how to integrate eclipse for security scan

Question

how to integrate eclipse for security scan - Please provide step by step

HansEnders · Answer

Install Eclipse 
 Run the install wizard for the Fortify SCA and Apps executable 
 Select the box next to "IDE - Eclipse", or "IDE - Visual Studio", or "IDE - IntelliJ", et al. 
 Complete the install wizard and allow it to check for updates. 
 Open Eclipse and note the new "Fortify menu". Use this menu to Analyze the project.

Eclipse can be an odd beast sometimes, so some implementations are not successful with the SCA Scan Wizard option. If you wish or need this, you can instead use the Add Software feature in Eclipse to point to the appropriate folder/archive in the installed Fortify SCA to add the analyzer to the Eclipse UI, as described above. 
 
 e.g. se Page 17 - Eclipse_Plugins_Guide_22.10.pdf - "Installing the Eclipse Complete Plugin from an Update Site"

However, be aware that running SCA scans from the IDE may offer you the worst performance for large code bases due to the overhead of your IDE and other OS features. It will be fine for small projects. Most advanced users will prefer to operate SCA from the CLI, which translates easily to running the same scans via a CI/CD pipeline, once you are familiar with the settings and usage. The included Scan Wizard GUI can be used to generate a CLI-based scan script (*.BAT or *.SH) and you can reverse-engineer that script to better learn how the CLI options are leveraged. 
 
 Refs: 
 https://www.microfocus.com/en-us/support/documentation 
 > https://www.microfocus.com/documentation/fortify-static-code/ 
 >> https://www.microfocus.com/documentation/fortify-static-code-analyzer-and-tools/2210/ 
 >>> https://www.microfocus.com/documentation/fortify-static-code-analyzer-and-tools/2210/Eclipse_Plugins_Help_22.1.0/index.htm

Menu

Fortify

how to integrate eclipse for security scan

Tags:

Top Replies

Resources