Coverity is a powerful static application security testing (SAST) tool that identifies critical security vulnerabilities, quality defects, and compliance issues in Java codebases.
Setup and Installation
1. Prerequisites and Dependencies
<!-- Maven Dependencies for Analysis -->
<properties>
<coverity.version>2023.09</coverity.version>
<jacoco.version>0.8.10</jacoco.version>
</properties>
<build>
<plugins>
<!-- Coverity Maven Plugin -->
<plugin>
<groupId>com.synopsys.integration</groupId>
<artifactId>coverity-maven-plugin</artifactId>
<version>1.1.0</version>
</plugin>
<!-- JaCoCo for Code Coverage -->
<plugin>
<groupId>org.jacoco</groupId>
<artifactId>jacoco-maven-plugin</artifactId>
<version>${jacoco.version}</version>
<executions>
<execution>
<goals>
<goal>prepare-agent</goal>
</goals>
</execution>
<execution>
<id>report</id>
<phase>verify</phase>
<goals>
<goal>report</goal>
</goals>
</execution>
</executions>
</plugin>
<!-- Compiler Configuration -->
<plugin>
<groupId>org.apache.maven.plugins</groupId>
<artifactId>maven-compiler-plugin</artifactId>
<version>3.11.0</version>
<configuration>
<source>17</source>
<target>17</target>
<encoding>UTF-8</encoding>
<showWarnings>true</showWarnings>
<showDeprecation>true</showDeprecation>
</configuration>
</plugin>
</plugins>
</build>
2. Coverity Configuration File
# coverity-config.xml <?xml version="1.0" encoding="UTF-8" standalone="no"?> <coverity-config version="1.0"> <build> <compiler> <name>java</name> <version>17</version> <target>17</target> </compiler> <source> <encoding>UTF-8</encoding> </source> </build> <analysis> <checker> <name>ALL</name> <enabled>true</enabled> </checker> <checker-group> <name>SECURITY</name> <enabled>true</enabled> </checker-group> <checker-group> <name>MISRA</name> <enabled>false</enabled> </checker-group> </analysis> <stream> <name>java-application</name> <description>Java Application Analysis Stream</description> </stream> </coverity-config>
3. Environment Setup Script
#!/bin/bash # setup-coverity.sh # Set Coverity home directory export COVERITY_HOME=/opt/cov-analysis-linux64-2023.09 export PATH=$COVERITY_HOME/bin:$PATH # Coverity Connect server details export COVERITY_URL=https://coverity.example.com export COVERITY_USERNAME=coverity-user export COVERITY_PASSWORD=coverity-password # Project configuration export COVERITY_PROJECT=java-application export COVERITY_STREAM=java-application-main echo "Coverity environment configured" echo "COVERITY_HOME: $COVERITY_HOME" echo "COVERITY_URL: $COVERITY_URL" echo "COVERITY_PROJECT: $COVERITY_PROJECT"
Build System Integration
1. Maven Integration
<!-- Coverity Maven Plugin Configuration -->
<plugin>
<groupId>com.synopsys.integration</groupId>
<artifactId>coverity-maven-plugin</artifactId>
<version>1.1.0</version>
<configuration>
<url>${coverity.url}</url>
<user>${coverity.user}</user>
<password>${coverity.password}</password>
<project>${coverity.project}</project>
<stream>${coverity.stream}</stream>
<covBuildOptions>--security</covBuildOptions>
<javaCompilerArgs>
<arg>-source</arg>
<arg>17</arg>
<arg>-target</arg>
<arg>17</arg>
<arg>-encoding</arg>
<arg>UTF-8</arg>
</javaCompilerArgs>
</configuration>
<executions>
<execution>
<id>coverity-analysis</id>
<phase>verify</phase>
<goals>
<goal>build</goal>
<goal>commit</goal>
<goal>run-history</goal>
</goals>
</execution>
</executions>
</plugin>
<!-- Profile for Coverity Analysis -->
<profiles>
<profile>
<id>coverity</id>
<properties>
<coverity.url>https://coverity.example.com</coverity.url>
<coverity.user>${env.COVERITY_USERNAME}</coverity.user>
<coverity.password>${env.COVERITY_PASSWORD}</coverity.password>
<coverity.project>java-application</coverity.project>
<coverity.stream>java-application-${project.version}</coverity.stream>
</properties>
<build>
