Powered By Blogger

Sunday, September 14, 2014

SAP ABAP static code analysis using Fortify SCA

Description: ABAP is one of the many application-specific fourth-generation languages. It was originally the report language for SAP R/2, a platform that enabled large corporations to build mainframe business applications for materials management and financial and management accounting.

Our Problem: Whether Fortify supports ABAP?
Yes, Fortify Supports ABAP.
How we can achive and create Fortify Reports?
get .abap files to be scanned. If you are getting txt files, then change the extension to .abap.
Now apply below commandlines to generate frp.


"C:\Program Files\HP_Fortify\HP_Fortify_SCA_and_Apps_4.00\bin\sourceanalyzer.exe" -b abapSample -clean

"C:\Program Files\HP_Fortify\HP_Fortify_SCA_and_Apps_4.00\bin\sourceanalyzer.exe" -b abapSample myABAPfile.abap


"C:\Program Files\HP_Fortify\HP_Fortify_SCA_and_Apps_4.00\bin\sourceanalyzer.exe" -b abapSample -scan -f myABAPfile.fpr

From .frp file, you can generate Report as xml and  pdf files.

"C:\Program Files\HP_Fortify\HP_Fortify_SCA_and_Apps_4.00\bin\ReportGenerator.bat" -format xml -f "myABAPfile_Report.xml" -source  “myABAPfile.fpr"

"C:\Program Files\HP_Fortify\HP_Fortify_SCA_and_Apps_4.00\bin\ReportGenerator.bat" -format pdf -f "myABAPfile_Security_Report.pdf" -source "myABAPfile.fpr"

"C:\Program Files\HP_Fortify\HP_Fortify_SCA_and_Apps_4.00\bin\ReportGenerator.bat" -format pdf -template "C:\Program Files\HP_Fortify\HP_Fortify_SCA_and_Apps_4.00\Core\config\reports\DeveloperWorkbook.xml" -f "myABAPfile_Developer_Workbook.pdf" -source "myABAPfile.fpr"

"C:\Program Files\HP_Fortify\HP_Fortify_SCA_and_Apps_4.00\bin\ReportGenerator.bat" -format pdf -template "C:\Program Files\HP_Fortify\HP_Fortify_SCA_and_Apps_4.00\Core\config\reports\ScanReport.xml" -f "myABAPfile_Scan_Summary.pdf" -source "myABAPfile.fpr"

No comments: