Micro Focus Fortify Static Code Analyzer User Guide, Which Are No Longer Published As of This Release
Total Page:16
File Type:pdf, Size:1020Kb
Micro Focus Fortify Static Code Analyzer Software Version: 20.1.2 User Guide Document Release Date: July 2020 Software Release Date: July 2020 User Guide Legal Notices Micro Focus The Lawn 22-30 Old Bath Road Newbury, Berkshire RG14 1QN UK https://www.microfocus.com Warranty The only warranties for products and services of Micro Focus and its affiliates and licensors (“Micro Focus”) are set forth in the express warranty statements accompanying such products and services. Nothing herein should be construed as constituting an additional warranty. Micro Focus shall not be liable for technical or editorial errors or omissions contained herein. The information contained herein is subject to change without notice. Restricted Rights Legend Confidential computer software. Except as specifically indicated otherwise, a valid license from Micro Focus is required for possession, use or copying. Consistent with FAR 12.211 and 12.212, Commercial Computer Software, Computer Software Documentation, and Technical Data for Commercial Items are licensed to the U.S. Government under vendor's standard commercial license. Copyright Notice © Copyright 2003 - 2020 Micro Focus or one of its affiliates Trademark Notices All trademarks, service marks, product names, and logos included in this document are the property of their respective owners. Documentation Updates The title page of this document contains the following identifying information: l Software Version number l Document Release Date, which changes each time the document is updated l Software Release Date, which indicates the release date of this version of the software This document was produced on July 14, 2020. To check for recent updates or to verify that you are using the most recent edition of a document, go to: https://www.microfocus.com/support-and-services/documentation Micro Focus Fortify Static Code Analyzer (20.1.2) Page 2 of 200 User Guide Contents Preface 11 Contacting Micro Focus Fortify Customer Support 11 For More Information 11 About the Documentation Set 11 Change Log 12 Chapter 1: Introduction 16 Fortify Static Code Analyzer 16 Fortify ScanCentral 17 Fortify Scan Wizard 17 Fortify Software Security Content 17 About the Analyzers 18 Related Documents 19 All Products 20 Micro Focus Fortify ScanCentral 20 Micro Focus Fortify Software Security Center 21 Micro Focus Fortify Static Code Analyzer 21 Chapter 2: Installing Fortify Static Code Analyzer 23 Fortify Static Code Analyzer Component Applications 23 About Downloading the Software 25 About Installing Fortify Static Code Analyzer and Applications 25 Installing Fortify Static Code Analyzer and Applications 26 Installing Fortify Static Code Analyzer and Applications Silently (Unattended) 27 Installing Fortify Static Code Analyzer and Applications in Text-Based Mode on Non-Windows Platforms 29 Manually Installing Fortify Security Content 30 About Upgrading Fortify Static Code Analyzer and Applications 30 Notes About Upgrading the Fortify Extension for Visual Studio 31 About Uninstalling Fortify Static Code Analyzer and Applications 31 Uninstalling Fortify Static Code Analyzer and Applications 31 Micro Focus Fortify Static Code Analyzer (20.1.2) Page 3 of 200 User Guide Uninstalling Fortify Static Code Analyzer and Applications Silently 32 Uninstalling Fortify Static Code Analyzer and Applications in Text-Based Mode on Non- Windows Platforms 32 Post-Installation Tasks 33 Running the Post-Install Tool 33 Migrating Properties Files 33 Specifying a Locale 33 Configuring for Security Content Updates 34 Configuring the Connection to Fortify Software Security Center 34 Removing Proxy Server Settings 35 Chapter 3: Analysis Process Overview 36 Analysis Process 36 Parallel Processing 37 Translation Phase 37 Mobile Build Sessions 38 Mobile Build Session Version Compatibility 38 Creating a Mobile Build Session 38 Importing a Mobile Build Session 38 Analysis Phase 39 Higher-Order Analysis 39 Modular Analysis 40 Modular Command-Line Examples 40 Translation and Analysis Phase Verification 41 Chapter 4: Translating Java Code 42 Java Command-Line Syntax 42 Java Command-Line Options 43 Java Command-Line Examples 45 Handling Resolution Warnings 45 Java Warnings 45 Using FindBugs 46 Translating Java EE Applications 47 Translating Java Files 47 Translating JSP Projects, Configuration Files, and Deployment Descriptors 47 Java EE Translation Warnings 47 Micro Focus Fortify Static Code Analyzer (20.1.2) Page 4 of 200 User Guide Translating Java Bytecode 48 Troubleshooting JSP Translation Issues 48 Chapter 5: Translating Kotlin Code 50 Kotlin Command-Line Syntax 50 Kotlin Command-Line Options 51 Kotlin Command-Line Examples 52 Kotlin and Java Translation Interoperability 