<plugins>
<plugin>
<groupId>org.apache.maven.plugins</groupId>
<artifactId>maven-surefire-plugin</artifactId>
<version>3.0.0</version>
<configuration>
<skipTests>true</skipTests>
</configuration>
</plugin>
</plugins>
</build>
</profile>
</profiles>
2. Gradle Integration
// build.gradle
plugins {
id 'java'
id 'com.coverity.coverity-gradle-plugin' version '8.0.0'
}
coverity {
covHome = System.getenv('COVERITY_HOME')
connect {
url = System.getenv('COVERITY_URL')
user = System.getenv('COVERITY_USERNAME')
password = System.getenv('COVERITY_PASSWORD')
project = System.getenv('COVERITY_PROJECT')
stream = System.getenv('COVERITY_STREAM')
}
tasks {
main {
buildCommand = 'gradle compileJava'
analyzeArguments = '--security --all'
}
}
}
task coverityBuild(type: com.coverity.gradle.tasks.CoverityBuild) {
description = 'Run Coverity build'
group = 'Verification'
doFirst {
println "Running Coverity analysis for project: ${project.name}"
}
}
task coverityAnalyze(type: com.coverity.gradle.tasks.CoverityAnalyze) {
description = 'Run Coverity analysis'
group = 'Verification'
dependsOn coverityBuild
}
task coverityCommit(type: com.coverity.gradle.tasks.CoverityCommit) {
description = 'Commit Coverity results'
group = 'Verification'
dependsOn coverityAnalyze
}
3. Jenkins Pipeline
// Jenkinsfile
pipeline {
agent any
environment {
COVERITY_HOME = '/opt/cov-analysis-linux64-2023.09'
COVERITY_URL = 'https://coverity.example.com'
COVERITY_PROJECT = 'java-application'
COVERITY_STREAM = 'java-application-${env.BRANCH_NAME}'
}
stages {
stage('Checkout') {
steps {
checkout scm
}
}
stage('Build') {
steps {
sh 'mvn clean compile -DskipTests'
}
}
stage('Coverity Analysis') {
steps {
script {
withCredentials([usernamePassword(
credentialsId: 'coverity-credentials',
usernameVariable: 'COVERITY_USERNAME',
passwordVariable: 'COVERITY_PASSWORD'
)]) {
sh '''
mvn coverity:build coverity:analyze coverity:commit \
-Dcoverity.url=${COVERITY_URL} \
-Dcoverity.user=${COVERITY_USERNAME} \
-Dcoverity.password=${COVERITY_PASSWORD} \
-Dcoverity.project=${COVERITY_PROJECT} \
-Dcoverity.stream=${COVERITY_STREAM} \
-DskipTests
'''
}
}
}
post {
success {
coverityIssueReport qualityGate: true
}
}
}
stage('Quality Gate') {
steps {
script {
def qualityGate = coverityQualityGate()
if (qualityGate.failed) {
error "Coverity Quality Gate failed: ${qualityGate.reason}"
}
}
}
}
}
post {
always {
publishHTML([
allowMissing: false,
alwaysLinkToLastBuild: true,
keepAll: true,
reportDir: 'target/coverity/report',
reportFiles: 'index.html',
reportName: 'Coverity Report'
])
}
}
}
Code Examples for Analysis
1. Security Vulnerabilities (Coverity will detect)
package com.example.vulnerable;
import java.sql.*;
import java.io.*;
import java.util.logging.Logger;
public class SecurityVulnerabilities {
private static final Logger logger = Logger.getLogger(SecurityVulnerabilities.class.getName());
// Coverity: SQL_INJECTION
public User findUserInsecure(String username) throws SQLException {
Connection conn = DriverManager.getConnection("jdbc:mysql://localhost/test");
Statement stmt = conn.createStatement();
// VULNERABLE: SQL Injection
String query = "SELECT * FROM users WHERE username = '" + username + "'";
ResultSet rs = stmt.executeQuery(query); // Coverity will flag this
return rs.next() ? mapToUser(rs) : null;
}
// Coverity: COMMAND_INJECTION
public void executeCommandInsecure(String userInput) throws IOException {
// VULNERABLE: Command Injection
Runtime.getRuntime().exec("ping " + userInput); // Coverity will flag this
}
// Coverity: PATH_MANIPULATION
public void readFileInsecure(String filename) throws IOException {
// VULNERABLE: Path Manipulation
File file = new File("/data/" + filename);
FileInputStream fis = new FileInputStream(file); // Coverity might flag this
// Process file...
