You can submit Python applications to Veracode for scanning.
See Supported Languages and Platforms for instructions for other platforms.
The Veracode Platform requires all source files for the application, including HTML template files (Flask/Django).
Veracode can also analyze Jython applications that are submitted as source.
Supported Python Versions
Supported Python Frameworks and Libraries
|AWS SDK for Python (Boto3)||1.x|
|httplib2||0.9.2 and earlier|
|Jinja Template Library||2.x|
Compilation and Packaging Guidance
Upload a compressed ZIP archive containing all Python and HTML code, maintaining the project structure, to the Veracode Platform. Do not include third-party packages. Do not upload individual Python source files.
Packaging AWS Lambda Applications
Veracode requires you to submit applications built for AWS Lambda according to the AWS Lambda Deployment Package formats. For information, see https://docs.aws.amazon.com/ and search for AWS Lambda Deployment Package in Python.
Identifying Lambda Function Handlers for Python
In Python, function handlers must have at least two positional (default) parameters. The function handlers may have additional parameters that must have initial values set, because AWS Lambda passes data only to the first two positional parameters.
To detect Lambda function handlers for Python, Veracode accepts the YAML and YML configuration files included as part of the uploaded package from the Serverless and AWS SAM frameworks. Veracode parses these configuration files to identify the function handlers defined in the uploaded artifact. Veracode uses these configuration files to identify the configuration of layers or other settings.
When a deployment package does not contain a YAML configuration file, Veracode applies the this heuristic to identify the candidate source files in which to look for function handlers in the deployment package:
- If a directory called functions exists, Veracode recognizes every Python file in every subdirectory below functions as a candidate source file.
- Veracode does not consider files in any directories one level below functions
as candidate files.
. └── functions ├── one │ ├── misc │ │ └── utils.py │ └── primero.py └── two ├── orangefunc.py └── utils.py
- The candidate files are:
- Every Python file in the top-level directory of the archive is a candidate source
. ├── misc │ └── utils.py └── primero.py
- The only candidate file is primero.py.
After Veracode identifies a candidate file, functions with exactly two parameters or with more parameters where all additional parameters have initial values set are considered function handlers. Example candidate function handlers are:
- def lambda_handler(event, context):
- def different_func(evt, ctx, xyz=123):
This function cannot be a function handler:
- def different_func(event):
Software Composition Analysis
If you have a Veracode Software Composition Analysis subscription, you can include third-party components in your static analysis submission to report on vulnerabilities in those components. To effectively scan third-party components, the submitted application must also meet the packaging requirements for SCA upload and scan.