Can I run fortify on .jar files instead of .java?

Question

I need to check vulnerabilities (if any) in the third party libraries that are being used in my project using Fortify.

For a few third party libraries, I am not able to access their source files. I only have the shipped .jar files.

Is it possible to run Fortify on .jar files instead ? All I could find in most of the documentations was that Fortify can be run on .java files, something like this:

sourceanalyzer -b MyProject -cp "lib/.jar" "src/*/*.java"

Answer 1

You can force SCA to scan the class files using the following command:

sourceanalyzer -b MyProject -source "1.6" -cp "{source_path}/**/*.jar" -scan -f MyProject.fpr -Dcom.fortify.sca.fileextensions.class=BYTECODE -Dcom.fortify.sca.DefaultFileTypes=class "{source_path}/**/*.class"

If I remember correctly, you need to explode the JAR files containing the class files you want to scan into {source_path}.

The results will be less than spectacular compared to a Java source scan, but you should get some results.

Answer 2

You can do one better than LaJmOn's suggestion and actually crack open the jars automatically.

for example:

sourceanalyzer -b apple -source 1.6 -Dcom.fortify.sca.fileextensions.jar=ARCHIVE /System/Library/Frameworks/JavaVM.framework/Home/lib/ext/apple_provider.jar