KSuresh349932 (Community Member) asked a question.

February 21, 2020 at 12:47 PM
Hi, when trying to add "gzip" as content-encoding in response header, the report asks to use contextual escaping methods. It is just a static string and could you please let me know why this needs to be escaped?

Eg:

response.addHeader("Content-Encoding", "gzip");

 

  • 2 answers
  • 388 views

  • Anthony Fielding (Veracode)

    Hi @KSuero812249 (Community Member)​,

    This is likely due to a discrepancy in the source code you are looking at compared to the binary and debug symbols (if any) that were submitted for scanning. It is not uncommon for customers to select a latest working copy of the source code when viewing the flaws which may be different than the binary scanned. This could explain why you are experiencing this unusual result. I recommend you re-compile and then re-scan the application. If you are experiencing unexpected or unusual behaviour on the Veracode Platform please email support@veracode.com.

     

    Thanks,

    Anthony Fielding

    Expand Post
    Selected as Best

  • Anthony Fielding (Veracode)

    Hi @KSuero812249 (Community Member)​,

    This is likely due to a discrepancy in the source code you are looking at compared to the binary and debug symbols (if any) that were submitted for scanning. It is not uncommon for customers to select a latest working copy of the source code when viewing the flaws which may be different than the binary scanned. This could explain why you are experiencing this unusual result. I recommend you re-compile and then re-scan the application. If you are experiencing unexpected or unusual behaviour on the Veracode Platform please email support@veracode.com.

     

    Thanks,

    Anthony Fielding

    Expand Post
    Selected as Best

  • KSuresh349932 (Community Member)

    ​Thanks for the response will re-scan the application as suggested.

Topics (1)

No articles found
Loading

Ask the Community

Get answers, share a use case, discuss your favorite features, or get input from the community.