vpopescu (Community Member) asked a question.

October 27, 2021 at 4:39 PM
Some flaws reported on line 1 (non-code line)

One of my programs is reporting flaws on line #1 of my code, and there is no executable code there (lines 1-15 are the file's comment header block)

 

What could be causing this, and how do I fix it?

 

Screenshot: same module and file, one flaw shows the correct flaw line, the next two show line 1.

 

tempsnip 

 

  • 1 answer
  • 598 views

  • Boy, Security Consultant (Veracode)

    Hi @vpopescu (Community Member)​ ,

     

    Veracode Static Analysis may report flaws on line 1 if no debug information is available for a given operation in the binary. With .NET we see this happen with frequent use of async (which generates some structures that don't have debug information).

     

    In this case we recommend:

    1. Ensuring you have provided a PDB file for this DLL.
    2. Reviewing the "Attack Vector" in the details for the flaw (available by clicking the black caret on the left of the flaw).
    3. Reviewing the "Data Path" Class and Function information.

     

    If none of these help you locate the line of code  I would recommend you schedule a consultation call to discuss. You can check out this knowledge article (https://community.veracode.com/s/article/How-to-schedule-a-consultation-call) on how to schedule a consultation call with us.

     

    Please consider letting us know how to better support you in these cases by letting us know your thoughts with Veracode Community Ideas at https://community.veracode.com/s/ideas .

     

    Thank you,

    Boy Baukema

    Expand Post

Topics (3)

No articles found
Loading

Ask the Community

Get answers, share a use case, discuss your favorite features, or get input from the community.