We have chosen Veracode to perform security assessment of our JavaEE code. We have been performing white-box security testing using Veracode. As I am quite new to Veracode, I was surprised to find no results for our imperfect jsp files. All the results were around a few servelets. Also we did not find any results in our Manager classes and Service Classes (backend code). Please guide. What am I missing here?
Hi and thanks for your feedback. I can offer you some general information here and provide suggestions about how we can dig into your specific application.
First, Veracode does have support for JSPs. We generally precompile the JSPs upon your submission so that we can ensure we have all the necessary supporting pieces, then we analyze the resulting bytecode alongside the rest of your compiled Java code.
There are a few things that can go wrong when a customer uploads JSPs:
All of that aside, we may simply have an issue in our engine when it comes to your application. The best thing to do is to schedule a readout with our service team so we can look at your results with you and offer you advice for your specific application. Depending on your subscription, you may have a "Request a Readout" button directly in the UI; if you don't, please contact us at support at veracode.com and we'll see what we can do to answer your concerns.