SSrivastav211188 (Community Member) asked a question.

March 11, 2022 at 10:56 AM
Dependency information for issue

Hello,

 

I am consuming issues identified by veracode using API at /v3/workspaces/<id>/projects/<id>/issues

 

For these libraries i want to get data around where the library is coming from.

Essentially I want the data around dependency graph.

 

I've looked at https://app.swaggerhub.com/apis/Veracode/veracode-sca_agent_api_specification/3.0 but nothing there seems to give dependency info.

 

I do see the info in the veracode UI under the fix/dependency graph section like this:

 

""This vulnerability is in a direct dependency. Vulnerable library <lib> was found in <path> It can be fixed by updating the version of the library in your project and rebuilding it.

 

I'm interested in both direct and transitive dependencies

  • 2 answers
  • 405 views

  • SSrivastav211188 (Community Member)

    I was able to find the info i needed at the path "/repo-issues/<site-id>/details"

    Selected as Best

  • Jason M., Veracode Support (Veracode)

    Hello @SSrivastav211188 (Community Member)​ ,

     

    Veracode does give information on a library if it is transitive or direct but we don't provide the URL path if is a dependency.  What you could use is called "call chains" within the Vulnerable Methods parameter. When writing code, the chain creates a function instead of doing it every single time. 

     

    Jason

    Veracode Engineer

    Expand Post

  • SSrivastav211188 (Community Member)

    I was able to find the info i needed at the path "/repo-issues/<site-id>/details"

    Selected as Best

Topics (1)

No articles found
Loading

Ask the Community

Get answers, share a use case, discuss your favorite features, or get input from the community.