CMckelvey129166 (Community Member) asked a question.
I am here because I have been using the VS Code Veracode Plugin for shifting left. It has been really good so far and helped me mitigate a lot but I am wondering about limitations within the path of the flaw. When a flaw is detected in the code, you can view the details of it and then inspect the path. I am building a Spring Boot app in Java 21 and have put in a @ControllerAdvice for all responses to requests in order to sanitize the result to fix a CWE-80 flaw.
Let me walk through this visually:
- After the flaw is found, click the Info icon to View flaw detailsimage478×449 14.7 KB
- When you click it, you’ll get a screen like below that starts on the fix but I have navigated to the Remediation Guidance tab. Here you can see the path and as you can tell, it stops at the ApiController and does not recognize the @ControllerAdvice class SanitizingResponseBodyAdvice.image1453×678 40.6 KB
I am curious if other Spring Boot devs that have been trying to mitigate CWE-80s or log neutralization in a one-stop-shop class because I find managing hundreds of locations with sanitation to be exhaustive and a huge time killer. There is a way to mitigate this manually but I thought it would make more sense for Veracode to consider the whole path of the request and maybe this is a limitation of Static Scanning? Anyone else experiencing this?
.png){kind=logo}
Hi @CMckelvey129166 (Community Member)
Veracode Static Analysis will not recognize any controls for CWE-80 being done in a @ControllerAdvice annotated class.
Static does look at/consider the full path, but it's possible that the whole path is not being displayed to you
I do understand that Veracode is having to scan all types of programming languages, frameworks and the like to catch these.
Is it possible that when Veracode recognizes the project as a Spring Boot app that it could consider annotations such as @ControllerAdvice?
I know I am essentially asking if Veracode can broaden their scope (feature request) but I think it is worth while with Spring Boot being a popular framework.
@SamHouston (Veracode) Sorry, meant to add you at the beginning
Thanks for the tag @CMckelvey129166 (Community Member) 🙂
Great suggestion - please submit it in our Ideas section and I will share it with our Product team: https://community.veracode.com/s/ideas
@SamHouston (Veracode) , when the idea is asking what integration version(s) I am requesting, is this in regards to what versions of Veracode I am asking about? I do not know what version of Veracode we run and have been looking around to see
hi @CMckelvey129166 (Community Member) You can use the cli to return the version: https://docs.veracode.com/r/veracode_version
Alright, I have submitted an idea. Thank you for the assistance with this.
Here is a link to the idea in case others are curious: https://community.veracode.com/s/idea/087Uf0000003813IAA/detail