.NET Frameworkエージェントのリリースノート

This is a new release of the .NET Framework (legacy) agent.

Protect semantic SQL injection rules cannot be disabled individually. (SUP-2325)

必要に応じてIISを再起動するチェックボックスがオフにされている場合の警告を.NET Frameworkインストーラに追加しました。(DOTNET-5304)

メッセージのログ出力時のメモリ使用量を削減しました。(DOTNET-5336)

プロファイラがアプリケーションへの接続に失敗した場合のログメッセージをクリーンアップしました。(DOTNET-5335)

インターン化された文字列に対するパフォーマンスを改善しました。(DOTNET-3597)

エージェントから、機密性の高い可能性のあるURLデータがテレメトリに送信されないようにしました。(DOTNET-5294)

Cookieのデシリアライズ時に、エージェントがデフォルト変換の使用にフラグを立てないようにしました。(DOTNET-5339)

エージェントによるXmlReaderの解析時のパフォーマンスを改善しました。

This is a new release of the .NET Framework (legacy) agent.

URL exclusions are not respected by Protect semantic SQL injection rules. (SUP-2325)

入力に「/」や「.」文字が含まれている場合に、エージェントが報告するパストラバーサルの過検知に関する問題を修正しました。(DOTNET-5051)

Protectにおいて、エージェントがSQLインジェクションの過検知を報告する問題を修正しました。(DOTNET-5066)

ルート検索の実行時に、特定のケースで System.IO.FileNotFoundExceptionが発生する問題を修正しました。(DOTNET-5050)

エスケープされたSQL値に対するSQLインジェクションの誤検知に対応するために、ProtectのAgentLibを更新しました。(DOTNET-5406)

エージェントインストーラのブートストラッパで、ログ出力とNULL参照処理を拡張しました。(DOTNET-5397)

ThreadStaticシグネチャのパフォーマンスをさらに改善しました。 (DOTNET-3883、DOTNET-5380)

エージェントインストーラは、.NET Framework 4.6.2がインストールされていてもキャッシュされていない場合の要件を処理するようになりました。(DOTNET-5396)

エージェントエクスプローラで、移動または削除されたIIS Expressアプリケーションが正しく表示されるようになりました。(DOTNET-5390)

Protectのコールバックの設定に関する問題を修正しました。(DOTNET-5393)

Contrast WebインターフェイスでProtectがオンになっている場合にセキュリティログが作成されない問題を修正しました。(DOTNET-5241)

セキュリティログに空のソースが含まれないようにしました。(DOTNET-5256)

プールされた配列が再利用される場合に、特定のケースで過検知とならないように修正しました。 (DOTNET-5234)

キーと値のペアの間に区切り文字がない場合に、ASP.NETディレクティブを正しく読み取れるようにしました。(DOTNET-5250)

ログファイルのパフォーマンスタイミングに、リクエストの開始と終了が含まれるようになりました。(DOTNET-5254)

AgentLibログ環境変数が、エージェントのIISネイティブモジュールで設定されるようになりました。(DOTNET-5068)

エージェントの有効な設定情報がContrastに送信される際にエラーが発生するバグを修正しました。(DOTNET-5242)

テレメトリサービスがWebサービスコンポーネントとして報告されないようにしました。(DOTNET-5232)

URIの正規化を新しい標準に合わせることにより、重複排除(デデュープ)機能を改善しました。(DOTNET-5128)

ContrastのProtectでpath-traversal-semantic-file-security-bypassルールにコードとURLの除外を適用するようになりました。(DOTNET-5167)

エージェントは、有効な設定データをContrastサーバに送るようになりました。(DOTNET-5127)

ThreadStaticメソッドの処理時のパフォーマンスを向上させました。

エージェントにContrast.AgentExplorer.Backend.exeプロセスが取り込まれなくなりました。(DOTNET-5116)

Telerik Reportingライブラリ使用時のパストラバーサルの過検知を防ぐメソッドシグネチャを追加しました。(DOTNET-5091)

より効率的にするために、実行時の早い段階でapp_pool_allowlist/denylistのチェックを行うようにしました。(DOTNET-5020)

信頼できないデシリアライズの脆弱性のトリガーとなる可能性のあるガジェットリストからSystem.Data.DataSetを削除しました。(DOTNET-5045)

エージェントのログファイルが、パストラバーサルの脆弱性のトリガーとならないようにしました。(DOTNET-5054)

