I have just pushed an update of QueryParam Scanner to GitHub, containing various improvements.
This update is on the rc0.7.5 branch, and it'd be nice if people could take it for a spin and make sure there are no issues with it. (There is a zip download for anyone without git.)
The visible changes which you might notice are:
- Added JSON output format, giving an alternative to XML for anyone using qpscanner in a scripted process.
- Added variable for number of potential risk files, and improved related wording in HTML output.
- Fixed bug where identical queries were causing incorrect line numbers.
- Fixed bug where query names were not being detected.
- Fixed bug where blank lines were incorrectly removed.
However, there are also significant under-the-hood changes. I removed my obsolete "Java Regex Utils" library (replacing it with the object part of cfRegex), and made a number of little code clean-ups.
A result of these changes is that qpscanner rc0.7.5 appears to be almost twice as fast as previous versions.
If you have any feedback, please feel free to contact me via GitHub, and similarly if you find any bugs then please raise them on the issue tracker.