Compilation Instructions for .NET Web Applications (ASP.NET)

Compilation Guide

See the master compilation guidelines for instructions for other platforms.

Required Files

To analyze ASP.NET applications, Veracode requires you to supply all the forms the application uses and all the dependencies in the compiled form, which are the .dll, .exe, and .pdb files. These analysis requirements are different from the deployment requirements because the ASP.NET server can compile these forms dynamically after deployment. If you do not submit precompiled forms, the scan can produce incomplete or incorrect results.

If the roslyn directory is present in your application, Veracode recommends you remove it.

You can prepare your ASP.NET application using the Veracode Visual Studio Extension or by using the command line and the ASP.NET compiler, using the instructions provided here. Alternatively, you can opt to precompile in Visual Studio where you use either the publish or deployment feature directly on the web projects. Veracode recommends that you use the Veracode Visual Studio Extension as it can work with both 32- and 64-bit architecture projects and can manage multiple web projects at the same time.

To prepare your .NET Application using the Visual Studio extension, use the instructions in the Integrating Veracode into Visual Studio page.

Preparing Your ASP.NET Application for Upload from the Command Line

Note: These instructions use a precompilation utility that is available in Microsoft .NET Framework 2.0 or later. To follow these instructions for an ASP.NET 1.1 application, you must perform the steps on a machine that has .NET 2.0 or later installed. If you do not submit precompiled forms, the scan can produce incomplete or incorrect results.

To prepare your application using the command line:

  1. Compile any supporting C# or VB.NET projects first according to the Veracode compilation instructions.
  2. You should precompile the web application using the ASP.NET compiler, and upload all resulting aspx.*.dll and aspx.*.pdb files along with any traditional DLL assemblies. When compiling the supporting DLLs, please follow the compilation instructions for C#. The following is a sample DOS command you can execute inside your project directory:
    • For the 32-bit version:
      c:\windows\microsoft.net\framework\v4.0.30319\aspnet_compiler.exe -fixednames -d -c -f -v <virtualpath> -p <physicalpath> <targetdir>
    • For the 64-bit version:
      c:\windows\microsoft.net\framework64\v4.0.30319\aspnet_compiler.exe -fixednames -d -c -f -v <virtualpath> -p <physicalpath> <targetdir>
    Note: For more information about aspnet_compiler, see MSDN.
  3. After precompiling the web application, zip the targetdir\bin directory as specified in the command line above and upload it to the Veracode Platform.

If you encounter any precompilation errors, check the precompilation troubleshooting page before you contact Veracode Support.

Precompiling ASP.NET Files with Visual Studio

You can use the native Microsoft Publish utility in Visual Studio to prepare binaries for a specific project in the Visual Studio solution. To precompile and deploy ASP.NET files for uploading to Veracode, you can use this procedure with Visual Studio 2005 and later.

For more information, read this procedure.

Automating the Precompilation of ASP.NET WebForms and MVC Views with MSBUILD

MSBuild scripts can automate the building of your Visual Studio solution and also interface with the Veracode Platform. You use the target folder built from the binaries to upload the .dll, .exe, and .pdb files to Veracode. You can resolve precompilation errors by looking up the errors in MSDN to prepare the application completely, including any MVC views if it is an MVC application.

For more information, read this procedure.

Frameworks

See the list of supported .NET frameworks.

Precompiling ASP.NET Core MVC Views with Visual Studio 2017

The Veracode Visual Studio Extension does not currently support .NET Core.

For more information about precompiling ASP.NET Core MVC views with Visual Studio 2017, read this procedure.