Packages
sobelow
0.10.1
0.14.1
0.14.0
0.13.0
0.12.2
0.12.1
0.12.0
0.11.1
0.11.0
0.10.6
0.10.5
0.10.4
0.10.3
0.10.2
0.10.1
0.10.0
0.9.3
0.9.2
0.9.1
0.9.0
0.8.0
0.7.8
0.7.7
0.7.6
0.7.5
0.7.4
0.7.3
0.7.2
0.7.1
0.7.0
0.6.9
0.6.8
0.6.7
0.6.6
0.6.5
0.6.4
0.6.3
0.6.2
0.6.1
0.6.0
0.5.4
0.5.3
0.5.2
0.5.1
0.5.0
0.4.9
0.4.8
0.4.7
0.4.6
0.4.5
0.4.4
0.4.3
0.4.2
0.4.1
0.4.0
0.3.12
0.3.11
0.3.10
0.3.9
0.3.8
0.3.7
0.3.6
0.3.5
0.3.4
0.3.3
0.3.2
0.3.1
0.3.0
0.2.8
0.2.7
0.2.6
0.2.5
0.2.4
0.2.3
Security-focused static analysis for Elixir & the Phoenix framework
Current section
Files
Jump to
Current section
Files
CHANGELOG.md
# Changelog
## v0.10.1
* Bug fixes
* Sobelow will use ".sobelow-skips" instead of ".sobelow" in your root directory for `--mark-skip-all`
## v0.10.0
* Enhancements
* Sobelow now uses "~/.sobelow/sobelow-vsn-check" for update checks
* The ".sobelow" file in your project root is for `--mark-skip-all` only
## v0.9.3
* Enhancements
* Improved checks for all aliased functions
* Bug Fixes
* JSON output for Raw findings is now properly normalized
* `send_download` correctly flags aliased function calls
* `send_download` now correctly flags piped functions
## v0.9.2
* Bug Fixes
* Fix error that resulted from redefining imported functions
## v0.9.1
* Bug Fixes
* Revert umbrella app recursion
## v0.9.0
* Enhancements
* Add `--mark-skip-all` and `--clear-skip` flags
* New CSRF via action reuse checks
* Sobelow can now be run in umbrella apps
* Bug Fixes
* Fix an error when printing some kinds of variables
## v0.8.0
* Enhancements
* Improve output consistency
* All JSON findings contain `type`, `file`, and `line` keys
* "Line" output now refers directly to the vulnerable line
* Default output headers have been normalized
**Note:** If you depend on the structure of the output, this
may be a breaking change. More information can be found at
[https://sobelow.io](https://sobelow.io).
## v0.7.8
* Enhancements
* Add `--threshold` flag
* Add module names to finding output
* Deprecations
* File/Path check has been deprecated
* Bug Fixes
* Fix inaccurate CSRF details
## v0.7.7
* Enhancements
* Add check for insecure websocket settings
* Bug Fixes
* Accept module attributes for application name
## v0.7.6
* Bug Fixes
* Fix issue that suppressed output options when config files were in use
## v0.7.5
* Misc
* Sobelow will now only halt when `--exit` flag is used
## v0.7.4
* Bug Fixes
* Log hardcoded secrets for txt output
## v0.7.3
* Misc
* Tweaks to `--out` flag.
## v0.7.2
* Enhancements
* Add router path to config findings
* Add `--out` flag for writing to file
## v0.7.1
* Enhancements
* Improved handling of JSON format
* Additional checks for File functions
## v0.7.0
* Enhancements
* Improved handling of vulnerabilities within templates.
* Bug Fixes
* Sobelow no longer incorrectly flags :binary `send_download` functions.
## v0.6.9
* Enhancements
* Improve template parsing and validation.
* Support multiple routers, and improve route discovery.
* Misc.
* Update language for missing directory.
## v0.6.8
* Bug Fixes
* Fix bug in the handling of certain piped functions.
* Revert not/in update that broke Elixir 1.4 compatibility.
## v0.6.7
* Enhancements
* Remove banner print from JSON format.
* Bug Fixes
* Fix error that occurred with certain function names in JSON format.
## v0.6.6
* Enhancements
* Add check for directory traversal via `send_download`
* Add check for missing Content-Security-Policy
* Check additional XSS vectors
## v0.6.5
* Bug Fixes
* Allow RCE module to be appropriately ignored.
## v0.6.4
* Enhancements
* Set timeout for version check.
## v0.6.3
* Enhancements
* Add RCE module to check for code execution via `Code` and `EEx`.
* Deprecations
* The `--with-code` flag has been changed to `--verbose`. The `--with-code`
flag will continue to work as expected until v1.0.0, but will print a
warning message.