Updating the GitHub repos for the 1.6.0 release of the Eclipse Fortify Plugin

As you can see by the recent eclipse related posts, I have been working on a Plugin for Eclipse that shows TeamMentor guidance to users that have access to the Fortify Eclipse plugin (and *.fpr files). We are now in the final stages of releasing the first public version (1.6.0) which is actually made of two parts: An Eclipse Plugin builder (which is Open Source) and a small 'Fortify Specific' code-mapping script. Very soon these will be in separate projects, but for now they are all hosted at the TeamMentor/TeamMentor_Eclipse_Plugin.

This post is just to document the current GitHub development model and where to find the main parts of this release.

How to word-wrap a word without breaking it (when using bootstrap)

I just had one of those bugs that should had taken 5m, but ended up taking a lot more because the behaviour of HTML and bootstrap was not as easy as I was expected.

Basically the problem was that we needed to handle (in the TeamMentor Eclipse Fortify Plugin) the cases when we don't have a TeamMentor mapping for the issue currently being shown in the Fortify views.

The solution was to show the current Fortify recommendation, which is available from their plugin (I need to explain how I got that data in another post), and after integrating that data in our plugin, it looked like this:

High-Res images of TeamMentor's Fortify integration in Eclipe

As you can read about here and here we are in the final process of officially releasing (and selling) the TeamMentor Eclipse Plugin with Fortify support.

Alli (from SI Marketing) asked me for some High-Res screenshots of how it works, which I just created on a clean install of Eclipse Kepler 64bit on OSX with both Fortify and TeamMentor plugins installed.

You can see the images below, or download the 1.2Mb images from these links:

• TeamMentor_Inside_Eclipse.png
• TM_Fortify_Command_Injection.png
• TM_Fortify_First_View.png
• TM_Fortify_SQL_Injection_Bottom_Part.png
• TM_Fortify_SQL_Injection_TopPart.png

Thse where taken on a MacBook Air with Retina display, using the OSX screenshot tool, which creates images with a 3108 × 2028 resolution (which I hope is OK for print).

Video: Coding WebInspect in real-time to Inject Fortify Plugin Views

Here is a detailed video that shows the multiple steps required to inject windows originally hosted in Eclipse (Java process) into WebInspect (.NET process).

Of course that this workflow could be automated using a script, but I hope that the video below helps to explain how it is actually works, and how windows are hijacked from one process into another:

Two Videos showing TeamMentor Eclipse Plugin integration with Fortify Eclipse Plugin (as shown in HP Protect 2013 conference)

Here are main videos shown at the HP Protect 2013 conference.

This is our first working version of an TeamMentor Eclipse plug-in that is able to show security guidance natively on Eclipse.

Injecting Fortify Eclipse Plug-in Views into Notepad and WebInspect (and key difference between Fortify content and TeamMentor content)

Following from Opening up a native Chrome Browser window inside Eclipse (raw version) and Injecting HP Fortify Eclipse Plug-in Views into HP’s WebInspect UI  here are a couple more examples of how to reuse Fortify Eclipse Plug-in Views into other processes.

Example 1: WebInspect with Fortify and TeamMentor (inside Chrome)

Injecting HP Fortify Eclipse Plug-in Views into HP’s WebInspect UI

Using the O2’s Win32 Window Hijacking capabilities (see also Opening up a native Chrome Browser window inside Eclipse (raw version)) , here is a PoC on how to inject a couple Eclipse Views from the HP Fortify Eclipse plug-in (which is Java app running under an JVM) into the HP WebInspect UI (which is .NET app running under an CLR).

The power of this PoC is to show that we can have the best of both worlds and show security consultants and developers the best possible environment/UI for them to analyze, review and fix security vulnerabilities.

Adding Custom Descriptions and Content to Fortify using the RulePack's CustomDescriptionRule element

After Cat.Net and Checkmarx, the next TeamMentor integration target is HP's Fortify

The idea is to add references and cross-links between Fortify results and TeamMentor Guidance. Since that way we get the best of both worlds: 

• SAST Findings
• Targeted and customised Security Guidance

I'm currently using the 5.16 version of Fortify which contains a nice Rule Editor that can be used to create well formatted RulePack files (this tool also as a nice wizard to help with the creation of 'proper' custom rules (for example to map out new Sources or Sinks)):