CGordon830606 (Community Member) asked a question.
Does veracode have some means to tell if a javascript project runs only on the client? We see some weird results when bundling projects together vs separate that leads me to believe that it may be able to determine if a project runs on a server
If we bundle several repositories in one zip to be scanned with SAST we will have many SSRF violations, but if we package the repos separately we only get the SSRF on the cloudflare project, which makes sense.
Is there some detection going on here? Is this a feature? It first it was just making me thing there are bugs.
.png){kind=logo}
Hello user,
I would recommend you contact our technical support team. Here's how you can log a case:
1. Navigate to the upper right corner of any page in the Community, and click on your user avatar.
2. Select Contact Support from the drop-down menu.Open a case with Support, for static team analysis and they will be able to assist you with your query.
Regards,
Pranita
Veracode Inc.
Thanks, I already have a consult scheduled
just following up that although Veracode could not tell us why SSRF in client repos was only detected in a monolith zip, they did recommend that we package in individual zips, and we are seeing the preferred results of SSRF only in server repos. Again, veracode can't tell me why at this time, but I"m satisfied that its finding them in the one repo that runs server side.