Hi folks! I wanted to highlight some work we’re doing that is intended to address a common pain point with static scanning, which we have been calling the “stuck scan problem.” This post will talk about what we’re working on, how you can take advantage of it today, and what’s coming next.

What are we announcing?

A new feature has been added to the uploadandscan action on the Java API Wrapper that automatically deletes the current scan under certain failure conditions.

Why this feature?

A “stuck scan” is a static scan that is started but not completed. It can happen for various reasons, including misconfiguration of the scan, upload of unscannable code, a scan that runs for longer than expected, or other issues. Stuck scans are a problem in a pipeline or other automated context because any given application or sandbox is only allowed one scan in an incomplete state at a time, so the “stuck scan” prevents a new scan from starting.

In many cases a “stuck scan” is a signal that the scan configuration should be reviewed—if a misconfiguration or unscannable code is the root cause, the scan will fail the next time it’s attempted unless the problem is fixed.

However, if a scan fails because of a one-time issue, removing the scan and trying again is absolutely the right thing to do. Today this has to be done manually by logging into the platform, finding the application and/or sandbox, and deleting the scan.

This last case has now been automated in the Veracode Java API Wrapper. If you use the Java API Wrapper uploadandscan action, you can now specify the --deleteIncompleteScan option. With this option specified, any incomplete scan that’s present for the specified application or sandbox will be deleted automatically when a new scan starts, removing the requirement for manual intervention.

This option is available for you in your pipeline if you call the Java API Wrapper directly. For example, if using the API Wrapper in Veracode’s Docker image, your task might look like this:

- java -jar veracodeJavaAPI.jar -vid $VERACODE_VID -vkey $VERACODE_VKEY

-action UploadAndScan -appname "Build System Demo Application" -createprofile false -autoscan true

-filepath target/verademo.war -version $BUILD_NUMBER -sandboxname ReleaseCandidate -createSandbox true

-deleteIncompleteScan true

We will update the Veracode Jenkins, Azure DevOps, and TeamCity integrations to support this option in the coming months as well.

Please leave a comment if you have any questions!