fis.close();
}
// Coverity: RESOURCE_LEAK
public void processFileResourceLeak(String filename) throws IOException {
// VULNERABLE: Resource Leak
FileInputStream fis = new FileInputStream(filename);
BufferedReader reader = new BufferedReader(new InputStreamReader(fis));
String line;
while ((line = reader.readLine()) != null) {
System.out.println(line);
}
// Missing: reader.close() and fis.close()
}
// Coverity: NULL_RETURNS
public void potentialNullPointer(String input) {
String result = getPossiblyNullString(input);
// VULNERABLE: Potential NPE
System.out.println(result.length()); // Coverity will flag this
}
// Coverity: FORWARD_NULL
public void forwardNullDereference(String input) {
String processed = processString(input);
if (processed != null) {
System.out.println(processed.length());
}
}
private String processString(String input) {
if (input == null) {
return null; // Coverity: FORWARD_NULL
}
return input.trim();
}
private String getPossiblyNullString(String input) {
if (input.isEmpty()) {
return null;
}
return input.toUpperCase();
}
private User mapToUser(ResultSet rs) throws SQLException {
User user = new User();
user.setId(rs.getInt("id"));
user.setUsername(rs.getString("username"));
return user;
}
}
2. Secure Code Examples
package com.example.secure;
import java.sql.*;
import java.io.*;
import java.nio.file.Paths;
import java.util.logging.Logger;
import java.util.regex.Pattern;
public class SecureImplementations {
private static final Logger logger = Logger.getLogger(SecureImplementations.class.getName());
private static final Pattern FILENAME_PATTERN = Pattern.compile("^[a-zA-Z0-9._-]+\\.txt$");
// SECURE: Parameterized query
public User findUserSecure(String username) throws SQLException {
String sql = "SELECT * FROM users WHERE username = ?";
try (Connection conn = DriverManager.getConnection("jdbc:mysql://localhost/test");
PreparedStatement stmt = conn.prepareStatement(sql)) {
stmt.setString(1, username);
try (ResultSet rs = stmt.executeQuery()) {
return rs.next() ? mapToUser(rs) : null;
}
}
}
// SECURE: Validated command execution
public void executeCommandSecure(String hostname) throws IOException {
if (!isValidHostname(hostname)) {
throw new IllegalArgumentException("Invalid hostname: " + hostname);
}
String[] command = {"ping", "-c", "1", hostname};
Process process = Runtime.getRuntime().exec(command);
// Process output securely
try (BufferedReader reader = new BufferedReader(
new InputStreamReader(process.getInputStream()))) {
String line;
while ((line = reader.readLine()) != null) {
logger.info("Ping output: " + line);
}
}
}
// SECURE: Path validation
public void readFileSecure(String filename) throws IOException {
if (!FILENAME_PATTERN.matcher(filename).matches()) {
throw new SecurityException("Invalid filename: " + filename);
}
Path safePath = Paths.get("/data", filename).normalize();
if (!safePath.startsWith("/data")) {
throw new SecurityException("Path traversal attempt: " + filename);
}
try (FileInputStream fis = new FileInputStream(safePath.toFile());
BufferedReader reader = new BufferedReader(new InputStreamReader(fis))) {
String line;
while ((line = reader.readLine()) != null) {
processLine(line);
}
}
}
// SECURE: Null-safe programming
public void nullSafeProcessing(String input) {
String result = getPossiblyNullStringSafe(input);
if (result != null) {
System.out.println(result.length());
} else {
logger.warning("Received null input, skipping processing");
}
}
// SECURE: Resource management
public void processFileSecure(String filename) throws IOException {
try (FileInputStream fis = new FileInputStream(filename);
InputStreamReader isr = new InputStreamReader(fis);
BufferedReader reader = new BufferedReader(isr)) {
String line;
while ((line = reader.readLine()) != null) {
processLine(line);
}
} // Resources automatically closed
}
// SECURE: Input validation
public boolean isValidHostname(String hostname) {
if (hostname == null || hostname.length() > 253) {
return false;
}
String hostnameRegex = "^[a-zA-Z0-9]([a-zA-Z0-9-]{0,61}[a-zA-Z0-9])?(\\.[a-zA-Z0-9]([a-zA-Z0-9-]{0,61}[a-zA-Z0-9])?)*$";