Microsoft.AspNet.Identityライブラリが、MTPインジェクションの過検知のトリガーとならないようにしました。(DOTNET-5018)

複数のContrastプロファイラが検出された場合、期待するバージョンのプロファイラがロードされていても、エージェントが例外をスローする問題を修正しました。(DOTNET-5023)

あるアプリケーションが管理者として実行され、別のアプリケーションが一般ユーザーとして実行されている場合、ログのクリーンアップ中に発生する例外を解消しました。(DOTNET-4963)

異なるバージョンのSystem.Netを組み込んで実行した場合に、ルート検索時に発生する例外を解消しました。(DOTNET-4978)

スキーム/ホストが実際には安全である特定のケースで、エージェントが未検証のリダイレクトの誤検知を報告しないようになりました。(DOTNET-5008)

バックグラウンドジョブを無効にする設定フラグagent.dotnet.debug.background_job_deny_listを追加しました。

AgentLibの例外処理を改善しました。

インストーラーによるアンインストール時に全てのレジストリキーを削除するようになりました。

エージェントエクスプローラは、デフォルトのポートが既に使用されている場合、別のポートを検出するようになりました。

エージェントエクスプローラーは、IIS Express配下のアプリケーションのネイティブモジュールにプラットフォーム固有のパスを使用するようになりました。

Fixed an issue that caused the Agent Explorer to crash on startup

Agent disables itself with a 404 message only if the response body includes an invalid application message

The agent now uses the agent-lib library by default

Fixed localization text in the installer

Log clean up is now done by one instance of the agent, thereby reducing resource consumption on start up

The agent has better logging if it cannot get the per-user config in certain cases

The diagnostics CLI displays an error message if it tried to create a dump file, but failed

Agent Explorer displays a better message for applications that are not instrumented due to an application allowlist or denylist

Installer no longer hangs if IIS is not installed and it tries to run  AppCmd

Agent no longer reports crypto-weak-randomness when certain database clients are used

プロファイラは通信に名前付きパイプを使用しなくなったため、場合によっては CPU使用率が急上昇する可能性がありました。

The agent now uses the agent-lib library by default

Improved documentation for the diagnostics 'memory-usage' verb.

Offset starting background jobs in agent to reduce start up resource usage.

Profiler no longer attaches to  Contrast.AgentExplorer.exe .

Improved performance for log cleanup.

DotnetAgentService no longer consumes 100% of CPU if the communication between it and Profiler gets into a bad state.

The agent now supports chaining with Aternity.

The agent will now report Redis database connections to FlowMap for connections using the StackExchange Redis driver.

The installer bootstrapper does not block bundle downgrades on silent installations.

The Contrast Assess untrusted deserialization FormatterValidator does not treat use of non-null binder as safe.

The agent processes ASP.NET page directives with comment lines correctly.

Assess and Protect now detect SQL-injection against PostgreSQL database usage of the npgsql library.

The agent now reports PostgreSQL database connections to FlowMap for connections using the npgsql library.

Improved agent reporting of View components for FlowMaps in the Contrast web interface.

Added the agent.dotnet.file_analysis_report_full_path configuration flag with a default value of false.

If you set the value to true, the agent reports the full file path (rather than a relative path) for Assess vulnerabilities discovered during file analysis (for example:. weak or vulnerable configurations in web.configor .aspx files.). This setting can result in the Contrast web interface displaying duplicate vulnerabilities if you deploy the same application to multiple servers with different physical paths.

This release includes a new version of Agent Explorer with several bug fixes and user interface improvements.

The invariant culture is now used when writing Protect events to syslog.(DOTNET-4661)

The agent will now more reliably detect and report databases to Flow Map. (DOTNET-3924)

Agent Explorer now shows statistics on number of vulnerabilities, number of attacks, and external services observed by agents, as well as information on libraries seen and number of classes used by each library.

Assess could sometimes report vulnerabilities involving data flow using interned strings. This has been fixed. (DOTNET-4589)

Further reduced the number of allocations that Contrast Assess uses to track dataflow through StringBuilder.Replace APIs.

Significantly improved performance, particularly for allocations that Assess uses to track dataflow through  StringBuilder.Replace APIs.

Diagnostics connect command failed with an unexpected error under .NET Framework. This issue is now fixed. (DOTNET-4634)

In Agent Explorer, the detailed view of an agent now displays why a degraded or faulted agent is in a bad state.

