.NET Framework agent release notes

This is a new release of the .NET Framework (legacy) agent.

Protect semantic SQL injection rules cannot be disabled individually. (SUP-2325)

Added warning to the .NET Framework installer when unchecking Restart IIS when required. (DOTNET-5304)

Reduced memory usage when logging messages. (DOTNET-5336)

Cleaned up log messages when the profiler fails to attach to an application. (DOTNET-5335)

Made performance improvements for interned strings. (DOTNET-3597)

The agent is now prevented from sending potentially sensitive URL data to telemetry. (DOTNET-5294)

The agent no longer flags usage of default transforms when deserializing cookies. (DOTNET-5339)

Made performance improvements when instrumenting XmlReader.

This is a new release of the .NET Framework (legacy) agent.

URL exclusions are not respected by Protect semantic SQL injection rules. (SUP-2325)

Fixed an issue with a path traversal false positive that the agent reported when input contained only '/' and/or '.' characters. (.NET-5051)

Resolved an issue that caused the agent to report a false positive for SQL injection in Protect. (.NET-5066)

Fixed an issue that caused a System.IO.FileNotFoundException, in certain cases, when performing route discovery (.NET 5050)

Updated Protect AgentLib to address SQLi false positives on escaped SQL values. (DOTNET-5406)

Expanded the logging and null reference handling in the bootstrapper for the agent installer. (DOTNET-5397)

Made more performance improvements for thread static signatures. (DOTNET-3883, DOTNET-5380)

The agent installer now handles .NET Framework 4.6.2 requirement when installed but not cached. (DOTNET-5396)

The Agent Explorer now properly shows moved or deleted IIS Express applications. (DOTNET-5390)

Fixed an issue with setting a callback for Protect. (DOTNET-5393)

Fixed an issue with the security log not being created if Protect is turned on in the Contrast web interface. (DOTNET-5241)

The security log no longer contains an empty source. (DOTNET-5256)

The agent prevents false positives in certain cases when a pooled array is reused. (DOTNET-5234)

The agent can now properly read ASP.NET directives if key-value pairs do not have delimiters between them. (DOTNET-5250)

Performance timings in the log files now include request start and request end. (DOTNET-5254)

AgentLib logging environment variables are now set with the agent's native IIS module. (DOTNET-5068)

Fixed a bug that caused errors when sending effective configuration information to Contrast. (DOTNET-5242)

The telemetry service is no longer reported as a web service component. (DOTNET-5232)

Improved deduping by updating URI normalization to new standard. (DOTNET-5128)

Contrast now applies code and URL exclusions to the Protect path-traversal-semantic-file-security-bypass rule. (DOTNET-5167)

The agent now sends effective configuration data to Contrast. (DOTNET-5127)

Improved the performance when processing thread static methods.

The agent no longer attaches to the Contrast.AgentExplorer.Backend.exe process (DOTNET-5116)

Added a method signature that prevents a false positive for path traversal when using the Telerik Reporting library. (DOTNET-5091)

The checks on the app_pool_allowlist/denylist are now done earlier during runtime in order to be more efficient. (DOTNET-5020)

Removed System.Data.DataSet from the list of gadgets that could trigger an untrusted deserialization vulnerability.(DOTNET-5045)

The agent's log files no longer trigger a path traversal vulnerability. (DOTNET-5054)

The Microsoft.AspNet.Identity library no longer triggers an SMTP injection false positive. (DOTNET-5018)

In the event that more than one Contrast profiler is detected, the agent no longer throws an exception if an expected version of the profiler is loaded. (DOTNET-5023)

Fixed an exception that occurred during log clean up when one application is running as administrator and another is running as a normal user. (DOTNET-4963)

Fixed an exception that occurred during route discovery when a different version of the System.Net assembly was loaded. (DOTNET-4978)

The agent no longer reports false positive unvalidated-redirect in certain cases where the scheme/host were actually safe. (DOTNET-5008)

Added config flag agent.dotnet.debug.background_job_deny_list to disable background jobs

Improved the handling of AgentLib exceptions

Installers now remove all registry keys when uninstalled

Agent Explorer finds a different port if its default port is already in use

Agent Explorer uses platform-specific paths for the Native Module for applications under IIS Express

