Download as PDF, PPTX
Uploaded byLightbend
Developing Secure Scala Applications With Fortify For Scala
The document outlines a webinar discussing Fortify SCA, a static analysis tool for Scala development that helps identify issues before production. It highlights its compatibility with existing Scala compilers, supports multiple programming languages, and provides a detailed explanation of its operation, including translating, scanning, and viewing results. The tool requires a Fortify SCA license and a Lightbend subscription, with a preview version already available for select customers.
Developing Secure Scala Applications With Fortify For Scala
- 1.
- 6.
- 7. ● Catch problemsduring development… ● ...before they hit production Why static analysis?
- 8. ● Established industryleader ● Strong support for Java / JVM ● Flexible cross-language technology Why Fortify SCA?
- 9. ● Leverage theScala team’s expertise Scala compiler development lives at Lightbend ● Leverage the existing Scala compiler Fortify SCA uses the real, actual Scala compiler ...to understand the real, actual Scala language Why Lightbend?
- 10. Can I useit? When can I use it?
- 11. ● required: FortifySCA license https://software.microfocus.com/en-us/software/sca/details ● required: Lightbend subscription https://www.lightbend.com/subscription includes support includes the entire Lightbend Enterprise Suite Who can use it?
- 12. ● Scala 2.12and 2.11 all language features ● Java 8 soon: 9 too ● Any build tool sbt, Maven, Gradle, plain scalac... ● Windows, MacOS, Linux Who can use it?
- 13. ● Preview versionalready in use by select customers ● Available to all customers in a few weeks When can I use it? as of November 16, 2017
- 14.
- 15. ● Step 1:Translate ● Step 2: Scan ● Step 3: View results How it works details in demo
- 16. ● Scala compilerplugin ● Runs very late in compilation just before bytecode is emitted similar to Scala.js, Scala Native How it works: Translation source code ... Fortify JVM bytecode
- 17. ● Add thecompiler plugin to your build ● Integrating translation with your existing build ensures fidelity same code, compiled with same compiler version, with same flags... How it works: Translation
- 18. credentials += ... resolvers+= ... addCompilerPlugin(...) scalacOptions += ... How it works: Translation details in demo
- 19. ● Same asany other language supported by Fortify SCA ● Scan locally or on CI server How it works: Scanning
- 20. ● at commandline or in GUI How it works: View results details in demo
- 21. ● Java rulebaseapplies to Scala code as well ● Scala-specific knowledge includes Play, sys.process, tracking data flow through collections API Vulnerabilities
- 22. ● Demo reposhows: ○ Command Injection ○ Cross-Site Scripting ○ Open Redirect ○ Server-Side Request Forgery Sample vulnerabilities
- 23. ● sbt plugin ●coverage for more libraries and frameworks ● support Fortify on Demand ● …? Planned features
- 24. ● let’s seeit in action on a sample project https://github.com/lightbend/play-webgoat It’s demo time!
- 25. ● required: FortifySCA license https://software.microfocus.com/en-us/software/sca/details ● required: Lightbend subscription https://www.lightbend.com/subscription includes support includes the entire Lightbend Enterprise Suite To reiterate...
- 26. lightbend.com/fortify Next Steps Interested inthe Fortify Scala Plugin?
- 27.