return hostname.matches(hostnameRegex);
}
private String getPossiblyNullStringSafe(String input) {
if (input == null || input.trim().isEmpty()) {
return null;
}
return input.trim().toUpperCase();
}
private void processLine(String line) {
// Process each line securely
logger.info("Processing: " + line);
}
private User mapToUser(ResultSet rs) throws SQLException {
User user = new User();
user.setId(rs.getInt("id"));
user.setUsername(rs.getString("username"));
return user;
}
}
3. Coverity Annotations and Suppressions
package com.example.annotations;
import java.sql.*;
import java.io.*;
// Custom annotations for Coverity
public @interface CoveritySuppress {
String value();
}
public @interface CoveritySecure {
String rationale();
}
public class AnnotatedCode {
// Coverity: Intentional resource not closed (false positive)
@CoveritySuppress("RESOURCE_LEAK")
public InputStream getGlobalResource() throws FileNotFoundException {
// This InputStream is managed elsewhere and intentionally not closed here
return new FileInputStream("global-config.properties");
}
// Coverity: False positive - null is handled by framework
@CoveritySuppress("NULL_RETURNS")
public String getNullableResult() {
// Framework handles null returns appropriately
return someFrameworkMethod();
}
// Secure method with annotation
@CoveritySecure(rationale = "Input validated and parameterized query used")
public User findUserValidated(String username) throws SQLException {
if (username == null || username.trim().isEmpty()) {
throw new IllegalArgumentException("Username cannot be null or empty");
}
// Additional input validation
if (!username.matches("^[a-zA-Z0-9_]{3,50}$")) {
throw new IllegalArgumentException("Invalid username format");
}
String sql = "SELECT * FROM users WHERE username = ?";
try (Connection conn = getConnection();
PreparedStatement stmt = conn.prepareStatement(sql)) {
stmt.setString(1, username);
try (ResultSet rs = stmt.executeQuery()) {
return rs.next() ? mapToUser(rs) : null;
}
}
}
// Coverity: Intentional command execution
@CoveritySuppress("COMMAND_INJECTION")
@CoveritySecure(rationale = "Command and arguments are hardcoded, no user input")
public void executeSystemCommand() throws IOException {
// This is a safe system command with no user input
String[] command = {"ls", "-la", "/tmp"};
Process process = Runtime.getRuntime().exec(command);
// Process output...
}
private Connection getConnection() throws SQLException {
return DriverManager.getConnection("jdbc:mysql://localhost/test");
}
private String someFrameworkMethod() {
// Framework implementation
return null; // Intentional for framework behavior
}
private User mapToUser(ResultSet rs) throws SQLException {
User user = new User();
user.setId(rs.getInt("id"));
user.setUsername(rs.getString("username"));
return user;
}
}
Coverity Configuration Files
1. Coverity Analysis Configuration
<!-- coverity-analysis-config.xml -->
<?xml version="1.0" encoding="UTF-8"?>
<analysis-config version="1.0">
<checker-config>
<!-- Security checkers -->
<checker name="SQL_INJECTION">
<enabled>true</enabled>
<severity>HIGH</severity>
</checker>
<checker name="COMMAND_INJECTION">
<enabled>true</enabled>
<severity>HIGH</severity>
</checker>
<checker name="PATH_MANIPULATION">
<enabled>true</enabled>
<severity>MEDIUM</severity>
</checker>
<!-- Resource management -->
<checker name="RESOURCE_LEAK">
<enabled>true</enabled>
<severity>MEDIUM</severity>
</checker>
<checker name="NULL_RETURNS">
<enabled>true</enabled>
<severity>MEDIUM</severity>
</checker>
<!-- Code quality -->
<checker name="FORWARD_NULL">
<enabled>true</enabled>
<severity>MEDIUM</severity>
</checker>
<checker name="DEADCODE">
<enabled>true</enabled>
<severity>LOW</severity>
</checker>
</checker-config>
<analysis-options>
<option name="security" value="true"/>
<option name="java-version" value="17"/>
<option name="analysis-threads" value="4"/>
<option name="strip-path" value="${source.dir}"/>
</analysis-options>
<file-options>
<include path="src/main/java/**/*.java"/>
<exclude path="src/test/java/**/*.java"/>