Fixed an issue that caused the Agent Explorer to crash on startup

Agent disables itself with a 404 message only if the response body includes an invalid application message

The agent now uses the agent-lib library by default

Fixed localization text in the installer

Log clean up is now done by one instance of the agent, thereby reducing resource consumption on start up

The agent has better logging if it cannot get the per-user config in certain cases

The diagnostics CLI displays an error message if it tried to create a dump file, but failed

Agent Explorer displays a better message for applications that are not instrumented due to an application allowlist or denylist

Installer no longer hangs if IIS is not installed and it tries to run  AppCmd

Agent no longer reports crypto-weak-randomness when certain database clients are used

The Profiler no longer uses a named pipe for communication, which in some cases could cause CPU usage to spike.

The agent now uses the agent-lib library by default

Improved documentation for the diagnostics 'memory-usage' verb.

Offset starting background jobs in agent to reduce start up resource usage.

Profiler no longer attaches to  Contrast.AgentExplorer.exe .

Improved performance for log cleanup.

DotnetAgentService no longer consumes 100% of CPU if the communication between it and Profiler gets into a bad state.

The agent now supports chaining with Aternity.

The agent will now report Redis database connections to FlowMap for connections using the StackExchange Redis driver.

The installer bootstrapper does not block bundle downgrades on silent installations.

The Contrast Assess untrusted deserialization FormatterValidator does not treat use of non-null binder as safe.

The agent processes ASP.NET page directives with comment lines correctly.

Assess and Protect now detect SQL-injection against PostgreSQL database usage of the npgsql library.

The agent now reports PostgreSQL database connections to FlowMap for connections using the npgsql library.

Improved agent reporting of View components for FlowMaps in the Contrast web interface.

Added the agent.dotnet.file_analysis_report_full_path configuration flag with a default value of false.

If you set the value to true, the agent reports the full file path (rather than a relative path) for Assess vulnerabilities discovered during file analysis (for example:. weak or vulnerable configurations in web.configor .aspx files.). This setting can result in the Contrast web interface displaying duplicate vulnerabilities if you deploy the same application to multiple servers with different physical paths.

This release includes a new version of Agent Explorer with several bug fixes and user interface improvements.

The invariant culture is now used when writing Protect events to syslog.(DOTNET-4661)

The agent will now more reliably detect and report databases to Flow Map. (DOTNET-3924)

Agent Explorer now shows statistics on number of vulnerabilities, number of attacks, and external services observed by agents, as well as information on libraries seen and number of classes used by each library.

Assess could sometimes report vulnerabilities involving data flow using interned strings. This has been fixed. (DOTNET-4589)

Further reduced the number of allocations that Contrast Assess uses to track dataflow through StringBuilder.Replace APIs.

Significantly improved performance, particularly for allocations that Assess uses to track dataflow through  StringBuilder.Replace APIs.

Diagnostics connect command failed with an unexpected error under .NET Framework. This issue is now fixed. (DOTNET-4634)

In Agent Explorer, the detailed view of an agent now displays why a degraded or faulted agent is in a bad state.

In Agent Explorer, the Summary tab now shows a consistent number of agents across different components. (DOTNET-4580)

Applications could crash when running with Dynatrace OneAgent when an environment variable was changed to a null value. This has been fixed. (DOTNET-4594)

This issue was incorrectly reported as fixed in .NET Framework 50.1.1

In .NET Framework 50.1.1, the installed agent's background service failed to start. This issue is now fixed.

Applications could crash when running with Dynatrace OneAgent when an environment variable was changed to a null value. This issue is now fixed. (DOTNET-4594)

Assess would incorrectly report a vulnerability when the value of the content-length header was used in a sink such as a database query. This issue is now fixed. (DOTNET-4537)

The .NET Core agent for IIS installer now includes Agent Explorer, a separate GUI application that provides high-level information about locally running .NET and .NET Framework agents. Use Agent Explorer to see high-level information such as:

Protect now reports the IP address of an attack in more scenarios.

Protect previously reported an untrusted-deserialization attack when the ASPNET RoleProvider feature deserialized a RolePrincipal object from an encrypted cookie value. This issue is now fixed. (DOTNET-4570)

Input exclusions now have full regular expression support.

