Here's a summary of the release over the last two weeks. Let us know in the comment section below if you have any question!

#Veracode Dynamic Analysis​ 

Changes to Reporting of CWE-829 - no longer map findings concerning missing or misconfigured CSP headers to CWE-829 when responses have no body. 

#Veracode Software Composition Analysis​ 

New API Endpoint for Listing Issues by Project - The Veracode SCA Agent REST API includes a new endpoint for querying issues by the project ID. This endpoint enables you to view issues specific to a project in an agent-based scan workspace. If the project is a container, the API also lists all issues linked to projects inside the container. 

#Veracode Platform​ 

Improved Email Notifications for Expiring API Credentials - Veracode sends an email notification when your Veracode API credentials are about to expire. The email now displays your API username for quickly identifying the account for which you need to generate new credentials. 

@Dynamic Analysis Group (Archived)​ @Software Composition Analysis Group (Archived)​ 

Hi,

While I am running a desktop agent based scan, after running a while, srcclr reports "com.sourceclear.agent.commands.ScanCommand ERROR Unable to scan and generate report: Java heap space".

I think increasing heap space via Jvm options to Maven (e.g. -Xms512m -Xmx3g -XX:MaxPermSize=1024m) might do the job.

How can I make srcclr use these JVM values when running mvn during the scan which is being done manually at present on Windows 2016 server Powershell window.?

I see srcclr using the following options in the debug output:

2020-09-23/15:04:37.798 com.sourceclear.engine.component.collectors.MavenNativeCollector INFO Running Maven with: C:\MAVEN\apache-maven-3.6.3-bin\apache-maven-3.6.3\bin\mvn.cmd compile -Dcheckstyle.skip=true -e -DskipTests -DskipITs -Dmaven.test.skip=true --fail-fast --nsu -Denforcer.skip=true com.srcclr:srcclr-maven-plugin:3.1.20:scan --batch-mode -DheadlessOutputFile=C:\Users\INDRA~1.PAT\AppData\Local\Temp\graph-1593005717018069188.json

I have spent multiple days searching the internet, and trying the other srcclr options such as compile_first, install_first, but nothing works. Help!

Thanks.

Indra.

I’m currently integrating some Veracode scans with some Python 3.8 apps. In the process, I’ve noticed that some SCA reports are returning false positives with some dependencies that have security vulnerabilities. The issue is that many of those dependencies aren’t actually being packaged with the app and are just dev dependencies. It seems the platform has a hard time distinguishing the two in the Pipfiles (dependency manifests) my projects have. I read in the documentation the requirements.txt are also supported however that doesn't seem to be the case. I do not get any results when doing so. Can anyone help?

Example of the pipfile

[[source]]

name = "pypi"

url = "https://pypi.org/simple"

verify_ssl = true

[dev-packages]

importlib-metadata = "*"

pytest = "*"

pytest-cov = "*"

[packages]

requests = "*"

simplejson = "*"

[requires]

python_version = "3.7"

More details follow. The task:

- task: AzurePowerShell@5

 displayName: 'SourceClear Scan'

 inputs:

  azureSubscription: '{subscription here}'

  ScriptType: InlineScript

  Inline: |

   $Env:SRCCLR_API_TOKEN="{token here}"

   Set-ExecutionPolicy AllSigned -Scope Process -Force

   iex ((New-Object System.Net.WebClient).DownloadString('https://download.srcclr.com/ci.ps1'))

   srcclr scan $(Build.SourcesDirectory) --debug

  azurePowerShellVersion: LatestVersion

 condition: succeededOrFailed()

To be honest I do not know much about the script other than it is used successfully in another build pipeline for a different source code repository

The project that fails is .NET Core 3.1

Any suggestions for what I need to modify to complete a successful scan?

What other information can I provide to assist with diagnosing this issue?