MStirling820357 (Community Member) asked a question.
Greenlight does not seem to be picking up CWE ID 93 flaws that our static scans are
I have read in some documentation on here (It was in a section on Veracode Greenlight best practices) that Greenlight should be picking up Improper Neutralization of CRLF Sequences ('CRLF Injection') (CWE ID 93) however when I select an object that is listed in the detailed report as having this flaw greenlight is not highlighting it.
The last static scan we ran picked up 9 flaws and every single one of the objects I scanned directly with Greenlight did not show the flaw - I tried scanning the individual objects but also at a folder and project level but still nothing was reported. Can anyone tell me why this is happening?
.png){kind=logo}
Hello @MStirling820357 (Community Member),
Thank you for reaching out to the Community.
Greenlight is a tool for Developers to help them get continuous flaw feedback on the code they are specifically writing. The scope of the scan is much smaller - so any flaws that span a larger scope of the project (SQL injection is often a major culprit of this) - they will find that with a Static scan, which assesses the ENTIRE application in a scan - whereas GL is ONLY looking at the code the Developer is actively working on.
This is why customers need both GL and Static - one is a tool to help developers reduce the number of flaws they enter into their codebase - and Static helps assess the entire scope of the project - looking across all of the different pieces of code that all of the developers have submitted.
Best regards,
Steven
Veracode Support Engineer