Fixed a reported issue where the diagnostics executable would crash with the error, Contrast.AgentLib was not found.

Agent upgrades would fail when an agent was installed with a custom data directory. This issue has been fixed. (DOTNET-4453)

Validated agent support for .NET Framework 4.8.1

The Agent Upgrade Service would only check for updates after restarting a second time, this has now been fixed. (DOTNET-4318)

On Windows Server 2012, the IIS installer will now warn users to install VC++ redistributable package necessary for the agent's upgrade service.

Diagnostic check-process now has limited support for 32-bit processes.

The agent would fail to clean up rolled over log files from native components. This has been fixed. (DOTNET-4314)

Assess hsts-header-missing previously checked the presence and value of the strict-transport-security header for requests made over TLS only. The rule will now also check for the strict-transport-security header if the X-Forwarded-Proto header indicates the request was made over TLS but TLS was terminated before reaching the application.

Diagnostics now offers a read-config option that will report on the effective configuration of currently running instrumented applications on the server.

Improved the accuracy of Protect XXE detection, fixing a false negative.

Assess previously reported the usage of a weak hash algorithm within Microsoft's Application Insight's snapshot collector. This will no longer be reported. (DOTNET-4252)

The agent would fail to report agent initialization errors to Contrast. This has been fixed.

Assess analysis would report an unvalidated-redirect when redirected to a string originating from HttpRequest.Path. The agent will now only report unvalidated-redirect if HttpRequest.Path does not start with a slash. (DOTNET-3950)

Protect will now detect unsafe file uploads using Telerik's RadAsyncUpload control, effectively blocking exploits of CVE-2017-11317.

The agent did not send assess.tags with the "preflight" vulnerability check (but did send this information with the vulnerability report.) The agent now sends the expected information with both messages. (DOTNET-4157)

The agent can now repeatedly scan static files such as web.config and .aspx files for vulnerabilities by configuring agent.dotnet.file_analysis_time_ms. Previously the agent would scan these files at application startup. Note that re-deploying an application or modifying web.config will typically cause a new application instance to be created, replacing the older instance. Any static files in this new instance would automatically be scanned by Contrast.

Added Assess sanitizers for mganss' HtmlSanitizer APIs. (DOTNET-4033)

Reduced the amount of memory used by the runtime for all libraries not instrumented by the agent. This has resulted in 5-10% reduction in process memory.

Agent's windows service will no longer generate system-info.yaml file in the agent's logs directory by default. Creation of this file can be enabled by setting agent.dotnet.enable_dvnr: true. (DOTNET-4147)

Improved Assess taint tracking for validation methods.

Protect will now block more untrusted deserialization attacks using JavaScriptSerializer, including those associated with CVE-2019-18935.

Improved accuracy of Assess URL character tracking to exclude the port number. (DOTNET-4093)

Minor performance improvements to the cost of calling into Contrast sensors from instrumented code.

Added diagnostics check-access option to test that a Windows user has access to agent profiler and sensor components.

Improved cookie value parsing logic to avoid reporting that an invalid cookie is missing HttpOnly or secure flags.

Added Assess verb-tampering rule.

Assess would report XSS when an application used WebForms' `__LASTFOCUS ` field. (DOTNET-3982)

Protect untrusted deserialization did not respect URL exclusions. (DOTNET-4019)

Assess would report header-injection against ASPNET MVC applications using the Web API 2 compatibility layer. (DOTNET-4015)

The agent installer would remove any profiling environment variables upon uninstall, which could disable other profiler-based products such as APM tools. The uninstaller will now only remove those environment variables if they are set to Contrast values (DOTNET-4025).

Expanded APIs used to detect unvalidated redirect vulnerabilities under Assess.

Diagnostics validate-yaml will now validate application.metadata and application.session_metadata values follow expected format.

Added new deep-connect diagnostics command to help troubleshoot agent communication with Contrast.

Semantic Path Traversal attacks would be detected and blocked by the agent but failed to report to Contrast. (DOTNET-3978)

Diagnostics cert-info command's validation of certificates now more closely matches the agent's HttpClient's certificate validation.

