Use Fortify sourceanalyzer with CMake

Question

I have a Makefile generated by CMake. The following path to CMake executable is set in the Makefile:

CMAKE_COMMAND = /home/xyz/opt/cmake/cmake-3.1.1/bin/cmake

How can I integrate Fortify sourceanalyzer with it and run scans?

You never edit the generated Makefile, but you have to tell CMake to use sourceanalyzer as a compiler or similar. — usr1234567, Apr 05 '16 at 14:03
can you provide me some background on how to tell CMake to use sourceanalyzer as a compiler? — user2361273, Apr 05 '16 at 14:05
I know nothing about fortify. With other tools, you replace the C or C++ compiler by the actual tool. — usr1234567, Apr 05 '16 at 14:08
http://stackoverflow.com/questions/19050461/cmake-add-target-for-invoking-clang-analyzer — user3159253, Apr 05 '16 at 14:08
usr1234567 - can you please tell me the name of any such tools, I want to give this approach a try. — user2361273, Apr 06 '16 at 06:02

score 7 · Answer 1 · answered Apr 13 '16 at 11:13

7

I had the same challenge but solved it by running it like this:

sourceanalyzer -b project_ID -clean
Go to your build directory and perform make clean or remove all contents including the Makefile
Run cmake by changing CC and CXX variables: CC="sourceanalyzer -b project_ID gcc" CXX="sourceanalyzer -b project_ID g++" cmake ..
Run make and fortify should be translating files while compilers do their job.
Run sourceanalyzer -b project_ID -scan -f results.fpr

Hope it helps.

answered Apr 13 '16 at 11:13

Stan

121
1
5

Hi Stan, thanks for your reply but CMake works differently and we can't set CC and CXX values. Refer following page: http://stackoverflow.com/questions/34906024/how-do-i-force-cmake-to-use-cl-exe-without-full-path/36791990#36791990 – user2361273 Apr 25 '16 at 06:25

score 2 · Answer 2 · edited May 23 '17 at 12:32

I was tasked with integrating our CMake build system with HP Fortify SCA and came across this Thread that gave some insights but lacked specifics as related to HP Fortify so I thought I would share my implementation.

I created a fortify_tools directory at the same level as the source directory. Inside the fortify_tools are a toolchain file and fortify_cc, fortify_cxx, and fortify_ar scripts that will be set as the cmake_compilers via the toolchain file.

fortify_cc

#!/bin/bash

sourceanalyzer -b <PROJECT_ID> gcc  $@

fortify_cxx

#!/bin/bash

sourceanalyzer -b <PROJECT_ID> g++ $@

fortify_ar

#!/bin/bash

sourceanalyzer -b <PROJECT_ID> ar $@

NOTE: insert your project name in place of PROJECT_ID

Setting cmake to use the scripts is accomplished in a toolchain file.

fortify_linux_toolchain.cmake

INCLUDE (CMakeForceCompiler)

SET(CMAKE_SYSTEM_NAME Linux)
SET(CMAKE_SYSTEM_VERSION 1)

#specify the compilers
SET(CMAKE_C_COMPILER ${CMAKE_SOURCE_DIR}/fortify_tools/fortify_cc)
SET(CMAKE_CXX_COMPILER ${CMAKE_SOURCE_DIR}/fortify_tools/fortify_cxx)
SET(CMAKE_AR_COMPILER ${CMAKE_SOURCE_DIR}/fortify_tools/fortify_ar)

To generate makefiles using the toolchain file

ccmake -DCMAKE_TOOLCHAIN_FILE=../fortify_tools/foritfy_linux_toolchain.cmake ../

configure and generate your makefiles and build your project.

Once the project is built from within the build directory generate a fortify report by

sourceanalyzer -Xmx2400M -debug -verbose -b <PROJECT_ID> -scan -f <PROJECT_ID>.fpr

I understand the last step is outside of CMake but I am pretty confident a cmake_custom_command can be created to perform the scan step as a post build action.

