeLoad, schema validation
  • Updated sink patterns to detect unsafe libraries:
    • node-serialize, serialize-javascript, flatted
    • Dangerous APIs: vm.runInNewContext, Function() constructor

• javascript-cross-site-scripting-ide

  • Enhanced to reduce false positives by:
    • Removing the eval($UNSANITIZED) pattern since server-side eval() represents Code Injection (CWE-94) rather than XSS

TypeScript

• typescript-code-injection-ide

  • Enhanced to reduce false positives by:
    • Excluding Angular Router navigation patterns ($ROUTER.navigate(...))
    • Excluding NgZone operations ($ZONE.run(...)) for variable assignments and navigation
    • Excluding $REGEX.exec(...) calls on standard named regex variables
    • Excluding VSCode command APIs (vscode.commands.executeCommand, vscode.commands.getCommands)
    • Excluding test helper functions (spawn from test-helpers)
    • Excluding SQL execution with common safe variable names (sql, db, database, conn, connection, pool)

• ts-hardcoded-credentials-library-ide

  • Enhanced to reduce false positives by:
    • Excluding non-sensitive key fields (URL slugs/identifiers)
    • Flagging key only when value contains credential like indicators or known secret prefixes

• typescript-no-sql-injection-ide

  • Enhanced to reduce false positives by:
    • Excluding Sequelize ORM SQL operations (findOne({ where: ... })) as these are SQL database operations, not NoSQL injection vectors
    • Excluding native JavaScript Array.find() methods as they are in-memory array operations
    • Excluding Angular HttpClient.delete() and other HTTP requests, as these are network requests
    • Excluding array operations with de-structuring callbacks
    • Excluding cryptographic hash operations, such as the update() method in jsSHA
    • Excluding Angular service HTTP requests with .find() and .subscribe() patterns

• typescript-cross-site-scripting-ide

  • Enhanced to reduce false positives by:
    • Excluding non-sink operations like array storage (messages.push with body/content), database inserts, internal data structures
    • Excluding safe string utilities
    • Excluding internationalization functions
    • Excluding safe cryptographic operations and hash function
    • Excluding configuration access using config.get(), since it does not affect CSRF behavior
    • Recognizing HTML encoding via entities.encode() as a sanitization step