能否使用HPE Static Code Analyzer扫描SAP Netweaver Developer Studio开发的SAP Web Dynpro代码？

Great question! The short answer is yes—HPE SCA (now often referenced under the Micro Focus Fortify brand) can absolutely scan SAP Web Dynpro code, but there are key setup details and limitations to keep in mind depending on whether you're working with Web Dynpro for Java or Web Dynpro for ABAP.

Key Details & Setup Steps #

1. Language/Framework Support #

• Web Dynpro for Java: Since this is essentially a Java EE-based framework, HPE SCA’s robust Java rule set will cover most standard security risks (injections, broken authentication, insecure direct object references, etc.). Many modern SCA versions also include specialized rules for SAP Java-based frameworks to catch Web Dynpro-specific issues like improper validation of WDContext inputs or insecure access to SAP backend services.
• Web Dynpro for ABAP: Support here depends on your SCA version. Recent releases include ABAP scanning capabilities, but you may need to enable the ABAP rule pack and ensure your SCA instance is configured to parse ABAP Web Dynpro artifacts (like .wddo files or generated ABAP classes).

2. Preparing Your Code for Scan #

• From Netweaver Developer Studio: Export your Web Dynpro project as a full source code package (or just copy the project directory directly). For Java-based projects, make sure to include the auto-generated gen folder—this contains critical Java files that the Web Dynpro framework generates from your design-time artifacts.
• Avoid Missing Dependencies: If your code references SAP-specific JARs (like com.sap.tc.webdynpro.*), ensure SCA has access to these during the scan (you can add them via the sourceanalyzer command’s -cp flag) to avoid false positives from unrecognized APIs.

3. Configuring the Scan #

• Enable Relevant Rule Sets: In your SCA configuration, enable the core Java/ABAP rules plus any SAP-specific rule packs (look for names like "SAP Web Dynpro" or "SAP Java EE") to get the most accurate results.
• Command Line Example (Java):

  sourceanalyzer -b MyWebDynProProject -cp "/path/to/sap/jars/*" /path/to/exported/project/source
  sourceanalyzer -b MyWebDynProProject -scan -f MyWebDynProScanResults.fpr
  

• Review Results: Use the Fortify Audit Workbench to filter results for Web Dynpro-specific issues—pay extra attention to findings related to input validation, session management, and backend service access.

Limitations to Consider #

• ABAP Web Dynpro Gaps: Some ABAP-specific Web Dynpro constructs (like context binding security or SAP-specific authorization checks) may not be fully covered by default rules. You may need to create custom rules based on SAP’s security best practices to fill these gaps.
• Generated Code Nuances: Auto-generated Web Dynpro code can sometimes include false positives (like automatically generated input handling that’s actually secure). Be sure to tune your scan rules or mark these as false positives after verification.

内容的提问来源于stack exchange，提问作者Umar Hyatt