Will the Veracode SCA scan flag vulnerabilities for POM artifacts which are defined as <scope>test</scope>?

GDay765431 (Community Member) asked a question.

January 8, 2024 at 9:34 PM

Will the Veracode SCA scan flag vulnerabilities for POM artifacts which are defined as <scope>test</scope>? The <scope>test</scope> would be used for libraries such as junit. Junit would be used when executing test case classes in a src/test path, but those src/test classes would be setup in the POM file to not get included when the deployment EAR is generated. Maven should automatically exclude the <scope>test</scope> artifacts when building the EAR. If there was a vulnerability found in a jar such as junit would Veracode still open a Vulnerability even if the junit artifact has been defined with <scope>test</scope> and thus is not part of the actual application EAR?

Boy, Security Consultant (Veracode)
2 years ago
Hi @GDay765431 (Community Member) ,

Veracode Software Composition Analysis currently supports 2 ways of analysing the dependencies of an application:

Upload & Scan - occurs when you upload your software for Veracode Static Analysis. Here, for EAR files, we analyze the built artifact, which as you've stated, does not contain any of the <scope>test</scope> libraries and as such we would not report any vulnerabilities on those components.
Agent Based Scanning - occurs when you use the agent ( https://docs.veracode.com/r/c_sc_what_is typically in a CI pipeline). Here you can control the 'scope' parameter ( https://docs.veracode.com/r/Multi_Language_Scan_Directives#scope ) but it defaults to 'compile' restricts the scan to system, provided, and compile dependencies.

Thank you,
Boy Baukema
Veracode Application Security Consulting
Schedule a Consultation - https://docs.veracode.com/r/t_schedule_consultation
Expand Post
GDay765431 (Community Member)
2 years ago
Thank you. That was the information that I needed.
Expand Post