.NET Core agent release notes
Release date: October 1, 2024
Language versions currently supported: .NET Core: 3.1 (limited support), .NET 5.0 (limited support), 6.0, 7.0, .NET 8.0
The Contrast Upgrade Service, which is installed alongside the .NET Core for IIS agent by default, does not upgrade across major versions by default. Set enable_major_version_upgrade
to true
in the upgrade service's configuration file in C:\ProgramData\Contrast\upgrade-service\
by default if you want to enable upgrades across major versions.
New and improved:
Added a log Injection Assess rule checks for
NO_NEWLINES
. (DOTNET-5910)
Bug fixes:
Fixed chaining with the New Relic automatic log collection. (DOTNET-5847)
Release date: September 12, 2024
Language versions currently supported: .NET Core: 3.1 (limited support), .NET 5.0 (limited support), 6.0, 7.0, .NET 8.0
The Contrast Upgrade Service, which is installed alongside the .NET Core for IIS agent by default, does not upgrade across major versions by default. Set enable_major_version_upgrade
to true
in the upgrade service's configuration file in C:\ProgramData\Contrast\upgrade-service\
by default if you want to enable upgrades across major versions.
New and improved:
The .NET Core agent now supports the use of
CONTRAST__API__TOKEN
instead ofCONTRAST__API__URL
,CONTRAST__API__API_KEY,
CONTRAST__API__SERVICE_KEY
, andCONTRAST__API__USER_NAME
for communication with Contrast. (DOTNET-5778)Note
Contrast TeamServer is not yet adding the token to the downloadable agent configuration file.
Bug fixes:
Fixed a possible race condition in the upgrade service. (DOTNET-5830)
Password hashing in MySqlConnector is no longer flagged as a vulnerability. (DOTNET-5805)
Release date: August 26, 2024
Language versions currently supported: .NET Core: 3.1 (limited support), .NET 5.0 (limited support), 6.0, 7.0, .NET 8.0
The Contrast Upgrade Service, which is installed alongside the .NET Core for IIS agent by default, does not upgrade across major versions by default. Set enable_major_version_upgrade
to true
in the upgrade service's configuration file in C:\ProgramData\Contrast\upgrade-service\
by default if you want to enable upgrades across major versions.
Bug fixes:
Fixed an issue with Protect loading libraries too lazily, which caused it to fail. (DOTNET-5828)
Release date: August 8, 2024
Language versions currently supported: .NET Core: 3.1 (limited support), .NET 5.0 (limited support), 6.0, 7.0, .NET 8.0
The Contrast Upgrade Service, which is installed alongside the .NET Core for IIS agent by default, does not upgrade across major versions by default. Set enable_major_version_upgrade
to true
in the upgrade service's configuration file in C:\ProgramData\Contrast\upgrade-service\
by default if you want to enable upgrades across major versions.
New and improved:
Improved the accuracy of the Protect SQL tokenizer. (DOTNET-5757)
Protect SQLi attack watching is now more accurate for open text. (DOTNET-5758)
Bug fixes:
The agent now applies sanitizer rules from Contrast that are marked All Rules to
trust-boundary
. (DOTNET-5781)The agent no longer reports CSP Insecure for obsolete headers. (DOTNET-5793)
Release date: July 25, 2024
Language versions currently supported: .NET Core: 3.1 (limited support), .NET 5.0 (limited support), 6.0, 7.0, .NET 8.0
The Contrast Upgrade Service, which is installed alongside the .NET Core for IIS agent by default, does not upgrade across major versions by default. Set enable_major_version_upgrade
to true
in the upgrade service's configuration file in C:\ProgramData\Contrast\upgrade-service\
by default if you want to enable upgrades across major versions.
New and improved:
Cloud resource IDs for AWS and Azure are now automatically sent to Contrast. (DOTNET-5156)
Added an advanced option to the agent installer to stop IIS earlier in the installation and restart once installation is complete. (DOTNET-5765)
Added a warning about unsupported versions of ASP.NET CORE assemblies to the profiler. (DOTNET-5739)
The .NET Core Site Extension no longer contains unnecessary Contrast Linux binaries. (DOTNET-5746)
Release date: July 3, 2024
Language versions currently supported: .NET Core: 3.1 (limited support), .NET 5.0 (limited support), 6.0, 7.0, .NET 8.0
The Contrast Upgrade Service, which is installed alongside the .NET Core for IIS agent by default, does not upgrade across major versions by default. Set enable_major_version_upgrade
to true
in the upgrade service's configuration file in C:\ProgramData\Contrast\upgrade-service\
by default if you want to enable upgrades across major versions.
New and improved:
Add logging of pending reboots and locked files to the agent installers. (DOTNET-5716)
Bug fixes:
Fixed Protect path traversal false positive caused by the Referer header in AgentLib. (DOTNET-5717)
Fixed handling of IPv6 addresses in the deep-connect diagnostic. (DOTNET-5735)
Release date: July 1, 2024
Language versions currently supported: .NET Core: 3.1 (limited support), .NET 5.0 (limited support), 6.0, 7.0, .NET 8.0
The Contrast Upgrade Service, which is installed alongside the .NET Core for IIS agent by default, does not upgrade across major versions by default. Set enable_major_version_upgrade
to true
in the upgrade service's configuration file in C:\ProgramData\Contrast\upgrade-service\
by default if you want to enable upgrades across major versions.
New and improved:
Updated the agent-lib flatbuffers version. (DOTNET-5722)
Added a configuration setting in the agent configuration file to control probe analysis. (DOTNET-5707)
Added a route observation error feature flag to the agent configuration file. (DOTNET-5682)
The profiler now logs warnings when the agent observes known unsupported technologies. (DOTNET-5681)
The profiler log timestamp precision is now the same as sensors. (DOTNET-5627)
Improved performance for
XmlSerializer
dataflow. (DOTNET-3876)Improved performance for Json/Bson Reader dataflow. (DOTNET-3873)
Improved performance for text encoding dataflow. (DOTNET-3871)
Improved performance for .NET Core properties for TextWriter. (DOTNET-3872)
Bug fixes:
Removed
System.Xml.XmlDocument
from the untrusted deserialization rule. (DOTNET-5684)Fixed a path traversal false positive for the
UserAgent
header inagentLib
. (DOTNET-5718)Fixed an SQL injection false positive in
agentLib
. (DOTNET-5719)Removed the launch condition for IIS being installed from the .NET Core installer. (DOTNET-5723)
Updated
assess.disabled_rules
toassess.rules.disabled_rules
in the agent configuration file. (DOTNET-5678)
Release date: May 21, 2024
Language versions currently supported: .NET Core: 3.1 (limited support), .NET 5.0 (limited support), 6.0, 7.0, .NET 8.0
The Contrast Upgrade Service, which is installed alongside the .NET Core for IIS agent by default, does not upgrade across major versions by default. Set enable_major_version_upgrade
to true
in the upgrade service's configuration file in C:\ProgramData\Contrast\upgrade-service\
by default if you want to enable upgrades across major versions.
Bug fixes:
Added additional dependencies to the agent installer. (DOTNET-5680)
The agent no longer adds an extra
/Contrast
to URLs in certain scenarios. (DOTNET-5644)Fixed a
NullReferenceException
that occurred under some conditions (DOTNET-5578)
Release date: May 8, 2024
Language versions currently supported: .NET Core: 3.1 (limited support), .NET 5.0 (limited support), 6.0, 7.0, .NET 8.0
The Contrast Upgrade Service, which is installed alongside the .NET Core for IIS agent by default, does not upgrade across major versions by default. Set enable_major_version_upgrade
to true
in the upgrade service's configuration file in C:\ProgramData\Contrast\upgrade-service\
by default if you want to enable upgrades across major versions.
Bug fixes:
Fix Contrast API URL resolution when a non-standard path is included. (DOTNET-5636)
Release date: May 1, 2024
Language versions currently supported: .NET Core: 3.1 (limited support), .NET 5.0 (limited support), 6.0, 7.0, .NET 8.0
The Contrast Upgrade Service, which is installed alongside the .NET Core for IIS agent by default, does not upgrade across major versions by default. Set enable_major_version_upgrade
to true
in the upgrade service's configuration file in C:\ProgramData\Contrast\upgrade-service\
by default if you want to enable upgrades across major versions.
New and improved:
Contrast reports application updates more often and and requests to the route observation endpoint are now deduped. (DOTNET-5540)
Bug fixes:
The agent now respects paths specified in
api.url
. (DOTNET-5621)Effective configuration report now sends the filename. (DOTNET-5626)
Release date: April 25, 2024
Language versions currently supported: .NET Core: 3.1 (limited support), .NET 5.0 (limited support), 6.0, 7.0, .NET 8.0
The Contrast Upgrade Service, which is installed alongside the .NET Core for IIS agent by default, does not upgrade across major versions by default. Set enable_major_version_upgrade
to true
in the upgrade service's configuration file in C:\ProgramData\Contrast\upgrade-service\
by default if you want to enable upgrades across major versions.