The Azure App Service Site Extension's XDT in version 50.0.7 included a bad transform that caused the App Service instance to crash. This has been fixed. (DOTNET-3983)

Improved reporting of library class names to exclude compiler-generated types.

Added the Assess overly permissive cross domain policy rule.

Diagnostics config-keys will now provide descriptions for special Contrast environment variables that can be used to configure specific agent behavior (e.g., CONTRAST_CONFIG_PATH to set the path of the agent's configuration file.)

In some rare cases, the Azure App Service Site Extension could fail to cleanly upgrade because the agent's profiler component was locked. Agent components within the site extension are now housed in a version-specific directory. Note that users that have manually specified the path to agent components will need to update these paths. This should not be common as the Site Extension automatically sets the environment variables with the correct paths necessary to load the agent.

Assess potential sanitizers and validators will now be automatically reported to Contrast by default.

The installed agent now enables profiler chaining by default.

Improved performance by reducing cost of jumping from instrumented code to Contrast sensors.

Route discovery of .aspx and .asmx routes will no longer discover child application's routes for applications hosted in IIS.

The agent's sensors component did not respect a custom data directory set during install. (DOTNET-3739)

Diagnostics' system-info command failed to gather information about IIS application pools and applications. (DOTNET-3670)

Improved performance of Assess and Protect analysis by reducing the cost of calling into Contrast code from instrumented code.

Improved performance of Assess analysis of application code with data flow within LINQ where clauses.

Fixed an issue where agent logs indicated an error due to a missing default configuration value. (DOTNET-3633)

Fixed an issue where the agent's Upgrade Service component could crash when instrumented by the Contrast .NET Core agent earlier than 2.1.0. Note that this would only occur if a user set global environment variables to add the Contrast .NET Core agent's profiler. (DOTNET-3689)

The agent should only restart IIS during installation. Restarting the agent's background Windows service will no longer restart IIS. The agent can still be disabled by the enable: false configuration setting.

Improved agent's ability to follow WCF message processing across multiple threads.

Dependencies of the agent diagnostics tool (contrast-dotnet-diagnostics.exe) could be removed during the upgrade process and not installed, causing the diagnostics tool to immediately crash when run. This has been resolved.

Fixed an escalation of privilege issue where a low-privilege user could remove the agent's logs directory. This has been fixed.

This version moves the .NET Framework agent to semantic versioning. Semantic versioning started with version 50.0.0 in order to maintain the agent's auto-upgrade capability and clearly differentiate this release from the current calendar-based versioning scheme.

The installed .NET Framework agent's service did not respect server.path configuration. (DOTNET-3507)

Reduced the amount of memory used by the agent's profiler component.

Agent did not respect URL-based exclusions for Assess response-based rules. (DOTNET-3161)

Agent could fail to initialize when it failed to inspect the main module of the current process. (DOTNET-3162)

Tray now provides a link to the data directory specified at install time.

Further reduced memory usage of the agent's profiler component.

The agent will no longer report weak hash algorithm used by the Azure Storage client SDK.

Further reduced the amount of memory used by the agent's profiler component.

Reduced agent's overhead on each request.

Improved detection of database connections of an unknown type (i.e., not SQL, ODBC, OleDB, MySQL, ...).

The Contrast .NET Framework agent will switch to use semantic versioning in a future version. Semantic versioning will start with version 50.0.0 in order to maintain the agent's auto-upgrade capability and clearly differentiate the future release from the current calendar-based versioning scheme.

Fixed an escalation of privilege vulnerability in the agent's auto-upgrade feature by moving the .NET Framework agent to use the Agent Upgrade Service. The new Agent Upgrade Service does not suffer from this same vulnerability.

The .NET Framework agent now includes a separate Agent Upgrade Service that can be used to keep the .NET Framework and .NET Core agents up to date. Auto-upgrade has been removed from the agent itself. The Agent Upgrade Service downloads the latest .NET framework agent from the configured NuGet repository. The Agent Upgrade Service has a configuration file for each installed agent to control the behavior of upgrading each agent.

The next version of the .NET Framework agent will move to semantic versioning, starting with version 50.0.0.

The agent will no longer log errors to the Windows Event Log when an application pool was excluded from instrumentation by application allow-list/deny-list.

