Of course, I don't have access to where the analyzer precompiled the JSP files so I cannot provide the source, and when I use locally built ones, the line numbers do not make sense I'm expecting because the static analyzer doesn't use the same precompiler version or settings as we do locally. In case it's useful, the scan engine version listed against that scan I mentioned in my previosu response was Veracode wants the source JSP file as we do the compilation on our side when it is upload to the platform.
For Java class files, we based the line numbers on the debug information provided to us. For languages where you provide us the source, we can show that source file in Triage Flaws if it is within 30 days or so from when the scan is completed.
Maybe the details of how JSP compilation work are not clear. I'll try to explain in hopes that it becomes more clear. This is done based on settings in the web. Both the. Here's a listing from a local Tomcat instance for our application:. Then, from there, the static analyzer performs its usual analysis of the Java. Moreover, the Veracode static analyzer as documented uses a fixed version of Java 1.
However, since the static analyzer has those files as part of the analysis process, the "triage flaws" UI could pull those files from the Veracode server as it does for the JSP files to make things easier for people.
The Compilation Guide does not properly address this aspect of the problem. The section entitled "JSP Files" discussed how it's compiled and that it explicitly does not use anything precompiled from the WAR file , and what it doesn't do, but doesn't address the issue of the source generated during the compilation process, or how to recreate that source in a precise way. I believe this is an issue that needs to be taken to the development team as it's not something that as far as I can tell is currently documented or supported.
Asked ago. Active 3 hr before. Viewed times. If you are using glassfish server, find the generated sources under. Can someone try to explain to me the why Javascript array. How JavaScript compiling sequence works in this code? Combining 2 complex Javascript functions Error no Jest: This usually means that you are trying to import a file which Jest cannot parse, e.
Map two arrays and compare in Javascript React How to compare an array with another element with javascript vanilla [closed]. Related Questions. How can I call scikit-learn classifiers from Java? Tag plug-ins are registered via a tagPlugins. The second extension point is the Expression Language interpreter.
Alternative interpreters may be configured through the ServletContext. Notice: This comments section collects your suggestions on improving documentation for Apache Tomcat. If you have trouble and need help, read Find Help page and ask your question on the tomcat-users mailing list.
Do not ask such questions here. The Apache Comments System is explained here. This significantly boosts the performance of JSP pages which use custom tags. The previously compiled JSP page will still be available to serve requests. Once the new page has been compiled successfully it will replace the old page.
This helps improve availability of your JSP pages on a production server. This compiler loads source dependencies from the container classloader. Ant and javac can still be used.
Jasper is implemented using the servlet class org. Default 0 seconds. This parameter only has an effect if the ServletContext attribute org. This attribute is always set when Jasper is used within Tomcat. By default the classpath is created dynamically based on the current web application. The valid values for this are the same as for the compiler attribute of Ant's javac task.
There is no default value.
0コメント