Fortify for Groovy & Scala projects

[gsman1]

Does anyone know if/when Fortify will be able to scan Groovy and Scala projects?

[Score · Accepted solution]

Hi Geert, I can confirm both Groovy and Scala on the Fortify radar. Unfortunately I can't give you an idea of when support will be introduced.

If possible I'd recommend you drop an email to fortifytechsupport@hp.com expressing your interest. The support team will then be able to get your name added to the open enhancement requests and keep you posted on any progress.

[gsman1]

New in SCA 4.30:

"Higher Order Analyzer is provided as a technology preview. For languages other than Java, it enables SCA to perform analysis on higher order functions such as lambdas.

To enable languages for higher order analysis, add a comma-delimited list of languages to the fortify-sca.properties file. For example:

com.fortify.sca.Phase0HigherOrder.Languages=javascript,ruby,python

To enable type inference for languages that are enabled for higher order analysis, add a comma-delimited list of languages to the fortify-sca.properties file. For example:

com.fortify.sca.TypeInferenceLanguages=javascript,ruby,python"

Languages other than Java....? So this could be Scala, Groovy? Or languages that are already supported by SCA?

[Score]

Hi Geert, I'm afraid the Higher Order Analyser is only available for languages already supported by SCA. At present this is the 3 listed in the examples.

While this functionality may ultimately help us in introducing support for both Groovy and Scala in the future, there's nothing specific for either in v4.30. Apologies I don't have better news.

[Score]

Hi Geert, something you may be interested in trying. A few of our PS guys have had some success in scanning the compiled class files from Groovy and Scala since they're compiled into Java bytecode. Bytecode support is available in v4.30 and you can find instructions on enabling it on Page 21 of the .

Of course this isn't actually a supported technique as we don't yet support Groovy or Scala. As such I can't guarantee it will work, but it may give you at least some results until we're able to offer actual support.

[will.chatham@no1]

I have an interest in this too. Is dropping an email to Fortify Support to express our interest really necessary, or do they read this forum?

[gsman1]

That's a good idea! I think this forum is actively followed by HP people but not sure if the Fortify Support people do as well so I think it doesn't harm to send an email

[will.chatham@no1]

Will do.

We should get them involved, since this is a Fortify forum

[will.chatham@no1]

That didn't work for me, unfortunately.

[Score]

Hey guys, Fortify Support is on here... in fact I'm a member of the Support team myself However it's still always useful to drop an email to fortifytechsupport@hp.com expressing your interest in any new features. That way a tracked support case is opened and either a new enhancement request will be filed which is visible to Product Management or, if one already exists (as they do for both Groovy and Scala), your name and case number will be added to it - throwing that extra bit of weight behind it when PM come to do their planning.

[will.chatham@no1]

FYI, I conversed with Fortify Support and had them add my name to the list of people requesting Groovy support. However, I was unable to get him to be forthcoming with a timeline for it.

[will.chatham@no1]

A new version of Fortify and no Groovy support. That's going to make life difficult for us here. Hopefully HP can provide a timeline for it now (?)