In Agent Explorer, the Summary tab now shows a consistent number of agents across different components. (DOTNET-4580)

Applications could crash when running with Dynatrace OneAgent when an environment variable was changed to a null value. This has been fixed. (DOTNET-4594)

This issue was incorrectly reported as fixed in .NET Framework 50.1.1

In .NET Framework 50.1.1, the installed agent's background service failed to start. This issue is now fixed.

Applications could crash when running with Dynatrace OneAgent when an environment variable was changed to a null value. This issue is now fixed. (DOTNET-4594)

Assess would incorrectly report a vulnerability when the value of the content-length header was used in a sink such as a database query. This issue is now fixed. (DOTNET-4537)

The .NET Core agent for IIS installer now includes Agent Explorer, a separate GUI application that provides high-level information about locally running .NET and .NET Framework agents. Use Agent Explorer to see high-level information such as:

Protect now reports the IP address of an attack in more scenarios.

Protect previously reported an untrusted-deserialization attack when the ASPNET RoleProvider feature deserialized a RolePrincipal object from an encrypted cookie value. This issue is now fixed. (DOTNET-4570)

Input exclusions now have full regular expression support.

Fixed a reported issue where the diagnostics executable would crash with the error, Contrast.AgentLib was not found.

Agent upgrades would fail when an agent was installed with a custom data directory. This issue has been fixed. (DOTNET-4453)

Validated agent support for .NET Framework 4.8.1

The Agent Upgrade Service would only check for updates after restarting a second time, this has now been fixed. (DOTNET-4318)

On Windows Server 2012, the IIS installer will now warn users to install VC++ redistributable package necessary for the agent's upgrade service.

Diagnostic check-process now has limited support for 32-bit processes.

The agent would fail to clean up rolled over log files from native components. This has been fixed. (DOTNET-4314)

Assess hsts-header-missing previously checked the presence and value of the strict-transport-security header for requests made over TLS only. The rule will now also check for the strict-transport-security header if the X-Forwarded-Proto header indicates the request was made over TLS but TLS was terminated before reaching the application.

Diagnostics now offers a read-config option that will report on the effective configuration of currently running instrumented applications on the server.

Improved the accuracy of Protect XXE detection, fixing a false negative.

Assess previously reported the usage of a weak hash algorithm within Microsoft's Application Insight's snapshot collector. This will no longer be reported. (DOTNET-4252)

The agent would fail to report agent initialization errors to Contrast. This has been fixed.

Assess analysis would report an unvalidated-redirect when redirected to a string originating from HttpRequest.Path. The agent will now only report unvalidated-redirect if HttpRequest.Path does not start with a slash. (DOTNET-3950)

Protect will now detect unsafe file uploads using Telerik's RadAsyncUpload control, effectively blocking exploits of CVE-2017-11317.

The agent did not send assess.tags with the "preflight" vulnerability check (but did send this information with the vulnerability report.) The agent now sends the expected information with both messages. (DOTNET-4157)

The agent can now repeatedly scan static files such as web.config and .aspx files for vulnerabilities by configuring agent.dotnet.file_analysis_time_ms. Previously the agent would scan these files at application startup. Note that re-deploying an application or modifying web.config will typically cause a new application instance to be created, replacing the older instance. Any static files in this new instance would automatically be scanned by Contrast.

Added Assess sanitizers for mganss' HtmlSanitizer APIs. (DOTNET-4033)

Reduced the amount of memory used by the runtime for all libraries not instrumented by the agent. This has resulted in 5-10% reduction in process memory.

Agent's windows service will no longer generate system-info.yaml file in the agent's logs directory by default. Creation of this file can be enabled by setting agent.dotnet.enable_dvnr: true. (DOTNET-4147)

Improved Assess taint tracking for validation methods.

Protect will now block more untrusted deserialization attacks using JavaScriptSerializer, including those associated with CVE-2019-18935.

Improved accuracy of Assess URL character tracking to exclude the port number. (DOTNET-4093)

Minor performance improvements to the cost of calling into Contrast sensors from instrumented code.

Added diagnostics check-access option to test that a Windows user has access to agent profiler and sensor components.

Improved cookie value parsing logic to avoid reporting that an invalid cookie is missing HttpOnly or secure flags.

Added Assess verb-tampering rule.