Finally, this is just the linux implementation but the concept scales well to Windows by creating the necessary batch files and windows specific toolchain file

score 0 · Accepted Answer · answered Apr 28 '16 at 04:12

0

Fortify doesn't support CMake, I received confirmation from Fortify support team.

answered Apr 28 '16 at 04:12

user2361273

57
1
2
9

score 0 · Answer 4 · answered Sep 14 '16 at 15:43

This answer is late, but might help someone. This is actually easy to fix - you simply need to run cmake inside sourceanalyzer as well. Make a simple build script that calls cmake and then make, and use sourceanalyzer on that instead. I am using fortify 4.21.

score 0 · Answer 5 · answered Mar 11 '19 at 23:55

Our old Fortify script for building hand-created Makefiles used a build command that looked like this:

$SOURCEANALYZER $MEMORY $LAUNCHERSWITCHES -b $BUILDID make -f Makefile -j12

I was able to get it working for a project that had been converted to CMake by replacing the above line with this, inspired by a couple of the other answers here:

CC="$SOURCEANALYZER $MEMORY $LAUNCHERSWITCHES -b $BUILDID gcc" \
CXX="$SOURCEANALYZER $MEMORY $LAUNCHERSWITCHES -b $BUILDID g++" \
AR="$SOURCEANALYZER $MEMORY $LAUNCHERSWITCHES -b $BUILDID ar" \
cmake -G "Unix Makefiles" -DCMAKE_BUILD_TYPE=Debug ..

make -f Makefile -j12 VERBOSE=1

This is with cmake 2.8.12.2 on Linux.

score 0 · Answer 6 · answered Sep 09 '20 at 08:57

Below is the script i use for my example project to generate HP Fortify report for Android JNI C/C++ Code.

#!/bin/sh

# Configure NDK version and CMake version
NDK_VERSION=21.0.6113669

CMAKE_VERSION=3.10.2
CMAKE_VERSION_PATH=$CMAKE_VERSION.4988404

PROJECTID="JNI_EXAMPLE"
REPORT_NAME=$PROJECTID"_$(date +'%Y%m%d_%H:%M:%S')"

WORKING_DIR="$( cd "$( dirname "${BASH_SOURCE[0]}" )" && pwd )"
BUILD_HOME=${WORKING_DIR}/../hpfortify_build
FPR="$BUILD_HOME/$REPORT_NAME.fpr"

# Following exports need to be configured according to host machine.
export ANDROID_SDK_HOME=/Library/Android/sdk
export ANDROID_CMAKE_HOME=$ANDROID_SDK_HOME/cmake/$CMAKE_VERSION_PATH/bin
export ANDROID_NDK_HOME=$ANDROID_SDK_HOME/ndk/$NDK_VERSION
# E.g. JniExample/app/hpfortify/build/CMakeFiles/3.10.2
export CMAKE_FILES_PATH=${BUILD_HOME}/CMakeFiles/$CMAKE_VERSION
export HPFORTIFY_HOME="/Applications/Fortify/Fortify_SCA_and_Apps_20.1.0/bin"
export PATH=$PATH:$ANDROID_SDK_HOME:$ANDROID_NDK_HOME:$ANDROID_CMAKE_HOME:$HPFORTIFY_HOME

echo "[========Start Android JNI C/C++ HP Fortify scanning========]"
echo "[========Build Dir: $BUILD_HOME========]"
echo "[========HP Fortify report path: $FPR========]"

function create_build_folder {
    rm -rf $BUILD_HOME
    mkdir $BUILD_HOME
}

# The standalone cmake build command can be found from below file. 
# JniExample/app/.cxx/cmake/release/x86/build_command.txt
# This file is generated after running command 
# `➜  JniExample git:(master) ✗ ./gradlew :app:externalNativeBuildRelease`
function configure_cmake_files {

    cd $BUILD_HOME
    
    $ANDROID_CMAKE_HOME/cmake -H$BUILD_HOME/. \
        -DCMAKE_CXX_FLAGS=-std=c++11 -frtti -fexceptions \
        -DCMAKE_FIND_ROOT_PATH=$BUILD_HOME/.cxx/cmake/release/prefab/x86/prefab \
        -DCMAKE_BUILD_TYPE=Release \
        -DCMAKE_TOOLCHAIN_FILE=$ANDROID_SDK_HOME/ndk/$NDK_VERSION/build/cmake/android.toolchain.cmake \
        -DANDROID_ABI=x86 \
        -DANDROID_NDK=$ANDROID_SDK_HOME/ndk/$NDK_VERSION \
        -DANDROID_PLATFORM=android-16 \
        -DCMAKE_ANDROID_ARCH_ABI=x86 \
        -DCMAKE_ANDROID_NDK=$ANDROID_SDK_HOME/ndk/$NDK_VERSION \
        -DCMAKE_EXPORT_COMPILE_COMMANDS=ON \
        -DCMAKE_LIBRARY_OUTPUT_DIRECTORY=$BUILD_HOME/intermediates/cmake/release/obj/x86 \
        -DCMAKE_MAKE_PROGRAM=$ANDROID_SDK_HOME/cmake/$CMAKE_VERSION_PATH/bin/ninja \
        -DCMAKE_SYSTEM_NAME=Android \
        -DCMAKE_SYSTEM_VERSION=16 \
        -B$BUILD_HOME/.cxx/cmake/release/x86 \
        -GNinja ..
}

