This is a plugin for MicroFoucs Fortify Software Security Center that allows for parsing of scan results generated by snyk test --json
.
The Fortify SSC is a software issue management center, and allows importing issues from external vendor code analyzers.
- Information on Parser plugins and an example can be found here
- It follows the api as described here
- As per requirements, the plugin is compiled into a single JAR file that includes the library it uses: Gson.
Latest release can be grabbed at the releases page. In case you're interested in compiling it on your own, you only need maven installed, then follow:
git clone git@github.com:snyk-partners/fortify-snyk-parser.git
cd fortify-snyk-parser
mvn install
Then grab the file produced at:
target/parser-x.x.x.jar
- Open your browser and go to:
http://127.0.0.1:8180/ssc/html/ssc/admin/parserplugins
- Click on
NEW
and acknowledge - Choose before-mentioned JAR file
- Once uploaded, click on "Snyk Parser Plugin" line, then click
ENABLE
and acknowledge - Plugin should be installed now
To use the Snyk Parser Plugin, cli scan results in .json
format should be generated.
snyk test --json > scan.json
and an app version should be declared (in: http://127.0.0.1:8180/ssc/html/ssc/version
).
If you don't have any, just create one (click NEW APPLICATION
and then fill out info).
- Generate
scan.zip
scan results files. Alongsidescan.json
execute:
echo "engineType=SNYK" > scan.info
zip -v scan.zip scan.json scan.info
- Go to
http://127.0.0.1:8180/ssc/html/ssc/version
and select the version to bind the report to. and click on the application you want to bind the scan results to. - Click
ARTIFACTS
tab and there clickARTIFACT
. - Click
ADD FILES
and select thescan.zip
you just made. Then clickSTART UPLOAD
.CLOSE
to close the window. - Once results were successfully processed, you should see status
Processing Complete
for the uploadedscan.zip
.
Alongside the scan.json
:
curl --noproxy localhost -X POST -H "Content-Type: application/json" -u admin:<PASSWORD> -d '{"fileTokenType": "UPLOAD"}' http://localhost:8180/ssc/api/v1/fileTokens
curl --noproxy localhost -X POST --form files=@"scan.json" "http://localhost:8180/ssc/upload/resultFileUpload.html?mat=<TOKEN>&entityId=<APP_ID>&engineType=SNYK"
APP_ID
is the id number of the app version, in the url when going to an app dashboard http://localhost:8180/ssc/html/ssc/version/<APP_ID>/
- In the app version dashboard (
http://localhost:8180/ssc/html/ssc/version/<APP_ID>/
). - Click on
AUDIT
tab at the top and you should see all issues reported by Snyk in the table. - Click on any row to reveal detailed information on issue.