New and improved:
Enabled suppport for gRPC (Grpc.AspNetCore). (DOTNET-5366)
Release date: April 24, 2024
Language versions currently supported: .NET Core: 3.1 (limited support), .NET 5.0 (limited support), 6.0, 7.0, .NET 8.0
The Contrast Upgrade Service, which is installed alongside the .NET Core for IIS agent by default, does not upgrade across major versions by default. Set enable_major_version_upgrade
to true
in the upgrade service's configuration file in C:\ProgramData\Contrast\upgrade-service\
by default if you want to enable upgrades across major versions.
New and improved:
Sending
ReJITCompilationStarted
is now limited to chained profilers. (DOTNET-5620)Updated the
AgentLib
version to get updated path-traversal Protect events. (DOTNET-5613)
Bug fixes:
Fixed a false negative for
unvalidated-redirect
ifHttpsRedirectionMiddleware
was in use. (DOTNET-5623)
Release.date: April 11, 2024
Language versions currently supported: .NET Core: 3.1 (limited support), .NET 5.0 (limited support), 6.0, 7.0, .NET 8.0
The Contrast Upgrade Service, which is installed alongside the .NET Core for IIS agent by default, does not upgrade across major versions by default. Set enable_major_version_upgrade
to true
in the upgrade service's configuration file in C:\ProgramData\Contrast\upgrade-service\
by default if you want to enable upgrades across major versions.
Bug fixes:
The
User-Agent
field is now populated in all requests sent to Contrast. (DOTNET-5599)
Release date: April 8, 2024
Language versions currently supported: .NET Core: 3.1 (limited support), .NET 5.0 (limited support), 6.0, 7.0, .NET 8.0
The Contrast Upgrade Service, which is installed alongside the .NET Core for IIS agent by default, does not upgrade across major versions by default. Set enable_major_version_upgrade
to true
in the upgrade service's configuration file in C:\ProgramData\Contrast\upgrade-service\
by default if you want to enable upgrades across major versions.
Note
Version 4.2.9 of the agent was skipped.
New and improved:
Dockerfile and diagnostics files are now shipped with the executable flag on Linux. (DOTNET-5592)
SMTP injection is now enabled in the agent. (DOTNET-5541)
Bug fixes:
Improved handling of
NullReferenceException
. (DOTNET-5542)The agent no longer reports an unvalidated redirect false positive if the application receives a 307 error from a request with a space in the Host header. (DOTNET-5564)
Release date: March 7, 2024
Language versions currently supported: .NET Core: 3.1 (limited support), .NET 5.0 (limited support), 6.0, 7.0, .NET 8.0
The Contrast Upgrade Service, which is installed alongside the .NET Core for IIS agent by default, does not upgrade across major versions by default. Set enable_major_version_upgrade
to true
in the upgrade service's configuration file in C:\ProgramData\Contrast\upgrade-service\
by default if you want to enable upgrades across major versions.
Bug fixes:
The Request End hook no longer throws a
NullReferenceException
when Assess is disabled. (DOTNET-5555)
Release date: March 5, 2024
Language versions currently supported: .NET Core: 3.1 (limited support), .NET 5.0 (limited support), 6.0, 7.0, .NET 8.0
The Contrast Upgrade Service, which is installed alongside the .NET Core for IIS agent by default, does not upgrade across major versions by default. Set enable_major_version_upgrade
to true
in the upgrade service's configuration file in C:\ProgramData\Contrast\upgrade-service\
by default if you want to enable upgrades across major versions.
New and improved:
Added additional logging when the agent detects a manually configured installation and an installer-based installation on the same machine. (DOTNET-5174)
Bug fixes:
Added a fix for the path traversal semantic file security bypass rule. (DOTNET-5520)
Release date: January 30, 2024
Language versions currently supported: .NET Core: 3.1 (limited support), .NET 5.0 (limited support), 6.0, 7.0, .NET 8.0
The Contrast Upgrade Service, which is installed alongside the .NET Core for IIS agent by default, does not upgrade across major versions by default. Set enable_major_version_upgrade
to true
in the upgrade service's configuration file in C:\ProgramData\Contrast\upgrade-service\
by default if you want to enable upgrades across major versions.
Bug fixes:
Performance metrics no longer generates a
KeyNotFoundException
when the feature is disabled. (DOTNET-5507)
Release date: January 29, 2024
Language versions currently supported: .NET Core: 3.1 (limited support), .NET 5.0 (limited support), 6.0, 7.0, .NET 8.0
The Contrast Upgrade Service, which is installed alongside the .NET Core for IIS agent by default, does not upgrade across major versions by default. Set enable_major_version_upgrade
to true
in the upgrade service's configuration file in C:\ProgramData\Contrast\upgrade-service\
by default if you want to enable upgrades across major versions.
New and improved:
Improved performance by no longer analyzing inconsequential
WebOptimizer
methods. (DOTNET-5443)Improved performance by no longer analyzing inconsequential
NopCommerce
hashing methods. (DOTNET-5425)
Bug fixes:
The agent installer no longer logs errors if it cannot send errors to telemetry due to a TLS problem. (DOTNET-5465)
Fixed an issue with GraphQL route discovery that didn't work in certain scenarios under .NET 6 and .NET 7. (DOTNET-5451)
The agent no longer reports unvalidated redirects for Swagger UI endpoints as a vulnerability because they are not considered unsafe. (DOTNET-5449)
Release date: January 9, 2024
Language versions currently supported: .NET Core: 3.1 (limited support), .NET 5.0 (limited support), 6.0, 7.0, .NET 8.0
The Contrast Upgrade Service, which is installed alongside the .NET Core for IIS agent by default, does not upgrade across major versions by default. Set enable_major_version_upgrade
to true
in the upgrade service's configuration file in C:\ProgramData\Contrast\upgrade-service\
by default if you want to enable upgrades across major versions.
New and improved:
Updated copyright year to 2024. (DOTNET-5408)
Instrumented
Half
,Int128
, andUInt128
primitive parsing. (DOTNET-5439)Instrumented
XmlReader Get/Read
methods. (DOTNET-3866)Instrumented
TimeOnly
parsing methods. (DOTNET-3850)The agent no longer enables buffering on the body for multipart/form-data requests. (DOTNET-5400)
Bug fixes:
Fixed a false positive SQL injection finding in an Entity Framework query with GUIDs (DOTNET-5403)
Archive
Release date: December 14, 2023
Language versions currently supported: .NET Core: 3.1 (limited support), .NET 5.0 (limited support), 6.0, 7.0, .NET 8.0
The Contrast Upgrade Service, which is installed alongside the .NET Core for IIS agent by default, does not upgrade across major versions by default. Set enable_major_version_upgrade
to true
in the upgrade service's configuration file in C:\ProgramData\Contrast\upgrade-service\
by default if you want to enable upgrades across major versions.
New and improved:
Updated
Protect AgentLib
to address SQLi false positives on escaped SQL values. (DOTNET-5406)
Release date: December 5, 2023
Language versions currently supported: .NET Core: 3.1 (limited support), .NET 5.0 (limited support), 6.0, 7.0, .NET 8.0
The Contrast Upgrade Service, which is installed alongside the .NET Core for IIS agent by default, does not upgrade across major versions by default. Set enable_major_version_upgrade
to true
in the upgrade service's configuration file in C:\ProgramData\Contrast\upgrade-service\
by default if you want to enable upgrades across major versions.
Note
.NET Core 4.1.5 was not released.
New and improved:
Expanded the logging and null reference handling in the bootstrapper for the agent installer. (DOTNET-5397)
Made more performance improvements for thread static signatures. (DOTNET-3883, DOTNET-5380)
Bug fixes:
The agent installer now handles .NET Framework 4.6.2 requirement when installed but not cached. (DOTNET-5396)
The Agent Explorer now properly shows moved or deleted IIS Express applications. (DOTNET-5390)
Release date: November 17, 2023
Language versions currently supported: .NET Core: 3.1 (limited support), .NET 5.0 (limited support), 6.0, 7.0, .NET 8.0
The Contrast Upgrade Service, which is installed alongside the .NET Core for IIS agent by default, does not upgrade across major versions by default. Set enable_major_version_upgrade
to true
in the upgrade service's configuration file in C:\ProgramData\Contrast\upgrade-service\
by default if you want to enable upgrades across major versions.
Note
.NET Core 4.1.5 was not released.
New and improved:
Added support for .NET 8.0
Made performance improvements for interned strings. (DOTNET-3597)
Made performance improvements for thread static methods. (DOTNET-3848, DOTNET-3849)
Added a warning to the .NET Core installer when unchecking Restart IIS when required. (DOTNET-5306)
Added Microsoft signatures for Assess Path Traversal. (DOTNET-5314)
Cleaned up log messages when the profiler fails to attach to an application. (DOTNET-5335)
Reduced memory usage when logging messages. (DOTNET-5336)
Added missing
String.Join
method signature. (DOTNET-5378)
Release date: October 10. 2023
Language versions currently supported: .NET Core: 3.1 (limited support), .NET 5.0 (limited support), 6.0, 7.0
The Contrast Upgrade Service, which is installed alongside the .NET Core for IIS agent by default, does not upgrade across major versions by default. Set enable_major_version_upgrade
to true
in the upgrade service's configuration file in C:\ProgramData\Contrast\upgrade-service\
by default if you want to enable upgrades across major versions.
