Fortify plugin correct syntax for javaAddOptions

Using Jenkins
1

The javaAddOptions syntax below does not work. I have tried several ways but everything ends up with the first -D parameter set to the entire string instead of 3 -D parameters and their values

fortifyTranslate addJVMOptions: '-64', 
                        buildID: '${JOB_NAME}-${BUILD_NUMBER}', 
                        debug: true,
                        excludeList: '"csci_all:csci_libs:csci_db/data:csci_nc/if/csc_Services:csci_cmw/src/csc_Security:csci_cmw/src/csc_Provisioning/ActiveDirectory:**/target/**/*:**/node_modules/**/*:**/test/**/*:**/tools/**/*:**/*.cs:**/*.ctl:**/*.dat:**/*.py:**/*.pem:**/*.cer:**/*.md:**/*.properties:**/*.wsdl:**/*.xsd:**/*.xml:**/*.sql:**/*.ts:**/*.js:**/*.html.js"', 
                        logFile: './${JOB_NAME}-${BUILD_NUMBER}-translation.log', 
                        maxHeap: '20000', 
                        projectScanType: 
                            fortifyJava(javaAddOptions: '"-Dcom.fortify.sca.hoa.Enable=true","-Dcom.fortify.sca.Phase0HigherOrder.Languages=javascript,typescript","-Dcom.fortify.sca.EnableDOMModeling=true"', 
                            javaClasspath: '"**/*.jar:**/target/*.class"', 
                            javaSrcFiles: '"**/*"', 
                            javaVersion: '1.8')
2

Hello @geturner and welcome to this community. :wave:

I think you maybe shouldn’t wrap each -D option in double quotes within the javaAddOptions parameter.
Instead, I believe you could provide them as a comma-separated list. Here’s my proposed syntax:

fortifyTranslate addJVMOptions: '-64', 
                        buildID: '${JOB_NAME}-${BUILD_NUMBER}', 
                        debug: true,
                        excludeList: '"csci_all:csci_libs:csci_db/data:csci_nc/if/csc_Services:csci_cmw/src/csc_Security:csci_cmw/src/csc_Provisioning/ActiveDirectory:**/target/**/*:**/node_modules/**/*:**/test/**/*:**/tools/**/*:**/*.cs:**/*.ctl:**/*.dat:**/*.py:**/*.pem:**/*.cer:**/*.md:**/*.properties:**/*.wsdl:**/*.xsd:**/*.xml:**/*.sql:**/*.ts:**/*.js:**/*.html.js"', 
                        logFile: './${JOB_NAME}-${BUILD_NUMBER}-translation.log', 
                        maxHeap: '20000', 
                        projectScanType: 
                            fortifyJava(javaAddOptions: [
                                "-Dcom.fortify.sca.hoa.Enable=true",
                                "-Dcom.fortify.sca.Phase0HigherOrder.Languages=javascript,typescript",
                                "-Dcom.fortify.sca.EnableDOMModeling=true"
                            ], 
                            javaClasspath: '"**/*.jar:**/target/*.class"', 
                            javaSrcFiles: '"**/*"', 
                            javaVersion: '1.8')

Keep in mind I haven’t tested it, that’s just a wild guess. :person_shrugging:

3

Thanks for your reply, but your comment does not line up with your proposed syntax. But I have been trying to figure out how to define a “list” syntax, and I will try with the brackets as you have proposed. But note, CSV is not ok by itself, as one of the values has a comma in it.

~WRD0000.jpg

4

Adding the brackets was a complete NO. That caused it to put that string in all the wrong places. Will try with braces instead.

5

Good luck with that.

6

Not a useful response. I would love to contact the plugin developers and get a “real” answer. I thought this forum would provide a way to do that.

7

It’s only the first day of your thread, don’t lose hope, somebody more knowledgeable may chime in.

8

My last attempt has worked. Just a simple space delimiter. For others that may need this, here is my latest:

fortifyTranslate addJVMOptions: ‘-64’,
buildID: ‘{JOB_NAME}-{BUILD_NUMBER}’,
debug: true,
excludeList: ‘“csci_all:csci_libs:csci_db/data:csci_nc/if/csc_Services:csci_cmw/src/csc_Security:csci_cmw/src/csc_Provisioning/ActiveDirectory:/target//:/node_modules//:/test//:/tools//:/*.cs:/.ctl:**/.dat:/*.py:/.pem:**/.cer:/*.md:/.properties:**/.wsdl:/*.xsd:/.xml:**/.sql:/*.ts:/.js:**/.html.js”’,
logFile: ‘./{JOB_NAME}-{BUILD_NUMBER}-translation.log’,
maxHeap: ‘20000’,
projectScanType:
fortifyJava(javaAddOptions: ‘-Dcom.fortify.sca.hoa.Enable=true -Dcom.fortify.sca.Phase0HigherOrder.Languages=javascript,typescript -Dcom.fortify.sca.EnableDOMModeling=true’,
javaClasspath: ‘“/*.jar:/target/.class"',
javaSrcFiles: '"**/”’,
javaVersion: ‘1.8’)