Fortify SCA Exclude Multiple Files - fortify

With the sourceanalyzer, how can I provide multiple file/path exclusions during translation?
Following the example from: Fortify SCA exclude test folder\files
/src/main/xyz/pqr/Abc.java
/src/main/xyz/test/abc.xsd
/src/test/xyz/Xyz.java
I have tried adding multiple -exclude flags, as well as different delimiters, with no luck.

If you use the Scan Wizard and review the resultant .bat file, you can see how they are invoking sourceanalyzer. For your particular question, you can create an argument file like so:
-exclude "/src/main/xyz/pqr/Abc.java"
-exclude "/src/main/xyz/test/abc.xsd"
-exclude "/src/test/xyz/Xyz.java"
Name it something like Exclude.args and then invoke sourceanalyzer like so:
sourceanalyzer.exe -b MyBuild #Exclude.args

I was working from an Azure DevOps Pipeline using fortify Translate batchscript task. In this environment it worked to add multiple -exclude flags:
steps:
- task: BatchScript#1
displayName: 'Fortify Translate JavaScript'
inputs:
filename: '$(FORTIFYSCA)\sourceanalyzer.exe'
arguments: '-debug -verbose -b $(Build.ApplicationName) $(Build.SourcesDirectory)\**\*.js -exclude node_modules\**\* -exclude coverage\**\*'

I am using the VS 2015 addin for Fortify scan. I sorted out the files I want to skip. I created a new filter and saved the results in a separate folder apart from Critical, High, etc.
This way the selected files were avoided from the final result.

Related

GCOV: gcda files combination

Good afternoon,
I'd like to know if it could be possible to combine several gcda files without using the lcov -a tracefile1 -a tracefile2 -o output.html.
Actually this is my spec:
compile my code on local server
excute tests on remote server 1 and 2
{
then copy the generated gcda on server1 on the local compilation server and generate the info file thanks to lcov
then copy the generated gcda on server2 on the local compilation server and generate the info file thanks to lcov
then combine both info files
}
The info file generation is actually quite long and I'd like to know if there is a possibility to combine gcdas from servers 1 and 2 without creating the info file.
And generate the info file only for the resulting gcdas?
Gcov as of now does not have any functionality to merge coverage reports.
I have a setup similar to yours and I use lcov to merge the tracefiles(or .info files).You can write scripts that will transfer the .gcda files from remote servers back to your local machine to generate the coverage report. There are other tools available that can solve your problem like TestWellCTC++,Rapicover,etc but they are not open source.
Gcov as of now has functionality to merge coverage reports:
$ gcov-tool merge path1 path2
(by default results will be stored in merged_profile folder).
To add to another answer, gcov can also merge coverage data from multiple runs with the help of gcov-tool:
$ gcov-tool merge dir1 dir2
(by default results will be stored into merged_profile folder).
Unfortunately gcov-tool allows merging only two profiles at a time but you can use gcov-tool-many to work around this.

How to name local workspace using command line interfaces while checking out files from CVS repository by means of a tag

Right now i am using below mentioned cvs command line argument for checking out files from CVS repository.
# Module1_1_20_2017 is the tag name.
#Test/user_Test/work is the module name.
cvs checkout -r Module1_1_20_2017 Test/user_Test/workload
I want contents of this Test/user_Test/workload module to be checked out into a local workspace folder named as work which is located at C:\Jenkins\jobs\workspace\work.
But every time when i use the above command it creates empty directories after this C:\Jenkins\jobs\workspace\work local workspace as C:\Jenkins\jobs\workspace\work\Test\user_Test\workload.
I want to get rid of these entire folders Test\user_Test\workload and after checking out files from Test/user_Test/work this module the local workspace should look like C:\Jenkins\jobs\workspace\work (not C:\Jenkins\jobs\workspace\work\Test\user_Test\workload) and this local workspace C:\Jenkins\jobs\workspace\work should contain all the files of this Test/user_Test/workload module.
What cvs command line will satisfy this requirement?In short I want to create a local name as in jenkins job configuration shown in the picture attached below.
Use the form cvs checkout -d <path> <module>.
In your case that is cvs checkout -d work Test/user_Test/workload
(Did cvs checkout --help not give you this answer?)

How to exclude target folder from Fortify scans

I want to exclude all files that are underneath a target folder from translations and scans. I have tried to use the -exclude parameter but it doesn't seem to work.
[warning]: No files were excluded as the file patterns: [**/target/**/*] specified for -exclude option did not match any files.
HP Fortify Static Code Analyzer 6.42.0006 (using JVM 1.8.0_45)
Processing C:/path/ProjectName/target/test/test_fortify_exclusion2.jsp
Processing C:/path/ProjectName/target/test_fortify_exclusion.jsp
I have also tried **target** and **/target/**.
Turned out I needed to specify the root path, preferably the path to the project. So in this example, it would have been: -exclude "C:/path/ProjectName/**/target/**/*"

CVS checkout without all of extra folders

I want to checkout a specific folder from deep within a CVS module into my Hudson / Jenkins workspace. Stripping off the other options (such as pruning, branch, etc) the CVS command is ...
cvs checkout -d workspace module\a\b\c\d\e\f
This causes my folder to contain a child folder 'a' and that contains 'b' and that contains ... well you get the idea. All of them are empty until you get down to folder 'f'.
What I'd really like is for myfolder to contain the contents of f. Does CVS support this functionality (without defining f as a module)?
And for bonus karma ... Can I get Jenkins to use this option with a .cvsrc or some other mechanism?
I don't get the behaviour you describe. When I move to an empty directory and do
cvs checkout -d fox modules/a/quick/brown/fox
I just get a new directory called fox containing the contents of the directory I requested. (Note the forward slashes.)
However, if I do
cvs checkout modules/a/quick/brown/fox
then I get what you describe.
I'm using the latest FSF build of CVS on windows, http://ftp.gnu.org/non-gnu/cvs/binary/feature/x86-woe/cvs-1-12-13a.zip .
There is a file called "modules", under your CVSROOT folder.
You can edit it, and a line like the following:
###shortcut name actual path########
f /a/b/c/d/e/f
Check this file back in. Once it sets in, you can just use
cvs checkout -d workspace f
Also, in Hudson, you can (in the Modules(s) ) box, just put f, and it should directly download only f, instead of the entire structure.
Once that is down, you could rename it using a shell/command.
More in General:
Go up 1 level above where you checked out
cvs co -r "TAG"

Using ant to add directories to CVS

How do I add a new directory into my CVS repository using Ant? From all that I've read, it appears that I have to cd to the parent directory and call the cvs command. How do I do that in Ant? I've seen approaches where an to cd is called in Ant; is that the best approach?
Eg of what I am trying to do:
Let's say I have a module Test_Module with directories "A", "B" and "C". Under each of these directories, there are directories for "Jan", "June", "Sept" and I want to create a "Alpha" directory under Test_Module-> C -> Sept.
So, I create a "Alpha" directory on my local system and run the cvs add command from Root and I get the following errror:
cvs add: in directory .:
cvs [add aborted]: there is no version here; do 'cvs checkout' first
I get the same error when I run this using Ant or from command line.
Now, if I cd to the Test_Module/C/Sept directory and run "cvs add Alpha" it creates the directory and everything is fine. So, how do I do the same in Ant? Are there any ant-contrib tasks that are out there that I could possibly use or even a built-in ant task that I am missing?
Thanks in Advance!!
did you look at the Ant CVS task?
I haven't used CVS for a while but since it's possible to manage a Subversion repository with Ant, I guess there should be no problem to do it for CVS

Resources