Note
.NET Core 4.1.5 was not released.
New and improved:
Improved performance when instrumenting LDAP APIs. (DOTNET-3844)
Improved performance instrumenting
EscapeForJs
. (DOTNET-3845)Improved performance when instrumenting enum parsing. (DOTNET-3846)
Improved performance when instrumenting string parsing for built-in types. (DOTNET-3847)
improved performance when instrumenting
XmlReader
. (DOTNET-3867)
Bug fixes:
The agent now prevents potentially sending user data to Sentry if an exception is thrown when doing MVC route discovery. (DOTNET-5299)
Improved performance when tracing data through
AnchorTagHelpers
. (DOTNET-5302)
Release date: September 19, 2023
Language versions currently supported: .NET Core: 3.1 (limited support), .NET 5.0 (limited support), 6.0, 7.0
The Contrast Upgrade Service, which is installed alongside the .NET Core for IIS agent by default, does not upgrade across major versions by default. Set enable_major_version_upgrade
to true
in the upgrade service's configuration file in C:\ProgramData\Contrast\upgrade-service\
by default if you want to enable upgrades across major versions.
Bug fixes:
Fixed an issue with the security log not being created if Protect is turned on in the Contrast web interface. (DOTNET-5241)
The security log no longer contains an empty source. (DOTNET-5256)
The agent prevents false positives in certain cases when a pooled array is reused. (DOTNET-5234)
Body capture is now disabled when the agent detects a gRPC request. (DOTNET-5000)
Release date: September 5, 2023
Language versions currently supported: .NET Core: 3.1 (limited support), .NET 5.0 (limited support), 6.0, 7.0
The Contrast Upgrade Service, which is installed alongside the .NET Core for IIS agent by default, does not upgrade across major versions by default. Set enable_major_version_upgrade
to true
in the upgrade service's configuration file in C:\ProgramData\Contrast\upgrade-service\
by default if you want to enable upgrades across major versions.
New and improved:
Performance timings in the log files now include request start and request end. (DOTNET-5254)
AgentLib logging environment variables are now set with the agent's native IIS module. (DOTNET-5068)
Bug fixes:
Fixed a bug that caused errors when sending effective configuration information to Contrast. (DOTNET-5242)
The telemetry service is no longer reported as a web service component. (DOTNET-5232)
Release date: August 28, 2023
Language versions currently supported: .NET Core: 3.1 (limited support), .NET 5.0 (limited support), 6.0, 7.0
The Contrast Upgrade Service, which is installed alongside the .NET Core for IIS agent by default, does not upgrade across major versions by default. Set enable_major_version_upgrade
to true
in the upgrade service's configuration file in C:\ProgramData\Contrast\upgrade-service\
by default if you want to enable upgrades across major versions.
New and improved:
Improved deduping by updating URI normalization to new standard. (DOTNET-5128)
Contrast now applies code and URL exclusions to the Protect
path-traversal-semantic-file-security-bypass
rule. (DOTNET-5167)The agent now tracks propagation through more
System.Text.Json
methods. (DOTNET-3874)The agent now tracks propagation through implicit conversion of string to
ReadOnlySpan<T>
(DOTNET-5011)Added missing StringBuilder method signatures (DOTNET-5015)
Diagnostics now check
CORECLR_PROFILER_PATH
when running thecheck-process
command (DOTNET-5075)
Release date: August 2, 2023
Language versions currently supported: .NET Core: 3.1 (limited support), .NET 5.0 (limited support), 6.0, 7.0
The Contrast Upgrade Service, which is installed alongside the .NET Core for IIS agent by default, does not upgrade across major versions by default. Set enable_major_version_upgrade
to true
in the upgrade service's configuration file in C:\ProgramData\Contrast\upgrade-service\
by default if you want to enable upgrades across major versions.
New and improved:
The agent now sends effective configuration data to Contrast. (DOTNET-5127)
The agent now attaches properly under ARM64 Alpine.
Release date: July 17, 2023
Language versions currently supported: .NET Core: 3.1 (limited support), .NET 5.0 (limited support), 6.0, 7.0
The Contrast Upgrade Service, which is installed alongside the .NET Core for IIS agent by default, does not upgrade across major versions by default. Set enable_major_version_upgrade
to true
in the upgrade service's configuration file in C:\ProgramData\Contrast\upgrade-service\
by default if you want to enable upgrades across major versions.
New and improved:
The Agent now supports applications on Ubuntu running ARM64 architecture.
Enhanced the performance when processing Span<T> objects.
Improved the performance when processing thread static methods.
Bug fixes:
The agent now sends the protocol when sending URIs for web services. (DOTNET-5145)
The agent no longer attaches to the
Contrast.AgentExplorer.Backend.exe
process. (DOTNET-5116)
Release date: June 28, 2023
Language versions currently supported: .NET Core: 3.1 (limited support), .NET 5.0 (limited support), 6.0, 7.0
The Contrast Upgrade Service, which is installed alongside the .NET Core for IIS agent by default, does not upgrade across major versions by default. Set enable_major_version_upgrade
to true
in the upgrade service's configuration file in C:\ProgramData\Contrast\upgrade-service\
by default if you want to enable upgrades across major versions.
New and improved:
Improved performance when tracing Span propagation. (DOTNET-3853, DOTNET-3856, DOTNET-3860, DOTNET-3861, DOTNET-3870, DOTNET-5034, DOTNET-5036, DOTNET-5037, DOTNET-5038, DOTNET-5040)
Release date: June 13, 2023
Language versions currently supported: .NET Core: 3.1 (limited support), .NET 5.0 (limited support), 6.0, 7.0
The Contrast Upgrade Service, which is installed alongside the .NET Core for IIS agent by default, does not upgrade across major versions by default. Set enable_major_version_upgrade
to true
in the upgrade service's configuration file in C:\ProgramData\Contrast\upgrade-service\
by default if you want to enable upgrades across major versions.
New and improved:
Changed the profiler to have Azure Functions Service Bus support turned on by default. (.NET-5080)
Bug fixes:
Fixed an issue with a path traversal false positive that the agent reported when input contained only '/' and/or '.' characters. (.NET-5051)
Resolved an issue that caused the agent to report a false positive for SQL injection in Protect. (.NET-5066)
Release date: May 31, 2023
Language versions currently supported: .NET Core: 3.1 (limited support), .NET 5.0 (limited support), 6.0, 7.0
The Contrast Upgrade Service, which is installed alongside the .NET Core for IIS agent by default, does not upgrade across major versions by default. Set enable_major_version_upgrade
to true
in the upgrade service's configuration file in C:\ProgramData\Contrast\upgrade-service\
by default if you want to enable upgrades across major versions.
New and improved:
The checks on the app_pool_allowlist/denylist are now done earlier during runtime in order to be more efficient. (DOTNET-5020)
Removed
System.Data.DataSe
t from the list of gadgets that could trigger an untrusted deserialization vulnerability.(DOTNET-5045)The agent's log files no longer trigger a path traversal vulnerability. (DOTNET-5054)
Bug fixes:
Route discovery continues to work when a bad JSON exists on an Azure Function app's
host.json
file. If this issue occurs, the routes will have no prefix. (DOTNET-5058)
Release date: May 24, 2023
Language versions currently supported: .NET Core: 3.1 (limited support), .NET 5.0 (limited support), 6.0, 7.0
The Contrast Upgrade Service, which is installed alongside the .NET Core for IIS agent by default, does not upgrade across major versions by default. Set enable_major_version_upgrade
to true
in the upgrade service's configuration file in C:\ProgramData\Contrast\upgrade-service\
by default if you want to enable upgrades across major versions.
Bug fixes:
Fixed an exception that occurred during log clean up when one application is running as administrator and another is running as a normal user. (DOTNET-4963)
The agent no longer reports false positive unvalidated-redirect in certain cases where the scheme/host were actually safe. (DOTNET-5008)
Thread safety issues with collections that could result in exceptions and performance degradation were addressed. (DOTNET-4986)
Added support for Telerik JavaScript encoding method signatures for XSS, so methods that use them should no longer result in xss vulnerabilities. (DOTNET-5002)
Release date: May 9, 2023
Language versions currently supported: .NET Core: 3.1 (limited support), .NET 5.0 (limited support), 6.0, 7.0
The Contrast Upgrade Service, which is installed alongside the .NET Core for IIS agent by default, does not upgrade across major versions by default. Set enable_major_version_upgrade
to true
in the upgrade service's configuration file in C:\ProgramData\Contrast\upgrade-service\
by default if you want to enable upgrades across major versions.
