Page tree

Versions Compared

Key

  • This line was added.
  • This line was removed.
  • Formatting was changed.

...

Kiuwan for Developers (K4D) is a plug-in for the Eclipse IDE that facilitates and automates compliance with quality standards and best practices for several languages.

...

To view the analysis' defects list, go to Window >> Show View >> Other >>  Kiuwan

 

 

Local defects list

Local defects list displays defects found during local analysis executed within your Eclipse by K4D. 

Info
titleLocal defects list

Local defects list displays defects found during local analysis executed within your Eclipse by K4D.

 

 

Info

Double-clicking on a defect will open associated file in Eclipse editor and place cursor on affected line.

Right-clicking and selecting a defect will allow you to inspect Rule Information for a better understanding of the defect.

This option will open an internal browser to display Rule Information.

In case you are presented with Kiuwan Login page, please use the same credentials than used in K4D Connection Settings.

 

Vulnerabilities details (Source and Sink) 

 

Info
titleSource and Sink

Security defects (i.e. vulnerabilites) are prefixed by a > icon. 

Clicking on > icon will open details on associated Source and Sink of the defect.
Just double-click on any of them to open source file and line.

 

 

Configuring Contents 

Local Analysis Configuration

Although K4D will execute the analysis with the rules contained into the model associated to the mapped Kiuwan application, you can further limit .

But K4D also allows you to reduce the scope of the K4D analysis to a subset of that model.

When you execute the local analysis on your Eclipse project, the number of defects can be quite large. If you are not going to work on all of them, you should consider to reduce the analysis to to let you concentrate on the most important subset of defects. K4D allows you to configure the local analysis to only report defects based on PriorityCharacteristic, Language or even a subet of file (based on file path substring)

This would allow you to concentrate on a specific set of rules or files, reducing the number of defects that appear in the list. Only those defects matching those the filters will be displayed.

Filters can be configured based on Priority, Characteristic or Language. Also, you can set a filter for defects of files whose file path contains some substring.

 

Info
titleMax number of defects

An important point is to set a limit for the number of defects displayed in the list

By default, it's set to 100. You can increase such limit, but performance of your Eclipse can be seriously damaged. Take care not to set that limit to a high number.


You can access Local Analysis Configuration by clicking on Image Added icon of Local Defects list. 

Note: All the options unchecked are equivalent to all checked.

 

Configuring

Filters

Defects View

Regardless of you have configured the subset of defects of K4D analysis (see above), you can further reduce that subset the defects view by defining additional filtering conditions.

Most important filter is Scope:

  • File option will only display defects of the selected file in the Eclipse source file editor
  • Project option will display the defects of the entire project

Additionally, you can define filters based on Priority, Characteristic and Language.

You can define view filters by clicking on  Image Added icon of Local Defects list. 

Note: All the options unchecked are equivalent to all checked.

Server defects list

 

Info
titleLocal defects list

Server defects list displays defects of the application stored at the Kiuwan servers.

This utility allows developers to download defects found during Kiuwan analysis of the application in a centralized environnment.


For example, let's consider that at some predefined point in application life cycle (for example, previoulsy to commit a new release to a pre-production environment), the application is analyzed in a centralized environment.
This analysis finds some defects that must be fixed before deploying to next phase. So, you, as a developer,will be notified that you must fix some blocking defects. 
When you start working on it, you need to have full and easy access to those "server" defects. 
Why do you need to have access to server defects ? Because it's very likely that you Local defect list be different to Server defect list:
  • Your current source code could be different to the source code of the server (you or other might already have modified that version)
  • The list of defects to be fixed will be more probably a subset of all defects found during the server analysis (more on this topic below)

In these cases, you will need to have access to server defects.

 

Source of Server defects list

 

Depending on your needs, the source of server defects could be different :
  • Last baseline analysis
    • All the defects found during last complete application analysis (i.e. the Application Baseline)
  • Action plan
    • Defects included within an Action Plan (you can select the plan from the app's list of available action plans)
  • Audit Delivery
    • Defects that must be fixed so the Audit of a delivery can be successfull (you can select the delivery among the list of executed deliveries)

Please, visit Kiuwan Life Cycle documentation for a full explanation of Baseline, Delivery and Audit concepts).

You can access Source of Server defects by clicking on Image Added icon of Server Defects list. 

Note: All the options unchecked are equivalent to all checked.

 

Besides to configure the source of server defects, you can further filter server defects to be downloaded based on Priority, Characteristic, Language or File Pattern

Info
titleMax number of defects

An important point is to set a limit for the number of defects displayed in the list

By default, it's set to 100. You can increase such limit, but performance of your Eclipse can be seriously damaged. Take care not to set that limit to a high number.

 

Configuring Filters

Besides to configure source and filters, you can further reduce the server defect list by defining additional filtering conditions.

You can define view filters by clicking on  Image Added icon of Server Defects list.

Note: All the options unchecked are equivalent to all checked.

 

An important filter is Scope:

  • File option will only display defects of the selected file in the Eclipse source file editor
  • Project option will display the defects of the entire project

Additionally, you can define filters based on PriorityCharacteristic and Language.

Because your source code could be different to the  source code of the analysys server, it might happens that some server defects could not match your current source code.

In these cases, you can filter by Orphan defects to display only those defects matching your currrent source code (defects with associated local resource) or those that doesn't (defects without associated local resource), or all of them.

A server defect could have been muted (for exmple, because it's a false positive or because it's a so special condition that must not be fixed). In these cases, you can use the Muted filter.

Any server defect may have an associated Life Cycle Status (To Review, Reviewed, or None) . When server defects are downloaded, you can filter defects based on their status. 

If you work on a to-review server defect, right-clicking on the defect you can "Mark as reviewed locally" that defect (see image below), and filter the defect list using Reviewed locally filter.

Then, that defect will be marked as "Reviewed locally"

...