Fortify on Oracle codebase -
fortify sca behaviour oracle codebase ( .sql , .trig , .pkg, .syn etc files) not expected :
observations : 1) reports 0 issues oracle codebase(s). 2) considers .sql files not other .pkg etc. though introducing com.fortify.sca.fileextensions.pkg = plsql in fortify-sca.properties dint help. still doesnt consider .pkg files. there other step required achieve this? 3) though introducing sql-injeciton code ( https://docs.oracle.com/cd/e38689_01/pt853pbr0/eng/pt/tpcd/task_preventingsqlinjection-0749b7.html ) testing purpose , dint help. doesnt catch problem well.
are these known issues ?
can please advise.
by default, files extension sql assumed t-sql rather pl/sql on windows platforms. if using windows , have pl/sql files sql extension, can configure sca treat them pl/sql rather explicitly specify each time run sourceanalyzer. change default behavior, set com.fortify.sca.fileextensions.sql property in fortify-sca.properties “tsql” or “plsql.”
Comments
Post a Comment