New and improved:
Added config flag
agent.dotnet.debug.background_job_deny_list
to disable background jobsImproved the handling of
AgentLib
exceptionsInstallers now remove all registry keys when uninstalled
Agent Explorer finds a different port if its default port is already in use
Agent Explorer uses platform-specific paths for the Native Module for applications under IIS Express
Release date: April 20, 2023
Language versions currently supported: .NET Core: 3.1 (limited support), .NET 5.0 (limited support), 6.0, 7.0
The Contrast Upgrade Service, which is installed alongside the .NET Core for IIS agent by default, does not upgrade across major versions by default. Set enable_major_version_upgrade
to true
in the upgrade service's configuration file in C:\ProgramData\Contrast\upgrade-service\
by default if you want to enable upgrades across major versions.
Bug fixes:
Fixed an issue that caused the Agent Explorer to crash on startup
Release date: April 12, 2023
Language versions currently supported: .NET Core: 3.1 (limited support), .NET 5.0 (limited support), 6.0, 7.0
The Contrast Upgrade Service, which is installed alongside the .NET Core for IIS agent by default, does not upgrade across major versions by default. Set enable_major_version_upgrade
to true
in the upgrade service's configuration file in C:\ProgramData\Contrast\upgrade-service\
by default if you want to enable upgrades across major versions.
New and improved
Agent disables itself with a 404 message only if the response body includes an
invalid application
messageFixed localization text in the installer
Log clean up is now done by one instance of the agent, thereby reducing resource consumption on start up
The agent has better logging if it cannot get the per-user config in certain cases
Agent Explorer displays a better message for applications that are not instrumented due to an application allowlist or denylist
Installer no longer hangs if IIS is not installed and it tries to run
AppCmd
Agent no longer reports crypto-weak-randomness when certain database clients are used
Release date: March 28, 2023
Language versions currently supported: .NET Core: 3.1 (limited support), .NET 5.0 (limited support), 6.0, 7.0
The Contrast Upgrade Service, which is installed alongside the .NET Core for IIS agent by default, does not upgrade across major versions by default. Set enable_major_version_upgrade
to true
in the upgrade service's configuration file in C:\ProgramData\Contrast\upgrade-service\
by default if you want to enable upgrades across major versions.
New and improved:
Service Bus queues can be excluded in an Azure Functions application using a Service Bus trigger.
Improved documentation on expectations for setting Azure Functions environment variables.
Release date: March 21, 2023
Language versions currently supported: .NET Core: 3.1 (limited support), .NET 5.0 (limited support), 6.0, 7.0
The Contrast Upgrade Service, which is installed alongside the .NET Core for IIS agent by default, does not upgrade across major versions by default. Set enable_major_version_upgrade
to true
in the upgrade service's configuration file in C:\ProgramData\Contrast\upgrade-service\
by default if you want to enable upgrades across major versions.
Important
Important improvements:
Installer: Changed the directories where the profiler and native modules are installed to:
%ProgramFiles%\Contrast\dotnet-core\sensors\runtimes\<platform>\native\
Site Extension: Changed the directory where the profiler is installed to:
content\ContrastNetCoreAppService-4.x.x.x\runtimes\<platform>\native\
Changed the name of the profiler DLL to:
ContrastProfiler.dll
.The agent now supports layered configurations.
Other improvements:
The agent now uses the
agent-lib
library by default.Improved the documentation for the diagnostics
'memory-usage'
verb.Offset starting background jobs in the agent to reduce startup resource usage.
Service Bus gRPC endpoints are no longer found during Azure Functions route discovery.
Release date: March 15, 2023
Language versions currently supported: .NET Core: 3.1 (limited support), .NET 5.0 (limited support), 6.0, 7.0
Important
With the release of the .NET Core agent version 3.0.0, Contrast support for .NET 5.0 and .NET Core 3.1 enters limited support. Under limited support, Contrast solves only the problems that we can reproduce under supported language versions
Microsoft support for .NET 5.0 ended on May 10th, 2022 . Contrast support for .NET 5.0 will EOS in December 2022. Also, support for .NET Core 3.1 ended on December 13th, 2022. The Contrast Upgrade Service, which is installed alongside the .NET Core for IIS agent by default, will not upgrade across major versions by default. Set enable_major_version_upgrade
to true
in the upgrade service's configuration file in C:\ProgramData\Contrast\upgrade-service\ by default
if you want to enable upgrades across major versions.
Contrast strongly recommends upgrading your applications to a newer, supported version of .NET.
New and improved:
Profiler no longer attaches to
Contrast.AgentExplorer.exe
.Improved performance for log cleanup.
Release date: March 1, 2023
Language versions currently supported: .NET Core: 3.1 (limited support), .NET 5.0 (limited support), 6.0, 7.0
Important
With the release of the .NET Core agent version 3.0.0, Contrast support for .NET 5.0 and .NET Core 3.1 enters limited support. Under limited support, Contrast solves only the problems that we can reproduce under supported language versions
Microsoft support for .NET 5.0 ended on May 10th, 2022 . Contrast support for .NET 5.0 will EOS in December 2022. Also, support for .NET Core 3.1 ended on December 13th, 2022. The Contrast Upgrade Service, which is installed alongside the .NET Core for IIS agent by default, will not upgrade across major versions by default. Set enable_major_version_upgrade
to true
in the upgrade service's configuration file in C:\ProgramData\Contrast\upgrade-service\ by default
if you want to enable upgrades across major versions.
Contrast strongly recommends upgrading your applications to a newer, supported version of .NET.
New and improved:
Agent now supports chaining with Aternity.
Agent now reports Redis database connections to FlowMap for connections using the StackExchange Redis driver.
Azure Function apps are named after the assembly rather than the host.
The installer bootstrapper does not block bundle downgrades on silent installations.
Release date: February 3, 2023
Language versions currently supported: .NET Core: 3.1 (limited support), .NET 5.0 (limited support), 6.0, 7.0
Important
With the release of the .NET Core agent version 3.0.0, Contrast support for .NET 5.0 and .NET Core 3.1 enters limited support. Under limited support, Contrast solves only the problems that we can reproduce under supported language versions
Microsoft support for .NET 5.0 ended on May 10th, 2022 . Contrast support for .NET 5.0 will EOS in December 2022. Also, support for .NET Core 3.1 ended on December 13th, 2022. The Contrast Upgrade Service, which is installed alongside the .NET Core for IIS agent by default, will not upgrade across major versions by default. Set enable_major_version_upgrade
to true
in the upgrade service's configuration file in C:\ProgramData\Contrast\upgrade-service\ by default
if you want to enable upgrades across major versions.
Contrast strongly recommends upgrading your applications to a newer, supported version of .NET.
New and improved:
Assess and Protect now detect SQL-injection vulnerabilities for PostgresSQL databases that use the npgsql library.
Agent now reports PostgresSQL database connections to FlowMap for connections using the npgsql library.
Expanded the
ValueStringBuilder
support for some propagation signatures.
Release date: January 25, 2023
Language versions currently supported: .NET Core: 3.1 (limited support), .NET 5.0 (limited support), 6.0, 7.0
Important
With the release of the .NET Core agent version 3.0.0, Contrast support for .NET 5.0 and .NET Core 3.1 enters limited support. Under limited support, Contrast solves only the problems that we can reproduce under supported language versions
Microsoft support for .NET 5.0 ended on May 10th, 2022 . Contrast support for .NET 5.0 will EOS in December 2022. Also, support for .NET Core 3.1 ended on December 13th, 2022. The Contrast Upgrade Service, which is installed alongside the .NET Core for IIS agent by default, will not upgrade across major versions by default. Set enable_major_version_upgrade
to true
in the upgrade service's configuration file in C:\ProgramData\Contrast\upgrade-service\ by default
if you want to enable upgrades across major versions.
Contrast strongly recommends upgrading your applications to a newer, supported version of .NET.
New and improved:
Expanded Assess coverage of
String.Normalize
APIs.Attacks that Protect detects now include the parameter names for attacks originating from model-bound values set from parameters sources.
Release date: January 12, 2023
Language versions currently supported: .NET Core: 3.1, .NET 5.0, 6.0, 7.0
Important
Microsoft support for .NET 5.0 ended on May 10th, 2022. Contrast support for .NET 5.0 will EOS in December 2022. Upgrade your application to a newer, supported version of .NET.
New and improved:
Improved agent reporting of View components for FlowMaps in the Contrast web interface.
Release date: December 14, 2022
Language versions currently supported: .NET Core: 3.1, .NET 5.0, 6.0, 7.0
Important
Microsoft support for .NET 5.0 ended on May 10th, 2022. Contrast support for .NET 5.0 will EOS in December 2022. Upgrade your application to a newer, supported version of .NET.
New and improved:
This release includes a new version of Agent Explorer with several bug fixes and UI improvements.
Release date: December 12, 2022
Language versions currently supported: .NET Core: 3.1, .NET 5.0, 6.0, 7.0
Important
Microsoft support for .NET 5.0 ended on May 10th, 2022. Contrast support for .NET 5.0 will EOS in December 2022. Upgrade your application to a newer, supported version of .NET.
