PVS-Studio 7.34: support for Apple Silicon ARM64, .NET 9, taint analysis in Java analyzer, and more

5 min read1 day ago

PVS-Studio 7.34 has been released. Discover the latest features, including support for Apple Silicon processors with ARM64 architecture, .NET 9 project compatibility, the introduction of the taint analysis mechanism in the Java analyzer, and more! Explore more details in our press release.

You can download the latest PVS-Studio version here.

PVS-Studio on Apple Silicon ARM64

PVS-Studio analyzers for macOS now support Apple Silicon processors with ARM64 architecture, which has broken new ground for macOS users. With version 7.34, we’ve introduced native builds that let you harness the full potential of this platform.

PVS-Studio C# analyzer introduces support for .NET 9 projects

Now, users can analyze C# code with all new .NET 9 features.

Therefore, the requirements for the C# analyzer on Windows have changed (details under the Breaking Changes heading).

Taint analysis implementation in PVS-Studio Java analyzer

In the latest update of PVS-Studio Java analyzer, our team has introduced the taint analysis mechanism. We’ve created the first diagnostic rule based on this mechanism, V5309. It can help detect SQL injection vulnerabilities.

Next year, our Java team will focus on SAST, expand coverage of the OWASP Top 10 list of the most common potential vulnerabilities, and add more diagnostic rules for taint analysis.

Modified file analysis mode

We’ve updated the PVS-Studio_Cmd and pvs-studio-dotnet command lines. Now they include a modified file analysis mode that auto-detects source files changed between analysis runs. This mode is an alternative to incremental analysis, and you can use it to check pull requests.

For more details on this mode, please consult the documentation.

Viewing analysis results in the CodeChecker web interface

Starting with the CodeChecker 6.25.0 release, users can upload PVS-Studio reports directly into the web interface for a streamlined review of code analysis results. For more details on this integration, please consult the documentation.

Flexible include files in the analysis

You can now more easily include or exclude source files and configuration files from the analysis in the .pvsconfig analyzer configuration files. You can use this mechanism to check Unreal Engine projects with UnrealBuildTool, starting with version 5.5.2. Learn more about it in the documentation.

Breaking Changes

The latest release introduces changes that break backward compatibility with previous analyzer versions. You may need to alter the way you use the analyzer.

The C# analyzer requirements on Windows (updated):

The analysis of .NET projects will now require installation of the .NET 9 SDK.
To analyze .NET Standard and .NET Framework SDK-style projects, the .NET SDK 9.0 installation is also required.
The requirements for analyzing classic .NET Framework projects have not changed: if Visual Studio or MSBuild versions 2017, 2019, or 2022 are installed, the.NET Framework 4.7.2 is sufficient.
Classic .NET Framework projects on systems with Visual Studio or MSBuild versions 2015 or earlier will also require the.NET 9 SDK.
To use the silent installation mode on Windows and analyze projects that require the .NET 9 SDK, the DOTNET component must be specified to install the .NET 9 SDK if it is not already installed on the system.

In the pvs-studio-analyzer command line utility, the behavior of the --sourcecetree-root (-r) flag has changed. Now, when a path is replaced in the generated report, the existence of the base directory path is checked.

If some paths fail to be replaced, a warning message is displayed; however, the return code remains 0.
If the path replacement fails for all the paths, the return code is non-zero, accompanied by the warning message.

New diagnostic rules

C, C++:

V1116. Creating an exception object without an explanatory message may result in insufficient logging.
V1117. The declared function type is cv-qualified. The behavior when using this type is undefined.
V2022. Implicit type conversion from integer type to enum type.
V5014. OWASP. Cryptographic function is deprecated. Its use can lead to security issues. Consider switching to an equivalent newer function.

C#:

V3207. The ‘not A or B’ logical pattern may not work as expected. The ‘not’ pattern is matched only to the first expression from the ‘or’ pattern.
V3208. Unity Engine. Using ‘WeakReference’ instance with ‘UnityEngine.Object’ is not supported. GC will not properly reclaim memory from this object because it is linked to a native object.
V3209. Unity Engine. Re-applying await to an Awaitable object will result in an exception.
V3210. Unity Engine. Unity does not allow removing the ‘Transform’ component using ‘Destroy’ or ‘DestroyImmediate’ methods. The method call will be ignored.
V4007. Unity Engine. Avoid creating and destroying UnityEngine objects in performance-sensitive context. Consider activating and deactivating them instead.

Java:

V6123. Modified value of the operand is not used after the increment/decrement operation.
V6124. Converting an integer literal to the type with a smaller value range will result in overflow.
V6125. Calling the ‘wait’, ‘notify’, and ‘notifyAll’ methods outside of synchronized context will lead to ‘IllegalMonitorStateException’.
V5309. Possible SQL injection. Potentially tainted data is used to create SQL command.

Articles

For those, who code in C++:

For those, who code in C#:

For those, who code in Java:

PVS-Studio 7.34: support for Apple Silicon ARM64, .NET 9, taint analysis in Java analyzer, and more

Written by Unicorn Developer

No responses yet