Assess would report XSS when an application used WebForms' `__LASTFOCUS ` field. (DOTNET-3982)

Protect untrusted deserialization did not respect URL exclusions. (DOTNET-4019)

Assess would report header-injection against ASPNET MVC applications using the Web API 2 compatibility layer. (DOTNET-4015)

The agent installer would remove any profiling environment variables upon uninstall, which could disable other profiler-based products such as APM tools. The uninstaller will now only remove those environment variables if they are set to Contrast values (DOTNET-4025).

Expanded APIs used to detect unvalidated redirect vulnerabilities under Assess.

Diagnostics validate-yaml will now validate application.metadata and application.session_metadata values follow expected format.

Added new deep-connect diagnostics command to help troubleshoot agent communication with Contrast.

Semantic Path Traversal attacks would be detected and blocked by the agent but failed to report to Contrast. (DOTNET-3978)

Diagnostics cert-info command's validation of certificates now more closely matches the agent's HttpClient's certificate validation.

The Azure App Service Site Extension's XDT in version 50.0.7 included a bad transform that caused the App Service instance to crash. This has been fixed. (DOTNET-3983)

Improved reporting of library class names to exclude compiler-generated types.

Added the Assess overly permissive cross domain policy rule.

Diagnostics config-keys will now provide descriptions for special Contrast environment variables that can be used to configure specific agent behavior (e.g., CONTRAST_CONFIG_PATH to set the path of the agent's configuration file.)

In some rare cases, the Azure App Service Site Extension could fail to cleanly upgrade because the agent's profiler component was locked. Agent components within the site extension are now housed in a version-specific directory. Note that users that have manually specified the path to agent components will need to update these paths. This should not be common as the Site Extension automatically sets the environment variables with the correct paths necessary to load the agent.

Assess potential sanitizers and validators will now be automatically reported to Contrast by default.

The installed agent now enables profiler chaining by default.

Improved performance by reducing cost of jumping from instrumented code to Contrast sensors.

Route discovery of .aspx and .asmx routes will no longer discover child application's routes for applications hosted in IIS.

The agent's sensors component did not respect a custom data directory set during install. (DOTNET-3739)

Diagnostics' system-info command failed to gather information about IIS application pools and applications. (DOTNET-3670)

Improved performance of Assess and Protect analysis by reducing the cost of calling into Contrast code from instrumented code.

Improved performance of Assess analysis of application code with data flow within LINQ where clauses.

Fixed an issue where agent logs indicated an error due to a missing default configuration value. (DOTNET-3633)

Fixed an issue where the agent's Upgrade Service component could crash when instrumented by the Contrast .NET Core agent earlier than 2.1.0. Note that this would only occur if a user set global environment variables to add the Contrast .NET Core agent's profiler. (DOTNET-3689)

The agent should only restart IIS during installation. Restarting the agent's background Windows service will no longer restart IIS. The agent can still be disabled by the enable: false configuration setting.

Improved agent's ability to follow WCF message processing across multiple threads.

Dependencies of the agent diagnostics tool (contrast-dotnet-diagnostics.exe) could be removed during the upgrade process and not installed, causing the diagnostics tool to immediately crash when run. This has been resolved.

Fixed an escalation of privilege issue where a low-privilege user could remove the agent's logs directory. This has been fixed.

This version moves the .NET Framework agent to semantic versioning. Semantic versioning started with version 50.0.0 in order to maintain the agent's auto-upgrade capability and clearly differentiate this release from the current calendar-based versioning scheme.

The installed .NET Framework agent's service did not respect server.path configuration. (DOTNET-3507)

Reduced the amount of memory used by the agent's profiler component.

Agent did not respect URL-based exclusions for Assess response-based rules. (DOTNET-3161)

Agent could fail to initialize when it failed to inspect the main module of the current process. (DOTNET-3162)

Tray now provides a link to the data directory specified at install time.

Further reduced memory usage of the agent's profiler component.

The agent will no longer report weak hash algorithm used by the Azure Storage client SDK.

Further reduced the amount of memory used by the agent's profiler component.

Reduced agent's overhead on each request.

Improved detection of database connections of an unknown type (i.e., not SQL, ODBC, OleDB, MySQL, ...).

The Contrast .NET Framework agent will switch to use semantic versioning in a future version. Semantic versioning will start with version 50.0.0 in order to maintain the agent's auto-upgrade capability and clearly differentiate the future release from the current calendar-based versioning scheme.

Fixed an escalation of privilege vulnerability in the agent's auto-upgrade feature by moving the .NET Framework agent to use the Agent Upgrade Service. The new Agent Upgrade Service does not suffer from this same vulnerability.