New and improved:
The agent now reports web service components that the application uses to populate the Contrast Flow Map.
The agent now supports attaching a debugger to .NET 6 applications without requiring the
DOTNET_EXTERNAL_DebuggerLaunchDisablesCodeVersioning=0 environment
variable.The invariant culture is now used when writing Protect events to
syslog
. (DOTNET-4661)
Bug fixes:
When both the agent package and the installed agent were deployed to the same server, the agent package's instrumentation would load the installed agent's sensors component. This issue is now fixed. (DOTNET-4683)
Release date: November 21, 2022
Language versions currently supported: .NET Core: 3.1, .NET 5.0, 6.0, 7.0
Important
Microsoft support for .NET 5.0 ended on May 10th, 2022. Contrast support for .NET 5.0 will EOS in December 2022. Upgrade your application to a newer, supported version of .NET.
Bug fixes:
Assess would report an XSS when ASPNET Core MVC used the URL, encoded by the framework when necessary, in generated form actions. This has been fixed. (DOTNET-4623)
The agent will now more reliably detect and report databases to Flow Map. (DOTNET-2199)
Release date: November 8, 2022
Language versions currently supported: .NET Core: 3.1, .NET 5.0, 6.0, 7.0
Important
Microsoft support for .NET 5.0 ended on May 10th, 2022. Contrast support for .NET 5.0 will EOS in December 2022. Upgrade your application to a newer, supported version of .NET.
New and improved:
Added support for .NET 7.
Release date: November 9, 2022
Language versions currently supported: .NET Core: 3.1, .NET 5.0, 6.0
Important
Microsoft support for .NET 5.0 ended on May 10th, 2022. Contrast support for .NET 5.0 will EOS in December 2022. Upgrade your application to a newer, supported version of .NET.
New and improved:
Agent Explorer now shows statistics for the number of vulnerabilities, number of attacks, and external services that agents observe, as well as information for libraries seen and number of classes that each library uses.
Bug fixes:
Assess could sometimes report vulnerabilities involving data flow using interned strings. This issue is now fixed. (DOTNET-4589)
Release date: November 2, 2022
Language versions currently supported: .NET Core: 3.1, .NET 5.0, 6.0
Important
Microsoft support for .NET 5.0 ended on May 10th, 2022. Contrast support for .NET 5.0 will EOS in December 2022. Upgrade your application to a newer, supported version of .NET.
New and improved:
Further reduced the number of allocations that Contrast Assess uses to track dataflow through
StringBuilder.Replace
APIs.
Release date: October 31, 2022
Language versions currently supported: .NET Core: 3.1, .NET 5.0, 6.0
Important
Microsoft support for .NET 5.0 ended on May 10th, 2022. Contrast support for .NET 5.0 will EOS in December 2022. Upgrade your application to a newer, supported version of .NET.
New and improved:
Significantly improved performance, particularly for allocations that Assess uses to track dataflow through
StringBuilder.Replace
APIs.
Release date: October 18, 2022
Language versions currently supported: .NET Core: 3.1, .NET 5.0, 6.0
Important
Microsoft support for .NET 5.0 ended on May 10th, 2022. Contrast support for .NET 5.0 will EOS in December 2022. Upgrade your application to a newer, supported version of .NET.
New and improved:
In Agent Explorer, the detailed view of an agent now displays why a degraded or faulted agent is in a bad state.
Bug fixes:
In Agent Explorer, the Summary tab now shows a consistent number of agents across different components. (DOTNET-4580)
Agents running within .NET Core 3.1 applications failed to report to Agent Explorer. This issue is now fixed. (DOTNET-4579)
Release date: October 13, 2022
Language versions currently supported: .NET Core: 3.1, .NET 5.0, 6.0
Important
Microsoft support for .NET 5.0 ended on May 10th, 2022. Contrast support for .NET 5.0 will EOS in December 2022. Upgrade your application to a newer, supported version of .NET.
Bug fixes:
Applications could crash when running with Dynatrace OneAgent when an environment variable was changed to a null value. This issue is now fixed. (DOTNET-4594)
This issue was incorrectly reported as fixed in .NET Core 2.3.1.
Release date: October 13, 2022
Language versions currently supported: .NET Core: 3.1, .NET 5.0, 6.0
Important
Microsoft support for .NET 5.0 ended on May 10th, 2022. Contrast support for .NET 5.0 will EOS in December 2022. Upgrade your application to a newer, supported version of .NET.
Bug fixes:
Applications could crash when running with Dynatrace OneAgent when an environment variable was changed to a null value. This issue is now fixed. (DOTNET-4594)
Assess would incorrectly report a vulnerability when the value of the content-length header was used in a sink such as a database query. This issue is now fixed. (DOTNET-4537)
Release date: October 5, 2022
Language versions currently supported: .NET Core: 3.1, .NET 5.0, 6.0
Important
Microsoft support for .NET 5.0 ended on May 10th, 2022. Contrast support for .NET 5.0 will EOS in December 2022. Upgrade your application to a newer, supported version of .NET.
New and improved:
The .NET Core agent for IIS installer now includes Agent Explorer, a separate GUI application that provides high-level information about locally running .NET and .NET Framework agents. Use Agent Explorer to see high-level information such as:
Applications and servers that the agent reports
Agent configuration
Agent version, anguage, and runtime
List of applications that are currently deployed to IIS and/or IIS Express and instrumented.
Bug fixes:
Protect now reports the IP address of an attack in more scenarios.
The .NET Core for IIS agent now supports running alongside Dynatrace in both in-process and out-of-process modes. Previously the agent only supported running alongside Dynatrace when using in-process hosting. (DOTNET-4572)
Release date: September 27, 2022
Language versions currently supported: .NET Core: 3.1, .NET 5.0, 6.0
Important
Microsoft support for .NET 5.0 ended on May 10th, 2022. Contrast support for .NET 5.0 will EOS in December 2022. Upgrade your application to a newer, supported version of .NET.
new and improved:
.NET 7 RC1 is now supported.
Input exclusions now have full regular expression support.
Release date: August 29, 2022
Language versions currently supported: .NET Core: 3.1, .NET 5.0, 6.0
Bug fixes
Fixed a reported issue where the diagnostics executable would crash with an error
Contrast.AgentLib was not found
.The agent would observe admin routes within Azure Functions that are only executed by the Azure Functions internals. The agent no longer reports these admin routes (DOTNET-4464).
Release date: August 23, 2022
Language versions currently supported: .NET Core: 3.1, .NET 5.0, 6.0
Bug fixes
Agent upgrades for the installed IIS agent would fail when an agent was installed with a custom data directory. This issue has been fixed. (DOTNET-4453)
Release date: August 8, 2022
Language versions currently supported: .NET Core: 3.1, .NET 5.0, 6.0
Important
Microsoft support for .NET 5.0 ended on May 10th, 2022. Contrast support for .NET 5.0 will EOS in December 2022. Upgrade your application to a newer, supported version of .NET.
Bug fixes:
The Agent Upgrade Service would only check for updates after restarting a second time, this has now been fixed. (DOTNET-4318)
Release date: August 1, 2022
Language versions currently supported: .NET Core: 3.1, .NET 5.0, 6.0
Important
Microsoft support for .NET 5.0 ended on May 10th, 2022. Contrast support for .NET 5.0 will EOS in December 2022. Upgrade your application to a newer, supported version of .NET.
New and improved:
Agent will now report SMTP Injection vulnerabilities under Assess.
On Windows Server 2012, the IIS installer will now warn users to install VC++ redistributable package necessary for the agent's upgrade service.
Bug fixes:
The agent would fail to clean up rolled over log files from native components. This has been fixed. (DOTNET-4314)
Release date: July 12, 2022
Language versions currently supported: .NET Core: 3.1, .NET 5.0, 6.0
Important
Microsoft support for .NET 5.0 ended on May 10th, 2022. Contrast support for .NET 5.0 will EOS in December 2022. Upgrade your application to a newer, supported version of .NET.
Bug fixes:
Assess
hsts-header-missing
previously checked the presence and value of thestrict-transport-security
header for requests made over TLS only. The rule will now also check for thestrict-transport-security
header if theX-Forwarded-Proto
header indicates the request was made over TLS but TLS was terminated before reaching the application.Diagnostics now offers a
read-config
option that will report on the effective configuration of currently running instrumented applications on the server.Improved the accuracy of Protect XXE detection, fixing a false negative.
Assess previously reported the usage of a weak hash algorithm within Microsoft's Application Insight's snapshot collector. This will no longer be reported. (DOTNET-4252)
Release date: June 28, 2022
Language versions currently supported: .NET Core: 3.1, .NET 5.0, 6.0
Important
Microsoft support for .NET 5.0 ended on May 10th, 2022. Contrast support for .NET 5.0 will EOS in December 2022. Upgrade your application to a newer, supported version of .NET.
Bug fixes:
Agent could cause an application error when capturing the application's response when the HTTP context was null at the end of the request. This has been fixed. (DOTNET-4219)
Resolved a performance regression only present in version 2.1.15.
