HP Fortify Static Code Analyzer Tools

Transcription

1 HP Fortify Static Code Analyzer Tools Software Version 4.30 Properties Reference Guide Document Release Date: April 2015 Software Release Date: April 2015

2 Legal Notices Warranty The only warranties for HP products and services are set forth in the express warranty statements accompanying such products and services. Nothing herein should be construed as constituting an additional warranty. HP shall not be liable for technical or editorial errors or omissions contained herein. The information contained herein is subject to change without notice. Restricted Rights Legend Confidential computer software. Valid license from HP required for possession, use or copying. Consistent with FAR and , Commercial Computer Software, Computer Software Documentation, and Technical Data for Commercial Items are licensed to the U.S. Government under vendor's standard commercial license. Copyright Notice Copyright 2015 Hewlett-Packard Development Company, L.P. Documentation Updates The title page of this document contains the following identifying information: Software Version number Document Release Date, which changes each time the document is updated Software Release Date, which indicates the release date of this version of the software To check for recent updates or to verify that you are using the most recent edition of a document, go to: You will receive updated or new editions if you subscribe to the appropriate product support service. Contact your HP sales representative for details. Part Number: 1-16b

3 Contents Preface iv Contacting HP Fortify Support iv For More Information iv About the HP Fortify Software Security Center Documentation Set iv Chapter 1: Properties Used in SCA Tools for Java Applications HP Fortify Properties (fortify.properties File) Server Properties (server.properties File) Chapter 2: Properties Used in SCA Tools for.net Applications HP Fortify Properties (fortify.properties File) IDE Properties (fortify-ide.properties file) TFS Configuration Contents iii

4 Preface Contacting HP Fortify Support If you have questions or comments about any part of this guide, contact HP Fortify using one of the following options. To Manage Your Support Cases, Acquire Licenses, and Manage Your Account To Support To Call Support For More Information For more information about HP Enterprise Security Products: About the HP Fortify Software Security Center Documentation Set The HP Fortify Software Security Center documentation set contains installation, user, and deployment guides for all HP Fortify Software Security Center products and components. In addition, you will find technical notes and release notes that describe new features, known issues, and last-minute updates. You can access the latest versions of these documents from the following HP ESP user community Protect724 website: You will need to register for an account. Preface iv

5 Chapter 1: Properties Used in SCA Tools for Java Applications This chapter describes the properties used in the following Static Code Analyzer tools: HP Fortify Audit Workbench HP Fortify Process Designer Custom Rules Editor Plugins for Eclipse, JDeveloper, and IntelliJ Properties are listed in alphabetical order in the following sections, based on the files in which they belong: HP Fortify Properties (fortify.properties File) on page 6 Server Properties (server.properties File) on page 23 Chapter 1: Properties Used in SCA Tools for Java Applications 5

6 HP Fortify Properties (fortify.properties File) Table 2 lists properties that belong in the fortify.properties file. Some of these properties already exist in the file, while you must add others. The colored boxes in the column indicate which SCA tools use the property. Table 1 lists the SCA tool acronyms used in Table 2. Table 1: Acronyms for SCA tools Acronym AWB ECP ERP CRE PD IRP IAP JRP SCA Tool Audit Workbench Eclipse Plugin (complete) Eclipse Remediation Plugin Custom Rules Editor Process Designer IntelliJ Remediation Plugin IntelliJ/Android Studio Analysis Plugin JDeveloper Remediation Extension Table 2: HP Fortify Properties com.fortify.scaexecutable Path Default: <Fortify Install Dir>/bin/sourceanalyzer.exe Specifies file path to sourceanalyzer.exe. Audit Workbench and the analysis IDE plugins (Eclipse, IntelliJ) use this property. SCA com.fortify.workingdirect ory Defaults: Windows: ${win32.localappdata}/fortify Unix: ${user.home}/.fortify Specifies the HP Fortify working directory to contain all user configuration and working files for all HP Fortify products. To configure this property, you must have write access to the directory. SCA Chapter 1: Properties Used in SCA Tools for Java Applications 6

