爲什麼BIRTReportGenerator無法找到我的源文件？

Question

我正在嘗試使用SCA用戶指南中概述的BIRTReportGenerator來構建強化報告。掃描工作正常，並生成一個fpr文件，但是當我運行報告生成器時，出現以下錯誤。

FPR source file not found or not readable. 

這裏是我使用的命令。這些是從用戶指南中直接剪切和粘貼的。唯一修改的是路徑。

sourceanalyzer -b myproject -clean 
sourceanalyzer -b myproject -cp /Users/ginger.mcmurray/Mobuyle-Android-New-Ui/MobuyleCore/libs -Dcom.fortify.sca.SuppressLowSeverity=true -Dcom.fortify.sca.LowSeverityCutoff=10.0 -jdk 1.6 MobuyleCore/src 
sourceanalyzer -b myproject -scan -f results.fpr 
BIRTReportGenerator -template "OWASP Top 10" -source results.fpr -format PDF -showSuppressed --Version "OWASP Top 10 2013" --UseFortifyPriorityOrder -output MyOWASP_Top10_Report.pdf 

如果我改用ReportGenerator，則一切正常。但是，我需要爲我們的安全部門創建BIRT報告的能力。

這是爲了一個android java項目，以防萬一。

另外，儘管在命令中包含路徑，但我仍然在我的jar文件中發現了很多未知的函數和參考問題。

帶有-debug選項的BIRTReportGenerator的輸出。

Start VM: -Xms40m 
-Xmx1088m 
-XX:MaxPermSize=320m 
-XX:-UseCompressedOops 
-Xdock:icon=../Resources/Awb.icns 
-XstartOnFirstThread 
-Dorg.eclipse.swt.internal.carbon.smallFonts 
-Dcom.fortify.InstallRoot=../../../../../../.. 
-Djava.awt.headless=true 
-Dcom.fortify.InstallRoot=/Applications/HP_Fortify/HP_Fortify_SCA_and_Apps_16.10/bin/.. 
-Xmx1000M 
-XX:MaxPermSize=256m 
-Djava.class.path=/Applications/HP_Fortify/HP_Fortify_SCA_and_Apps_16.10/Core/private-bin/awb/eclipse/Auditworkbench.app/Contents/MacOS//../../../plugins/org.eclipse.equinox.launcher_1.3.0.v20140415-2008.jar 
-os macosx 
-ws cocoa 
-arch x86_64 
-launcher /Applications/HP_Fortify/HP_Fortify_SCA_and_Apps_16.10/Core/private-bin/awb/eclipse/Auditworkbench.app/Contents/MacOS/eclipse 
-name HPE Security Fortify Report Generation 
--launcher.library /Applications/HP_Fortify/HP_Fortify_SCA_and_Apps_16.10/Core/private-bin/awb/eclipse/Auditworkbench.app/Contents/MacOS//../../../plugins/org.eclipse.equinox.launcher.cocoa.macosx.x86_64_1.1.200.v20150204-1316/eclipse_1607.so 
-startup /Applications/HP_Fortify/HP_Fortify_SCA_and_Apps_16.10/Core/private-bin/awb/eclipse/Auditworkbench.app/Contents/MacOS//../../../plugins/org.eclipse.equinox.launcher_1.3.0.v20140415-2008.jar 
--launcher.appendVmargs 
-application com.hp.fortify.birt.report.generator.console.Application 
-data /Users/ginger.mcmurray/.fortify/BIRT16.10/workspace 
-configuration /Users/ginger.mcmurray/.fortify/BIRT16.10/configuration442 
-template OWASP Top 10 
-source results.fpr 
-format PDF 
-showSuppressed 
--Version OWASP Top 10 2013 
--UseFortifyPriorityOrder 
-debug 
-output MyOWASP_Top10_Report.pdf 
-consoleLog 
-vm /Applications/HP_Fortify/HP_Fortify_SCA_and_Apps_16.10/jre/lib/jli/libjli.dylib 
-vmargs 
-Xms40m 
-Xmx1088m 
-XX:MaxPermSize=320m 
-XX:-UseCompressedOops 
-Xdock:icon=../Resources/Awb.icns 
-XstartOnFirstThread 
-Dorg.eclipse.swt.internal.carbon.smallFonts 
-Dcom.fortify.InstallRoot=../../../../../../.. 
-Djava.awt.headless=true 
-Dcom.fortify.InstallRoot=/Applications/HP_Fortify/HP_Fortify_SCA_and_Apps_16.10/bin/.. 
-Xmx1000M 
-XX:MaxPermSize=256m 
-Djava.class.path=/Applications/HP_Fortify/HP_Fortify_SCA_and_Apps_16.10/Core/private-bin/awb/eclipse/Auditworkbench.app/Contents/MacOS//../../../plugins/org.eclipse.equinox.launcher_1.3.0.v20140415-2008.jar 
Configuration location: 
    file:/Users/ginger.mcmurray/.fortify/BIRT16.10/configuration442/ 
Configuration file: 
    file:/Users/ginger.mcmurray/.fortify/BIRT16.10/configuration442/config.ini loaded 
Install location: 
    file:/Applications/HP_Fortify/HP_Fortify_SCA_and_Apps_16.10/Core/private-bin/awb/eclipse/ 
Configuration file: 
    file:/Applications/HP_Fortify/HP_Fortify_SCA_and_Apps_16.10/Core/private-bin/awb/eclipse/configuration/config.ini loaded 
Loading timestamp file from: 
    file:/Users/ginger.mcmurray/.fortify/BIRT16.10/configuration442/ .baseConfigIniTimestamp 
    No timestamp file found 
Timestamps found: 
    config.ini in the base: 1458848541000 
    remembered -1 
Shared configuration location: 
    file:/Applications/HP_Fortify/HP_Fortify_SCA_and_Apps_16.10/Core/private-bin/awb/eclipse/configuration/ 
Framework located: 
    file:/Applications/HP_Fortify/HP_Fortify_SCA_and_Apps_16.10/Core/private-bin/awb/eclipse/plugins/org.eclipse.osgi_3.10.2.v20150203-1939.jar 
Loading extension: reference:file:org.eclipse.osgi.compatibility.state_1.0.1.v20140709-1414.jar 
    eclipse.properties not found 
Framework classpath: 
    file:/Applications/HP_Fortify/HP_Fortify_SCA_and_Apps_16.10/Core/private-bin/awb/eclipse/plugins/org.eclipse.osgi_3.10.2.v20150203-1939.jar 
    file:/Applications/HP_Fortify/HP_Fortify_SCA_and_Apps_16.10/Core/private-bin/awb/eclipse/plugins/ 
    file:/Applications/HP_Fortify/HP_Fortify_SCA_and_Apps_16.10/Core/private-bin/awb/eclipse/plugins/org.eclipse.osgi.compatibility.state_1.0.1.v20140709-1414.jar 
Debug options: 
    file:/Applications/HP_Fortify/HP_Fortify_SCA_and_Apps_16.10/Core/private-bin/awb/eclipse/Auditworkbench.app/Contents/MacOS/.options not found 
Time to load bundles: 5 
Starting application: 864 
FPR source file not found or not readable. 

Answer 1

似乎是在BIRTReportGenerator在具有相對路徑做的版本上的MacOS時16.10/16.20的錯誤。

此問題已在17.10（截至2017年10月的當前版本）中修復。

我不知道解決方法，您可以嘗試聯繫Fortify技術支持（fortifytechsupport@hpe.com）並查看他們是否有解決方法。