KGromyko264780 (Community Member) asked a question.

April 23, 2021 at 9:41 AM
Determine entry points for Pipeline scans

Hello everybody.

I am investigating Veracode pipeline scans for future implementing it to our company CI/CD process. It is provided fast vulnerabilities scan of zip archives. But when I send for analysis zip archive with many external dependency dll libraries, it takes much time to end scan - sometimes on small archives it takes more than 1 hour - that`s why scan failes because Veracode timeout is equal 1 hour. So, my question is about how to determine special entry points as in Static scan for archive in the beginning of Pipeline scan to speed up scanning and reduce time for scan? As entry points I want to determine only my dll libraries exclude external libraries (for example Microsoft, System for .net). Is it possible or does exist another approach for doing that work?

Thank you for advance.

  • 4 answers
  • 2.37K views
KGromyko264780 likes this.

  • Jason M., Veracode Support (Veracode)

    Hi @KGromyko264780 (Community Member)​ ,

    When uploaded, if something is identified as 3rd party code, then Veracode won't scan it, as there is no configuration you need to do as this is the default behavior of the scanner. The scan is scoped to what it sees as 1st party code.

     

    It sounds like your full application might be ideal for the pipeline scans, or another suggestion is that you can reduce the scope of the app. If you haven't already, I would advise reviewing this Help Center Article Run a Pipeline Scan.

     

    Jason

    Veracode Support Engineer

    Expand Post
    Selected as Best

  • Jason M., Veracode Support (Veracode)

    Hello @KGromyko264780 (Community Member)​ ,

     

    For the most optimal, relevant and actionable findings we recommend only selecting first party modules without an entry point or with an entry point that is user facing. This typically means that you should not select modules with a library entry point (such as MyProject.XmlSerializers.dll). By default, the Scanner will select any modules that contain entry points AND are not a dependency of any other module in the compilation. For a module to even be selected at all, it must contain an entry point.

     

    Alternatively, for more false positives, but fewer false negatives you may consider selecting all available first party top-level modules. As a rule of thumb typical scan should not contain more than a handful (5) entry points, in fact, most scans should will likely not have more than 1 or 2 entry points for the highest signal-to-noise ratio. Please be sure to review the Help Center Article Selecting Modules to Scan.

     

    If the information we’ve provided you has helped resolve your challenge (or answered your question), we would appreciate it if you could mark the response that was helpful with “Select as Best”. This will help other Community members who come across your question as a similar challenge they might be facing and your best answer will help them find the right solution as well.

     

    Jason

    Veracode Support Engineer

    Expand Post

    • KGromyko264780 (Community Member)

      Thank you for your answer. But my main problem is in quick analyzing zip archive with my published project. Size of my zip archive is 3.5 Megabytes. But time spended on pipeline scan of it is more than 1 hour - more than Veracode timeout. In my project I have many dependencies of widespread libraries owned by Microsoft. First of all I want to scan only my code (my dll compiled from my source code). All dependencies I will scan in my Static scans. I only want to tell Veracode Pipeline to scan dlls without Microsoft dlls. Can I do this job?

      Expand Post

      • Jason M., Veracode Support (Veracode)

        Hi @KGromyko264780 (Community Member)​ ,

        When uploaded, if something is identified as 3rd party code, then Veracode won't scan it, as there is no configuration you need to do as this is the default behavior of the scanner. The scan is scoped to what it sees as 1st party code.

         

        It sounds like your full application might be ideal for the pipeline scans, or another suggestion is that you can reduce the scope of the app. If you haven't already, I would advise reviewing this Help Center Article Run a Pipeline Scan.

         

        Jason

        Veracode Support Engineer

        Expand Post
        Selected as Best

Topics (3)

No articles found
Loading

Ask the Community

Get answers, share a use case, discuss your favorite features, or get input from the community.