7 com.fortify.audit.ui.disable AddingFolders If set to true, disables the add folder functionality in Audit Workbench and the HP Fortify Plugin for Eclipse. com.fortify.audit.ui.disable Bugtrackers If set to true, disables bugtracker integration in Audit Workbench and the HP Fortify Plugin for Eclipse. com.fortify.audit.ui.disable EditingCustomTags If set to true, removes the ability to edit custom tags from Audit Workbench and the HP Fortify Plugin for Eclipse. com.fortify.audit.ui.disable Suppress If set to true, removes the ability to suppress issues in Audit Workbench and the HP Fortify Plugin for Eclipse. com.fortify.authentication Key Default: ${com.fortify.workingdirectory}/config/tools Specifies the directory to contain the Software Security Center client authentication token. com.fortify.awb.debug If set to true, Audit Workbench runs in debug mode. Chapter 1: Properties Used in SCA Tools for Java Applications 7

8 com.fortify.awb.javaextens ions Specifies the file extensions (comma-delimited) for Audit Workbench or the HP Fortify Plugin for Eclipse to treat as Java files during scanning. If no value is specified, Audit Workbench and the Eclipse plugin recognize java, jsp, and jspx files as Java files. The property is used only to determine whether a project includes Java files and to add Java-specific controls to the Advanced Scan panel. com.fortify.awb.linuxfont Adjust Default: 0 Specifies the font size to use on Linux platforms. Audit Workbench adds the specified size to original font size. com.fortify.awb.macfonta djust Default: 2 Specifies size to tune font size for Mac platform. Audit Workbench adds the specified size to the original font size. com.fortify.awb.windowsf ontadjust Default: 0 Specifies size to tune font size for Windows platform. Audit Workbench adds the specified size to original font size. com.fortify.debug If set to true, runs all SCA tools in debug mode. Chapter 1: Properties Used in SCA Tools for Java Applications 8

9 com.fortify.disabledescript ionxmlescaping If set to true, disables XML escaping issue description (for example, changing " in xml/fvdl to "). com.fortify.disableexternal EntryCorrelation If set to true, parses URL in ExternalEntries/Entry in audit.fvdl. <ExternalEntries> <Entry name=" HTML Form" type="url"> <URL>/auth/PerformChangePass.action</URL> <SourceLocation path="pages/content/changepass.jsp" line="16" lineend="16" colstart="0" colend="0" snippet=" b944cec7a3d98775a499ae8fa#pages/content/ ChangePass.jsp:16:16"/> </Entry> </ExternalEntries> Chapter 1: Properties Used in SCA Tools for Java Applications 9

10 com.fortify.disableminvirt CallConfidenceComputatio n If set to true, disables computing minimum virtual call confidence. Static Code Analyzer supports the com.fortify.sca.rendering.enableminvirtualconfidence property. If com.fortify.sca.rendering.enableminvirtualconfidence is set to true, Static Code Analyzer adds the virtual call confidence on node of issues coming out of the dataflow analyzer as follows: <Node id="9"> <SourceLocation path="main.java" line="37" lineend="37" colstart="0" colend="0" contextid="3" snippet=" a2a14f412a93d3f017bc2bb4#main.java:37:37"/> <Action type="outcall">nextelement(return)</action> <Knowledge> <Fact primary="false" type="confidence">confidence: 0.58 (Virtual Call)</Fact> <Fact primary="false" type="call">virtual : ForInter.Pasta.Penne.nextElement</Fact> </Knowledge> </Node> Audit Workbench and the Eclipse plugins use this attribute to compute minimum virtual call confidence and enable issue filtering. For example, it can be used to filter out all issues that contain virtual call with confidence lower than com.fortify.disableremove dissuepersistance If set to true, disables removed issue persistence (clears removed issues from the results file). com.fortify.disablereportc ategoryrendering If set to true, disables rendering issue description into report. Chapter 1: Properties Used in SCA Tools for Java Applications 10

11 com.fortify.displayeventid If set to true, displays event id in tooltip of issue node in the issues panel of Audit Workbench and the Plugin for Eclipse. com.fortify.eclipse.debug If set to true, runs the Eclipse plugin in debug mode. com.fortify.installationuser Name Default: ${user.name} Specifies default user name for logging in to Software Security Center for the first time. Audit Workbench and all IDE plugins use this property. com.fortify.remediation.pa ginateissues If set to true or if no value is specified, the JDeveloper, IntelliJ, and Eclipse remediation plugins use pagination during issue download. If set to false, these plugins download all issues at once. com.fortify.remediation.pa ginationcount Default: 1000 If com.fortify.remediation.paginateissues is set to true, specifies page count. Chapter 1: Properties Used in SCA Tools for Java Applications 11

