How SCA counts Lines Of Codes ?

[gp1988]

Is there an article it is possible to study how Fortify counts the number of Lines of Code ? I am doing an integration between Fortify and Sonarqube and Fortify LOCs is different than Sonar LOCs.

Thanks in advance,

Best Regards

[mlacasse · Accepted solution]

Hi,

Total LOC is counted by third party step counter tool, and Executable LOC is counted by SCA itself. SCA only count executable code and it doesn't contains the following code elements.

- blank line
- comment
- brace {}
- import statement
- annotation
- #define, #include
- HTML
- data definition langauge directive

Thank you

Mark LaCasse
Fortify Customer Support
Micro Focus

[gp1988]

Thanks very much!

Could you tell me if SCA analyzes also comments even if it does not include them in Executable LOCs? For example information disclosure in client-side Javascript comments could give information about database structures, or passwords. 

Thanks again! 

[mlacasse]

Yes, SCA will be analyzing the comments for key information like passwords and will flag this. 

Thank you

Mark LaCasse
Fortify Customer Support
Micro Focus