Translation and Analysis Phase Properties
The properties for the fortify-sca.properties file in the following table are general properties that apply to the translation and/or analysis (scan) phase.
| Property Name | Description |
|---|---|
| Translation and Scan | |
|
|
Specifies the build ID of the build. Value Type: String Default: (none) Command-Line Option: |
|
|
Specifies the encoding of the command-line options file provided with Note: This property is only valid in the Value Type: String Default: JVM system default encoding Example: |
|
|
Specifies a colon-separated list of languages to exclude from the translation phase. The valid language values are Value Type: String Default: (none) Command-Line Option: |
|
|
Specifies a colon-separated list of languages to translate. The valid language values are Value Type: String Default: All languages in the specified source are translated unless explicitly excluded with the Command-Line Option: |
|
|
Specifies the directory to store intermediate files generated in the translation and analysis phases. Fortify Static Code Analyzer makes extensive use of intermediate files located in this project root directory. In some cases, you achieve better performance for analysis by making sure this directory is on local storage rather than on a network drive. Value Type: String (path) Default (Windows): Note: Default (Non-Windows): Command-Line Option: Example: |
| Translation | |
|
Note: This is a partial list. For the complete list, see the properties file. |
Specifies how to translate specific file extensions for languages that do not require build integration. The valid file extension types are Value Type: String (valid language type) Default: See the Examples:
You can also specify a value of Example:
|
|
Note: This is a partial list. For the complete list, |
Specifies custom-named compilers. Value Type: String (compiler) Default: See the Compilers section in the Example: To tell Fortify Static Code Analyzer that “my-gcc” is a gcc compiler:
Notes:
|
com.fortify.sca.
|
If set to true, Fortify Static Code Analyzer includes Value Type: Boolean Default: |
|
|
Specifies one or more files to exclude from translation. Separate multiple files with semicolons (Windows) or colons (non-Windows). See Specifying Files and Directories for more information on how to use file specifiers. Note: Fortify Static Code Analyzer only uses this property during translation without build integration. When you integrate with most compilers or build tools, Fortify Static Code Analyzer translates all source files that the compiler or build tool processes even if they are specified with this property. However, the Fortify Static Code Analyzer xcodebuild and MSBuild integrations do support the Value Type: String Default: Not enabled Command-Line Option: Example: |
|
|
Specifies the source file encoding type. Fortify Static Code Analyzer allows you to scan a project that contains differently encoded source files. To work with a multi-encoded project, you must specify the Typically, if you do not specify the encoding type, Fortify Static Code Analyzer uses Value Type: String Default: (none) Command-Line Option: Example:
|
|
|
On Windows platforms, specifies the path to the Value Type: String (path) Default: Example:
|
|
|
Specifies whether the xcodebuild touchless adapter continues translation if the xcodebuild subprocess exited with a non-zero exit code. If set to false, translation stops after encountering a non-zero xcodebuild exit code and the Fortify Static Code Analyzer touchless build halts with the same exit code. If set to true, the Fortify Static Code Analyzer touchless build executes translation of the build file identified prior to the xcodebuild exit, and Fortify Static Code Analyzer exits with an exit code of zero (unless some other error also occurs). Regardless of this setting, if xcodebuild exits with a non-zero code, then the xcodebuild exit code, stdout, and stderr are written to the log file. Value Type: Boolean Default: |
| Scan | |
|
|
If set to true, Fortify Static Code Analyzer generates implied methods when it encounters implementation by inheritance. Value Type: Boolean Default: |
|
|
If set to true, enables alias analysis. Value Type: Boolean Default: |
|
|
Specifies whether to enable Control Flow Analyzer timeouts. Value Type: Boolean Default: |
|
|
Specifies a subset of source files to scan. Only the source files that were linked in the named binary at build time are included in the scan. Value Type: String (path) Default: (none) Command-Line Option: |
|
|
If set to true, Fortify Static Code Analyzer removes dead code issues, for example because the compiler generated dead code and it does not appear in the source code. Value Type: Boolean Default: |
|
|
Specifies a comma- or colon-separated list of the types of analysis to perform. The valid values for this property are Value Type: String Default: This property is commented out and all analysis types are used in scans. Command-Line Option: |
|
|
Dead code is code that can never be executed, such as code inside the body of an Value Type: Boolean Default: |
|
|
If set to true, disables function pointers during the scan. Value Type: Boolean Default: |
|
|
Specifies a comma- or colon-separated list of analyzers to use for a scan in addition to the default analyzers. The valid values for this property are Value Type: String Default: (none) |
com.fortify.sca.
