Release Notes

0.8.3

New features

  • New XSS and SQL injection machine learning engines

Improvements

  • SQL Injection grammatical analysis was removed to improve performances and lower false-positive rate

Bug fix

  • XSS and SQL injection tests won't fail when model is not loaded

  • Fix Base64 decoding, which was a little bit too invasive

  • Log only mode was sending empty response on Flask

Limitation

  • Version 0.8.3 is not available on AWS Lambda Functions

  • AWS Lambda support will be provided in next version

0.8.2

New feature

  • Attack details display with verbose level = 100+

Improvements

  • Improved JSON data analysis recursion

  • Lowered TCP logs connection timeout

Bug fix

  • Removed a debug output when analyzing json data

  • Specific payloads may crash XSS detection engine

  • Fixed an SQL Injection false positive

  • Fixed requirements.txt for build from sources

v0.8.1

New features

  • Zero-Trust Application Access

Improvements

  • Noticeably improved documentation by fixing typos, dead links, etc.

Bug fix

  • Fixed several issues in agents for AWS, GCP and Azure serverless functions

  • XSS check would fail while testing very specific JSON content

License

  • License changed to CC BY-NC-SA 4.0 (https://creativecommons.org/licenses/by-nc-sa/4.0/)

v0.8.0

Broken - Removed

v0.7.2

New features

  • Application routes are sent when first connecting to configuration server (cloud operations)

  • New API functions:

    • set_config(): change configuration from the protected application

    • get_routes(): get routes defined in the applications

Improvements

  • Handling of nested base64-encoded JSON structures

  • Added explicit versions in dependencies requirements

Bug fix

  • No security engine was activated when running with default configuration

v0.7.1

New features

  • Added detection engine and machine learning score in SQLI and XSS attack logs

  • Added request path in JSON security logs

Improvements

  • Improved JSON extraction from headers values

  • Improved SQL injection grammatical analysis to prevent some false-positive

  • Country identification in logs can be disabled via the RESOLVE_COUNTRY configuration option

  • Leaked data can be logged by setting the DLP_LOG_LEAKED_DATA configuration option to True (default: False)

Bug fix

  • Some cookie values were not properly processed

  • PyRASP would crash at launch if SQL injection or XSS protections are not activated

v0.7.0

New features

  • PyRASP classes API

Improvements

  • Improved ML engines for SQL Injection and XSS detection

    • Default SQL Injection detection probabilities raised to 0.85

    • Default XSS detection probabilities raised to 0.70

  • Attack payloads are now base64 encoded in logs

Bug fix

  • Flask agent was still processing page, even if attack was detected

v0.6.2

New features

  • Support for Azure Functions

Improvement

  • Slightly improved SQL injection detection

Bug fix

  • Fixed XSS engine false positive with some large JSON data

  • Disabled security checks would be handled according to default value

Misc

  • Fixed few things in documentation

v0.6.1

New features

  • Support for Google Cloud Functions

  • "Log Only" mode for detections

  • Added exceptions to properly manage false-positive

  • Added Brute Force specific attack type (previously merged with Flood)

Improvements

  • Decoy routes can be defined as a pattern with specific match function (regex, starts with or contains)

  • Added MITRE ATT&CK technique ID and PCB attack ID in logs

  • Added action taken by PyRASP agent in logs

  • Default security checks are loaded if missing from configuration file (see documentation for values)

Bug fix

  • Attack floods are not detected on AWS Lambda agent, each attack being blocked individually

  • Error floods were not detected if source IP was not blacklisted (which was totally nonsense)

v0.6.0

New features

  • Python AWS Lambda functions support

Improvements

  • Option to disable source IP country resolution in logs

  • Configuration file can be set by environment variable

  • Table of content and hyperlinks in the documentation

  • Offending source IP country resolution in logs is now optional (default to enabled for backward compatibility)

Bug fix

  • Offending source IPs were blackisted event if the SECURITY_CHECKS value was set to 1 (Enabled, no Blacklisting)

Last updated