Translation and analysis phase properties
The properties for the fortify-sca.properties file in the following table are general properties that apply to the translation and/or analysis (scan) phase.
| Property name | Description |
|---|---|
| Translation and scan | |
|
|
Specifies the build ID of the build. Value type: String Default: (none) Command-line option: |
|
|
Specifies the encoding of the command-line options file provided with Note: This property is only valid in the Value type: String Default: JVM system default encoding Example: |
|
|
Specifies a colon-separated list of languages to exclude from the translation phase. The valid language values are Value type: String Default: (none) Command-line option: |
|
|
Specifies a colon-separated list of languages to translate. The valid language values are Value type: String Default: All languages in the specified source are translated unless explicitly excluded with the Command-line option: |
com.fortify.sca.
|
If set to true, OpenText SAST includes build script files that have the same name as a build tool (such as gradlew) during translation as source files. Value type: Boolean Default: Command-line option: |
|
|
Specifies the directory to store intermediate files generated in the translation and analysis phases. OpenText SAST makes extensive use of intermediate files located in this project root directory. In some cases, you achieve better performance for analysis by making sure this directory is on local storage rather than on a network drive. Value type: String (path) Default (Windows): Note: Default (non-Windows): Command-line option: Example: |
| Translation | |
|
Note: This is a partial list. For the complete list, see the properties file. |
Specifies how to translate specific file name extensions of languages that do not require build integration. The valid extension types are Value type: String (valid language type) Default: See the Examples:
You can also specify a value of Example:
|
|
Note: This is a partial list. For the complete list, |
Specifies custom-named compilers. Value type: String (compiler) Default: See the Compilers section in the Example: To tell OpenText SAST that “my-gcc” is a gcc compiler:
Notes:
|
com.fortify.sca.
|
If set to true, OpenText SAST includes Value type: Boolean Default: |
|
|
Specifies one or more files to exclude from translation. Separate multiple files with semicolons (Windows) or colons (non-Windows). See Specifying files and directories for more information on how to use file specifiers. Value type: String Default: Not enabled Command-line option: Example: |
|
|
Specifies the source file encoding type. OpenText SAST allows you to scan a project that contains differently encoded source files. To work with a multi-encoded project, you must specify the Typically, if you do not specify the encoding type, OpenText SAST uses Value type: String Default: (none) Command-line option: Example:
|
|
|
On Windows platforms, specifies the path to the Value type: String (path) Default: Example:
|
|
|
Specifies whether the xcodebuild touchless adapter continues translation if the xcodebuild subprocess exited with a non-zero exit code. If set to false, translation stops after encountering a non-zero xcodebuild exit code and the OpenText SAST touchless build halts with the same exit code. If set to true, the OpenText SAST touchless build executes translation of the build file identified prior to the xcodebuild exit, and OpenText SAST exits with an exit code of zero (unless some other error also occurs). Regardless of this setting, if xcodebuild exits with a non-zero code, then the xcodebuild exit code, stdout, and stderr are written to the log file. Value type: Boolean Default: |
| Scan | |
|
|
If set to true, OpenText SAST generates implied methods when it encounters implementation by inheritance. Value type: Boolean Default: |
|
|
If set to true, enables alias analysis. Value type: Boolean Default: |
|
|
Specifies whether to enable Control Flow Analyzer timeouts. Value type: Boolean Default: |
|
|
Specifies a subset of source files to scan. Only the source files that were linked in the named binary at build time are included in the scan. Value type: String (path) Default: (none) Command-line option: |
|
|
Specifies a comma- or colon-separated list of the types of analysis to perform. The valid values for this property are Value type: String Default: This property is commented out and all analysis types are used in scans. Command-line option: |
|
|
If set to true, disables function pointers during the scan. Value type: Boolean Default: |
|
|
Specifies a comma- or colon-separated list of analyzers to use for a scan in addition to the default analyzers. The valid values for this property are Value type: String Default: (none) |
com.fortify.sca.
|
Extends the default exit code options. See Exit codes for a description of the exit codes and the valid values for this property. |
com.fortify.sca.
|
Specifies the path to a filter file for the scan. See Excluding issues with filter files for more information. Value type: String (path) Default: (none) Command-line option: |
|
|
Specifies a comma-separated list of IIDs to be filtered out using a filter file. Value type: String Default: (none) Example:
|
|
|
Specifies a comma- or colon-separated list of languages for which to remove rules. The valid language values are Value type: String Default: (none) Example: |
|
|
Specifies the length of a taint path between input and output parameters in a function call. Value type: Integer Default: |
|
|
Specifies whether OpenText SAST runs in parallel analysis mode. Value type: Boolean Default: |
com.fortify.sca.
|
Specifies a comma-separated list of languages for which to run higher-order analysis. Higher-order analysis improves the ability to track dataflow through higher-order code, which is commonly used in modern
dynamic languages. Valid values are Value type: String Default: |
|
|
Specifies the total time (in seconds) for higher-order analysis. When the analyzer reaches the hard timeout limit, it exits immediately. OpenText recommends this timeout limit in case some issue causes the analysis to run too long. OpenText recommends that you set the hard timeout to about 50% longer than the soft timeout, so that either the fixpoint pass limiter or the soft timeout occurs first. Value type: Number Default: |
|
|
Specifies the scan precision. Scans with a lower precision level are performed faster. The valid values are Value type: Number Default: (none) Command-line option: |
|
|
Specifies the issue template file to use for the scan. This only affects scans on the local machine. If you upload the FPR to Fortify Software Security Center, it uses the issue template assigned to the application version. Value type: String Default: (none) Command-line option: Example:
|
|
|
If set to true, OpenText SAST performs a quick scan. OpenText SAST uses the settings from Value type: Boolean Default: (not enabled) Command-line option: |
|
|
Specifies the scan policy for prioritizing reported vulnerabilities (see Applying a scan policy to the analysis). The valid scan policy values are Value type: String Default: Command-line option: |
|
|
Specifies the number of threads for parallel analysis mode. Add this property only if you need to reduce the number of threads used because of a resource constraint. If you experience an increase in scan time or problems with your scan, a reduction in the number of threads used might solve the problem. Value type: Integer Default: (number of available processor cores) |
|
|
The amount of time (in seconds) that type inference can spend to analyze a single function. Unlimited if set to zero or is not specified. Value type: Long Default: |
|
|
Comma- or colon-separated list of languages that use type inference. This setting improves the precision of the analysis for dynamically-typed languages. Value type: String Default: |
|
|
Specifies the total amount of time (in seconds) that type inference can spend in phase 0 (the interprocedural analysis). Unlimited if set to zero or is not specified. Value type: Long Default: |
com.fortify.sca.
|
Specifies a colon-separated list of functions to hide from all analyzers. Value type: String Default: |