Can I run fortify on .jar files instead of .java?

Question

I need to check vulnerabilities (if any) in the third party libraries that are being used in my project using Fortify. For a few third party libraries, I am not able to access their source files. I only have the shipped .jar files. Is it possible to run Fortify on .jar files instead ? All I could find in most of the documentations was that Fortify can be run on .java files, something like this: sourceanalyzer -b MyProject -cp "lib/.jar" "src/*/*.java"

Accepted Answer

You can do one better than LaJmOn's suggestion and actually crack open the jars automatically.

for example:

```
sourceanalyzer -b apple -source 1.6 -Dcom.fortify.sca.fileextensions.jar=ARCHIVE /System/Library/Frameworks/JavaVM.framework/Home/lib/ext/apple_provider.jar
```

Can I run fortify on .jar files instead of .java?

Solution

Problem