Static IDE Scan (Greenlight) Group (Archived) — MPeitz503616 (Community Member) asked a question.
I am not seeing results when I scan a vb file.
Ask the Community
Get answers, share a use case, discuss your favorite features, or get input from the community.
By clicking “Accept All Cookies”, you agree to the storing of cookies on your device to enhance site navigation, analyze site usage, and assist in our marketing efforts.
.png){kind=logo}
These cookies are necessary for the website to function and cannot be switched off in our systems. They are usually only set in response to actions made by you which amount to a request for services, such as setting your privacy preferences, logging in or filling in forms. You can set your browser to block or alert you about these cookies, but some parts of the site will not then work. These cookies do not store any personally identifiable information.
These cookies allow us to count visits and traffic sources so we can measure and improve the performance of our site. They help us to know which pages are the most and least popular and see how visitors move around the site. All information these cookies collect is aggregated and therefore anonymous. If you do not allow these cookies we will not know when you have visited our site, and will not be able to monitor its performance.
These cookies may be set through our site by our advertising partners. They may be used by those companies to build a profile of your interests and show you relevant adverts on other sites. They do not store directly personal information, but are based on uniquely identifying your browser and internet device. If you do not allow these cookies, you will experience less targeted advertising.
Hi @MPeitz503616 (Community Member) - Greenlight supports VB.net in Visual Studio. Is this the IDE you're using?
P.S. Here is a full list of Supported IDEs and Languages for Greenlight.
Yes I am using Visual Studio 2017. It's interesting I am looking at the same code that came back with issues from a veracode static scan. When I run greenlight on the code it does not show that it has issues. So there is a disconnect. If I run a green light scan on a code file that is in C# the results match between the Veracode Scan and the Green light scan.
Hi @MPeitz503616 (Community Member) , the "discrepancy" in scan results between Greenlight Scan and Static Scan is expected. Check the feedback from @Veracode Support (Veracode, Inc.) from our support team:
"Greenlight scans just that page of code, while static scans the entire app and will scan all the data paths. This will always yield more flaws than when you see in Greenlight since Static Scan is taking the entire scope into the Scanner, instead of just that one file.
Think of it like this, a room in a house is the file. The room looks secure when greenlight scans it since the room's door IS locked. However, once the Static scanner scans the entire house, they find an unlocked door to the house itself outside of that one room. Now that one room is no longer secure since outsiders can get into the house and essentially kick down this petty locked door. so the flaw is marked on the file (room) since the entire scope (house) has now been scanned for flaws."
Does that make sense?