I have run into a sudden large decrease in my Veracode score and I am trying to figure out the cause.

I have a slow moving project, that we have been scanning successfully for over a year now. This release, Veracode found 150 *new* flaws that have been untouched in the codebase for more than 3 years. All of the new flaws are either CWE 80 or 209. Again, these lines of code were present (untouched) in both the high and low scoring static scans.

The only thing that has changed is our naming of the war files. We are trying to be more CI/CD, and went from quarterly release war files named project-2019Q4-SNAPHOT.war to project-2019-11130000.war. (yes, we know you shouldn't deploy snapshot wars)

Does Veracode react/score differently if the jar/war file have "SNAPSHOT" in the name? If so, how to fix these for an internal API/REST server (no external exposure) ?

Code snippets below.

== CWE 80 ========================

getErrorResponse(THERE_IS_N)_MAPPER_FOUND_FOR_THE_GIVEN_GUID + guid ,HttpStatus.NOT_FOUND);

protected ResponseEntity getErrorResponse(String error, HttpStatus status) {

HttpHeaders responseHeaders = new HttpHeaders();

responseHeaders.setContentType(MediaType.TEXT_PLAIN);

return new ResponseEntity(error, responseHeaders, status);

}

=== CWE 209 ==========================

new ResponseEntity("An error occurred while adding the fields to the mapper: " + e.getMessage(), HttpStatus.INTERNAL_SERVER_ERROR);

}