BValand958915 (Community Member) asked a question.

April 29, 2020 at 7:56 PM
How to prepare angular project files for veracode scan.

Hi,

 

I am newbie to veracode scanning so i would like to know what files we need to include for veracode static scan.

 

I have angular project which is written in typescript so should i compile my project via ng build and zip dist folder for scanning. Please advise?

 

I would prefer typescript code scanned so if there is any issue i can see which line of code and easy to fix.

 

Another concern is about node_modules the documentation says include it in the source files but the zip file will be around 150mb.

 

Do i need to include only the packages that are not listed in package.json or package-lock.json files?

 

The veracode documentation - https://help.veracode.com/reader/4EKhlLSMHm5jC8P8j3XccQ/AM8PAkQKwsHbNYXy2VeX5Q

 

The document refers as below :-

When analyzing Node.JS applications, if you want to analyze components within the node_modules folder, include it in the uploaded source. Files within the node_modules folder appear as selectable modules only if they are not listed as part of the dependencies or devDependencies sections of either the package.json or package-lock.json files.

Note: Excluding the node_modules folder from an upload may affect your SCA Results.

 

 

  • 4 answers
  • 8.89K views

  • BValand958915 (Community Member)

    Hi Anthony

     

    Thanks for your reply.

     

    I had a call with Veracode support and was advised that we are not required to include node_modules folder if package is specified in package.json or package.lock.json file as dependencies or devDependencies.

     

    Thanks

    Bhavesh

     

     

     

     

    Expand Post
    Selected as Best

  • Anthony Fielding (Veracode)

    Hi @BValand958915 (Community Member)​,

    Thanks for your question. The recommendation as per the Help Centre article you refer to (https://help.veracode.com/reader/4EKhlLSMHm5jC8P8j3XccQ/AM8PAkQKwsHbNYXy2VeX5Q) is to package your node_modules, package.json and package-lock.json artefacts. This will give you coverage into the risks your third-party components could expose your application to. I understand that including node_modules can result in a larger scan, but that is how it is with the Node packaging mechanism unfortunately. You should include all packages that your application depends on in the scan to give you the coverage of this third-party risk. I hope that answers your question.

     

    Thanks,

    Anthony Fielding

    Expand Post

    • BValand958915 (Community Member)

      Hi Anthony

       

      Thanks for your reply.

       

      I have not included node_module part of my scan but i can see third-party modules listed and scanned under Software Composition Analysis - Third Party Components.

       

      All the modules that i have specified as dependencies in package.json are listed.

       

      Can you please clarify ?

       

      Thanks

      Bhavesh

       

       

      Expand Post

  • BValand958915 (Community Member)

    Hi Anthony

     

    Thanks for your reply.

     

    I had a call with Veracode support and was advised that we are not required to include node_modules folder if package is specified in package.json or package.lock.json file as dependencies or devDependencies.

     

    Thanks

    Bhavesh

     

     

     

     

    Expand Post
    Selected as Best

Topics (4)

No articles found
Loading

Ask the Community

Get answers, share a use case, discuss your favorite features, or get input from the community.