This is a plugin for MicroFoucs Fortify Software Security Center that allows for parsing of scan results generated by snyk test --json
.
The Fortify SSC is a software issue management center, and allows importing issues from external vendor code analyzers.
Latest release can be grabbed at the releases page. In case you're interested in compiling it on your own, you only need maven installed, then follow:
git clone git@github.com:snyk-partners/fortify-snyk-parser.git
cd fortify-snyk-parser
mvn install
Then grab the file produced at:
target/parser-x.x.x.jar
http://127.0.0.1:8180/ssc/html/ssc/admin/parserplugins
NEW
and acknowledgeENABLE
and acknowledgeTo use the Snyk Parser Plugin, cli scan results in .json
format should be generated.
snyk test --json > scan.json
and an app version should be declared (in: http://127.0.0.1:8180/ssc/html/ssc/version
).
If you don't have any, just create one (click NEW APPLICATION
and then fill out info).
scan.zip
scan results files. Alongside scan.json
execute:
echo "engineType=SNYK" > scan.info
zip -v scan.zip scan.json scan.info
http://127.0.0.1:8180/ssc/html/ssc/version
and select the version to bind the report to.
and click on the application you want to bind the scan results to.ARTIFACTS
tab and there click ARTIFACT
.ADD FILES
and select the scan.zip
you just made. Then click START UPLOAD
. CLOSE
to close the window.Processing Complete
for the uploaded scan.zip
.
Alongside the scan.json
:
curl --noproxy localhost -X POST -H "Content-Type: application/json" -u admin:<PASSWORD> -d '{"fileTokenType": "UPLOAD"}' http://localhost:8180/ssc/api/v1/fileTokens
curl --noproxy localhost -X POST --form files=@"scan.json" "http://localhost:8180/ssc/upload/resultFileUpload.html?mat=<TOKEN>&entityId=<APP_ID>&engineType=SNYK"
APP_ID
is the id number of the app version, in the url when going to an app dashboard http://localhost:8180/ssc/html/ssc/version/<APP_ID>/
http://localhost:8180/ssc/html/ssc/version/<APP_ID>/
).AUDIT
tab at the top and you should see all issues reported by Snyk in the table.