Setting up the Static Analyzer Command Line Utility
For static analysis, download a small Command Line Utility. When you extract the utility to your local disk, you can use its command line interface (CLI) to perform security analysis.
About this task
- When the IRX file is generated for compiled languages, application byte code files are converted into an Intermediate Representation of the code.
- When an IRX file is generated for scripting languages, source files are included in the encrypted IRX file.
- When you use the Visual Studio plug-in, IRX file generation and upload happens automatically from the IDE.
Procedure
-
Start the Create scan wizard.
Important: AppScan 360° users must use the versions of the Static Analyzer Command Line Utility (
SAClientUtil
) and AppScan Go! included with the AppScan 360° installation. AppScan on Cloud users must use the versions downloaded from the AppScan on Cloud service. They are not interchangeable. - Click Create scan under SAST.
- Click Upload an archive to scan.
-
Under Generate the IRX file, select
the platform on which you plan to run the Command Line Utility, and then click
Download. This downloads an
SAClientUtil_<version>_<os>.zip
file (where <version> is the current version of the Command Line Utility and <os> is the operating system that the Command Line Utility is for).Note: You can reopen the welcome form by selecting How do I create an IRX file? in the form to select an IRX file. - Extract the file to a local drive.
-
If you plan to use the CLI for IRX file generation,
uploading IRX files, or for managing scans: Add the location
of the \bin directory of the extracted
SAClientUtil_<version>_<os>.zip
file to yourPATH
environment variable. If you do not do this, all commands will need to be qualified by using the \bin directory of the extractedSAClientUtil_<version>_<os>.zip
file each time the command is issued.Tip: After you change thePATH
, issueappscan version
(Windows™) orappscan.sh version
(Linux™ and macOS) at a command prompt. If the Static Analyzer Command Line Utility version, home, and other information are returned, thePATH
is set correctly.
What to do next
If you are running the Command Line Utility on a computer that is behind a proxy, use one of these methods for specifying the proxy so that the Command Line Utility can connect to the cloud:
- Command Line Utility CLI and supported integrated development
environments (IDE): Set this global or system environment variable so that the
proxy is automatically recognized:
- Windows:
APPSCAN_OPTS=-Dhttps.proxyHost=<proxy> -Dhttps.proxyPort=<port>
- Linux and macOS:
APPSCAN_OPTS="-Dhttps.proxyHost=<proxy> -Dhttps.proxyPort=<port>"
Where
<proxy>
is the host name of the proxy server and<port>
is the port number that the proxy server is using.Or, each time that you use the CLI or IDE (launched from a command prompt or terminal), you can set the Command Line Utility to use the proxy by issuing a command:
- Windows™:
set "APPSCAN_OPTS=-Dhttps.proxyHost=<proxy> -Dhttps.proxyPort=<port>"
- Linux™ and macOS:
export APPSCAN_OPTS="-Dhttps.proxyHost=<proxy> -Dhttps.proxyPort=<port>"
- Windows:
- Maven: If you added the static
analysis plug-in to Maven, you can add the property to the
MAVEN_OPTS
environment variable globally or you can add the property to each command.
- Static Analyzer Command Line Utility updates are available on
a regular basis and details listed in Recent updates.
Updates may include:
- New language support
- Updated language support (new files types associated with supported languages, for example)
- New features
- Fixes
- Plugins automatically download the latest Static Analyzer Command Line Utility when they run.
- If you try to prepare code for scanning using an outdated version of the Static Analyzer Command Line Utility, you may see a message directing you to update the utility to the latest version. Upgrade to the latest Static Analyzer Command Line Utility based on your operating system (Windows, Linux, Mac).
- If you are using AppScan Go!, accept and install the latest update if an update is offered.