SCA security policy rules

The following security policy rules apply to Software Composition Analysis (SCA) scans only. For other scan types, see General security policy rules. These rules define the security requirements that scanned applications must meet to pass policy. They are preconfigured in the built-in policies.

To add these rules to a custom policy in the Veracode Platform, create or edit a custom policy and select the rules from the Rule Type dropdown in the Add New Rule dialog. Some rules have an Advanced Options dropdown with additional requirements.

You can also add and configure these rules with the Policy API.

note

Rules that show (Agent Only) apply to SCA Agent-based Scan, and don't apply to SCA Upload and Scan. Some rules only apply to SCA Upload and Scan.

Component Blocklist Enforcement

This rule requires that applications don't contain any components from your organization's blocklist.

To manually add components found from SCA Upload and Scan to a blocklist, see Add components to a blocklist. The list of blocklisted components appears after you add this rule.

Supported scan types: SCA Upload and Scan only

Component Licenses

This rule disallows components (libraries) with specific license risk ratings (High, Medium, Low, Non-OSS, or Unrecognized). SCA agent scans create License issues for components that violate this rule.

In the Veracode Platform, in the Add New Rule dialog, for Requirement, select the license risk ratings that aren't allowed.

Supported scan types: SCA Agent-based Scan and SCA Upload and Scan

Advanced options

• Component Dependency (Agent Only)
  • Any: apply this rule to licenses associated with any library, regardless of the dependency type (direct or transitive).
  • Direct: apply this rule only to licenses associated with direct dependency libraries. This is the default.
  • Transitive: apply this rule only to licenses associated with transitive dependency libraries.
• Build Action (Agent Only)
  • Warning: for violations of this rule, return exit code 0, which allows the build to continue. This is the default.
  • Error: for violations of this rule, return a non-zero exit code that you can include in a CI build script to break a build. To determine the exit code for a scan after it completes, run echo $?. If the results return an exit code greater than 0, one or more licenses have violated this rule. The exit code reflects the highest-severity finding that violated the rule.
• Override Severity (Agent Only)
  • No: when creating License issues, apply the risk rating of the scanned license as the severity for the corresponding issue (the risk levels will match). This is the default.
  • Yes: when creating License issues, apply the selected severity (Very High, High, Medium, or Low risk) to each issue.
• Non-OSS Licenses
  • Allowed: ignore findings for components with licenses that aren't open source (OSS), such as commercial licenses. This is the default.
  • Not Allowed: flag components with non-OSS licenses as a violation.
• Unrecognized Licenses
  • Allowed: ignore findings for components with licenses that we can't identify. This is the default.
  • Not Allowed: flag components with licenses we can't identify as a violation.
• Components with Multiple Licenses
  • All licenses must meet requirements: flag components that use more than one license and at least one of the licenses violates the requirements in this rule. This is the default.
  • One or more licenses must meet requirements: components that use more than one license pass this rule if at least one of the licenses complies with the requirements in this rule.
• Licenses by Name
  • Blocklist: ignore additional licenses. In the Licenses table, select the checkbox next to each license to ignore. If the licenses aren't allowed based on the risk level selected in the Requirement dropdown, you don't need to select them. This is the default.
  • Allowlist: allow licenses that are disallowed based on the risk level selected in the Requirement dropdown. In the Licenses table, select the checkbox next to each license to grant an exception from the selected risk level.

Component Versions (Agent Only)

This rule creates Library issues for outdated libraries (components) in your projects.

In the Veracode Platform, in the Add New Rule dialog, for Requirement, select Outdated Version. You can use the advanced options to configure build actions or override the severity of findings for specific component dependencies.

Supported scan types: SCA Agent-based Scan only

Advanced options

• Component Dependency (Agent Only)
  • Any: apply this rule to components associated with any library, regardless of the dependency type (direct or transitive).
  • Direct: apply this rule only to components associated with direct dependency libraries. This is the default.
  • Transitive: apply this rule only to components associated with transitive dependency libraries.
• Build Action (Agent Only)
  • Warning: for violations of this rule, return exit code 0, which allows the build to continue. This is the default.
  • Error: for violations of this rule, return a non-zero exit code that you can include in a CI build script to break a build. To determine the exit code for a scan after it completes, run echo $?. If the results return an exit code greater than 0, one or more components have violated this rule. The exit code reflects the highest-severity finding that violated the rule.
• Override Severity (Agent Only): when creating Library issues for outdated libraries, apply the selected severity (Very High, High, Medium, or Low) to each issue. The default is Low.

Vulnerability CVSS Score

This rule restricts vulnerabilities that meet or exceed the specified CVSS v3 score.

In the Veracode Platform, in the Add New Rule dialog, for Requirement, enter a score between 0.0 and 10.0.

note

If you add this rule to a policy that includes the Findings by Severity rule for SCA findings, these rules might conflict. In the Findings by Severity rule, we recommend clearing the Software Composition Analysis checkbox.

Supported scan types: Container scan, SCA Upload and Scan

Vulnerability Severity (Agent Only)

This rule disallows vulnerabilities based on their severity rating and creates Vulnerability issues for vulnerabilities that violate this rule.

In the Veracode Platform, in the Add New Rule dialog, for Requirement, select the severity rating to disallow. You can use the advanced options to filter by vulnerable methods, component dependency, and whether a fix is available.

note

You must create a separate Vulnerability Severity rule for each set of unique inputs. The inputs are Severity, Vulnerable Method, Fix Available, and Dependency Type. The outputs of the created issues are Build Action, Create Issue (applies automatically and isn't configurable), and Override Severity.

Supported scan types: SCA Agent-based Scan only

Advanced options

• Vulnerable Methods (Agent Only)
  • Any: apply this rule to any vulnerability, regardless of whether we detect vulnerable methods. This is the default.
  • Yes: apply this rule only to vulnerabilities for which we detect vulnerable methods.
  • No: apply this rule only to vulnerabilities for which we don't detect vulnerable methods.
• Component Dependency (Agent Only)
  • Any: apply this rule to vulnerabilities associated with any library, regardless of the dependency type (direct or transitive). This is the default.
  • Direct: apply this rule only to vulnerabilities associated with direct dependency libraries.
  • Transitive: apply this rule only to vulnerabilities associated with transitive dependency libraries.
• Fix Available (Agent Only)
  • Any: flag any vulnerabilities, regardless of whether a fix is available. This is the default.
  • Yes: flag only vulnerabilities where a fix is available.
  • No: flag only vulnerabilities where a fix isn't available.
• Build Action (Agent Only)
  • Warning: for violations of this rule, return exit code 0, which allows the build to continue. This is the default.
  • Error: for violations of this rule, return a non-zero exit code that you can include in a CI build script to break a build. To determine the exit code for a scan after it completes, run echo $?. If the results return an exit code greater than 0, one or more vulnerabilities have violated this rule. The exit code reflects the CVSS score of the highest-severity finding that violated the rule.
• Override Severity (Agent Only)
  • No: when creating Vulnerability issues, apply the severity of the vulnerability to the corresponding issue (the severities will match). This is the default.
  • Yes: when creating Vulnerability issues, apply the selected severity (Very High, High, Medium, or Low risk) to each issue.