The .NET Framework agent now includes a separate Agent Upgrade Service that can be used to keep the .NET Framework and .NET Core agents up to date. Auto-upgrade has been removed from the agent itself. The Agent Upgrade Service downloads the latest .NET framework agent from the configured NuGet repository. The Agent Upgrade Service has a configuration file for each installed agent to control the behavior of upgrading each agent.

The next version of the .NET Framework agent will move to semantic versioning, starting with version 50.0.0.

The agent will no longer log errors to the Windows Event Log when an application pool was excluded from instrumentation by application allow-list/deny-list.

Implemented Assess event limits to improve performance.

Protect will no longer report semantic SQL findings on queries constructed safely using EF 6.

Profiler will now log all profiler settings, not just settings from the YAML file.

Profiler will no longer instrument diagnostics/powershell/powershell core.

Improved Assess coverage of APIs that return task.

Protect will no longer report semantic SQL chaining on queries constructed safely using LINQ 2 SQL.

Protect will no longer report use of dangerous functions on queries constructed safely using Entity Framework.

Assess will no longer report untrusted deserialization against JsonNET JsonSerializerProxy. (DOTNET-3031)

Protect will no longer report untrusted deserialization within System.Web.Services.Protocols.SoapHttpClientProtocol..ctor().(DOTNET-3042)

Protect false negative against model-binding inputs in ASP.NET MVC applications when Assess was disabled. (DOTNET-3026)

Protect false negative against post parameter inputs in ASP.NET Web Forms applications when Assess was disabled. (DOTNET-3036)

Assess false positive when using JsonSerializerProxy with Json.NET deserialization (DOTNET-3031)

Protect semantic SQL Injection chaining will no longer report on safe queries generated by Entity Framework.

Agent did not send sessionId when reporting routes. (DOTNET-3021)

Improved performance of calling into Contrast code from instrumented methods.

The agent would report a different route for discovery and observation of some ASPX pages with an inline class. (DOTNET-2928)

The agent would report untrusted deserialization when BinaryFormatter was used to copy an object with a string property set to untrusted data. (DOTNET-2905)

Expanded Assess sql-injection coverage of NHibernate.

When instrumenting an application targeting .NET 4.0 through .NET 4.6.2, the agent will now report to Contrast via a separate application domain in order to support communication with Contrast over TLS 1.2.

Reduced memory used by agent to capture stack traces.

Improve performance of capturing repeated stack traces under Protect.

Agent could cause intermittent application crashes due to storing a reference to the ASP.NET HttpApplication and calling Dispose multiple times. (DOTNET-2902)

Diagnostics check-process will now inspect logs in the logs directory specified by environment variable (if set).

Agent will now report agent errors to telemetry.

Agent now recognizes the HTML sanitization APIs from the AntiXSS library (previously the agent recognized the encoding methods primarily).

Agent now recognizes Path.GetFileName as a sanitizer for path-traversal.

Agent will no longer attempt to auto-upgrade if there is another install in progress on the server.

Agent could fail to identify Assess sources when inspecting a model bound object that mixed JObject type within a POCO type. (DOTNET-2810)

Library reporting could fail on obfuscated assemblies. (DOTNET-2846)

Agent reported sql-injection within the SQL query generation of Oracle.DataAccess assembly. (DOTNET-2842)

Improved logging when both CLR and CoreCLR are in the same process.

Added telemetry for installer failures.

Improved instrumentation performance under CLR Instrumentation Engine (CIE).

Implemented Assess NoSQL Injection rule.

Fixed an error in parsing certain SQL queries in Protect semantic SQL rules. (DOTNET-2807)

Agent initialization will now log the final resolved value for assess.enable and protect.enable.

Improved agent performance when using the Common Instrumentation Engine (CIE).

.NET Framework agent hangs on async tasks. (SUP-2667)

In some cases, the agent could report data from the same application for two servers with slightly different paths. (SUP-2700)

Improved route discovery for Model View Controller (MVC).

Improved startup performance by removing XML serialization during startup.

Fixed an Untrusted Deserialization false positive condition when running as OWIN self-hosted. (SUP-2613, SUP-2468)

Fixed the agent using excessive memory when registering routes with JSON.net. (SUP-2624)

The agent’s profiler component will no longer keep its log file locked after deciding not to instrument a process.

Improved accuracy for async APIs under Assess.

