Wednesday, 18 September 2013

Injecting Fortify Eclipse Plug-in Views into Notepad and WebInspect (and key difference between Fortify content and TeamMentor content)

Following from Opening up a native Chrome Browser window inside Eclipse (raw version) and Injecting HP Fortify Eclipse Plug-in Views into HP’s WebInspect UI  here are a couple more examples of how to reuse Fortify Eclipse Plug-in Views into other processes.

Example 1: WebInspect with Fortify and TeamMentor (inside Chrome)

image

Left Panel: WebInspect (.Net)

image

Top-right Panel: Fortify’s SCA Audits Results (Java SWT)

image

Middle-right Panel: Fortify’s Remediation (Java SWT)

image

Bottom-right Panel: Chrome (C++) with TeamMentor loader

image


Example 2) WebInspect with Fortify views

image

Note how all controls are alive

image

... and working ok:

image

…where events in the SCA Analysis Result view are reflected in the other injected Fortify views

image

... like the Trace Diagram of the selected finding:

image

Example 3) WebInspect with one Fortify View and a C# REPL

image


Example 4) Fortify Views in Notepad

Here is the Analysis Evidence View inside Notepad:

image

Which is a really powerful concept, since we can show security guidance even to developers that want to code using Notepad.

Next lets show below the SCA Analysis view, the multiple Fortify views usually shown in the lower-middle pane of Eclipse (i.e. let's add an Eclipse TabControl currently hosting multiple Fortify Plugin views)

image

Again the multiple Fortify views are synchronised with the selected finding (n the SCA Analysis view

Like the Issue Details:

image

Issue Description

image

… or Recommendations
image


Example 4) Injecting Fortify and Chrome into WebInspect

In this final example, whe have:
  • at the top: text-based Fortify content
  • at the bottom:  web-based TeamMentor content (in Chrome):

image

Apart from the look and feel (and linkage) differences, the TeamMentor content is Editable:

image

... which allows for the creation of custom (per app or finding) guidance, targeted for developers and (ideally) designed so that developers can copy and paste from it:

image
Post a Comment