12 com.fortify.locale Default: en (English) Specifies Fortify locale (for rules and metadata only). Other possible values are: es (Spanish) ja (Japanese) ko (Korean) zh_cn (Simplified Chinese) zh_tw (Chinese, Traditional) com.fortify.model.checksig Default: true (normal) / false (minimum load) If set to true, verifies signature in FPR. If com.fortify.model.useissueparsefilters is set to true, then com.fortify.model.minimalload is set to true, com.fortify.model.issuecutoffstartindex is not null, com.fortify.model.issuecutoffendindex is not null, com.fortify.model.issuecutoffbycategorystartindex is not null or com.fortify.model.issuecutoffbycategoryendindex is not null, com.fortify.model.checksig is false, and the signature in FPRs are not verified. com.fortify.model.customd escriptionsheader Specifies custom prefix for the description header. It prepends your text to the Description/Recommendation header, so that you see MY Recommendations instead of Custom Recommendations. Note: To update description headers, HP Fortify recommends that you use <CustomDescriptionRule> with <Header> text instead. com.fortify.model.disablec hopbuildid If set to true, does not shorten the build ID, even if the build ID exceeds 250 characters. Chapter 1: Properties Used in SCA Tools for Java Applications 12

13 com.fortify.model.disablec ontextpool If set to true, disables loading of the ContextPool section of the audit.fvdl file. If null or false, loads the ContextPool section of the audit.fvd file. This property can be configured if com.fortify.model.minimalload is not set to true. If com.fortify.model.minimalload is set to true, then com.fortify.model.disablecontextpool is set to true automatically. com.fortify.model.disabled escription If set to true, disables loading the Description section from audit.fvdl. This property can be configured if com.fortify.model.minimalload is not set to true. If com.fortify.model.minimalload is true, then com.fortify.model.disabledescription is automatically set to true. com.fortify.model.disablee nginedata If set to true, disables loading the EngineData section of audit.fvdl to save memory while opening large FPR files. These data are displayed on the Analysis Information tab of Project Summary pane. The property can help if too many analysis warnings occur during a scan. However, HP Fortify recommends that you instead set a limit for com.fortify.model.maxengineerrorcount to open FPR files that have a large number of SCA warnings. com.fortify.model.disableh otspotfiltersets Determines whether to hide the default Hotspot and Data Validation filter sets in Audit Workbench and Eclipse plugin if the current project template does not contain these filter sets. Chapter 1: Properties Used in SCA Tools for Java Applications 13

14 com.fortify.model.disablep rograminfo This property can be configured if com.fortify.model.minimalload is not true. If com.fortify.model.minimalload is true, then this property is set to true automatically. If set to true, prevents the loading of metatable from the ProgramData section of FPR files. If set to false, loads metatable from the FPR file. com.fortify.model.disablep rogrampoint If set to true, disables loading of the ProgramPoint section from the runtime.fvdl file. com.fortify.model.disabler eplacementparsing If set to true, disables replacing conditional description. This property can be configured if com.fortify.model.minimalload is not true. If com.fortify.model.minimalload is true, then this property is set to true automatically. com.fortify.model.disables nippets If set to true, disables the loading of the Snippets section from the audit.fvdl file. If set to (none) or false, loads Snippets section from the audit.fvdl file. This property can be configured if com.fortify.model.minimalload is false. If com.fortify.model.minimalload is set to true, then com.fortify.model.disablesnippets is automatically set to true. Chapter 1: Properties Used in SCA Tools for Java Applications 14

15 com.fortify.model.disableu nifiedinductions If set to true, disables the loading of the UnifiedInductionPool section of the audit.fvdl file. If set to (none) or false, loads the UnifiedInductionPool section of the audit.fvdl file. This property can be configured if com.fortify.model.minimalload is not true. If com.fortify.model.minimalload is set to true, then com.fortify.model.disableunifiedinductions is set to true automatically. com.fortify.model.disableu nifiedpool If set to true, disables the loading of the UnifiedNodePool section from the audit.fvdl file. If set to (none) or false, loads the UnifiedNodePool section from the audit.fvdl file. This property can be configured if "com.fortify.model.minimalload" is not true. If com.fortify.model.minimalload is true, then com.fortify.model.disableunifiedpool is set to true automatically. If the value is not specified or false, this property is set to none. com.fortify.model.disableu nifiedtrace If set to true, disables the loading of the UnifiedTracePool section from the audit.fvdl file. If set to (none) or false, loads the UnifiedTracePool section from the audit.fvdl file. This property can be configured if com.fortify.model.minimalload is not true. If com.fortify.model.minimalload is true, then com.fortify.model.disableunifiedtrace is set to true automatically. If a value is not specified or is false, com.fortify.model.disableunifiedtrace is set to none. Chapter 1: Properties Used in SCA Tools for Java Applications 15