function build {
    cmake --build .
}

function cleanup {
    rm -rf $BUILD_HOME/CMakeFiles/native-lib.dir
    rm -rf $FPR
    $HPFORTIFY_HOME/sourceanalyzer -clean
}

function replace_compiler_paths {
    FORTIFY_TOOLS_PATH="$WORKING_DIR"
    CLANG_PATH="$ANDROID_SDK_HOME/ndk/$NDK_VERSION/toolchains/llvm/prebuilt/darwin-x86_64/bin/clang"
    CLANGXX_PATH="$ANDROID_SDK_HOME/ndk/$NDK_VERSION/toolchains/llvm/prebuilt/darwin-x86_64/bin/clang++"
    HPFORTIFY_CCPATH="$FORTIFY_TOOLS_PATH/fortify_cc"
    HPFORTIFY_CXXPATH="$FORTIFY_TOOLS_PATH/fortify_cxx"\"
    sed -i '' 's+'$CLANG_PATH'+'$HPFORTIFY_CCPATH'+g' $CMAKE_FILES_PATH/CMakeCCompiler.cmake
    sed -i '' 's+'$CLANG_PATH.*[^")"]'+'$HPFORTIFY_CXXPATH'+g' $CMAKE_FILES_PATH/CMakeCXXCompiler.cmake
}

function scan {
    $HPFORTIFY_HOME/sourceanalyzer -b $PROJECTID -scan -f $FPR

    # copy the file to $WORKING_DIR
    cp $FPR $WORKING_DIR
}


create_build_folder

configure_cmake_files

echo "[========Compile C/C++ using normal compiler ========"]
build

echo "[========Replace the compiler with HP Fortify analyser wrapper compilers ========"]
replace_compiler_paths

echo "[========Clean up the build intermediates and the older build ID and fpr file ========"]
cleanup

echo "[========Recompile C/C++ using HP Fortify analyser wrapper compilers ========"]
build

echo "[========Scan the compiled files and generate final report ========"]
scan

echo "[========Change directory to original working dir ========"]
cd $WORKING_DIR

Need to configure below vars before using it. For my case, I use NDK 21 and CMake 3.10.2 and my project ID is "JNI_EXAMPLE"

# Configure NDK version and CMake version
NDK_VERSION=21.0.6113669

CMAKE_VERSION=3.10.2
CMAKE_VERSION_PATH=$CMAKE_VERSION.4988404

PROJECTID="JNI_EXAMPLE"

# Following exports need to be configured according to host machine.
export ANDROID_SDK_HOME=/Library/Android/sdk
export ANDROID_NDK_HOME=$ANDROID_SDK_HOME/ndk/$NDK_VERSION
export HPFORTIFY_HOME="/Applications/Fortify/Fortify_SCA_and_Apps_20.1.0/bin"

Here is a more detailed explanation: Using HP Fortify to Scan Android JNI C/C++ Code

score 0 · Answer 7 · answered Nov 28 '20 at 13:23

On recent version of CMake one can use:

CMAKE_<LANG>_COMPILER_LAUNCHER='sourceanalyzer;-b;<PROJECT_ID>'

You can add other arguments (like -Xmx2G for instance), semicolon separated, as mentioned on cmake documentation You need to check if you don't use the compiler launcher for another tool like ccache. We can probably use both with

CCACHE_PREFIX='.../sourceanalyzer -b ID'

score 0 · Answer 8 · answered Sep 02 '21 at 21:35

Here is what I've used in CMake project:

project(myFortifiedProject LANGUAGES CXX)

set(CMAKE_CXX_COMPILER_LAUNCHER ${FORTIFY_TOOL} -b ${PROJECT_NAME})

So when running cmake (assuming sourceanalyzer is on the path):

cmake <other args> -DFORTIFY_TOOL=sourceanalyzer

So the normal build command works:

make myFortifiedProject

And you can finally collect results with:

sourceanalyzer -b myFortifiedProject -scan

Use Fortify sourceanalyzer with CMake

8 Answers8