Veracode Fix for SAST
Veracode Fix for SAST is an intelligent remediation solution that helps your development teams reduce the time and effort they spend securing their applications. Developers can use Fix to get AI-generated code patches, review the suggested patches, and directly apply them to flaws in their application source, without writing any code.
Fix resolves findings found by Pipeline Scan, but doesn't resolve findings found by Upload and Scan.
How Veracode Fix for SAST helps developers
Veracode data shows that organizations are not keeping up with their security debt. Developers lack the training, experience, and tools to find and fix security findings in their code. A 2022 report by Techstrong Research showed that 73% of developers are expected to write secure code, but lack adequate tools and knowledge.
The amount of time it takes for developers to remediate only half of their open findings in a given codebase continues to grow. Typically, developers must update codebases that have several security findings, and they are responsible for the overall security of any applications they build with these codebases. Their organization might also hold them accountable for addressing the security debt of their applications. Developers must spend time finding, researching, and fixing flaws they might not have created in code they might not have written.
Fix for SAST provides contextual suggestions for each finding. Developers can review and apply each suggested fix to their code, reducing the time spent researching and fixing flaws across all codebases.
Video: Veracode Fix for SAST
How Veracode Fix for SAST works
Veracode Fix for SAST analyzes application source files alongside findings from a Static Analysis performed with Veracode Pipeline Scan. It processes the results—including CWE IDs, flaw severities, and flaw locations—to generate secure code patches. These patches replace vulnerable code with secure code generated using remediation data from Veracode.
Fix uses a machine learning (ML) model to generate secure patches for complex codebases. When you request a fix, it applies a retrieval-augmented generation (RAG) technique to find a secure patch from Veracode remediation data.
To determine the best fixes, Fix analyzes key factors such as the CWE ID, the programming language, the risky function (or "sink"), and the surrounding code context. Each suggested code patch demonstrates secure coding practices for addressing a specific flaw in a specific location. Veracode routinely refines these patches using Static Analysis flaw data and real-world vulnerabilities to ensure accuracy and security.
Each time you run Fix, it does the following:
- Uploads a copy of your source files and Static Analysis results file,
results.json, from a Pipeline Scan to the Veracode Intelligent Remediation Engine. - Uses the ML model to compare the code in your source files against secure code samples from Veracode.
- Returns a list of flaws you can fix. Each flaw includes the Common Weakness Enumeration (CWE) ID, a brief description of the flaw, and the line of code where the flaw exists. If you use Fix in the Veracode CLI, the flaws appear as a numbered list of issues.
- Matches a patch from the secure code samples provided by Veracode to your code and suggests up to five fixes for the selected flaw. If no relevant fixes exist, Fix returns
No fixes found. - Applies the selected fix by rewriting the affected code.
- Discards the uploaded
results.jsonfile, ensuring that it is no longer accessible to Veracode.
After applying a fix for a routine injection flaw, such as CRLF injection, cross-site scripting (XSS), or SQL injection, Veracode recommends testing your code before committing it. For other flaw categories, additional steps might be required. For example, if Veracode recommends updating a hashing algorithm to a more secure version, such as migrating from MD5 to SHA, you must update all instances of hashed data. If the hashed data is part of an interface, update its definition and ensure all parties using it also update their implementations.
Account requirements
To use Fix for SAST, you must have one of the following accounts:
Access Veracode Fix for SAST
You can access Veracode Fix for SAST through the following tools:
- Fix in CLI: use the Veracode CLI to automate flaw remediation and generate patches for code vulnerabilities from the command line.
- Fix in IDE: use the Veracode IDE extension to identify and apply patches directly within your integrated development environment.
Supported integrations
Veracode Fix supports the following integrations:
- Veracode CLI to automate flaw remediation. See the quickstart.
- Supported IDEs to identify and apply fixes directly in your IDE.
- Veracode Fix GitHub action to automate fixes in your GitHub repositories.
Supported languages
- How Veracode Fix for SAST helps developers
- Video: Veracode Fix for SAST
- How Veracode Fix for SAST works
- Account requirements
- Access Veracode Fix for SAST
- Supported integrations
- Supported languages
- Supported CWEs
Supported CWEs
Veracode Fix for SAST suggests fixes for the following CWEs in each supported language. For a complete list of CWEs supported by each Veracode scan type, see Veracode and the CWE.