52 Chapter 6: Translating .NET Code 53 About Translating .NET Code 53 .NET Command-Line Syntax 54 .NET Command-Line Options 54 Handling Translation Errors 55 .NET Translation Errors 55 ASP.NET Errors 55 Chapter 7: Translating C and C++ Code 56 C and C++ Code Translation Prerequisites 56 C and C++ Command-Line Syntax 56 Options for Code in Visual Studio Solution or MSBuild Project 57 Scanning Pre-processed C and C++ Code 57 Chapter 8: Translating JavaScript and TypeScript 58 Translating Pure JavaScript Projects 58 Excluding Dependencies 58 Excluding NPM Dependencies 59 Translating JavaScript Projects with HTML Files 59 Including External JavaScript or HTML in the Translation 60 Chapter 9: Translating Python Code 62 Python Translation Command-Line Syntax 62 Including Import Files 62 Micro Focus Fortify Static Code Analyzer (20.1.2) Page 5 of 200 User Guide Including Namespace Packages 63 Using the Django Framework with Python 63 Python Command-Line Options 63 Python Command-Line Examples 64 Chapter 10: Translating Code for Mobile Platforms 65 Translating Apple iOS Projects 65 iOS Project Translation Prerequisites 65 iOS Code Analysis Command-Line Syntax 66 Translating Android Projects 66 Android Project Translation Prerequisites 66 Android Code Analysis Command-Line Syntax 67 Filtering Issues Detected in Android Layout Files 67 Chapter 11: Translating Ruby Code 68 Ruby Command-Line Syntax 68 Ruby Command-Line Options 68 Adding Libraries 69 Adding Gem Paths 69 Chapter 12: Translating Go Code 70 Go Command-Line Options 70 Chapter 13: Translating Apex and Visualforce Code 71 Apex Translation Prerequisites 71 Apex and Visualforce Command-Line Syntax 71 Apex and Visualforce Command-Line Options 72 Downloading Customized Salesforce Database Structure Information 72 Chapter 14: Translating COBOL Code 74 Preparing COBOL Source Files for Translation 74 COBOL Command-Line Syntax 75 COBOL Command-Line Options 76 Micro Focus Fortify Static Code Analyzer (20.1.2) Page 6 of 200 User Guide Chapter 15: Translating Other Languages 77 Translating PHP Code 77 PHP Command-Line Options 77 Translating ABAP Code 78 INCLUDE Processing 79 Importing the Transport Request 79 Adding Fortify Static Code Analyzer to Your Favorites List 80 Running the Fortify ABAP Extractor 81 Uninstalling the Fortify ABAP Extractor 85 Translating Flex and ActionScript 85 Flex and ActionScript Command-Line Options 86 ActionScript Command-Line Examples 87 Handling Resolution Warnings 88 ActionScript Warnings 88 Translating ColdFusion Code 88 ColdFusion Command-Line Syntax 88 ColdFusion Command-Line Options 89 Translating SQL 89 PL/SQL Command-Line Example 89 T-SQL Command-Line Example 90 Translating Scala Code 90 Translating ASP/VBScript Virtual Roots 90 Classic ASP Command-Line Example 92 VBScript Command-Line Example 92 Chapter 16: Integrating into a Build 93 Build Integration 93 Make Example 94 Devenv Example 94 Modifying a Build Script to Invoke Fortify Static Code Analyzer 94 Touchless Build Integration 95 Ant Integration 95 Gradle Integration 96 Maven Integration 97 Installing and Updating the Fortify Maven Plugin 97 Micro Focus Fortify Static Code Analyzer (20.1.2) Page 7 of 200 User Guide Testing the Fortify Maven Plugin Installation 97 Using the Fortify Maven Plugin 98 MSBuild Integration 99 Using MSBuild Integration 100 Using the Touchless MSBuild Integration 100 Chapter 17: Command-Line Interface 103 Translation Options 103 Analysis Options 105 Output Options 108 Other Options 111 Directives 113 Specifying Files 114 Chapter 18: Command-Line Utilities 116 Fortify Static Code Analyzer Utilities 116 About Updating Security Content 117 Updating Security Content 118 fortifyupdate Command-Line Options 118 Working with FPR Files from the Command Line 119 Merging FPR Files 120 Displaying Analysis Results Information from an FPR File 121 Extracting a Source Archive from an FPR File 125 Allocating More Memory for FPRUtility 126 Generating Reports from the Command Line 126 Generating a BIRT Report 127 Generating a Legacy Report 129 Checking the Fortify Static Code Analyzer Scan Status 130 SCAState Utility Command-Line Options 130 Chapter 19: Improving Performance 133 Hardware Considerations 133 Sample Scans 135 Tuning Options 135 Micro Focus Fortify Static Code Analyzer (20.1.2) Page 8 of 200 User Guide Breaking Down Codebases 136 Quick Scan 137 Limiters 137 Using Quick Scan and Full Scan 138 Limiting Analyzers and Languages 138 Disabling Analyzers 138 Disabling Languages 139 Optimizing FPR Files 139 Filter Files 139 Excluding Issues from the FPR with Filter Sets 140 Excluding Source Code from the FPR 140 Reducing the FPR File Size 141 Opening Large FPR Files 142 Monitoring Long Running Scans 143 Using the SCAState Utility 144 Using JMX Tools 144 Using JConsole 144 Using Java VisualVM 144 Chapter 20: Troubleshooting 146 Exit Codes