Important: Please read the Qt Code of Conduct -

Using Fortify SCA (not outdated “HP Fortify”) on Qt code

  • I've been trying to research this for a while and my limited experience with compiling is hindering my ability to figure it out.

    Basically, I have some code which is being written in Qt Creator, then built with these build steps:

    qmake.exe [project name].pro -spec win32-msvc "CONFIG+=qtquickcompiler"
    jom.exe in C:\eclipseworkspace[project directory]

    I'd like to use the Fortify SCA (Static Code Analyzer) to automatically scan this code for vulnerabilities, but most of its user-friendly features are designed towards Java. I haven't given up, though, because Fortify does claim to be able to scan C++ code that uses 3rd Party Compilers (which I assume Qt falls into that category). (Page 37 of this document)

    As a preliminary step to running Qt Creator on my actual code, I've wanted to see if I can at least get it to run on any Qt sample project, to see what the steps to do that would be.

    I'm using Qt 5.12.7 on a Windows 10 OS with the MSVC2017 32bit compiler, but I feel any correlation between Qt and Fortify that works will be enough to set me off in the right direction.

    Or perhaps my optimism is misplaced and I just don't understand the limitations of what I want to do. Either way, it'd be nice to know.

  • Lifetime Qt Champion

    Hi and welcome to devnet,

    Qt does not use third party compiler. However it uses tools to generate code and build files.

    One possible way would be to create a custom makespec based on the one used by your kit and modify there the compiler line to include the specifics of Fortify.

  • Thank you for your response!

    I'll look into that when I get some time. In the meantime, do you have any examples of "creating a custom makespec" that I could refer to so I know I'm on the right track?
    Also, to verify, Qt (and qmake) would not be considered a third party C++ compiler, either?

  • Lifetime Qt Champion

    To create a new one, copy the one you are using and give it a new name.

Log in to reply