Implemented Assess event limits to improve performance.

Protect will no longer report semantic SQL findings on queries constructed safely using EF 6.

Profiler will now log all profiler settings, not just settings from the YAML file.

Profiler will no longer instrument diagnostics/powershell/powershell core.

Improved Assess coverage of APIs that return task.

Protect will no longer report semantic SQL chaining on queries constructed safely using LINQ 2 SQL.

Protect will no longer report use of dangerous functions on queries constructed safely using Entity Framework.

Assess will no longer report untrusted deserialization against JsonNET JsonSerializerProxy. (DOTNET-3031)

Protect will no longer report untrusted deserialization within System.Web.Services.Protocols.SoapHttpClientProtocol..ctor().(DOTNET-3042)

Protect false negative against model-binding inputs in ASP.NET MVC applications when Assess was disabled. (DOTNET-3026)

Protect false negative against post parameter inputs in ASP.NET Web Forms applications when Assess was disabled. (DOTNET-3036)

Assess false positive when using JsonSerializerProxy with Json.NET deserialization (DOTNET-3031)

Protect semantic SQL Injection chaining will no longer report on safe queries generated by Entity Framework.

Agent did not send sessionId when reporting routes. (DOTNET-3021)

Improved performance of calling into Contrast code from instrumented methods.

The agent would report a different route for discovery and observation of some ASPX pages with an inline class. (DOTNET-2928)

The agent would report untrusted deserialization when BinaryFormatter was used to copy an object with a string property set to untrusted data. (DOTNET-2905)

Expanded Assess sql-injection coverage of NHibernate.

When instrumenting an application targeting .NET 4.0 through .NET 4.6.2, the agent will now report to Contrast via a separate application domain in order to support communication with Contrast over TLS 1.2.

Reduced memory used by agent to capture stack traces.

Improve performance of capturing repeated stack traces under Protect.

Agent could cause intermittent application crashes due to storing a reference to the ASP.NET HttpApplication and calling Dispose multiple times. (DOTNET-2902)

Diagnostics check-process will now inspect logs in the logs directory specified by environment variable (if set).

Agent will now report agent errors to telemetry.

Agent now recognizes the HTML sanitization APIs from the AntiXSS library (previously the agent recognized the encoding methods primarily).

Agent now recognizes Path.GetFileName as a sanitizer for path-traversal.

Agent will no longer attempt to auto-upgrade if there is another install in progress on the server.

Agent could fail to identify Assess sources when inspecting a model bound object that mixed JObject type within a POCO type. (DOTNET-2810)

Library reporting could fail on obfuscated assemblies. (DOTNET-2846)

Agent reported sql-injection within the SQL query generation of Oracle.DataAccess assembly. (DOTNET-2842)

Improved logging when both CLR and CoreCLR are in the same process.

Added telemetry for installer failures.

Improved instrumentation performance under CLR Instrumentation Engine (CIE).

Implemented Assess NoSQL Injection rule.

Fixed an error in parsing certain SQL queries in Protect semantic SQL rules. (DOTNET-2807)

Agent initialization will now log the final resolved value for assess.enable and protect.enable.

Improved agent performance when using the Common Instrumentation Engine (CIE).

.NET Framework agent hangs on async tasks. (SUP-2667)

In some cases, the agent could report data from the same application for two servers with slightly different paths. (SUP-2700)

Improved route discovery for Model View Controller (MVC).

Improved startup performance by removing XML serialization during startup.

Fixed an Untrusted Deserialization false positive condition when running as OWIN self-hosted. (SUP-2613, SUP-2468)

Fixed the agent using excessive memory when registering routes with JSON.net. (SUP-2624)

The agent’s profiler component will no longer keep its log file locked after deciding not to instrument a process.

Improved accuracy for async APIs under Assess.

Added support for server.path configuration.

The agent will now report the host of Web Service components.

The agent's background service (DotNetAgentService.exe) will now run under its own virtual service account.

The agent will now identify database components for applications using the Oracle database driver.

Virtual patches for QueryString parameters do not work if the values contain structured data. (SUP-1763)

When attempting to upgrade the agent, the uninstall fails and rolls back creating a loop. (DOTNET-2685)

Improved agent performance.

