Topic
2 replies Latest Post - ‏2014-09-24T07:44:03Z by Arnab Roy
Arnab Roy
Arnab Roy
7 Posts
ACCEPTED ANSWER

Pinned topic Usage of Bundles in AppScan Source for Developer plugin

‏2014-07-01T06:24:31Z |

Hello,

Can some one guide me on how to effectively use Bundles (created in AppScan Source for Analysis) in  AppScan Source for Developer plugin.

 

For example,

- we scanned a C/C++ code in Visual Studio plugin (AppScan Src. Dev.). We identified a lot of issues as False Positives. I want to get rid of these FP findings.

- we opened the assessment in AppScan Source for Analysis, created Bundle called 'False Positive' and that removed the results from the 'Findings', in Source for Analysis. This works in Source for Analysis.

- now when we opened the same Bundle in Visual Studio and re-scan the latest version of our code. Unfortunately the findings (False Positives as in the Bundles) were not removed. Note, that in our latest source codes some lines numbers of those vulnerabilities (False Positives) have changed. Can this be the reason why the Bundle was ignored?

 

Appreciate any feedback on this topic.

Regards,

 

 

 

  • Eric_Silva
    Eric_Silva
    3 Posts
    ACCEPTED ANSWER

    Re: Usage of Bundles in AppScan Source for Developer plugin

    ‏2014-09-17T11:27:07Z  in response to Arnab Roy
    Hello Arnab, fine. 
     
    Bundles are used for this grouping you did it correctly, however you must take into consideration he is manipulating its "assessment" and not your code. So any action you take in the time of screening is on top of the object "assessment". When you import a Bundle on the tool you are importing a static assessment of code with references to code that is being tested (lines) you should use it in intention facilitate the correction process! 
     
    When the variation in the number of lines, you probably found a "suspected" and not vulnerability. In some previous experiments have identified this type of behavior and realized I did not actually "changed the line", but being a suspected it may not be the vulnerable line but directly or indirectly affected by the vulnerability. To clear this check the trace function and identify its type and discovered the suspects know their relationship to other objects. 
     
    Hope this helps, regards.
    • Arnab Roy
      Arnab Roy
      7 Posts
      ACCEPTED ANSWER

      Re: Usage of Bundles in AppScan Source for Developer plugin

      ‏2014-09-24T07:44:03Z  in response to Eric_Silva

      Thank You Eric. This helped.