Version: 25.5.0

RASP Java Agent Release Notes (25.5.0)

Overview

W4J-1989. XSS security events now include a taint pattern of the payload in the taintPattern CEF extension
W4J-1967, PM-442. ARMR HTTP rule can now define CSRF STP protection for selected application URLs
W4J-1964, PM-596. Requirement to run java with add-opens flags in certain configurations removed. You should remove this flag if you added it for compatibility with prior Agent versions.
W4J-1872. Invalid calls to JavaField API in ARMR Patches are now not silently ignored
W4J-1866. Logging improvement to include line number in patch exceptions
W4J-1687. Improved ARMR Patch link rule warning messages reporting when duplicate location specifiers used
W4J-1256. Improved taint propagation for Base64 encoding and decoding operations

W4J-1918. Agents 25.3.0 and above ignore instance properties configuration with "com.waratek." prefix
W4J-1695. Improved compatibility of ARMR XXE rule with WebLogic
W4J-1815. Improved logging message when required agent properties file is not specified
W4J-1981. Improved taint propagation in URL encoded safe characters in some cases
W4J-1991. Fix for edge case NullPointerException ('because replicode.core.logging.VMLog.INSTANCE is null')
W4J-1998. CEF extension value defined in ARMR Patch could be null

W4J-252 Additional filesystem read events are generated for certain Application and JDK folders the first time an ARMR filesystem rule that contains the api() directive triggers
W4J-435 ARMR Socket input specifier not working on some Java6 JDK
W4J-1431 ARMR HTTP CSRF rule is not working correctly on in JSP page on Tomcat 10, 11 and JBossEAP8
W4J-1432 ARMR HTTP XSS rule is not working correctly on JBoss EAP 8 and Wildfly 32
W4J-1477 ARMR Patch for CVE-2016-5552 disables input() specifier on DNS/Socket rules on Windows
REM-2445 Inconsistent warning messages logged when user inadvertently omits -Dcom.waratek.log.file property depending on whether log.mode is LOCAL or is BOTH