Improved Assess data propagation on async methods.

Improved Assess detection of unsafe cryptographic algorithms.

The agent will now report the verb and URL template for discovered routes for Web API, WCF, and ASMX applications.

Agent does not handle valid tls_versions configuration: tls|tls11|tls12 (DOTNET-2551)

Improved application archiving capabilities. Once an application is archived in the Contrast web interface, the .NET Framework agent will be disabled without needing an IIS restart.

When auto-update is enabled, the installer will be placed in a secure directory and executed with elevated permissions.

False positive reported for path traversal when MVC internal code is used. (SUP-2403)

Different signatures for the same dataflow reports duplicate routes. (SUP-2345)

False positive reported when using XMLSerializer. (SUP-2361)

All agent configuration settings referring to the terms blacklist and whitelist have been changed to denylist and allowlist, respectively. For example, agent.dotnet.app_pool_whitelist is now agent.dotnet.app_pool_allowlist. The agent will continue to respect the old configuration names until August 2nd, 2022.

Added greater flexibility in how the agent can be configured. Applications within an application pool can be configured individually via their web.config or a contrast_security.yaml file in the root directory. There is an order of precedence where properties set for an application override those set at the server.

The .NET Contrast tray will now display the application name used by IIS until the application has been loaded. Any application name customizations will be reflected in the tray once the application has been loaded by IIS.

The agent's Windows service will now start, even if it is unable to communicate with Contrast.

The agent installer now has an option, enabled by default, to restrict access to the installed contrast_security.yaml file. The option can be disabled if needed at install time.

Protect will now mask sensitive data in the attack vector if enabled in the Contrast web interface.

Protect path traveral in monitoring mode will now report a path-traversal probe when an attack goes through a "path resolution API" such as Path.GetFullPath. (SUP-2190)

Temporarily brought back legacy web.config settings.

The .NET Framework auto-update feature will now verify that downloaded updates have a valid signature and are signed by Contrast.

When auto-update is enabled, the .NET agent doesn’t verify the signature of the newly downloaded installer.

When running with New Relic, the .NET agent runs into exceptions. (SUP-2318)

Added checkpoints to ensure semantic SQL rules are not reported by the agent when the rule is disabled in the Contrast web interface.

Removed the agent.dotnet.enable_runtimeid_callbackhandler configuration setting.

Session-based auto-verification policies didn’t change vulnerability status in version 20.11.2. (SUP-2365)

Applications excluded from the allowlist continue to show on the agent’s tray. (SUP-1551)

Windows 10 machines running in German cause the .NET Framework agent installer for Windows to crash. (SUP-2279)

Fixed a path traversal false positive when running with MVC. (SUP-2265)

Protect Semantic SQL Injection rules do not respect URL exclusions. (SUP-2325)

Installer launches .NET Contrast tray with elevated user permissions. (DOTNET-2279)

.NET Framework agent has a problem on startup when an application specified a custom NLog configuration file. (SUP-2220)

The agent now reports names of classes used as part of enhanced library usage.

The agent was reporting misleading route observation predictions upon route discovery. (DOTNET-2227)

The agent fails to start when Contrast provided a syslog configuration with messages at "INFO" level. (DOTNET-2310)

Agent reported path traversal within the FriendlyUrls library's routing logic. (DOTNET-2311)

Added support for route coverage of Web Site Projects (WSP).

Deprecated and removed CONTRAST__AGENT__DOTNET__CONTAINER. The configuration flag has no effect. All environments that required it, no longer require the flag to function.

Reduced the size of the Azure App Service Site Extension by removing diagnostics from the download. Diagnostics is still available for other deployment types.

XXE will now correctly be detected when running under OWIN in .NET Framework quirks mode.

Agent sensors logged a NullReferenceException when evaluating some instrumented methods for Assess XXE under OWIN-hosted applications. The null reference has been fixed. (DOTNET-2261)

The agent's background Windows service had to be restarted when Contrast configuration settings in web.config were changed. This issue has been fixed so that changes in web.config will automatically be detected and applied. (DOTNET-2254)

There was a race condition for IIS detection where the Contrast tray's IIS tab would sometimes not be displayed. This issue has been fixed. (DOTNET-2251)

File Analysis rules now report relative path for files.

