浮雲雅築: [研究]Fortify ReportGenerator.bat 25.2.0 用 filterSet 參數僅顯示 Critical, High 問題

2025年9月5日星期五

[研究]Fortify ReportGenerator.bat 25.2.0 用 filterSet 參數僅顯示 Critical, High 問題

[研究]Fortify ReportGenerator.bat 25.2.0 用 filterSet 參數僅顯示 Critical, High 問題

2025-09-05

ReportGenerator.bat 25.2.0 位於 C:\Program Files\Fortify\OpenText_Application_Security_Tools_25.2.0\bin 目錄，是 OpenText Fortify SAST (SCA) 靜態程式原始碼安全性掃描工具中，用來產生傳統 pdf 報告的 .bat 程式。

產生報告相關工具還有 BIRTReportGenerator.cmd, FPRUtility.bat。

不加任何參數會顯示所有參數，但看不出版本，僅能根據目錄所在判斷。

C:\>ReportGenerator


Fortify ReportGenerator Help:

Usage: -format pdf -f outputFile.pdf -source myAuditedProject.fpr

Required Options:
        -format         Output format (pdf, xml)
        -f              The file to which results are written
        -source         The audit project on which to base the report

Additional Options:
        -template       The Fortify Report template used to define the report.
                        If omitted then the default template is used
        -user           The user name to include in the report.
        -showRemoved    Include removed issues in the report.
        -showSuppressed Include suppressed issues in the report.
        -showHidden     Include hidden issues in the report.
        -filterSet      The filterset used when generating the report.
        -verbose        Output verbose status messages to the console.
        -debug          Enable debug logging.



C:\>

例如：run.bat

set FORTIFY_TEMPLATE=D:\FortifyTemplate\MyTemplate.xml
set WORKSPACE=D:\WORKSPACE
set SubFolder=Solution1
set JOB_NAME=JOB_Solution1

sourceanalyzer.exe -b %JOB_NAME% -clean
sourceanalyzer.exe -b %JOB_NAME% devenv .\Solution1\Solution1.sln /Rebuild
sourceanalyzer.exe -b %JOB_NAME% -scan -64 -verbose -Xmx14G -format "fpr" -f "%WORKSPACE%\%SubFolder%\Solution1.fpr"
   
ReportGenerator.bat -template %FORTIFY_TEMPLATE% -format "pdf" -f "%WORKSPACE%\%SubFolder%\Solution1.pdf" -source  "%WORKSPACE%\%SubFolder%\Solution1.fpr"

【關於 -filterSet 參數】

官方網站沒找到實際說明和使用範例，實際測試沒有加上時，預設的【Filter Set】是【Security Auditor View】，會把 .fpr 中所有 Critical, High, Medium, Low 都輸出到 .pdf，加上 -filterSet "Quick View" 參數後，僅會輸出 Critical, High到 .pdf 報告，Medium, Low 在 pdf 中都顯示 0。

實際使用範例：

set FORTIFY_TEMPLATE=D:\FortifyTemplate\MyTemplate.xml
set WORKSPACE=D:\WORKSPACE
set SubFolder=Solution1
set JOB_NAME=JOB_Solution1

sourceanalyzer.exe -b %JOB_NAME% -clean
sourceanalyzer.exe -b %JOB_NAME% devenv .\Solution1\Solution1.sln /Rebuild
sourceanalyzer.exe -b %JOB_NAME% -scan -64 -verbose -Xmx14G -format "fpr" -f "%WORKSPACE%\%SubFolder%\Solution1.fpr"
   
ReportGenerator.bat -template %FORTIFY_TEMPLATE% -format "pdf" -f "%WORKSPACE%\%SubFolder%\Solution1.pdf" -source  "%WORKSPACE%\%SubFolder%\Solution1.fpr" -filterSet "Quick View"

下圖，.fpr 中的結果，Filter Set 選 Security Auditor View 時