i8bevo (Community Member) asked a question.
We have a pipeline that packages multiple zip files together. We zip the zip files together to create a master file. We'd like Veracode to consume the master file without requiring that we re-package them.
Hello @i8bevo (Community Member) ,
If you are referring to "nested files", we do not support nested archives. If they're included in your upload, the scanner will ignore them. This is because there is a type of attack called a zip bomb. You can learn more about zip bombs by following this link: http://www.allhackspro.com/2017/09/destroy-anyones-computer-zip-bomb.html.
We also have this noted in this Help Center article: https://help.veracode.com/r/compilation_java
If the information we’ve provided you has helped resolve your challenge (or answered your question), we would appreciate it if you could mark the response that was helpful with “Select as Best”. This will help other Community members who come across your question as a similar challenge they might be facing and your best answer will help them find the right solution as well.
Jason
Veracode Support Engineer
.png){kind=logo}
Hello @i8bevo (Community Member) ,
If you are referring to "nested files", we do not support nested archives. If they're included in your upload, the scanner will ignore them. This is because there is a type of attack called a zip bomb. You can learn more about zip bombs by following this link: http://www.allhackspro.com/2017/09/destroy-anyones-computer-zip-bomb.html.
We also have this noted in this Help Center article: https://help.veracode.com/r/compilation_java
If the information we’ve provided you has helped resolve your challenge (or answered your question), we would appreciate it if you could mark the response that was helpful with “Select as Best”. This will help other Community members who come across your question as a similar challenge they might be facing and your best answer will help them find the right solution as well.
Jason
Veracode Support Engineer