Packaging Instructions for Python

Compilation Guide

You can submit Python applications to Veracode for scanning.

See Supported Languages and Platforms for instructions for other platforms.

Required Files

The Veracode Platform requires all source files for the application, including HTML template files (Flask/Django).

Veracode can also analyze Jython applications that are submitted as source.

Supported Python Versions

Language Supported Versions
Python 2.x, 3.x

Supported Python Frameworks and Libraries

Framework/Library Supported Versions
AWS SDK for Python (Boto3) 1.x
Cryptography 0.6–1.x
Django 1.x, 2.x
Flask 0.x
httplib2 0.9.2 and earlier
Jinja Template Library 2.x
Requests 2.x
SQLAlchemy .9.x–1.0.x

Compilation and Packaging Guidance

Upload a compressed ZIP archive containing all Python and HTML code, maintaining the project structure, to the Veracode Platform. Do not include third-party packages. Do not upload individual Python source files.

The Veracode Platform scans only files with the following extensions:
  • PY
  • HTML
  • HTM

Packaging AWS Lambda Applications

Veracode requires you to submit applications built for AWS Lambda according to the AWS Lambda Deployment Package formats. For information, see https://docs.aws.amazon.com/ and search for AWS Lambda Deployment Package in Python.

Note: Veracode does not support the analysis of dependencies submitted as Lambda layers. To analyze Lambda components deployed in layers, submit them as standard deployment packages, or consider repackaging the function to include layer components as part of the lambda function package.

Identifying Lambda Function Handlers for Python

In Python, function handlers must have at least two positional (default) parameters. The function handlers may have additional parameters that must have initial values set, because AWS Lambda passes data only to the first two positional parameters.

To detect Lambda function handlers for Python, Veracode accepts the YAML and YML configuration files included as part of the uploaded package from the Serverless and AWS SAM frameworks. Veracode parses these configuration files to identify the function handlers defined in the uploaded artifact. Veracode uses these configuration files to identify the configuration of layers or other settings.

When a deployment package does not contain a YAML configuration file, Veracode applies the this heuristic to identify the candidate source files in which to look for function handlers in the deployment package:

  • If a directory called functions exists, Veracode recognizes every Python file in every subdirectory below functions as a candidate source file.
  • Veracode does not consider files in any directories one level below functions as candidate files.
      .
      └── functions
      ├── one
      │   ├── misc
      │   │   └── utils.py
      │   └── primero.py
      └── two
      ├── orangefunc.py
      └── utils.py 
     
  • The candidate files are:
    • functions/one/primero.py
    • functions/two/orangefunc.py
    • functions/two/utils.py
  • Every Python file in the top-level directory of the archive is a candidate source file.
      .
      ├── misc
      │   └── utils.py
      └── primero.py 
     
  • The only candidate file is primero.py.

After Veracode identifies a candidate file, functions with exactly two parameters or with more parameters where all additional parameters have initial values set are considered function handlers. Example candidate function handlers are:

  • def lambda_handler(event, context):
  • def different_func(evt, ctx, xyz=123):

This function cannot be a function handler:

  • def different_func(event):

Software Composition Analysis

If you have a Veracode Software Composition Analysis subscription, you can include third-party components in your static analysis submission to report on vulnerabilities in those components. To effectively scan third-party components, the submitted application must also meet the packaging requirements for SCA upload and scan.