Hi @ZGulser393733 (Community Member)​ ,

Veracode Static Analysis does not currently support scanning .aar or .framework files.

Please follow our compilation guide for your technology: https://help.veracode.com/reader/4EKhlLSMHm5jC8P8j3XccQ/UXI5sR0ayWfLm6ifmd4zWw

Thank you,

Boy Baukema

Thanks for your prompt response. This is something I need to know a bit more in detail though. So,

1. I believe Veracode defines the modules in an application based on their file extension. For example, if it sees a .jar file, it marks it as a module, right?
2. If the 1st assumption is correct, would it be potentially possible to turn .aar files into .jar files and have them scanned?

A 'Module' (in Veracode Static Analysis terms) is a scannable unit of work with an entry point. A single jar file may be considered a module though typically this jar file will have dependencies and that jar file with all jar files it depends on will be considered as one module (you can see these dependencies by clicking the + sign after pre-scan or on the review modules screen).

Veracode Static Analysis tries to locate automatically which files contain 'entry points' for your application, those points at which your app(lication) is called by the outside world. For a server side MVC app this will typically be the controller, for an Android app this will be Activities/Services/etc reachable via an Intent.

A module will then be identified by it's entry point.

This is important because Veracode Static Analysis uses this to determine whether code is actually called and how it is called.

Now we typically do allow you to select libraries as entry points because automatically detecting entry points can be very hard and some customers like to select these libraries to detect. But it is important to realise that this is roughly analogous to saying "The user is directly able to manipulate this module".

As a Veracode Application Security Consultant I will typically discourage you from doing so because this give you flaws that are not very actionable. For example if you have a library function that manipulates files and takes in a filename from the application it will be flagged for CWE 73 file path manipulation. Though the security of this function relies more on how it's used in your app(lication).

This can lead to alarm fatigue ( https://en.wikipedia.org/wiki/Alarm_fatigue ).

So the TL;DR is that yes, you can turn it into a JAR file and scan the JAR file. But it will give you low quality results and instead we recommend scanning the library in it's context.

Thank you,

Boy Baukema

Thanks again!

One last thing...I understand that if a jar module has nested jar modules (or like you've put above - "depends" on the other jars), it will be considered as a single module. Does it mean that those dependencies are scanned as well? I'm asking this because I've run into this statement "Please note, Veracode does not scan JAR files nested inside other JAR files" in the docs;

https://help.veracode.com/reader/4EKhlLSMHm5jC8P8j3XccQ/HQ0pp2GBWwN7Wl4GR7gQdQ

@ZGulser393733 (Community Member)​ as you probably know a JAR file is very little more than a ZIP file with a well described folder structure. Veracode will, with the exception of Spring Boot JAR files, not look for and extract other JAR files from a JAR (for example from fat JARs / Uber JARs). In this case we will not consider any 'nested' JAR files (or ZIP files) for analysis.

This is different from JAR files that have been uploaded separately in the main upload. Those will be linked together into one module and the usage of the of these dependencies will be analysed.

If you have concerns with scan coverage you can look at the files that have been detected in a given modules you can, after analysis, open the Static Scan details in the menu on the left hand side and click on Source Files which gives an overview of the files found per module.

You can also schedule a Consultation in the Veracode Platform which will be scheduled with me or one of my colleagues.

Thank you,

Boy Baukema