JHyun398998 (Community Member) asked a question.

May 20, 2020 at 8:40 AM
How to package a Scala, Play Framework, application for proper Software Composition Analysis (SCA).

What is the proper way to package / bundle a Scala, Play Framework, application for proper Software Composition Analysis (SCA)? We already submit Java Spring Boot application "fat" jars with dependencies and these correctly show the dependent libraries. But for Scala, the Veracode documentation specifically says to not include dependencies, except for SCA, and yet does not describe how to bundle them for SCA.

 

Note, we are submitting multiple web apps under a single Application entry. Do we bundle each Scala application with dependent jars in a zip file? Or do we just submit all the jar files, including dependencies, without bundling? How would Veracode know which is our code and which are dependencies?

  • 5 answers
  • 757 views

  • JHyun398998 (Community Member)

    I think I've found a solution/workaround/hack by repackaging the Scala Play Framework application as a fake war file. I took the main jar file of the application and extracted its contents into the war's WEB-INF/classes directory and put all the third party dependencies into the WEB-INF/lib directory. Even though the war didn't have a web.xml file, which the Veracode scan flagged, it still processed the archive, performed the normal scan and performed the SCA scan.

    Expand Post
    Selected as Best

    • JHyun398998 (Community Member)

      Yes. This is what we are currently doing. However, submitting the application this way causes the Veracode scan to *not* show anything in the Software Composition Analysis (SCA) which specifically analyzes third-party dependencies. In the same documentation you link to, the instructions say:

       

      "Software Composition Analysis

      If you have a Veracode Software Composition Analysis subscription, you can include third-party components in your static analysis submission to report on vulnerabilities in those components. To effectively scan third-party components, the submitted application must also meet the packaging requirements for SCA upload and scan."

       

      But there are no instructions on how to package a Scala problem with third-party dependencies so that it will be scanned properly. There are only instructions on how to package without dependencies.

      Expand Post

      • JHyun398998 (Community Member)

        The instructions do not go far enough to explain what to do. The JAR format does not natively support including dependencies within it so "Upload the package as a JAR file with all of its dependencies." is not descriptive enough.

         

        There is this statement for Java packaging:

         

        Note: Veracode does not scan JAR files nested inside other JAR files, except for Spring Boot applications. Veracode does support analysis of uber-jar files created by the Maven Shade plugin.

         

        The Scala equivalent for shade is sbt-assembly, but I'm guessing that although Veracode supports this for general analysis, it probably won't be supported for SCA. Shade/assembly essentially splits apart dependent jars into class files and includes them into the final jar file individually. This probably means SCA won't be able to tell which is our code and which is third party code and the whole point of SCA is to specifically identify third party code.

        Expand Post

  • JHyun398998 (Community Member)

    I think I've found a solution/workaround/hack by repackaging the Scala Play Framework application as a fake war file. I took the main jar file of the application and extracted its contents into the war's WEB-INF/classes directory and put all the third party dependencies into the WEB-INF/lib directory. Even though the war didn't have a web.xml file, which the Veracode scan flagged, it still processed the archive, performed the normal scan and performed the SCA scan.

    Expand Post
    Selected as Best

Topics (1)

No articles found
Loading

Ask the Community

Get answers, share a use case, discuss your favorite features, or get input from the community.