|
Extends the default exit code options. See Exit Codes for a description of the exit codes and the valid values for this property. |
com.fortify.sca.
|
Specifies the path to a filter file for the scan. See Excluding Issues with Filter Files for more information. Value Type: String (path) Default: (none) Command-Line Option: |
|
|
Specifies a comma-separated list of IIDs to be filtered out using a filter file. Value Type: String Default: (none) Example:
|
com.fortify.sca.
|
If set to true, higher-order analysis is enabled. Value Type: Boolean Default: |
|
|
Specifies a comma- or colon-separated list of build IDs for libraries pre-scanned as separate modules to use in the project scan. Each build ID must denote an existing scanned library. Value Type: String (build IDs) Default: (none) Command-Line Option: Example: |
com.fortify.sca.
|
Specifies the cutoff level for severity suppression. Fortify Static Code Analyzer ignores any issues found with a lower severity value than the one specified for this property. Value Type: Number Default: |
|
|
Specifies the length of a taint path between input and output parameters in a function call. Value Type: Integer Default: |
|
|
Specifies whether Fortify Static Code Analyzer runs in parallel analysis mode. Value Type: Boolean Default: |
com.fortify.sca.
|
Specifies a comma-separated list of languages for which to run higher-order analysis. Valid values are Value Type: String Default: |
|
|
Specifies the total time (in seconds) for higher-order analysis. When the analyzer reaches the hard timeout limit, it exits immediately. Fortify recommends this timeout limit in case some issue causes the analysis to run too long. Fortify recommends that you set the hard timeout to about 50% longer than the soft timeout, so that either the fixpoint pass limiter or the soft timeout occurs first. Value Type: Number Default: |
|
|
Specifies the scan precision. Scans with a lower precision level are performed faster. The valid values are Value Type: Number Default: (none) Command-Line Option: |
|
|
Specifies the issue template file to use for the scan. This only affects scans on the local machine. If you upload the FPR to Fortify Software Security Center, it uses the issue template assigned to the application version. Value Type: String Default: (none) Command-Line Option: Example:
|
|
|
If set to true, Fortify Static Code Analyzer performs a quick scan. Fortify Static Code Analyzer uses the settings from Value Type: Boolean Default: (not enabled) Command-Line Option: |
|
|
Specifies the scan policy used to prioritize reported vulnerabilities. The valid scan policy values are Value Type: String Default: Command-Line Option: |
|
|
If set to true, Fortify Static Code Analyzer performs modular scan of this project, which enables use of this library's build ID with the This property is ignored if the Value Type: Boolean Default: false Command-Line Option: |
com.fortify.sca.
|
If set to true, Fortify Static Code Analyzer ignores low severity issues found in a scan. Value Type: Boolean Default: |
|
|
Specifies the number of threads for parallel analysis mode. Add this property only if you need to reduce the number of threads used because of a resource constraint. If you experience an increase in scan time or problems with your scan, a reduction in the number of threads used might solve the problem. Value type: Integer Default: (number of available processor cores) |
com.fortify.sca. |
The amount of time (in seconds) that type inference can spend to analyze a single function. Unlimited if set to zero or is not specified. Value Type: Long Default: |
|
|
Comma- or colon-separated list of languages that use type inference. This setting improves the precision of the analysis for dynamically-typed languages. Value Type: String Default: |
|
|
Specifies the total amount of time (in seconds) that type inference can spend in phase 0 (the interprocedural analysis). Unlimited if set to zero or is not specified. Value Type: Long Default: |
com.fortify.sca.
|
Specifies a colon-separated list of functions to hide from all analyzers. Value Type: String Default: |