DHobert101612 (Community Member) asked a question.
I have done some research on how to fix flaws for CWE 117. The fixes are in a Global.asax.cs file, but when I check them in, package them up, and submit them for a scan to determine whether the fixes are valid the scan does not seem to recognize my updates.
I made some significant changes to the code unit in question and to the affected code, so I know that the line # on which the flaws were being detected has changed. Nevertheless, the report shows the flaws on the same line #, which suggests to me that the changes are not being recognized by Veracode. Any ideas on how to get changes in a file like Global.asax.cs to be "seen". Personally I would expect them to simply be compiled into the website DLL(s).
Thanks!
Dan
.png){kind=logo}
Hi @DHobert101612 (Community Member) ,
If updates to the source code are not detected by Veracode Static Analysis this is typically a sign that what is sent for Veracode Static Analysis is not the same as the source code, typical causes include:
Please consider also verifying with a tool like ILSpy ( https://github.com/icsharpcode/ILSpy ) whether the corrected code is inside one of the dlls (for Global.asax.cs this will likely be called "App_Global.dll") that is sent to Veracode for Veracode Static Analysis.
If you have any other questions, I would recommend you schedule a consultation call to discuss.
You can check out this knowledge article (https://community.veracode.com/s/article/How-to-schedule-a-consultation-call) on how to schedule a consultation call with us.
Thank you,
Boy Baukema