Packaging Instructions for JavaScript and TypeScript

Compilation Guide

Supported JavaScript Libraries and Technologies

Veracode supports analyzing many client- and server-side JavaScript and TypeScript applications, including those that use HTML5 APIs, ECMAScript 2015, ECMAScript 2016, ECMAScript 2017, ECMAScript 2018, and JSX. Veracode also supports the following technologies:

Framework Supported Versions
Angular 0-1.x, 2.x, 4.x–8.x
Backbone.js 1.3.3 and earlier
Bootstrap 1–4
Cheerio.js 0.2–0.20
Ember.js 1.x, 2.x
Express 0–4.17.1
jQuery All
Koa.js 0.x–2.3.0
Node.js 12.12.x and earlier
React.js 0.13–16.x.x, react-router versions 2–4
SAPUI5/OpenUI5 1.x
Underscore.js 1.8.3 and earlier
Vue.js 1-2.x, vue-router versions 1–3.x

Template Engines

Name Supported Versions
Angular templates All
Handlebars.js 1–4.x
Hogan.js 0–3.x
Mustache.js 0.6–2.2.x
Swig 1.x

Unsupported JavaScript Technologies

The Veracode Platform does not support the analysis of CoffeeScript or Dart applications.

Packaging Guidance for JavaScript and TypeScript

Veracode extracts client-side JavaScript from JSP files that are uploaded as part of a JAR, WAR, or EAR file, and creates a separate JavaScript module that is selectable for analysis.

Upload a ZIP file containing JavaScript source code, or files that contain JavaScript. Veracode only extracts JavaScript from files with the following extensions:
  • ASP
  • CSS
  • ES
  • ES6
  • HBS
  • HJS
  • HTM
  • HTML
  • JS
  • JSX
  • JSON
  • JSP
  • MAP
  • PHP
  • TS
  • TSX
  • VUE
Note: If a packaged web application includes files that contain JavaScript and those included files have one of the file extensions in the previous list, Veracode extracts the JavaScript and scans it.

When analyzing Node.JS applications, if you want to analyze components within the node_modules folder, include it in the uploaded source. Files within the node_modules folder appear as selectable modules only if they are not listed as part of the dependencies or devDependencies sections of either the package.json or package-lock.json files.

Note: Excluding the node_modules folder from an upload may affect your SCA results.

When you submit .NET applications that use TypeScript for analysis, package the TypeScript source files separately from the .NET application. For best results, do not precompile TypeScript applications into JavaScript. Submit only the TypeScript source files.

If your JavaScript build or packaging process produces source map files that include the original source, submit the MAP files with the other files in your application, which Veracode can use to provide greater accuracy when analyzing the application.

Veracode requires that you submit JavaScript as source code in a format readable by developers. Build steps that minify, obfuscate, bundle, or otherwise compress JavaScript significantly affect the quality of analysis results.

Software Composition Analysis for JavaScript

If you want to identify vulnerabilities in your third-party components, Software Composition Analysis is available for JavaScript. Before you submit your application for analysis, verify you have packaged your application according to the following instructions:
  • Verify that the package includes the package-lock.json, bower.json, or yarn.lock file, depending on whether you use the NPM, Bower, or Yarn package manager, respectively.
  • For NPM, if the package-lock.json file is not present, include the node_modules folder in the package.
  • For Bower, if the bower.json file is not present, include the bower_components folder in the package.