<exclude path="**/generated/**/*.java"/>
</file-options>
</analysis-config>
2. Suppressions File
<!-- coverity-suppressions.xml --> <?xml version="1.0" encoding="UTF-8"?> <suppressions version="1.0"> <!-- Suppress specific issues in test code --> <suppress> <file>.*/src/test/.*</file> <checker>RESOURCE_LEAK</checker> <reason>Test code resource management handled by framework</reason> </suppress> <!-- Suppress intentional null returns in framework code --> <suppress> <file>.*/framework/.*</file> <checker>NULL_RETURNS</checker> <reason>Framework intentionally returns null in certain cases</reason> </suppress> <!-- Suppress specific method false positives --> <suppress> <file>.*/AnnotatedCode\.java</file> <function>getGlobalResource</function> <checker>RESOURCE_LEAK</checker> <reason>Resource managed globally, intentional design</reason> </suppress> <!-- Suppress third-party library issues --> <suppress> <file>.*/lib/.*\.jar</file> <checker>ALL</checker> <reason>Third-party library code</reason> </suppress> </suppressions>
Advanced Integration
1. Custom Checker Configuration
// Custom Coverity Checker Example
package com.example.coverity.custom;
import com.coverity.security.api.Checker;
import com.coverity.security.api.CheckerContext;
import com.coverity.security.api.CheckerResult;
import com.coverity.security.api.SourceLocation;
@Checker(
id = "CUSTOM_SENSITIVE_DATA_LOGGING",
name = "Sensitive Data Logging Checker",
description = "Detects logging of sensitive data",
category = "SECURITY",
severity = Checker.Severity.MEDIUM
)
public class SensitiveDataLoggingChecker {
private static final String[] SENSITIVE_KEYWORDS = {
"password", "secret", "token", "key", "credential"
};
public CheckerResult check(CheckerContext context) {
// Implementation to detect sensitive data logging
// This is a simplified example
String code = context.getCode();
SourceLocation location = context.getLocation();
for (String keyword : SENSITIVE_KEYWORDS) {
if (code.toLowerCase().contains(keyword) &&
(code.contains("log.") || code.contains("Logger") || code.contains("System.out"))) {
return CheckerResult.failure(
location,
"Potential sensitive data logging: " + keyword,
"Avoid logging sensitive information"
);
}
}
return CheckerResult.success();
}
}
2. Coverity REST API Integration
package com.example.coverity.api;
import org.springframework.http.*;
import org.springframework.web.client.RestTemplate;
import com.fasterxml.jackson.databind.JsonNode;
import com.fasterxml.jackson.databind.ObjectMapper;
import java.util.*;
public class CoverityApiClient {
private final String baseUrl;
private final String username;
private final String password;
private final RestTemplate restTemplate;
private final ObjectMapper objectMapper;
public CoverityApiClient(String baseUrl, String username, String password) {
this.baseUrl = baseUrl;
this.username = username;
this.password = password;
this.restTemplate = new RestTemplate();
this.objectMapper = new ObjectMapper();
}
public List<CoverityIssue> getProjectIssues(String projectName) {
String url = baseUrl + "/api/issues/v1?projectId=" + projectName;
HttpHeaders headers = createHeaders();
HttpEntity<String> entity = new HttpEntity<>(headers);
ResponseEntity<String> response = restTemplate.exchange(
url, HttpMethod.GET, entity, String.class);
try {
JsonNode root = objectMapper.readTree(response.getBody());
return parseIssues(root);
} catch (Exception e) {
throw new RuntimeException("Failed to parse Coverity issues", e);
}
}
public void suppressIssue(String issueId, String reason) {
String url = baseUrl + "/api/issues/v1/" + issueId + "/suppress";
Map<String, String> suppression = new HashMap<>();
suppression.put("reason", reason);
HttpHeaders headers = createHeaders();
HttpEntity<Map<String, String>> entity = new HttpEntity<>(suppression, headers);
restTemplate.exchange(url, HttpMethod.POST, entity, String.class);
}
public CoverityMetrics getProjectMetrics(String projectName) {
String url = baseUrl + "/api/metrics/v1?projectId=" + projectName;
HttpHeaders headers = createHeaders();