Service crashes under .NET Framework 4.7.1 for users in 20.9.3. (DOTNET-2192)

SystemWeb OWIN Web API instrumentation results in duplicate events in response stream. (SUP-1917)

Fixed PathToYaml installer option to support relative paths.

Found memory leak in correlation tasks. (SUP-2065)

Improved accuracy by supporting Uri.Escape URL-encoding methods.

Agent can now discover WebForms Routes in pre-compiled applications.

Made the .NET Framework Contrast tray window resizable.

Improved ASMX route detection and handling of sources from deserialization.

Telemetry is now enabled in the .NET Framework agent in order to gather valuable data about the agent’s functionality. The data is all anonymous, no personal information is collected.

Azure Service Fabric is supported as a deployment type for the .NET Framework agent.

Cleaned up text in the Contrast tray.

.NET service restart causes IIS workers to fail to start. (SUP-1818)

There is a null reference in FileAnalysisEngine.FindVulnerabilities parameter.

Tray crashes on startup. (SUP-1891)

Agent fails to startup properly when application is archived. (SUP-1849)

Added connect to contrast-dotnet-diagnostics to test the agent’s ability to connect to Contrast.

Added config-keys to contrast-dotnet-diagnostics to display configuration options supported by the agent.

Added cert-info to contrast-dotnet-diagnostics to display information about the certificate provided by the value of the api.url configuration setting.

Improved the performance of Protect SQL-Injection detection.

Improved the performance of Protect against XML-based inputs.

Added validate-yaml to contrast-dotnet-diagnostics to verify the agent’s contrast-security.yaml configuration file.

The agent’s file analysis rules now execute within the context of the agent’s sensors component. These rules will now execute in Azure App Service and Docker deployments. Previously these rules only executed in the agent’s background Windows service component.

When a third-party profiler would be chained with Contrast, that profiler could instrument some internal Contrast methods which lead to some instability. This issue has been fixed now.

The agent could fail to properly observe some Web API 2 routes. This issue has been fixed now.

When an OWIN-based application was deployed to Azure App Service, the agent would cause an application error. This issue has been fixed.

When the agent’s background Windows service was shutting down it could sometimes harmlessly crash. This issue has been fixed.

Improved detection of dangerous path use in Protect; specifically, when interacting with the file system (path-traversal-semantic-dangerous-paths rule) and in arguments to OS commands (cmd-injection-semantic-dangerous-paths rule).

Beginning with this release, the minimum supported operating system is Windows Server 2012 and the minimum .NET Framework version is .NET 4.7.1.

The legacy .NET Framework agent maintains support for Windows Server 2008 and older .NET Framework versions. The legacy agent has all of the current features of the .NET Framework agent and receives critical bug fixes but otherwise will not be further developed.

When an application sent a request to the same URL as the current request, the agent would report an SSRF vulnerability. This is fixed now.

When the agent would report an xcontenttype-header-missing vulnerability, it was rejected due to missing information. The agent now sends all expected information for this vulnerability.

Improved handling of scenarios where the agent would write repeated errors to log files, creating larger than necessary log files.

The agent will now log unknown configuration keys at startup. This should help with troubleshooting configuration issues (for example, invalid yaml).

The agent’s auto-update feature will no longer update the agent when running on Windows Server 2008 or servers with .NET Framework 4.7.0 or older. This change is in preparation for the upcoming fork of the Contrast .NET Framework agent. See below for more details.

The next release of the .NET Framework agent will raise the minimum supported operating system to Windows Server 2012 and raise the minimum .NET Framework version to .NET 4.7.1. Support for Windows Server 2008 and older versions of the .NET Framework will be maintained via a fully featured legacy .NET Framework agent. This legacy agent will have all of the current features of the .NET Framework agent and will receive critical bug fixes but otherwise will not be the focus for future .NET development.

When an application hosted on IIS was (mis)configured without a virtual path, the agent’s background Windows service would crash. The agent’s background Windows service now properly handles this configuration.

A race condition around requests for configuration values that did not have default values could lead to a crash of the agent’s background Windows service. The race condition has been fixed, default configuration values have been provided for all configuration options, and missing default configuration values are now properly handled.