Release date: June 21, 2022
Language versions currently supported: .NET Core: 3.1, .NET 5.0, 6.0
Important
Microsoft support for .NET 5.0 ended on May 10th, 2022. Contrast support for .NET 5.0 will EOS in December 2022. Upgrade your application to a newer, supported version of .NET.
New and improved:
Improved Assess response capture, especially with regards to reducing the agent's impact to response streaming.
Improved detection of when the agent is running in an Azure Functions environment.
Release date: June 13, 2022
Language versions currently supported: .NET Core: 3.1, .NET 5.0, 6.0
Important
Microsoft support for .NET 5.0 ended on May 10th, 2022. Contrast support for .NET 5.0 will EOS in December 2022. Upgrade your application to a newer, supported version of .NET.
Bug fixes:
The agent did not send
assess.tags
with the "preflight" vulnerability check (but did send this information with the vulnerability report.) The agent now sends the expected information with both messages. (DOTNET-4157)Assess analysis did not include ASPNET Core MVC model-bound path parameters. The agent will now correctly find vulnerabilities originating from a model-bound path parameter. (DOTNET-4163)
Release date: May 26, 2022
Language versions currently supported: .NET Core: 3.1, .NET 5.0, 6.0
Important
Microsoft support for .NET 5.0 ended on May 10th, 2022. Contrast support for .NET 5.0 will EOS in December 2022. Upgrade your application to a newer, supported version of .NET.
New and improved:
Added Assess sanitizers for mganss' HtmlSanitizer APIs. (DOTNET-4033)
Reduced the amount of memory used by the runtime for all libraries not instrumented by the agent. This has resulted in 5-10% reduction in process memory.
Release date: May 17, 2022
Language versions currently supported: .NET Core: 3.1, .NET 5.0, 6.0
Important
Microsoft support for .NET 5.0 ended on May 10th, 2022. Contrast support for .NET 5.0 will EOS in December 2022. Upgrade your application to a newer, supported version of .NET.
New and improved:
Improved Assess taint tracking for validation methods.
Assess will no longer propagate on
HttpRequest.PathBase
.(DOTNET-4117)
Release date: May 10, 2022
Language versions currently supported: .NET Core: 3.1, .NET 5.0, 6.0
New and improved:
Improved accuracy of Assess URL character tracking to exclude the port number. (DOTNET-4093)
Assess will no longer report path traversal on Linux systems when ASP.NET Core reads time zone info from the file system. (DOTNET-4062)
Release date: April 27, 2022
Language versions currently supported: .NET Core: 3.1, .NET 5.0, 6.0
New and improved:
Minor performance improvements to the cost of calling into Contrast sensors from instrumented code.
Added diagnostics
check-access
option to test that a Windows user has access to agent profiler and sensor components.Improved cookie value parsing logic to avoid reporting that an invalid cookie is missing
HttpOnly
orsecure
flags.
Release date: April 14, 2022
Language versions currently supported: .NET Core: 3.1, .NET 5.0, 6.0
Bug fixes:
Protect untrusted deserialization did not respect URL exclusions. (DOTNET-4019)
Agent failed to detect web service flow map components when an application used .NET Core's dependency injection (i.e.,
services.AddHttpClient
).(DOTNET-4023)
Release date: March 24, 2022
Language versions currently supported: .NET Core: 3.1, .NET 5.0, 6.0
New and improved:
Agent will now report web service components which can be viewed on the application's flow map diagram. (This item mistakenly appeared in release notes for 2.1.6)
Expanded APIs used to detect unvalidated redirect vulnerabilities under Assess.
Diagnostics
validate-yaml
will now validate application.metadata and application.session_metadata values follow expected format.Added new
deep-connect
diagnostics command to help troubleshoot agent communication with Contrast.
Bug fixes:
Semantic Path Traversal attacks would be detected and blocked by the agent but failed to report to Contrast. (DOTNET-3978)
Release date: March 16, 2022
Language versions currently supported: .NET Core: 3.1, .NET 5.0, 6.0
New and improved:
Diagnostics
cert-info
command's validation of certificates now more closely matches the agent's HttpClient's certificate validation.
Bug fixes:
The Azure App Service Site Extension's XDT in version 2.1.6 included a bad transform that caused the App Service instance to crash. This has been fixed. (DOTNET-3983)
Release date: March 14, 2022
Language versions currently supported: .NET Core: 3.1, .NET 5.0, 6.0
New and improved:
Improved reporting of library class names to exclude compiler-generated types.
Added Protect support for GraphQL inputs.
Agent will now report web service components which can be viewed on the application's flow map diagram.
Diagnostics
config-keys
will now provide descriptions for special Contrast environment variables that can be used to configure specific agent behavior (e.g.,CONTRAST_CONFIG_PATH
to set the path of the agent's configuration file.)
Bug fixes:
Agent instrumentation of Utf8JsonReader lead to an application crash under 32-bit processes.
In some rare cases, the Azure App Service Site Extension could fail to cleanly upgrade because the agent's profiler component was locked. Agent components within the site extension are now housed in a version-specific directory. Note that users that have manually specified the path to agent components will need to update these paths. This should not be common as the Site Extension automatically sets the environment variables with the correct paths necessary to load the agent.
Release date: February 28, 2022
Language versions currently supported: .NET Core: 3.1, .NET 5.0, 6.0
New and improved:
Improved performance of Assess analysis, especially with regards to methods with internal implementations that make heavy use of Span APIs.
Assess potential sanitizers and validators will now be automatically reported to Contrast by default.
.NET Core for IIS agent now enables profiler chaining by default.
Release date: February 10, 2022
Language versions currently supported: .NET Core: 3.1, .NET 5.0, 6.0
New and improved:
Assess now supports GraphQL sources and route coverage for graphql-dotnet library versions 4.0.1+.
Improved performance by reducing cost of jumping from instrumented code to Contrast sensors.
Release date: January 24, 2022
Language versions currently supported: .NET Core: 3.1, .NET 5.0, 6.0
New and improved:
Improved performance of Assess analysis of
System.Text.Json
API calls.
Bug fixes:
The agent's sensors component did not respect a custom data directory set during install. (DOTNET-3739)
Diagnostics' system-info command failed to gather information about IIS application pools and applications. (DOTNET-3670)
Release date: January 11, 2022
Language versions currently supported: .NET Core: 3.1, .NET 5.0, 6.0
New and improved:
Improved performance of Assess and Protect analysis by reducing the cost of calling into Contrast code from instrumented code.
Improved performance of Assess analysis of application code with data flow within LINQ where clauses.
Bug fixes:
Fixed an issue where agent logs indicated an error due to a missing default configuration value. (DOTNET-3633)
Fixed an issue where the agent's Upgrade Service component could crash when instrumented by the Contrast .NET Core agent earlier than 2.1.0. Note that this would only occur if a user set global environment variables to add the Contrast .NET Core agent's profiler. (DOTNET-3689)
Routes included the application's virtual path when deployed to IIS. (DOTNET-3632)
Release date: December 14, 2021
Language versions currently supported: .NET Core: 3.1, .NET 5.0, 6.0
New and improved:
Now supports profiler chaining with AppDynamics.
Now supports Assess log-injection.
Bug fixes:
When an instrumented application used a static DI container with cookie options then the agent would cause the application to fail to start. (DOTNET-3630)
Important note:
Starting with version 2.0.0, the Contrast .NET Core agent no longer supports .NET Core 2.1 and .NET Core 3.0. The agent continues to support .NET Core 3.1, 5.0, and 6.0. This follows Microsoft's EOL for .NET Core 2.1 on August 22, 2021 and .NET Core 3.0 on March 3, 2020.
Release date: November 9, 2021
Language versions currently supported: .NET Core: 3.1, .NET 5.0, 6.0
New and improved:
.NET Core 2.1.0 adds support for applications targeting .NET 6.
Improved Assess data flow analysis through APIs using
Span
,Memory
,ValueTask
,ValueStringBuilder
, andStringSegment
types.Agent now recognizes specific
DateOnly
andTimeOnly
APIs as validators for Assess.Added route coverage support for .NET 6's minimal API structure.
Important note:
Starting with version 2.0.0, the Contrast .NET Core agent no longer supports .NET Core 2.1 and .NET Core 3.0. The agent continues to support .NET Core 3.1 and 5.0. This follows Microsoft's EOL for .NET Core 2.1 on August 22, 2021 and .NET Core 3.0 on March 3, 2020.
Release date: October 6, 2021
Language versions currently supported: .NET Core: 3.0, 3.1, 5.0
Note
Starting with version 2.0.0, the Contrast .NET Core agent no longer supports .NET Core 2.1 and .NET Core 3.0. The agent continues to support .NET Core 3.1 and 5.0. This follows Microsoft's EOL for .NET Core 2.1 on August 22, 2021 and .NET Core 3.0 on March 3, 2020.
New and improved:
The .NET Core agent now supports Assess Stored XSS and Trust Boundary Violation rules.
Minor performance improvements.
Improved security of the agent upgrade service.