Added support for server.path configuration.

The agent will now report the host of Web Service components.

The agent's background service (DotNetAgentService.exe) will now run under its own virtual service account.

The agent will now identify database components for applications using the Oracle database driver.

Virtual patches for QueryString parameters do not work if the values contain structured data. (SUP-1763)

When attempting to upgrade the agent, the uninstall fails and rolls back creating a loop. (DOTNET-2685)

Improved agent performance.

Improved Assess data propagation on async methods.

Improved Assess detection of unsafe cryptographic algorithms.

The agent will now report the verb and URL template for discovered routes for Web API, WCF, and ASMX applications.

Agent does not handle valid tls_versions configuration: tls|tls11|tls12 (DOTNET-2551)

Improved application archiving capabilities. Once an application is archived in the Contrast web interface, the .NET Framework agent will be disabled without needing an IIS restart.

When auto-update is enabled, the installer will be placed in a secure directory and executed with elevated permissions.

False positive reported for path traversal when MVC internal code is used. (SUP-2403)

Different signatures for the same dataflow reports duplicate routes. (SUP-2345)

False positive reported when using XMLSerializer. (SUP-2361)

All agent configuration settings referring to the terms blacklist and whitelist have been changed to denylist and allowlist, respectively. For example, agent.dotnet.app_pool_whitelist is now agent.dotnet.app_pool_allowlist. The agent will continue to respect the old configuration names until August 2nd, 2022.

Added greater flexibility in how the agent can be configured. Applications within an application pool can be configured individually via their web.config or a contrast_security.yaml file in the root directory. There is an order of precedence where properties set for an application override those set at the server.

The .NET Contrast tray will now display the application name used by IIS until the application has been loaded. Any application name customizations will be reflected in the tray once the application has been loaded by IIS.

The agent's Windows service will now start, even if it is unable to communicate with Contrast.

The agent installer now has an option, enabled by default, to restrict access to the installed contrast_security.yaml file. The option can be disabled if needed at install time.

Protect will now mask sensitive data in the attack vector if enabled in the Contrast web interface.

Protect path traveral in monitoring mode will now report a path-traversal probe when an attack goes through a "path resolution API" such as Path.GetFullPath. (SUP-2190)

Temporarily brought back legacy web.config settings.

The .NET Framework auto-update feature will now verify that downloaded updates have a valid signature and are signed by Contrast.

When auto-update is enabled, the .NET agent doesn’t verify the signature of the newly downloaded installer.

When running with New Relic, the .NET agent runs into exceptions. (SUP-2318)

Added checkpoints to ensure semantic SQL rules are not reported by the agent when the rule is disabled in the Contrast web interface.

Removed the agent.dotnet.enable_runtimeid_callbackhandler configuration setting.

Session-based auto-verification policies didn’t change vulnerability status in version 20.11.2. (SUP-2365)

Applications excluded from the allowlist continue to show on the agent’s tray. (SUP-1551)

Windows 10 machines running in German cause the .NET Framework agent installer for Windows to crash. (SUP-2279)

Fixed a path traversal false positive when running with MVC. (SUP-2265)

Protect Semantic SQL Injection rules do not respect URL exclusions. (SUP-2325)

Installer launches .NET Contrast tray with elevated user permissions. (DOTNET-2279)

.NET Framework agent has a problem on startup when an application specified a custom NLog configuration file. (SUP-2220)

The agent now reports names of classes used as part of enhanced library usage.

The agent was reporting misleading route observation predictions upon route discovery. (DOTNET-2227)

The agent fails to start when Contrast provided a syslog configuration with messages at "INFO" level. (DOTNET-2310)

Agent reported path traversal within the FriendlyUrls library's routing logic. (DOTNET-2311)

Added support for route coverage of Web Site Projects (WSP).

Deprecated and removed CONTRAST__AGENT__DOTNET__CONTAINER. The configuration flag has no effect. All environments that required it, no longer require the flag to function.

Reduced the size of the Azure App Service Site Extension by removing diagnostics from the download. Diagnostics is still available for other deployment types.

XXE will now correctly be detected when running under OWIN in .NET Framework quirks mode.

Agent sensors logged a NullReferenceException when evaluating some instrumented methods for Assess XXE under OWIN-hosted applications. The null reference has been fixed. (DOTNET-2261)

The agent's background Windows service had to be restarted when Contrast configuration settings in web.config were changed. This issue has been fixed so that changes in web.config will automatically be detected and applied. (DOTNET-2254)

There was a race condition for IIS detection where the Contrast tray's IIS tab would sometimes not be displayed. This issue has been fixed. (DOTNET-2251)

File Analysis rules now report relative path for files.

