Hi RHall, Thanks for the question! Veracode Greenlight provides immediate feedback on the code you are actively working. Greenlight analysis is focused on a file or package and is able to identify flaws that are contained within that portion of the code. Flaws that require inter-class or inter-package data or control flow analysis require the complete application to be scanned. Therefore, scanning the complete application with Veracode Static may result in finding more flaws because the scope of what is being scanned is larger. The advantage to using Veracode Greenlight is that the class of problems that can be found by examining a portion of the overall application can be found immediately and the results provided in the context of what you are working on. Let me know if this answer makes sense in the context of your application. Our Security Consultants can also take a deeper look at the application with you to ensure the Static findings are indeed inter-class/package dependent and require the larger scope of the application to be detected. In Greenlight, did you try scanning the java package that the file is part of? In the Veracode Platform, are you familiar with the data path provided in the Triage Flaw Viewer for static scans, this helps to illustrate the intra-class/package flow that the static engine takes?

Hi @jworthington (Veracode, Inc.)​ , Thanks for the response. I think @RHall266178 (Community Member)'s question is actually simpler than this. I too see cases where the full static scan detects CWE's that are directly identifiable in a single java file, but that Greenlight doesn't flag. Those cases exactly match others where Greenlight does correctly match/flag the full scan report.

For example, I'm looking at the CWE 601 flaws from the full scan such as:

public void someMethod(String url, HttpServletResponse response) {

// Do some stuff...

response.sendRedirect( url ); // CWE 601 !

}

In some java files/line#'s from the full scan Greenlight flags this as expected. In others Greenlight doesn't flag it. I thought I noticed a pattern where static methods didn't scan correctly in GL, but I did a test of this and it seems not to be the case. I can take cut/paste/rename a methodX() that GL flags to methodY() and the same flaw isn't flagged in methodY().

We'd really love to rely on GL for pre-validating our mitigations. Any help/insights would be greatly appreciated.

Hi Ken, If the source and sink are in the same file (intra-class) or package (intra-package) that is being scanned Greenlight should be able to detect the flaw. If you have a specific instance you want to investigate further, please schedule a consultation call or create a support ticket. Our Security Consultants can dig deeper into the results to give you a more detailed answer. Have you used our "Schedule a Consultation" feature that's available in the Veracode Platform? Thanks Janet

Thanks for the reply, Janet. We do have specific instances and are compiling them, along with other questions, for a consultation. Sadly, only one of our Dev team members has permissions to do that - we don't know why (we don't know offhand who our admin for this account is to help look into this). If we were to submit a ticket, what precise information would you need? E.g., what references do you need? Maybe,

• Application
• Scan report date
• CWE ID
• Java filename + line #

Thanks for your time and prompt reply,

Ken