Georges (Community Member) asked a question.
Dear all,
My current client has built an internal framework for all projects that access similar features. This framework is currently being used in a bit over 100 applications. When onboarding a consuming application, the same false positives have to be accepted, which creates quite some admin overhead. Is there a way to centrally scan this framework and all its features, creating the possibility to deselect the framework module from the consuming application? This way, a consuming application would only be scored on the self-written code, also making the scoring more fair.
As I've understood from Veracode Support, code path analysis would not occur when scanning a framework as there are no entry points. More rudimentary "regex-based" issues would still be found, but I'm now looking for a way to get the best of both worlds without having to revisit the framework-related FPs every time a new app is onboarded.
I'm unsure if test-projects of the framework could be seen as providers of entry points. Any other suggestions on how you see this and/or how you have tackled this in your org would be highly appreciated.
Best regards,
GB
P.S.: If this would be important : the language used for the shared framework is .NET. and is distributed through an internal NuGet store
.png){kind=logo}
I think this really depends on your module selection and treating the framework as a 3rd party library. I would not select any of the framework components as an entry point. The framework should have it's own application space to work through findings on the platform.
Thanks for your reply, @marcboggs (Community Member) .
> I would not select any of the framework components as an entry point.
Fully agreed; IMO it should be a "third party" component that is scanned in its own right.
> The framework should have it's own application space to work through findings on the platform.
The question there is : what do you select as an entry point in a framework that doesn't really have any? I'm merely doing triage analysis and have no experience with submitting code and doing initial module selection, however I do see in the "Review Modules" screen that the "Start Rescan" button gets greyed out when all modules are deselected as entry points.
This led me to imagine that maybe unit tests could be added and used as entry points? Worst case, a mock app would need to be written to serve that purpose, but that's also an overhead I don't want to decide on tasking someone with if better approaches are available.
How is the framework made available? Is it .net dlls?
That's correct and packaged in .nupkg (zip) archives, if I'm not mistaken.