Hello Team,

I have a setup where AWS Codepipeline is used for CICD and I have maintained a buildspec.yml file for the Veracode to detect the application and then send it for vulnerability scan. Previously, the command was executed fine but, in recent past I am bombarded with errors and unable to send the scan for vulnerability.

Set of Command used previously:

   - echo Running Veracode...

   - curl -L -o VeracodeJavaAPI.jar https://repo1.maven.org/maven2/com/veracode/vosp/api/wrappers/vosp-api-wrappers-java/23.4.11.2/vosp-api-wrappers-java-23.4.11.2.jar

   - java -jar VeracodeJavaAPI.jar -vid $VID -vkey $VKEY -action uploadandscan -appname "MyApp" -createprofile false -filepath file.zip -version $(date +%Y-%m-%d-%H:%M)

The above commands used to work perfectly fine and was able to provide the results in Veracode.

Now, it seems there is some change in the command line code and receiving some errors.

The code used:

- echo Running Veracode...

- curl -L -o VeracodeJavaAPI.jar https://repo1.maven.org/maven2/com/veracode/vosp/api/wrappers/vosp-api-wrappers-java/23.4.11.2/vosp-api-wrappers-java-23.4.11.2.jar

- java -jar VeracodeJavaAPI.jar -vid $VID -vkey $VKEY -action uploadandscan -appname "MyApp" -createprofile false -sandboxname "MySandbox" -version $(date +%Y-%m-%d-%H:%M) -inputfilepath file.zip

Error Received:

[Container] 2024/01/18 06:58:03.165124 Running command echo Running Veracode...

Running Veracode...

[Container] 2024/01/18 06:58:03.169253 Running command curl -L -o VeracodeJavaAPI.jar https://repo1.maven.org/maven2/com/veracode/vosp/api/wrappers/vosp-api-wrappers-java/23.4.11.2/vosp-api-wrappers-java-23.4.11.2.jar3799

% Total % Received % Xferd Average Speed Time Time Time Current 3800 Dload Upload Total Spent Left Speed 38013802 0 0 0 0 0 0 0 0 --:--:-- --:--:-- --:--:-- 0 3803100 1570k 100 1570k 0 0 13.2M 0 --:--:-- --:--:-- --:--:-- 13.2M

[Container] 2024/01/18 06:58:04.528040 Running command java -jar VeracodeJavaAPI.jar -vid $VID -vkey $VKEY -action uploadandscan -appname "MyApp" -createprofile false -sandboxname "MySandbox" -version $(date +%Y-%m-%d-%H:%M) -inputfilepath file.zip

3806[2024.01.18 06:58:09.008] **************************************** 3807[2024.01.18 06:58:09.009] Command: 1/96940

3808[2024.01.18 06:58:09.009] **************************************** 3809[2024.01.18 06:58:09.348] Transaction ID: [1ce0ace1-8a3d-4f3e-8a46-4a538524eab5]

3810[2024.01.18 06:58:12.800]

3811[2024.01.18 06:58:12.800] Application profile "MyApp" (appid=1841535) was located.

3812[2024.01.18 06:58:13.405]

3813[2024.01.18 06:58:13.405] Sandbox "MySandbox" (sandboxid=5903383) was located.

3814[2024.01.18 06:58:13.406]

3815[2024.01.18 06:58:13.406] Creating a new analysis with name "2024-01-18-06:58".

3816[2024.01.18 06:58:14.551]

3817[2024.01.18 06:58:14.551] The analysis id of the new analysis is "32231732".

3818[2024.01.18 06:58:14.553]

3819[2024.01.18 06:58:14.553] Cannot read the array length because "<local4>" is null

3820[2024.01.18 06:58:14.554]

3821[2024.01.18 06:58:14.554] Parsing error: Cannot read the array length because "<local4>" is null

3822

3823[Container] 2024/01/18 06:58:14.563029 Command did not exit successfully java -jar VeracodeJavaAPI.jar -vid $VID -vkey $VKEY -action uploadandscan -appname "MyApp" -createprofile false -sandboxname "MySandbox" -version $(date +%Y-%m-%d-%H:%M) -inputfilepath file.zip exit status 3

3824[Container] 2024/01/18 06:58:14.567322 Phase complete: POST_BUILD State: FAILED

It would be great if someone can help me.