Fortify on Oracle codebase -


fortify sca behaviour oracle codebase ( .sql , .trig , .pkg, .syn etc files) not expected :

observations : 1) reports 0 issues oracle codebase(s). 2) considers .sql files not other .pkg etc. though introducing com.fortify.sca.fileextensions.pkg = plsql in fortify-sca.properties dint help. still doesnt consider .pkg files. there other step required achieve this? 3) though introducing sql-injeciton code ( https://docs.oracle.com/cd/e38689_01/pt853pbr0/eng/pt/tpcd/task_preventingsqlinjection-0749b7.html ) testing purpose , dint help. doesnt catch problem well.

are these known issues ?

can please advise.

by default, files extension sql assumed t-sql rather pl/sql on windows platforms. if using windows , have pl/sql files sql extension, can configure sca treat them pl/sql rather explicitly specify each time run sourceanalyzer. change default behavior, set com.fortify.sca.fileextensions.sql property in fortify-sca.properties “tsql” or “plsql.”


Comments

Popular posts from this blog

ruby on rails - RuntimeError: Circular dependency detected while autoloading constant - ActiveAdmin.register Role -

c++ - OpenMP unpredictable overhead -

javascript - Wordpress slider, not displayed 100% width -