Frame 1.1.4

Fixed

• Findings lost when code was written another ordinary way (#9). A Flask app that keeps its database connection on flask.g (the Flask docs' get_db() pattern) lost its SQL injection findings. An adversarial review of every frontend then found and fixed the same class of bug in Python, JavaScript/TypeScript, Java, C# and C/C++: chained and unpacking assignments, try/except/finally and catch bodies, compound assignment (x += e was lowered as x = e in Java and C#), ternaries, switch, break/continue/goto, struct and object fields, dict and list literals, comprehensions, lambdas, method references, library callbacks (forEach, map, then), out/ref arguments, Razor control flow, C macros and many more. Metamorphic tests now rewrite each vulnerable flow without changing its meaning and require the finding to survive, and lowering tripwires fail when data-carrying syntax is dropped.
• Fewer false positives. A same-file Java helper returning a constant no longer taints its result (OWASP BenchmarkJava, full suite: false positives 429 to 216, no true positive lost); constant dict keys (', '.join(f'{k} = ?' for k in updates)), numeric operators in JavaScript, numeric parsing in C#, and sizeof in C (was the constant 0) no longer produce findings.
• Scanner robustness. The Python frontend evaluated constant conditions with eval, so a scanned file containing 9**9**9 could stall the scan; it now uses a bounded evaluator.
• Package metadata: the licence is an SPDX expression (license = "Apache-2.0"), removing the setuptools deprecation warning.

Added

• Unhashed credential storage (CWE-522). A password or generated token written to a database without a hash, MAC or KDF in between, read from the SQL the program writes.
• Flask views' returned HTML is an XSS sink when the response is sent as HTML.
• Replacer functions (re.sub, String.replace) and map callbacks carry what they return; path containment through path.relative / os.path.relpath is a guard.

Changed

• C#: while (true) with no way out is reported as CWE-835, as in Java and C.

Install: pip install -U "frame-security[scan]". The GitHub Action lambdasec/frame-action@v1 now runs 1.1.4.

Full changelog: v1.1.3...v1.1.4