Bug fixes:
NullReferenceException
when agent attempted to determine the version of .NET Core from an unusual command line. (DOTNET-3454)Assess SQL Injection false positive when numeric values were safely used by Entity Framework Core internally. (DOTNET-3435)
Release date: September 22, 2021
Language versions currently supported: .NET Core: 3.0, 3.1, 5.0
Note
Starting with version 2.0.0, the Contrast .NET Core agent no longer supports .NET Core 2.1 and .NET Core 3.0. The agent continues to support .NET Core 3.1 and 5.0. This follows Microsoft's EOL for .NET Core 2.1 on August 22, 2021 and .NET Core 3.0 on March 3, 2020.
New and improved:
Improved Assess data flow coverage through
String.Format
andJsonEncodedText.Encode
.Added Assess and Protect handling for when
System.Text.Json
serialization is set as the formatter/model-binder for ASP.NET Core.
Release date: September 1, 2021
Language versions currently supported: .NET Core: 3.0, 3.1, 5.0
Note
Starting with version 2.0.0, the Contrast .NET Core agent no longer supports .NET Core 2.1 and .NET Core 3.0. The agent continues to support .NET Core 3.1 and 5.0. This follows Microsoft's EOL for .NET Core 2.1 on August 22, 2021 and .NET Core 3.0 on March 3, 2020.
New and improved:
Further reduced the amount of memory used by the agent's profiler component.
Reduced agent's overhead on each request.
Release date: August 16, 2021
Language versions currently supported: .NET Core: 2.1, 3.0, 3.1, 5.0
Note
An upcoming version (2.0) of the .NET Core agent will drop support for .NET Core 2.1 and 3.0. This follows Microsoft's support policy with .NET Core 2.1 support ending on August 22nd. (.NET Core 3.0 EOL was March 3, 2020)
New and improved:
The installed .NET Core for IIS agent now includes an auto-upgrade service that, if enabled in the service's configuration, will automatically upgrade the agent to the latest version on NuGet.
Improved Assess coverage APIs involving
Span<T>
,Range
, andIndex
parameters.The agent will no longer report weak hash algorithm used by the Azure Storage client SDK.
Bug fixes:
The agent would fail to discover routes declared using ASPNET Core MVC 3+ endpoint-style routing. (DOTNET-3265)
Release date: July 22, 2021
Language versions currently supported: .NET Core: 2.1, 3.0, 3.1, 5.0
Note
An upcoming version (2.0) of the .NET Core agent will drop support for .NET Core 2.1 and 3.0. This follows Microsoft's support policy with .NET Core 2.1 support ending on August 22nd. (.NET Core 3.0 EOL was March 3, 2020)
New and improved:
Further reduced memory usage of the agent's profiler component.
Improved Assess coverage of
Memory<T>
andMemoryExtension
APIs.Added official support for RHEL 7 and 8.
Bug fixes:
The agent could fail to report discovered routes to Contrast. (DOTNET-3234)
Release date: July 12, 2021
Language versions currently supported: .NET Core: 2.1, 3.0, 3.1, 5.0
New and improved:
Reduced the amount of memory used by the agent's profiler component.
Improved Assess coverage of
Memory<T>
andSpan<T>
APIs.
Bug fixes:
Agent did not respect URL-based exclusions for Assess response-based rules. (DOTNET-3161)
Release date: June 30, 2021
Language versions currently supported: .NET Core: 2.1, 3.0, 3.1, 5.0
New and improved:
Protect will no longer report semantic SQL findings on queries constructed safely using EF Core 2.1/3.1/5.0.
Profiler will now log all profiler settings, not just settings from the YAML file.
Profiler will no longer instrument diagnostics/powershell/powershell core.
Improved Assess coverage of APIs that return task.
Release date: June 21, 2021
Language versions currently supported: .NET Core: 2.1, 3.0, 3.1, 5.0
New and improved:
Protect will no longer report semantic SQL chaining on queries constructed safely using LINQ 2 SQL.
Protect will no longer report use of dangerous functions on queries constructed safely using Entity Framework.
Bug fixes:
Agent's interaction with ASPNET Core's DI container could cause applications built on top of a Boilerplate template to not start up. (DOTNET-3038)
Assess will no longer report untrusted deserialization against JsonNET
JsonSerializerProxy
. (DOTNET-3031)
Release date: June 14, 2021
Language versions currently supported: .NET Core: 2.1, 3.0, 3.1, 5.0
Bug fixes:
Assess false positive when using
JsonSerializerProxy
with Json.NET deserialization. (DOTNET-3031)
Release date: June 10, 2021
Language versions currently supported: .NET Core: 2.1, 3.0, 3.1, 5.0
Bug fixes:
Agent did not send
sessionId
when reporting routes. (DOTNET-3021)
Release date: June 2, 2021
Language versions currently supported: .NET Core: 2.1, 3.0, 3.1, 5.0
New and improved:
Improved performance of calling into Contrast code from instrumented methods.
Improved agent startup performance.
Will now discover and observe health check routes.
Will now observe endpoint routing routes (discovery was implemented in a previous version).
Release date: May 25, 2021
Language versions currently supported: .NET Core: 2.1, 3.0, 3.1, 5.0
New and improved:
Agent will now discover endpoint routing routes.
Release date: May 20, 2021
Language versions currently supported: .NET Core: 2.1, 3.0, 3.1, 5.0
New and improved:
Improved memory usage of logging communication with Contrast.
Agent will now discover and observe routes used by routing middleware handlers.
Release date: May 12, 2021
Language versions currently supported: .NET Core: 2.1, 3.0, 3.1, 5.0
New and improved:
Reduced memory used by agent to capture stack traces.
Improve performance of capturing repeated stack traces under Protect.
Improved Assess coverage of ref struct objects when using the Common Instrumentation Engine (CIE).
Improved Assess sql-injection coverage of EF Core APIs.
Release date: May 5, 2021
Language versions currently supported: .NET Core: 2.1, 3.0, 3.1, 5.0
New and improved:
Expanded coverage of Protect cmd-injection rule.
Will now discover health check routes.
Diagnostics now offers
create-script
to create deployment "scripts" for the local machine. Currently supports PowerShell, bash, launch settings, and web.config.Diagnostics
check-process
will now inspect logs in the logs directory specified by environment variable (if set).Agent will now report agent errors to telemetry.
Bug fixes:
Agent could fail to identify Assess sources when inspecting a model bound object that mixed
JObject
type within a POCO type. (DOTNET-2534)Library reporting could fail on obfuscated assemblies. (DOTNET-2846)
Release date: April 19, 2021
Language versions currently supported: .NET Core: 2.1, 3.0, 3.1, 5.0
New and improved:
Improved logging when both CLR and CoreCLR are in the same process.
Improved instrumentation performance under CLR Instrumentation Engine (CIE).
Improved logging for unsupported .NET Core runtime versions.
Added verb + url reporting for .NET Core Razor Pages discovered routes.
Bug fixes:
Fixed an error in parsing certain SQL queries in Protect semantic SQL rules. (DOTNET-646)
Fixed a memory leak. (DOTNET-2771)
Release date: April 13, 2021
Language versions currently supported: .NET Core: 2.1, 3.0, 3.1, 5.0
New and improved:
Agent initialization will now log the final resolved value for
assess.enable
andprotect.enable
.Improved route discovery for controller actions using convention or pattern-based routing.
Bug fixes:
.NET Core agent hangs on async tasks. (SUP-2667)
Release date: March 25, 2021
Language versions currently supported: .NET Core: 2.1, 3.0, 3.1, 5.0
New and improved:
Improved accuracy for
async
APIs under Assess.Accurate reporting of the verb and URL parameters for unexercised routes when using the NetCore framework.
Release date: March 10, 2021
Language versions currently supported: .NET Core: 2.1, 3.0, 3.1, 5.0
New and improved:
Added support for
server.path
configuration.The agent will now report the host of Web Service components.
Release date: March 2, 2021
Language versions currently supported: .NET Core: 2.1, 3.0, 3.1, 5.0
New and improved:
Improved agent performance by alleviating common agent hot spots.
Improved Assess data propagation on asynchronous methods.
Improved Assess detection of unsafe cryptographic algorithms.
Bug fixes:
Agent does not properly handle valid tls_versions configuration: tls|tls11|tls12 (DOTNET-2551)
The agent's profiler component chooses not to instrument a process when .NET Framework runtime was loaded first but the environment variable indicated .NET Core. (SUP-2225)
Release date: February 10, 2021
Language versions currently supported: .NET Core: 2.1, 3.0, 3.1, 5.0
New and improved:
Improved application archiving capabilities. Once an application is archived in the Contrast web interface, the .NET Core agent will be disabled without needing an IIS restart.
Bug fixes:
Different signatures for the same dataflow reports duplicate routes. (SUP-2345)
Release date: February 2, 2021
Language versions currently supported: .NET Core: 2.1, 3.0, 3.1, 5.0
Important note:
All agent configuration settings referring to the terms
blacklist
andwhitelist
have been changed todenylist
andallowlist
, respectively. For example,agent.dotnet.app_pool_whitelist
is nowagent.dotnet.app_pool_allowlist
. The agent will continue to respect the old configuration names until August 2nd, 2022.