16 com.fortify.model.enablep athelementbaseindexshift If set to true, enables backward compatibility with pre-2.5 migrated projects. com.fortify.model.enableso urcecorrelation If set to true, takes dataflow source into consideration for issue correlation. The default is false since correlations with runtime results may be not reliable with this setting turned on. com.fortify.model.execme morysetting Default: iidmigrator and RuntimeBridge fortifyupdate-exe Specifies the JVM heap memory size for Audit Workbench launching external utilities such as iidmigrator, event2fpr, and fortifyupdate. com.fortify.model.forceiid Migration If set to true, forces running Instance ID migration during a merge. com.fortify.model.fullrepo rtfilenames If set to true, uses full file name in reports. com.fortify.model.iidmigra toroptions Specifies options (space-delimited values) for iidmigrator run by FPRUtility or Audit Workbench\Eclipse. For more information, see iidmigrator help. Chapter 1: Properties Used in SCA Tools for Java Applications 16

17 com.fortify.model.issuecut offbycategorystartindex Default: 0 Specifies the start index for issue cut-off by category. com.fortify.model.issuecut offbycategoryendindex Default: java.lang.integer.max_value Specifies the end index for issue cut-off by category. com.fortify.model.issuecut offstartindex Default: 0 Specifies the start index for issue cut-off. Select the first issue (by number) to be loaded. com.fortify.model.issuecut offendindex Default: java.lang.integer.max_value Determines the end index for issue cut-off. Select the last issue to be loaded (by number). com.fortify.model.maxengi neerrorcount Default: 2500 Determines how many errors reported by the analysis engine to are to be loaded by Audit Workbench/Eclipse or FPRUtility. To allow an unlimited number, specify -1. This drastically speeds up loading of some large FPR files. HP Fortify recommends that you keep the default value of 2500 since this is the most that Audit Workbench can display. Also used by FPRUtility.bat Chapter 1: Properties Used in SCA Tools for Java Applications 17

18 com.fortify.model.mergere solvestrategy Default: DefaultToMasterValue Specifies merge resolve strategy from: DefaultToMasterValue (use primary project) DefaultToImportValue (use secondary project) NoStrategy (prompt for project to use) com.fortify.model.minimal Load If set to true, minimizes the data loaded from an FPR file. com.fortify.model.nproces singthreads Default: Number of available processors Specifies the number of threads to process FPR files. If com.fortify.model.persistdatatodisk is set to true, defaults to 1 thread. If the specified number exceeds the number of available processors: int maxthreads = java.lang.runtime.getruntime().availableprocessors(), then Fortify uses the number of available processors as the number of threads used to process FPR files. Also used by FPRUtility.bat com.fortify.model.persistd atatodisk If set to true, enables a persistence strategy to reduce the memory footprint and use disk drive to swap FPR data out of memory. Chapter 1: Properties Used in SCA Tools for Java Applications 18

19 com.fortify.model.persiste nceblocksize Default: 250 When com.fortify.model.persistencestrategy is set to CUSTOM, com.fortify.model.persistenceblocksize specifies the number of attribute values that comprise a single block of attributes. These blocks are cached to disk and read back in as needed. A higher number decreases the total number of cache files, but increases the file size and the amount of memory that is read in each time. com.fortify.model.persiste ncequeuecapacity Default: queue is unbounded When com.fortify.model.persistencestrategy is set to CUSTOM, this property specifies the maximum number of attribute value blocks that can exist in producer/consumer queue. com.fortify.model.persiste ncestrategy Default: CUSTOM If com.fortify.model.persistdatatodisk is set to true, this property specifies persistence algorithm (to push data from memory to disk). com.fortify.model.priorityi mpactthreshold Default: 2.5F Specifies priority impact threshold as follows: High = values >= 2.5 Low = values < 2.5 Critical = High Impact && High Likelihood Hot = High Impact && Low Likelihood Medium = Low Impact && High Likelihood Low = Low Impact && Low Likelihood Chapter 1: Properties Used in SCA Tools for Java Applications 19

