Veracode Base Camp — A.Digulla (Community Member) asked a question.
How to make sure that all our code gets scanned?
We have an application that is delivered as a single ZIP archive. In that archive are start scripts, config files and folders with JARs. Depending on how the customer wants to use the application, we start a Java process that waits for messages via a JMS messaging service, via REST, or starts a web server.
For the scan, we upload the JARs and do a static scan via the Veracode web app. That gives us just ~20 medium flaws for ~150 MB worth of JARs. We could enjoy this great result but we have the nagging feeling that Veracode simply fails to identify all the possible entry points (like JMS listeners or UI event handlers).
Questions:
- Is there a way to see all the entry points that Veracode detected?
- Is there a way to see the scan coverage (like how many % of the code in the JAR were scanned)?
- Can we influence what Veracode considers an entry point?
.png){kind=logo}
Hi @A.Digulla (Community Member) ,
You can view the entry points we detected by navigating to Review Modules in the Veracode Platform, you can find more information here: https://help.veracode.com/r/c_request_modules_scan .
We do not currently display entry point information to the level of functions. We also do not allow configuration of entry points, this is managed by Veracode Engineering and Research. Please consider registering your idea with Veracode Community Ideas at https://community.veracode.com/s/ideas .
You can view the files Veracode Static Analysis analyzed by navigating to the Static Scan Details page ( https://help.veracode.com/r/Reviewing_the_Static_Scan_Details , accessible by clicking the name of a scan). This will open a new submenu "Source Files" which will list all files we scanned in the upload.
If you have any other questions, I would recommend you schedule a consultation call to discuss.
You can check out this knowledge article (https://community.veracode.com/s/article/How-to-schedule-a-consultation-call) on how to schedule a consultation call with us.
Thank you,
Boy Baukema
Click on scans. Click on Review Modules. You will see each module listed and whether or not it was an entry point.
I have to admit that the "entry point" list is ...pointless. It doesn't say what it considers an entry point in the code. Only main() methods? Or anything else?
Right now, I get the impression that over 90+% of my code isn't scanned and I can't figure out what VeraCode does. This is very frustrating.
Example: I'm using JMS (ActiveMQ). So someone from outside can send me a message which will trigger processing. Can VeraCode detect this case?
What about REST endpoints? Does VeraCode consider Spring annotations?
I also have XML files which configure entry points. How do I tell VeraCode about those?
How can I configure a method or class as an entry point for my application?
Veracode Static Analysis is configured with generic Java functions as a source of control and tainted data as well as definitions per supported library / framework which you can see in our documentation: https://help.veracode.com/r/compilation_java .
For example for the Spring Framework we do consider functions annotated with @RequestMapping to be sources of potentially attacker controlled input. If your library is not specified in this list but it does use data from supported generic Java functions or from supported libraries / frameworks it will still be able to to detect this input.
Veracode Static Analysis does not currently display entry point information to the level of functions. It also does not allow configuration of entry points, this is managed by Veracode Engineering and Research. Please consider registering your idea with Veracode Community Ideas at https://community.veracode.com/s/ideas .
If you have false negatives (flaws you believe should be reported by Veracode Static Analysis but are not), I would recommend you schedule a consultation call to discuss.
You can check out this knowledge article (https://community.veracode.com/s/article/How-to-schedule-a-consultation-call) on how to schedule a consultation call with us.
Thank you,
Boy Baukema