New and improved:
Protect will now mask sensitive data in the attack vector if enabled in the Contrast web interface.
Refined crypto-bad-mac rule to ignore .NET Core library code.
Added support for additional .NET Core deployment types (self-contained and framework dependant executables).
Bug fixes:
Protect path traveral in monitoring mode will now report a path-traversal probe when an attack goes through a "path resolution API" such as
Path.GetFullPath
. (SUP-2190)
Release date: January 13, 2021
Language versions currently supported: .NET Core: 2.1, 3.0, 3.1, 5.0
New and improved:
Self-contained .NET Core deployments are now supported.
Release date: January 11, 2021
Language versions currently supported: .NET Core: 2.1, 3.0, 3.1, 5.0
New and improved:
Added checkpoints to ensure semantic SQL rules are not reported by the agent when the rule is disabled in the Contrast web interface.
Added support for framework dependent executables.
Removed
agent.dotnet.enable_runtimeid_callbackhandler
configuration.
Bug fixes:
Session based auto-verification policies didn’t change the vulnerability status. (SUP-2365)
Release date: December 8, 2020
Language versions currently supported: .NET Core: 2.1, 3.0, 3.1, 5.0
New and improved:
The profiler will now log to syslog in the event of a major error or exception.
Release date: December 1, 2020
Language versions currently supported: .NET Core: 2.1, 3.0, 3.1, 5.0
Bug fixes:
.NET Core agent has a problem on startup when an application specified a custom NLog configuration file. (SUP-2220)
Release date: November 19, 2020
Language versions currently supported: .NET Core: 2.1, 3.0, 3.1, 5.0
New and improved:
The agent now supports .NET Core 5.
Release date: November 16, 2020
Language versions currently supported: .NET Core: 2.1, 3.0, 3.1
New and improved:
The agent now reports names of classes used as part of enhanced library usage.
Bug fixes:
The agent was reporting misleading route observation predictions upon route discovery. (DOTNET-2213)
The agent fails to start when Contrast provided a syslog configuration with messages at
INFO
level. (DOTNET-2310)The agent caused an error during agent initialization if the console was disabled. (DOTNET-2283)
Release date: October 29, 2020
Language versions currently supported: .NET Core: 2.1, 3.0, 3.1
Important notes:
New and improved:
With this release, the CLR Instrumentation Engine (CIE) is fully supported. Custom CIE environment variables are no longer required and can be removed. (You may have to reinstall the site extension.)
Officially deprecated and removed CONTRAST__AGENT__DOTNET__CONTAINER. The configuration flag has no effect. All environments that required it, no longer require the flag to function.
Reduced the size of the Azure App Service Site Extension by removing diagnostics from the download. Diagnostics is still available for other deployment types.
Minor performance improvements under Protect's XSS.
Bug fixes:
When agent sensors failed to initialize under Windows, they would crash the IIS process with an "IOException: The handle is invalid." exception. (DOTNET-2253)
Release date: October 20, 2020
Language versions currently supported: .NET Core: 2.1, 3.0, 3.1
Important notes:
We will no longer support .NET Core 2.2 beginning with this version. This is keeping up with Microsoft’s support policy, and their announcement to end support for .NET Core 2.2 by Dec 23, 2019. If you are using .NET Core 2.2, please make sure to use the .NET Core agent version 1.5.20 or lower until you can upgrade your application’s .NET Core runtime.
New and improved:
The .NET Core agent now supports logging to stdout for managed code.
Bug fixes:
Found memory leak in correlation tasks. (SUP-2065)
Release date: October 8, 2020
Language versions currently supported: .NET Core: 2.1, 2.2, 3.0, 3.1
Bug fixes:
Agent causes 500 if the app changes the maximum request body size. (SUP-2032, workaround available)
Release date: September 30, 2020
Language versions currently supported: .NET Core: 2.1, 2.2, 3.0, 3.1
New and improved:
Telemetry now reports application framework and profiler chaining configurations.
Release date: September 17, 2020
Language versions currently supported: .NET Core: 2.1, 2.2, 3.0, 3.1
New and improved:
Azure Service Fabric is supported as a deployment type for the .NET Core agent.
Bug fixes:
The agent does not respect the
api.certificate.ignore_cert_errors
configuration property.
Release date: September 3, 2020
Language versions currently supported: .NET Core: 2.1, 2.2, 3.0, 3.1
New and improved:
Telemetry is now enabled in the .NET Core agent in order to gather valuable data about the agent’s functionality. The data is all anonymous, no personal information is collected.
Language versions currently supported: .NET Core: 2.1, 2.2, 3.0, 3.1
Bug fixes:
Agent fails to startup properly when application is archived. (SUP-1849)
Language versions currently supported: .NET Core: 2.1, 2.2, 3.0, 3.1
Bug fixes:
Type scanning may throw an exception. (SUP-1671)
Language versions currently supported: .NET Core: 2.1, 2.2, 3.0, 3.1
New features and improvements:
Improved logging around Virtual Patch usage.
Bug fixes:
Virtual patches for QueryString parameters do not work if the values contain structured data. (SUP-1763)
Language versions currently supported: .NET Core: 2.1, 2.2, 3.0, 3.1
New features and improvements:
Improved logging around non-graceful shutdowns.
Language versions currently supported: .NET Core: 2.1, 2.2, 3.0, 3.1
Agent versions released during the past month: 1.5.10, 1.5.11, 1.5.12
New features and improvements:
Added
connect
to contrast-dotnet-diagnostics to test the agent’s ability to connect to Contrast.Added
config-keys
to contrast-dotnet-diagnostics to display configuration options supported by the agent.Added
cert-info
to contrast-dotnet-diagnostics to display information about the certificate provided by the value of theapi.url
configuration setting.Improved the performance of Protect SQL-Injection detection.
Improved the performance of Protect against XML-based inputs.
Added
validate-yaml
to contrast-dotnet-diagnostics to verify the agent’s contrast-security.yaml configuration file.
Language versions currently supported: .NET Core: 2.1, 2.2, 3.0, 3.1
Agent versions released during the past month: 1.5.5, 1.5.7, 1.5.8, 1.5.9
New features and improvements:
Improved the Assess analysis used to identify SSRF vulnerabilities to reduce the number of false positives reported by the agent.
Improved the Protect analysis used to analyze user inputs for potential SQL injection attacks to improve accuracy and performance.
The agent will now clean up old logs.
Removed the dependency on Microsoft.Extensions.Caching.Memory.
Improved performance of Protect XSS.
Improved performance of Protect SQL-Injection.
Bug fixes:
When the agent would report vulnerabilities for four response-based Assess rules related to CSP and HSTS, the report would be rejected by Contrast due to missing information. The agent now sends all expected information for these rules.
When an instrumented application defined a type using a large number of nested generic types, the agent could cause a StackOverflow error. This has now been fixed.
When a user would disable multiple Protect rules through the ‘contrast.protect.disabled_rules’ setting in the yaml file, the agent would not respect this setting. The agent will now respect this configuration setting.
When a user would disable logging, the agent’s profiler component would still log high level information during initialization. The profiler will no longer create a log when logging is disabled.
Language versions currently supported: .NET Core: 2.1, 2.2, 3.0, 3.1
Agent versions released during the past month: 1.5.3
New features and improvements:
Improved detection of dangerous path use in Protect; specifically, when interacting with the file system (path-traversal-semantic-dangerous-paths rule) and in arguments to OS commands (cmd-injection-semantic-dangerous-paths rule).
The agent will no longer attempt to load under .NET Core versions less than 2.1 as these versions are not supported.
Bug fixes:
When an application sent a request to the same URL as the current request, the agent would report an SSRF vulnerability. This is fixed now.
When the agent would report an
xcontenttype-header-missing
vulnerability, Contrast would reject the vulnerability report due to missing information. The agent now sends all expected information for this vulnerability.When an instrumented application closed the response stream, the agent could cause an application error. This is fixed now.
When an instrumented application seeked within a response stream, the agent could cause an application error. This is fixed now.
Language versions currently supported: .NET Core: 2.1, 2.2, 3.0, 3.1
Agent versions released during the past month: 1.4.0, 1.5.0
New features and improvements:
Added support for Linux Azure App Service.
Added support for Alpine.
Improved handling of scenarios where the agent would write repeated errors to log files, creating larger than necessary log files.
The agent will now log unknown configuration keys at startup. This should help with troubleshooting configuration issues (for example invalid yaml).
Bug fixes:
When applications redirected to a URL that had been validated using
Url.IsLocalUrl
, the agent would still report an unvalidated redirect vulnerability. The agent will now respect theUrl.IsLocalUrl
validator.A race condition around requests for configuration values that did not have default values could lead to an unhandled error in the agent. The race condition has been fixed, default configuration values have been provided for all configuration options, and missing default configuration values are now properly handled.