20 com.fortify.model.priorityl ikelihoodthreshold Default: 2.5F Specifies priority likelihood threshold as follows: High = values >= 2.5 Low = values < 2.5 Critical = High Impact && High Likelihood Hot = High Impact && Low Likelihood Medium = Low Impact && High Likelihood Low = Low Impact && Low Likelihood com.fortify.model.report.ta rgetenv Defaults: On Windows: xp On Linux: openoffice On OSX: mac Specifies the target environment for generating RTF format reports. You can control RTF format generation with the following setting: com.fortify.model.report.targetenv=<format> valid <format> values: For xp, set the options required for RTF documents to display correctly in Microsoft Word XP (2002) and later. For word2000, set the options required for RTF documents to display correctly in Microsoft Word 2000 and Microsoft Word 97. For openoffice, set the options required for RTF documents to display correctly in OpenOffice.Org Writer. For mac, set the options required for RTF documents to display correctly in Microsoft Word for Mac. com.fortify.model.report.us esystemlocale If set to true, uses system locale for report output. If set to false, uses com.fortify.locale in the fortify.properties file. If a value is not specified, use java.util.locale.getdefault(). Chapter 1: Properties Used in SCA Tools for Java Applications 20

21 com.fortify.model.reportli nelimit Default: 500 Specifies the character limit for each issue code snippet in reports. com.fortify.model.useiidmi grationfile Specifies full path of the iid migration file to use. Also used by FPRUtility.bat com.fortify.model.useissue ParseFilters If set to true, respects IssueParseFilters.properties settings. com.fortify.model.useoldii DMigrationAttributes If set to true, uses attributes of old issue during iid migration while merging similar issues of old and new scans. com.fortify.removedissuep ersistancelimit Default: 1000 Specifies how many removed issues to keep. com.fortify.search.defaults yntaxver Default: 2 Determines whether the AND and OR operators are used in searches. These are enabled in search syntax by default. To block the use of the AND and OR operators, set the value to 1. To use ANDs and ORs with no parentheses, set the value to 2. Chapter 1: Properties Used in SCA Tools for Java Applications 21

22 com.fortify.storeoriginalde scriptions If set to true, stores original plain text issue descriptions (before parsing) as well as the parsed ones with tags replaced with specific values. com.fortify.taintflagblackli st Specifies taint flags to exclude (comma-delimited values). com.fortify.usesourceproje cttemplate If set to true, forces the use of filter sets and folders from the project template associated with the secondary project. The filter sets and folders from the primary project are used by default. Also used by FPRUtility.bat Chapter 1: Properties Used in SCA Tools for Java Applications 22

23 Server Properties (server.properties File) Table 3 lists properties that belong in the server.properties file. This file is used by all HP Fortify SCA command-line tools, standalone applications, and plugins. Because some of the values are encrypted, you must use the scapostinstall tool to configure this file. For information about how to use the scapostinstall tool, see the HP Fortify Static Code Analyzer Installation and Configuration Guide. Table 3: Server Properties autoupgrade.server Default: Specifies SCA_and_Apps AutoUpdate server, which enables users to check for new versions of the SCA_and_Apps installer on a web server and run the installer if an update is available. install.auto.upgrade If set to true, enables Audit Workbench AutoUpdate function. rp.update.from.manager If set to true, updates security contents from Software Security Center instead of from the Rulepack update server. rulepack.auto.update If set to true, updates security content automatically. rulepack.days Default: 15 Specifies the interval (in days) between security content updates. Chapter 1: Properties Used in SCA Tools for Java Applications 23

24 Table 3: Server Properties (Continued) rulepackupdate.proxy.port Specifies the proxy server port to access the Rulepack server (uploadclient.proxy.port is used if rp.update.from.manager is set to true). rulepackupdate.proxy.server Specifies proxy server name to access the Rulepack server (uploadclient.proxy.server is used if rp.update.from.manager is set to true). rulepackupdate.server Default: Determines Rulepack server location. uploadclient.proxy.port Specifies the proxy server port to use to access Software Security Center server. uploadclient.proxy.server Specifies the proxy server name to use to access Software Security Center server. uploadclient.server Default: Specifies the URL of the Software Security Center server. Chapter 1: Properties Used in SCA Tools for Java Applications 24

