veracode-demo-labs.github.io
| Return to Home | Return to GitHub/Veracode-Demo-Labs |
IntelliJ
Begin by ensuring the project builds.
| Pull up the terminal using ALT+F12 or from the main menu, select View | Tool Windows | Terminal |
Type in “cd app”
then “mvn clean install”
This will create verademo.war in the target folder.
Submit Scan with Greenlight
See more about Greenlight here - https://docs.veracode.com/r/c_master_greenlight
Right click on the main folder and click Veracode Greenlight to submit a scan.
Review results and organize by Severity.
Submit SAST/SCA sandbox scan
In the platform create an application profile and a sandbox.
From IntelliJ, click Veracode - Upload and Scan
Cancel out of the first screen so you can properly set the application profile and sandbox.
Add the verademo.war file to the upload
Submit the scan
Remediate | re-scan | no new flaws
While we wait a few minutes for that to complete, lets fix a SQLi issue and resubmit the scan. In UserController.java, comment out the two bad code sections, and uncomment the two good code sections.
Locate the SQLi on line 170.
Should look like…
Should look like…
Save the file and submit a Greenlight scan.
The issue is now gone.
Open the Terminal to recompile the project using “mvn clean install”.
Submit another sandbox scan - Scan 2.
Download results from Scan 1.
The SQLi exists.
Download results from Scan 2.
The flaw is gone.
The reporting shows 3 issue fixed. Two other issues were resolved while fixing the SQLi.
Next steps would be:
- Remediate or mitigate any issues that violate policy
- Automate scans via CI/CD to prevent new flaws from being committed.
- Connect bug tracking systems to establish a continuos feedback loop of any issues.
- Establish a recurring DAST scan.
- Developer training
| Return to Home | Return to GitHub/Veracode-Demo-Labs |