Download Fortify SCA User Guide

Translating J2EE Applications
Translating J2EE applications involves processing Java source files, J2EE components such as JSP files, deployment descriptors such as web.xml, and configuration files such as struts-config.xml.
The steps include:
1. Translating the Java files.
Refer to the samples earlier in this chapter.
2. Translating the JSP files.
Refer to the sample below.
3. Processing the configuration files.
An example is:
sourceanalyzer -b my_buildid "mydirectory/myfile.xml"
Working with JSP Projects
To translate JSP files, Fortify SCA requires that the JSP files are in a standard Web Application Archive (WAR) layout. If your source directory is already organized in a WAR layout, you can translate JSP files directly from the source directory. If this is not the case, you may need to deploy your application and translate the JSP files from the deployment directory.
If your JSP files use any tag libraries, such as JSTL, ensure that the libraries’ jar files are in the WEB-INF/lib directory. Otherwise, the JSP compiler will not resolve the tag libraries and could produce incorrect results.
By default, Fortify SCA uses a version of the Jasper JSP compiler to compile JSP files into Java files during the translation phase. However, if your web application is developed specifically for an application server, you must use the JSP compiler for that application server when performing the translation.
To support this, Fortify SCA provides the following command line options:
•
-appserver supported values: weblogic/websphere
•
-appserver-home
For Weblogic, the path to the directory containing the server/lib directory
For WebSphere, the path to the directory containing the bin/JspBatchCompiler script
•
-appserver-version supported values:
Weblogic versions 7, 8, 9, and 10
WebSphere version 6
If you are using an application server that is not listed, use the default internal Fortify JSP compiler. For example:
sourceanalyzer -b my_buildid -cp "WEB-INF/lib/*.jar" "WEB-INF/**/*.jsp"
XML Configuration Files
Fortify SCA uses the web.xml configuration file during the project scan for the following information: •
servlet tags
•
servlet‐mapping tags
•
filter tags
•
filter‐mapping tags
•
error‐page tags
Fortify SCA User Guide
8