C#
| CWE ID | CWE name | Single fix support | Batch fix support |
|---|---|---|---|
| 73 | External Control of File Name or Path | Yes | No |
| 80 | Improper Neutralization of Script-Related HTML Tags in a Web Page | Yes | Yes |
| 89 | Improper Neutralization of Special Elements used in an SQL Command | Yes | Yes |
| 117 | Improper Output Neutralization for Logs | Yes | Yes |
| 209 | Information Exposure Through an Error Message | Yes | Yes |
| 316 | Cleartext Storage of Sensitive Information in Memory | Yes | Yes |
| 327 | Use of a Broken or Risky Cryptographic Algorithm | Yes | No |
| 331 | Insufficient Entropy | Yes | Yes |
| 352 | Cross-Site Request Forgery (CSRF) | Yes | Yes |
| 404 | Improper Resource Shutdown or Release | Yes | Yes |
| 601 | URL Redirection to Untrusted Site ('Open Redirect') | Yes | No |
| 611 | Improper Restriction of XML External Entity Reference | Yes | Yes |
COBOL
| CWE ID | CWE name | Single fix support | Batch fix support |
|---|---|---|---|
| 78 | Improper Neutralization of Special Elements used in an OS Command (OS Command Injection) | Yes | No |
| 209 | Information Exposure Through an Error Message | Yes | No |
| 248 | Uncaught Exception | Yes | No |
| 489 | Leftover Debug Code | Yes | No |
| 252 | Unchecked Return Value | Yes | No |
Go
| CWE ID | CWE name | Single fix support | Batch fix support |
|---|---|---|---|
| 73 | External Control of File Name or Path | Yes | Yes |
| 78 | Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') | Yes | Yes |
| 117 | Improper Output Neutralization for Logs | Yes | Yes |
Java
| CWE ID | CWE name | Single fix support | Batch fix support |
|---|---|---|---|
| 80 | Improper Neutralization of Script-Related HTML Tags in a Web Page | Yes | Yes |
| 89 | Improper Neutralization of Special Elements used in an SQL Command | Yes | Yes |
| 113 | Improper Neutralization of CRLF Sequences in HTTP Headers | Yes | Yes |
| 117 | Improper Output Neutralization for Logs | Yes | Yes |
| 159 | Improper Handling of Invalid Use of Special Elements | Yes | Yes |
| 209 | Generation of Error Message Containing Sensitive Information | Yes | Yes |
| 327 | Use of a Broken or Risky Cryptographic Algorithm | Yes | No |
| 331 | Insufficient Entropy | Yes | Yes |
| 404 | Improper Resource Shutdown or Release | Yes | Yes |
| 502 | Deserialization of Untrusted Data | Yes | No |
| 597 | Use of Wrong Operator in String Comparison | Yes | Yes |
| 601 | URL Redirection to Untrusted Site ('Open Redirect') | Yes | No |
| 611 | Improper Restriction of XML External Entity Reference | Yes | Yes |
JavaScript and TypeScript
| CWE ID | CWE name | Single fix support | Batch fix support |
|---|---|---|---|
| 73 | External Control of File Name or Path | Yes | No |
| 78 | Improper Neutralization of Special Elements used in an OS Command | Yes | No |
| 80 | Improper Neutralization of Script-Related HTML Tags in a Web Page | Yes | Yes |
| 89 | Improper Neutralization of Special Elements used in an SQL Command | Yes | Yes |
| 113 | Improper Neutralization of CRLF Sequences in HTTP Headers | Yes | Yes |
| 117 | Improper Output Neutralization for Logs | Yes | Yes |
| 209 | Generation of Error Message Containing Sensitive Information | Yes | Yes |
| 311 | Missing Encryption of Sensitive Data | Yes | No |
| 312 | Cleartext Storage of Sensitive Information | Yes | No |
| 327 | Use of a Broken or Risky Cryptographic Algorithm | Yes | No |
| 352 | Cross-Site Request Forgery (CSRF) | Yes | Yes |
| 601 | URL Redirection to Untrusted Site ('Open Redirect') | Yes | Yes |
| 611 | Improper Restriction of XML External Entity Reference | Yes | Yes |
| 614 | Sensitive Cookie in HTTPS Session Without 'Secure' Attribute | Yes | Yes |
Kotlin
| CWE ID | CWE name | Single fix support | Batch fix support |
|---|---|---|---|
| 80 | Improper Neutralization of Script-Related HTML Tags in a Web Page | Yes | Yes |
| 89 | Improper Neutralization of Special Elements used in an SQL Command | Yes | Yes |
| 113 | Improper Neutralization of CRLF Sequences in HTTP Headers | Yes | Yes |
| 117 | Improper Output Neutralization for Logs | Yes | Yes |
| 331 | Insufficient Entropy | Yes | Yes |
| 404 | Improper Resource Shutdown or Release | Yes | Yes |
PHP
| CWE ID | CWE name | Single fix support | Batch fix support |
|---|---|---|---|
| 73 | External Control of File Name or Path | Yes | No |
| 80 | Improper Neutralization of Script-Related HTML Tags in a Web Page | Yes | Yes |
| 89 | Improper Neutralization of Special Elements used in an SQL Command | Yes | Yes |
| 117 | Improper Output Neutralization for Logs | Yes | Yes |
Python
| CWE ID | CWE name | Single fix support | Batch fix support |
|---|---|---|---|
| 73 | External Control of File Name or Path | Yes | No |
| 78 | Improper Neutralization of Special Elements used in an OS Command | Yes | Yes |
| 80 | Improper Neutralization of Script-Related HTML Tags in a Web Page | Yes | Yes |
| 89 | Improper Neutralization of Special Elements used in an SQL Command | Yes | Yes |
| 295 | Improper Certificate Validation | Yes | Yes |
| 327 | Use of a Broken or Risky Cryptographic Algorithm | Yes | No |
| 331 | Insufficient Entropy | Yes | Yes |
| 601 | URL Redirection to Untrusted Site ('Open Redirect') | Yes | No |
| 757 | Selection of Less-Secure Algorithm During Negotiation ('Algorithm Downgrade') | Yes | Yes |
Ruby
| CWE ID | CWE name | Single fix support | Batch fix support |
|---|---|---|---|
| 73 | External Control of File Name or Path | Yes | Yes |
| 80 | Improper Neutralization of Script-Related HTML Tags in a Web Page | Yes | Yes |
| 89 | Improper Neutralization of Special Elements used in an SQL Command | Yes | Yes |
| 117 | Improper Output Neutralization for Logs | Yes | Yes |
| 601 | URL Redirection to Untrusted Site ('Open Redirect') | Yes | Yes |
Scala
| CWE ID | CWE name | Single fix support | Batch fix support |
|---|---|---|---|
| 78 | Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') | Yes | Yes |
| 80 | Improper Neutralization of Script-Related HTML Tags in a Web Page (HTML Injection) | Yes | Yes |
| 117 | Improper Output Neutralization for Logs | Yes | Yes |
| 611 | Improper Restriction of XML External Entity Reference | Yes | Yes |