HttpEntity<String> entity = new HttpEntity<>(headers);
ResponseEntity<CoverityMetrics> response = restTemplate.exchange(
url, HttpMethod.GET, entity, CoverityMetrics.class);
return response.getBody();
}
private HttpHeaders createHeaders() {
HttpHeaders headers = new HttpHeaders();
headers.setContentType(MediaType.APPLICATION_JSON);
headers.setAccept(Collections.singletonList(MediaType.APPLICATION_JSON));
String auth = username + ":" + password;
String encodedAuth = Base64.getEncoder().encodeToString(auth.getBytes());
headers.set("Authorization", "Basic " + encodedAuth);
return headers;
}
private List<CoverityIssue> parseIssues(JsonNode root) {
List<CoverityIssue> issues = new ArrayList<>();
JsonNode issuesNode = root.path("issues");
for (JsonNode issueNode : issuesNode) {
CoverityIssue issue = new CoverityIssue();
issue.setId(issueNode.path("id").asText());
issue.setCheckerName(issueNode.path("checkerName").asText());
issue.setSeverity(issueNode.path("severity").asText());
issue.setFilePath(issueNode.path("filePath").asText());
issue.setLineNumber(issueNode.path("lineNumber").asInt());
issue.setDescription(issueNode.path("description").asText());
issues.add(issue);
}
return issues;
}
public static class CoverityIssue {
private String id;
private String checkerName;
private String severity;
private String filePath;
private int lineNumber;
private String description;
// Getters and setters
public String getId() { return id; }
public void setId(String id) { this.id = id; }
public String getCheckerName() { return checkerName; }
public void setCheckerName(String checkerName) { this.checkerName = checkerName; }
public String getSeverity() { return severity; }
public void setSeverity(String severity) { this.severity = severity; }
public String getFilePath() { return filePath; }
public void setFilePath(String filePath) { this.filePath = filePath; }
public int getLineNumber() { return lineNumber; }
public void setLineNumber(int lineNumber) { this.lineNumber = lineNumber; }
public String getDescription() { return description; }
public void setDescription(String description) { this.description = description; }
}
public static class CoverityMetrics {
private int totalIssues;
private int criticalIssues;
private int highIssues;
private int mediumIssues;
private int lowIssues;
// Getters and setters
public int getTotalIssues() { return totalIssues; }
public void setTotalIssues(int totalIssues) { this.totalIssues = totalIssues; }
public int getCriticalIssues() { return criticalIssues; }
public void setCriticalIssues(int criticalIssues) { this.criticalIssues = criticalIssues; }
public int getHighIssues() { return highIssues; }
public void setHighIssues(int highIssues) { this.highIssues = highIssues; }
public int getMediumIssues() { return mediumIssues; }
public void setMediumIssues(int mediumIssues) { this.mediumIssues = mediumIssues; }
public int getLowIssues() { return lowIssues; }
public void setLowIssues(int lowIssues) { this.lowIssues = lowIssues; }
}
}
3. Quality Gate Service
package com.example.coverity.quality;
import org.springframework.stereotype.Service;
import java.util.List;
@Service
public class CoverityQualityGate {
public QualityGateResult evaluate(List<CoverityIssue> issues, QualityGateConfig config) {
QualityGateResult result = new QualityGateResult();
result.setTotalIssues(issues.size());
// Count issues by severity
long criticalCount = issues.stream()
.filter(issue -> "CRITICAL".equals(issue.getSeverity()))
.count();
long highCount = issues.stream()
.filter(issue -> "HIGH".equals(issue.getSeverity()))
.count();
// Evaluate against thresholds
result.setCriticalIssuesExceeded(criticalCount > config.getMaxCriticalIssues());
result.setHighIssuesExceeded(highCount > config.getMaxHighIssues());
result.setTotalIssuesExceeded(issues.size() > config.getMaxTotalIssues());
result.setPassed(!result.isCriticalIssuesExceeded() &&
!result.isHighIssuesExceeded() &&
!result.isTotalIssuesExceeded());
return result;
}
public static class QualityGateResult {
private boolean passed;
private int totalIssues;