25 Chapter 2: Properties Used in SCA Tools for.net Applications The following sections describe the properties used by the following HP Fortify Static Code Analyzer tools: HP Fortify Package for Microsoft Visual Studio HP Fortify Scanning Package for Microsoft Visual Studio Properties are listed in alphabetical order based on the files in which they belong: HP Fortify Properties (fortify.properties File) on page 25 IDE Properties (fortify-ide.properties file) on page 28 TFS Configuration on page 28 HP Fortify Properties (fortify.properties File) Table 4 lists the properties that belong in the fortify.properties file. Some of these properties already exist in the file, while others must be added. Table 4: HP Fortify Properties com.fortify.audit.ui.disablebug trackers com.fortify.audit.ui.disablesup press com.fortify.authenticationkey com.fortify.debug com.fortify.model.customdesc riptionsheader com.fortify.model.forceiidmig ration If set to true, disables bug tracker integration. If set to true, disables issue suppression. Default: com.fortify.authenticationkey Specifies the directory used to store the manager client authentication token. If set to true, runs all SCA tools in debug mode. Specifies a custom description header. If set to true, forces Instance ID Migration. Chapter 2: Properties Used in SCA Tools for.net Applications 25

26 Table 4: HP Fortify Properties (Continued) com.fortify.model.priorityimpa ctthreshold com.fortify.model.prioritylikel ihoodthreshold com.fortify.model.useiidmigra tionfile com.fortify.scaexecutablepath com.fortify.search.defaultsynta xver com.fortify.visualstudio.vm.arg s com.fortify.vs.aspnetcompiler Executable com.fortify.vs.aspnetvirtualm ap.<name_of_virtual_dir> com.fortify.vs.aspvirtualroot Default: 2.5F Specifies priority impact threshold. Valid values: High = values >= 2.5 Low = values < 2.5 Critical = High Impact && High Likelihood Hot = High Impact && Low Likelihood Medium = Low Impact && High Likelihood Low = Low Impact && Low Likelihood Default: 2.5F Specifies priority likelihood threshold. Valid values: High = values >= 2.5 Low = values < 2.5 Critical = High Impact && High Likelihood Hot = High Impact && Low Likelihood Medium = Low Impact && High Likelihood Low = Low Impact && Low Likelihood Specifies full path of iid migration file Default: <Fortify Install Dir>/bin/sourceanalyzer.exe Specifies file path to sourceanalyzer.exe. Default: 2 Determines whether the AND and OR operators are used in searches. These are enabled in search syntax by default. To block the use of the AND and OR operators, set the value to 1. Default: -Xmx256m Specifies JVM args Specifies file path to the aspnet_compiler.exe file. Determines the mapping between the virtual root and full path to the corresponding physical directory. Specifies ASP Virtual Root. Chapter 2: Properties Used in SCA Tools for.net Applications 26

27 Table 4: HP Fortify Properties (Continued) com.fortify.vs.aspvirtualroot Prop com.fortify.vs.debug com.fortify.vs.disablecintegrat ion com.fortify.vs.disablemigratio ncheck com.fortify.vs.disablepassingil dasmpath com.fortify.vs.disablereferenc elibdirsandexcludes com.fortify.vs.ildasmpath com.fortify.vs.listprojectprop erties com.fortify.vs.netframework Root com.fortify.vs.requireaspprec ompilation com.fortify.vs.skipaspprecom pilation com.fortify.vs.skipaspprecom pilation com.fortify.workingdirectory Specifies the property key required to get the ASP Virtual Root from the ASP.NET project. If set to true, runs the HP Fortify Package for Visual Studio in debug mode. If set to true, disables C/C++ build integration in Visual Studio. If set to true, disables iid migration checking. If set to true, disables passing ILDASM path to SCA with -Dcom.fortify.sca.IldasmPath. If set to true, disables using references added to a project. Specifies the file path to ildasm.exe. If set to true, lists Visual Studio project properties in a log file. Specifies the file path to.net Framework root. Default: true If set to true, stops translation whenever ASP precompilation fails. If set to true, causes SCA to translate the default ASP output instead of running the aspnet_compiler. If set to true, causes SCA to translate the default ASP output instead of running the aspnet_compiler Default: C:\Users\<login user>\appdata\local\fortify Specifies the HP Fortify working directory. Chapter 2: Properties Used in SCA Tools for.net Applications 27

28 IDE Properties (fortify-ide.properties file) Table 5 lists the properties that belong in the fortify-ide.properties file. Table 5: IDE Properties hide.secondary.source.files rulepack.auto.update If set to true, hides source files that also have auto-generated source files from the IDE. For example, if you create a form in CS, a separate.designer.cs file is created (form.cs and Form.desinger.cs are created). The files are hidden if they are tagged as "secondary" file type in the fvdl file. If set to true, updates security content automatically. rulepack.days Default: 15 Specifies frequency (in days) of security content updates. TFS Configuration The following property is in the TFSconfiguration.properies file: server.url Description: Specifies TFS (Team Foundation Server) location. Chapter 2: Properties Used in SCA Tools for.net Applications 28