Software Composition Analysis Group (Archived) — wilsonperdomo (Community Member) asked a question.
I’m currently integrating some Veracode scans with some Python 3.8 apps. In the process, I’ve noticed that some SCA reports are returning false positives with some dependencies that have security vulnerabilities. The issue is that many of those dependencies aren’t actually being packaged with the app and are just dev dependencies. It seems the platform has a hard time distinguishing the two in the Pipfiles (dependency manifests) my projects have. I read in the documentation the requirements.txt are also supported however that doesn't seem to be the case. I do not get any results when doing so. Can anyone help?
Example of the pipfile
[[source]]
name = "pypi"
url = "https://pypi.org/simple"
verify_ssl = true
[dev-packages]
importlib-metadata = "*"
pytest = "*"
pytest-cov = "*"
[packages]
requests = "*"
simplejson = "*"
[requires]
python_version = "3.7"
.png){kind=logo}
Here's the guide I referenced.
https://help.veracode.com/reader/4EKhlLSMHm5jC8P8j3XccQ/GVsa7Fl8UL7PRkROIGPVFQ
Here's the requirements.txt file I also tried using
requests==2.23.0
simplejson==3.17.0
Hello @wilsonperdomo (Community Member) ,
Veracode Agent-Based Scan agents support scans that include per-scan directives, known as scan directives. To specify these scan directives on a per-project basis, include a srcclr.yml file at the root of the scan.
You can try vuln_methods_ignored_directories.... that does support Python
and yes we do support requirements.txt, see the same help page
https://help.veracode.com/r/c_sc_scan_directives
If the information we’ve provided you has helped resolve your challenge (or answered your question), we would appreciate it if you could mark the response that was helpful with “Select as Best”. This will help other Community members who come across your question as a similar challenge they might be facing and your best answer will help them find the right solution as well.
Best regards,
Steven
Veracode Support Engineer
@Steven D., Veracode Support (Veracode) Thanks for getting back to me. Wile he scan directive file looks like a powerful exclusion mechanism, it seems like it does not support excluding the dev dependencies for pipfiles (Python) by the scope directive. Can you confirm this is correct? Based on the documentation it seems to only work for Ruby, Java, NPM, Yarn, Bower, PHP.
web application security blog entry clarifies what are False Positives in web application security and what negative effect they have on web security specialists. It additionally clarifies why basic robotized web security apparatuses produce bogus positives and how Netsparker Web Application Security Scanner doesn't report any bogus positives whatsoever.
FaceTime for PC
Hi @wilsonperdomo (Community Member) ,
yes we don't support the SCOPE configuration option for pipenv collectors currently. All dependencies, including dev-dependencies, are produced upon an agent scan.
May I suggest you click on the link below and suggest tis to our Product Manages. With continuous voting, you get to influence the product roadmap by championing the Ideas that matter to you the most.
Best regards,
Steven
Veracode Support Engineer
To determine these output mandates on a for each venture premise, incorporate a srcclr.yml document at the base of the sweep.
FaceTime
Clear separation of dev and production dependencies in your Pipfile. Check Veracode's supported file formats, but if 'requirements.txt' doesn't work, stick with the Pipfile approach. Exclude dev dependencies from the scan if they won't be packaged with the app.