Service crashes under .NET Framework 4.7.1 for users in 20.9.3. (DOTNET-2192)

SystemWeb OWIN Web API instrumentation results in duplicate events in response stream. (SUP-1917)

Fixed PathToYaml installer option to support relative paths.

Found memory leak in correlation tasks. (SUP-2065)

Improved accuracy by supporting Uri.Escape URL-encoding methods.

Agent can now discover WebForms Routes in pre-compiled applications.

Made the .NET Framework Contrast tray window resizable.

Improved ASMX route detection and handling of sources from deserialization.

Telemetry is now enabled in the .NET Framework agent in order to gather valuable data about the agent’s functionality. The data is all anonymous, no personal information is collected.

Azure Service Fabric is supported as a deployment type for the .NET Framework agent.

Cleaned up text in the Contrast tray.

.NET service restart causes IIS workers to fail to start. (SUP-1818)

There is a null reference in FileAnalysisEngine.FindVulnerabilities parameter.

Tray crashes on startup. (SUP-1891)

Agent fails to startup properly when application is archived. (SUP-1849)

Added connect to contrast-dotnet-diagnostics to test the agent’s ability to connect to Contrast.

Added config-keys to contrast-dotnet-diagnostics to display configuration options supported by the agent.

Added cert-info to contrast-dotnet-diagnostics to display information about the certificate provided by the value of the api.url configuration setting.

Improved the performance of Protect SQL-Injection detection.

Improved the performance of Protect against XML-based inputs.

Added validate-yaml to contrast-dotnet-diagnostics to verify the agent’s contrast-security.yaml configuration file.

The agent’s file analysis rules now execute within the context of the agent’s sensors component. These rules will now execute in Azure App Service and Docker deployments. Previously these rules only executed in the agent’s background Windows service component.

When a third-party profiler would be chained with Contrast, that profiler could instrument some internal Contrast methods which lead to some instability. This issue has been fixed now.

The agent could fail to properly observe some Web API 2 routes. This issue has been fixed now.

When an OWIN-based application was deployed to Azure App Service, the agent would cause an application error. This issue has been fixed.

When the agent’s background Windows service was shutting down it could sometimes harmlessly crash. This issue has been fixed.

Improved detection of dangerous path use in Protect; specifically, when interacting with the file system (path-traversal-semantic-dangerous-paths rule) and in arguments to OS commands (cmd-injection-semantic-dangerous-paths rule).

Beginning with this release, the minimum supported operating system is Windows Server 2012 and the minimum .NET Framework version is .NET 4.7.1.

The legacy .NET Framework agent maintains support for Windows Server 2008 and older .NET Framework versions. The legacy agent has all of the current features of the .NET Framework agent and receives critical bug fixes but otherwise will not be further developed.

When an application sent a request to the same URL as the current request, the agent would report an SSRF vulnerability. This is fixed now.

When the agent would report an xcontenttype-header-missing vulnerability, it was rejected due to missing information. The agent now sends all expected information for this vulnerability.

Improved handling of scenarios where the agent would write repeated errors to log files, creating larger than necessary log files.

The agent will now log unknown configuration keys at startup. This should help with troubleshooting configuration issues (for example, invalid yaml).

The agent’s auto-update feature will no longer update the agent when running on Windows Server 2008 or servers with .NET Framework 4.7.0 or older. This change is in preparation for the upcoming fork of the Contrast .NET Framework agent. See below for more details.

The next release of the .NET Framework agent will raise the minimum supported operating system to Windows Server 2012 and raise the minimum .NET Framework version to .NET 4.7.1. Support for Windows Server 2008 and older versions of the .NET Framework will be maintained via a fully featured legacy .NET Framework agent. This legacy agent will have all of the current features of the .NET Framework agent and will receive critical bug fixes but otherwise will not be the focus for future .NET development.

When an application hosted on IIS was (mis)configured without a virtual path, the agent’s background Windows service would crash. The agent’s background Windows service now properly handles this configuration.

A race condition around requests for configuration values that did not have default values could lead to a crash of the agent’s background Windows service. The race condition has been fixed, default configuration values have been provided for all configuration options, and missing default configuration values are now properly handled.