maria.paula.cheska.tolentino (Community Member) asked a question.

February 19, 2020 at 12:21 AM
Using Veracode TeamCity plugin, when uploading zip, the policy status returns Pass even if there are flaws logged.

​We are using TeamCity plugin version 2.0, if we upload the files in a zip format, it returns Pass even if there were flaws logged. On the other hand, if we upload files individually, it does not scan JS and config files as it returns the message: "The file cannot be analyzed". However, it recognizes the flaws and fails the build.

 

Having said that, are there any workarounds we can do to retrieve the correct status when files are uploaded in zip format? We need this in order to trigger the notification for developers to look into the flaws. Thank you.

 

  • 5 answers
  • 1.69K views

  • rmachado (Veracode, Inc.)

    Hello Maria Paula,

     

    The notification you need to send to developers, are they related to flaws found by the scan or the failure to upload the files, "The file cannot be analyzed"? Flaws found by a scan are not the same thing as “file cannot be analyzed” error.

     

    When you upload your files for scanning, before the scan starts, the files must pass validation. If the file is not packaged/compiled according to the compilation guide or it contains languages or frameworks that are not supported it will fail the prescan check. When the files fail prescan you will get the file cannot be analyzed message.

    Compilation guide: https://help.veracode.com/reader/4EKhlLSMHm5jC8P8j3XccQ/AM8PAkQKwsHbNYXy2VeX5Q

     

    If the prescan is successful the files are submitted for scanning. If the scan finds issues in your application it will show those issues in the flaws report.

     

    According to our compilation guide, .js files cannot upload by themselves, if they are the prescan check will fail, you will get the file cannot be analyzed message and the build will.

    However, when you upload your .js project as .zip file, this will not cause the build to break because that is what the scanner expects. 

     

    You may leverage the getprescanresults.do API to check the status of a prescan and configured your notification based on the response from this call.

    https://help.veracode.com/r/r_getprescanresults

     

    I hope that helps.

     

    Regards,

    Rafael

    Expand Post
    Selected as Best

  • rmachado (Veracode, Inc.)

    Hello Maria Paula,

     

    The notification you need to send to developers, are they related to flaws found by the scan or the failure to upload the files, "The file cannot be analyzed"? Flaws found by a scan are not the same thing as “file cannot be analyzed” error.

     

    When you upload your files for scanning, before the scan starts, the files must pass validation. If the file is not packaged/compiled according to the compilation guide or it contains languages or frameworks that are not supported it will fail the prescan check. When the files fail prescan you will get the file cannot be analyzed message.

    Compilation guide: https://help.veracode.com/reader/4EKhlLSMHm5jC8P8j3XccQ/AM8PAkQKwsHbNYXy2VeX5Q

     

    If the prescan is successful the files are submitted for scanning. If the scan finds issues in your application it will show those issues in the flaws report.

     

    According to our compilation guide, .js files cannot upload by themselves, if they are the prescan check will fail, you will get the file cannot be analyzed message and the build will.

    However, when you upload your .js project as .zip file, this will not cause the build to break because that is what the scanner expects. 

     

    You may leverage the getprescanresults.do API to check the status of a prescan and configured your notification based on the response from this call.

    https://help.veracode.com/r/r_getprescanresults

     

    I hope that helps.

     

    Regards,

    Rafael

    Expand Post
    Selected as Best

    • maria.paula.cheska.tolentino (Community Member)

       

      ​Thanks Rafael. To answer your first question, the notification will be triggered if there are flaws found in the scan results. 

       

      On both scenarios, either individually uploaded or packaged in a zip file, it passes the prescan validation. However the difference between the two is with individually uploaded, it fails the build when there are flaws found from the result but with zip it does not fail the build (both Wait for scan to complete and When the 'Upload and scan with Veracode' action fails, the entire build fails are checked). Also, both scenarios returns "The scan finished with policy status 'Pass'"

       

      Are there any API or setting I can use to let me know if the scan result has flaws or not? Thank you.

      Expand Post

  • rmachado (Veracode, Inc.)

    Hello Maria Paula,

     

    Please check step 15 of the ‘Configuring a TeamCity Project for Veracode Scans’ section. The scan will fail if the scan does not pass policy. Perhaps you can use the return message to trigger your notifications.

    https://help.veracode.com/reader/PgbNZUD7j8aY7iG~hQZWxQ/4bLHd8N_Etj~dgfiY3WMYg

     

    Also, you might be able to leverage the getbuildinfo.do API, https://help.veracode.com/reader/LMv_dtSHyb7iIxAQznC~9w/_WKxFKj~jpXVF6iN0IgWvA. The getbuildinfo.do call provides information about the most recent scan or a specific scan of the application. The results will be similar to the below:

     

    xc

    You might be able to configure your notification based on policy compliance status or rules status.

     

    I hope that helps. 

    Expand Post

Topics (1)

No articles found
Loading

Ask the Community

Get answers, share a use case, discuss your favorite features, or get input from the community.