Static Reviewer, Software Composition Analysis, Firewall Firmware Reviewer and Team Reviewer provide a Command Line Interface (CLI) for easy integrating on supported and unsupported CI/CD Platform.
...
While you execute an Analysis of an application with Command Line Interface, you can do other tasks with Security Reviewer graphic interface or Jenkins plugin simultaneously.
CLI command are written in .NET Core, available for Windows and Linux. They can be included in .bat and .sh as well as in CI/CD Pipeline.
Using the Command Line Interface is provided through SRConsole command. Itis a JAVA application that can be included both in a .cmd, .bat and a .sh file.
In case of Multi-Analysis, they can:
Parallel Analyses. All analysis tasks will be done simoultaneously until hardware resource availability. In case resource consumption will reach 90%, the remaining analysis tasks will be serialized.
Sequential Analyses
...
, you can:
Include Static Reviewer in your DevOps
Set Team Reviewer’s connection
Set Language Options via CLI
Execute a Multiple Static Analysis (Multi-Analysis) of different types on different applications, written in different languages
Command Line Interface is provided through some basic commands:
SRCheck
To launch the Scan. It provides the following arguments:
Mandatory Arguments
-a APPLICATION -v VERSION -p FOLDERTOSCAN -r RULESET
Where:
APPLICATION is the name of the App you want to scan. If contains spaces or “-“ must be double quoted
VERSION. Version of App. If contains spaces or “-“ must be double quoted
FOLDERTOSCAN pathname of the source code folder to scan. If contains spaces or “-“ must be double quoted
RULESET can be CWE, OWASP, OWASP2021
Additional Arguments
-c COMPONENTS -s FPS -d FPD -e EXCLUSIONS -w ALM -m -x -n -o -f CUSTOMSEC -q CUSTOMDEAD
Where:
-m, --mobile in case of Mobile App
-x, --noexclusion do Not Apply Exclusions
-n, --skippdf to skip PDF reports creation
-o, --onlysec Security Analysis only
-f, --customsec Custom Security Ruleset
-q, --customdead Custom Dead Code-Best Practices Ruleset
COMPONENTS pathname of Components XML file. If the path contains spaces or “-“must be double quoted. See related section above.
FPS pathname of Security False Positives CSV file, to be imported from a previous scan. If the path contains spaces or “-“ must be double quoted
FPD pathname of Dead Code-Best Practices False Positives CSV file, to be imported from a previous scan. If the path contains spaces or “-“ must be double quoted
EXCLUSIONS pathname of Exclusion txt file, to be imported from a previous scan. If the path contains spaces or “-“ must be double quoted. See related section above.
ALM pathname of Components XML file. If the path contains spaces or “-“ must be double quoted. See related section above.
CUSTOMSEC Path of custom ruleset (.rls) for Security Analysis
CUSTOMDEAD Path of custom ruleset (.rls) for Dead Code-Best Practices Analysis
Informational Arguments
--help Display the Usage screen
--version Display version information
-l, --silent Silent Mode
-g, --debug Debug Mode
Team Reviewer Arguments
In case you purchased Team Reviewer, some additional arguments are available to SRCheck:
-t, --tenant Tenant name (Default: USER, in case of mono-tenant)
-u, --update Update Results on Team Reviewer
-b, --pType Product Type (Only with -u and if omitted = User Group)
-T, --truri Override Team Reviewer URL usually set with SRsetCNF command (see below)
-P, --port Override Team Reviewer Port usually set with SRsetCNF command (see below)
-K, --apikey Override API Key usually set with SRsetCNF command (see below)
-U, --proxyuser Override Proxy User
-W, --proxypasswd Override Proxy Password
-I, --proxyuri Override Proxy URL
-X, --proxyport Override Proxy Port
SRsetCNF
Sets the Team Reviewer Connection Configuration. Please note that each argument needs “=”.
Mandatory Arguments
SRsetCNF -url=TEAMREVIEWERURL -tcpport=TEAMREVIEWERPORT –api=APIKEY
Where:
-url Team Reviewer URL
-tcpport Team Reviewer TCP Port
–api Your personal API Key to connect to Team Reviewer
Additional Arguments
In case you have a multi-tenant Team Reviewer configuration:
-tenant Team Reviewer tenant name
-add Add a Team Reviewer tenant by name from your client configuration
-delete Remove a Team Reviewer tenant by name from your client configuration
In case you are connected to Team Reviewer through a Proxy, the following optional arguments are available:
-proxy=PROXYIP -proxyport=PROXYTCPPORT -user=USERNAME -pwd=PASSWORD
SRsetOPT
SRsetOPT to set the Language Options before scanning for locating Java JDK, COBOL copybooks folder, and Ruby executable. Please note that each argument needs “=”. It provides the following arguments:
-l=LANGUAGE -p=PATH
Where:
LANGUAGE can be java or cobol or ruby
PATH
For JAVA is the java executable location, for example “C:\Program Files\Java\jdk-11.0.11\bin” or “/usr/bin/”. For Ruby is the Ruby installation path, for example “C:\ruby193” (Not needed under Linux).
For COBOL is the CopyBook folder, for example “D:\_COPY” or ”/home/user1/src/copybooks”.
Software Composition Analysis
...
Firmware Reviewer
...
Team Reviewer API Client
Team Reviewer is our default Dashboard. All features provided by the Web GUI are invokable via REST API, including Admin tasks. Team Reviewer provides a JAVA tool for invoking REST API via Command Line.
...