I have an SCA scan setup for my project using the sca-maven-plugin that I created from the source code and installed in my local repository. My build is done using the TeamCity build agent on the server where Fortify is installed.
I have no problem running a scan and am happy to generate reports from the generated .fpr using ReportGenerator. Early reports showed that I had some vulnerabilities from PHP files that were mistakenly included in the project (which is a Java project). After deleting these files, why is Fortify still reporting vulnerabilities for these files, even if they no longer exist in my project?
I confirmed that the build agent is configured to clear all sources before checking the latter, and indeed, I can see on the server itself that these PHP files no longer exist, but reports and .fpr still report problems against them.
Are there any problems that are constantly being kept for tracking / trend that I also need to clear, or is there something else that I am missing?
An output from the assembly showing that the files are indeed missing, but are still included in the scope of analysis below:
[07:40:16][com.....myapp:web] [INFO] --- sca-maven-plugin:3.90:scan (default-cli) @ web ---
[07:40:16][com.....myapp:web] [INFO] Packaging -> war
[07:40:16][com.....myapp:web] [INFO] Top-Level Artifact ID -> web
[07:40:16][com.....myapp:web] [INFO] Build Label -> web-2.0.0-SNAPSHOT
[07:40:16][com.....myapp:web] [INFO] Build Version -> 2.0.0-SNAPSHOT
[07:40:16][com.....myapp:web] [INFO] Build Project Name -> web
[07:40:16][com.....myapp:web] [INFO] Build ID -> web-2.0.0-SNAPSHOT
[07:40:16][com.....myapp:web] [INFO] Results File -> C:\...\buildAgent\work\c649372994269e88/myapp.fpr
[07:40:16][com.....myapp:web] [INFO] Location of SCA Executable -> sourceanalyzer
[07:40:16][com.....myapp:web] [INFO] Scan Log -> C:\...\buildAgent\work\c649372994269e88\web\target/sca-scan.log
[07:40:16][com.....myapp:web] [INFO] FindBugs Results -> false
[07:40:16][com.....myapp:web] [INFO] Fail on Error -> false
[07:40:16][com.....myapp:web] [INFO] Upload to SSC -> false
[07:40:16][com.....myapp:web] [INFO] Issues will not be tracked and trended without uploading to SSC.
[07:40:16][com.....myapp:web] [INFO] *** !! Scanning aggregate project - web !! ***
[07:40:16][com.....myapp:web] [INFO] Created output dir C:\...\buildAgent\work\c649372994269e88\web\target
[07:40:16][com.....myapp:web] [INFO] cmd: "cmd.exe /X /C "sourceanalyzer -scan @C:\...\buildAgent\work\c649372994269e88\web\target/sca-scan-args.txt""
[07:40:19][com.....myapp:web] Fortify Static Code Analyzer 6.00.0096
[07:40:25][com.....myapp:web] [error]: File C:/.../buildAgent/work/c649372994269e88/web/target/myapp/WEB-INF/views/components/datatables/media/unit_testing/templates/dom_data_th.php not found
[07:40:25][com.....myapp:web] [error]: File C:/.../buildAgent/work/c649372994269e88/web/target/myapp/WEB-INF/views/components/datatables/media/unit_testing/controller.php not found
[07:40:25][com.....myapp:web] [error]: File C:/.../buildAgent/work/c649372994269e88/web/target/myapp/WEB-INF/views/components/datatables/media/unit_testing/performance/large.php not found
[07:40:25][com.....myapp:web] [error]: File C:/.../buildAgent/work/c649372994269e88/web/target/myapp/WEB-INF/views/components/datatables/media/unit_testing/templates/-complex_header.php not found
[07:40:25][com.....myapp:web] [error]: File C:/.../buildAgent/work/c649372994269e88/web/target/myapp/WEB-INF/views/components/datatables/media/unit_testing/templates/2512.php not found
[07:40:25][com.....myapp:web] [error]: File C:/.../buildAgent/work/c649372994269e88/web/target/myapp/WEB-INF/views/components/datatables/media/unit_testing/templates/6776.php not found
[07:40:25][com.....myapp:web] [error]: File C:/.../buildAgent/work/c649372994269e88/web/target/myapp/WEB-INF/views/components/datatables/media/unit_testing/templates/complex_header_2.php not found
[07:40:25][com.....myapp:web] [error]: File C:/.../buildAgent/work/c649372994269e88/web/target/myapp/WEB-INF/views/components/datatables/media/unit_testing/templates/deferred_table.php not found
[07:40:25][com.....myapp:web] [error]: File C:/.../buildAgent/work/c649372994269e88/web/target/myapp/WEB-INF/views/components/datatables/media/unit_testing/templates/dom_data.php not found
source
share