In this release, we've focused on helping you enforce compliance with security standards and enhancing the existing functionality.

Security Compliance Pack

In this release, we've introduced the Security Pack to give you instant access to test configurations that help you enforce compliance with security standards and practices. The Security Pack includes the following test configurations:

• CWE 3.1
• CWE SANS Top 25 2011
• Microsoft Secure Coding Guidelines
• OWASP Top 10 2017
• PCI Data Security Standard
• PCI v3.1 Data Security Standard (Server Configuration)
• Security Assessment
• UL 2900

See Built-in Test Configurations for details.

Compliance Packs require dedicated license features to be activated. Contact Parasoft Support for more details on Compliance Packs licensing.

Standalone License Server

You can now obtain the Parasoft license from an additional instance of DTP or a standalone License Server. See Setting the Parasoft License (for desktop) and Setting the License (for automation).

Collecting Coverage for .NET Core Web Applications

dotTEST can collect coverage for .NET Core web applications deployed on IIS server; see Application Coverage for Web Applications.

New and Updated Test Configurations

We've added the following built-in test configuration:

• CWE 3.1

• CWE SANS Top 25 2011

• OWASP Top 10 2017 (see Deprecated Test Configurations)

The following test configurations that enforce safety standards have been moved from the Static Analysis category to the Security Pack (see Security Compliance Pack):

• Microsoft Secure Coding Guidelines

• OWASP Top 10 2017

• PCI Data Security Standard

• PCI v3.1 Data Security Standard (Server Configuration)

• Security Assessment

• UL 2900

The following test configurations have been updated to improve analysis results:

• Critical Rules

• Demo

• Find Memory Issues

• PCI Data Security Standard

• PCI v3.1 Data Security Standard (Server Configuration)

• Recommended .NET Core Rules

• Recommended Rules

• UL 2900

See Built-in Test Configurations for the list of test configurations shipped with dotTEST.

Deprecated Test Configurations

• CWE-SANS Top 25 Most Dangerous Programming Errors – deprecated and replaced with the CWE SANS Top 25 2011 test configuration

• OWASP Top 10 2017 – deprecated and replaced with the new OWASP Top 10 2017 test configuration

The deprecated test configurations are not available by default and can only be applied as user-defined test configuration. They are now shipped with dotTEST in the following location: [INSTALL_DIR]\configs\builtin\Deprecated.

Other Changes

• We've updated VSTest to version 15.9.0 - see VSTest Release Notes for details.

• We've enhanced the presentation of Flow Analysis results in the IDE.

• NuGet packages are now automatically restored before the project is built (see Restoring Packages Before the Build).

• We've removed support for Microsoft Team Foundation Server 2008.

New Static Analysis Rules

The following rules have been added:

Updated Static Analysis Rules

The following static analysis rules and metrics have been updated to improve analysis results:

• BD.SECURITY.TDFNAMES

• BD.SECURITY.TDSQL

• BD.SECURITY.TDXSS

• BRM.HBCM

• BRM.HBCP

• CS.BRM.IDOU

• CS.BRM.IEB

• CS.BRM.UCB

• IFD.DDFODB

• NG.FN.PNCFN

• OPU.CPTEQ

• OPU.REVT

• PB.DNCF

• PB.INOE

• SEC.ACWNS

• METRIC.CLLOCRIF

• METRIC.CLLOCRIT

• METRIC.CLLOCRIM
  

 The following rules are deprecated and have been replaced by the BD.RES.LEAKS rule:

• GC.UFID

• PB.CFSRLV

• SEC.CDBC

• SEC.CDBCLV

• SEC.CDR

• SEC.CDRLV

The output messages of the following rules have been updated, and as a result, suppressions associated with these rules on DTP may no longer be available:

• BD.PB.ARRAY

• BD.PB.ZERO

You can restore the previous messages and suppressions for the BD category rules; see Why are suppressions of some rules no longer available on DTP after dotTEST was upgraded to a newer version?.

Resolved Bugs and FRs