private boolean criticalIssuesExceeded;
private boolean highIssuesExceeded;
private boolean totalIssuesExceeded;
// Getters and setters
public boolean isPassed() { return passed; }
public void setPassed(boolean passed) { this.passed = passed; }
public int getTotalIssues() { return totalIssues; }
public void setTotalIssues(int totalIssues) { this.totalIssues = totalIssues; }
public boolean isCriticalIssuesExceeded() { return criticalIssuesExceeded; }
public void setCriticalIssuesExceeded(boolean criticalIssuesExceeded) {
this.criticalIssuesExceeded = criticalIssuesExceeded;
}
public boolean isHighIssuesExceeded() { return highIssuesExceeded; }
public void setHighIssuesExceeded(boolean highIssuesExceeded) {
this.highIssuesExceeded = highIssuesExceeded;
}
public boolean isTotalIssuesExceeded() { return totalIssuesExceeded; }
public void setTotalIssuesExceeded(boolean totalIssuesExceeded) {
this.totalIssuesExceeded = totalIssuesExceeded;
}
}
public static class QualityGateConfig {
private int maxCriticalIssues = 0;
private int maxHighIssues = 5;
private int maxTotalIssues = 50;
// Getters and setters
public int getMaxCriticalIssues() { return maxCriticalIssues; }
public void setMaxCriticalIssues(int maxCriticalIssues) {
this.maxCriticalIssues = maxCriticalIssues;
}
public int getMaxHighIssues() { return maxHighIssues; }
public void setMaxHighIssues(int maxHighIssues) {
this.maxHighIssues = maxHighIssues;
}
public int getMaxTotalIssues() { return maxTotalIssues; }
public void setMaxTotalIssues(int maxTotalIssues) {
this.maxTotalIssues = maxTotalIssues;
}
}
}
Best Practices
- Integration Strategy:
- Run Coverity in CI/CD pipeline
- Set up quality gates
- Regular scanning schedule
- Issue Management:
- Triage findings regularly
- Use suppressions for false positives
- Track remediation progress
- Performance:
- Use incremental analysis
- Configure appropriate checkers
- Exclude test and generated code
- Security:
- Focus on security checkers
- Regular vulnerability assessment
- Compliance reporting
# Example command line usage cov-build --dir cov-int mvn compile cov-analyze --dir cov-int --security --all cov-commit-defects --dir cov-int --url $COVERITY_URL --stream $COVERITY_STREAM
Conclusion
Coverity integration in Java provides:
- Comprehensive static analysis for security vulnerabilities
- Quality defect detection and code improvement suggestions
- Integration with major build systems and CI/CD pipelines
- Customizable checkers and suppression mechanisms
- Quality gates for automated compliance checking
By implementing the patterns and configurations shown above, you can significantly improve your Java application's security posture, catch vulnerabilities early in the development process, and maintain high code quality standards across your organization.
Secure Java Dependency Management, Vulnerability Scanning & Software Supply Chain Protection (SBOM, SCA, CI Security & License Compliance)
https://macronepal.com/blog/github-code-scanning-in-java-complete-guide/
Explains GitHub Code Scanning for Java using tools like CodeQL to automatically analyze source code and detect security vulnerabilities directly inside CI/CD pipelines before deployment.
https://macronepal.com/blog/license-compliance-in-java-comprehensive-guide/
Explains software license compliance in Java projects, ensuring dependencies follow legal requirements (MIT, Apache, GPL, etc.) and preventing license violations in enterprise software.
https://macronepal.com/blog/container-security-for-java-uncovering-vulnerabilities-with-grype/
Explains using Grype to scan Java container images and filesystems for known CVEs in OS packages and application dependencies to improve container security.
https://macronepal.com/blog/syft-sbom-generation-in-java-comprehensive-software-bill-of-materials-for-jvm-applications/
Explains using Syft to generate SBOMs (Software Bill of Materials) for Java applications, listing all dependencies, libraries, and components for supply chain transparency.
https://macronepal.com/blog/comprehensive-dependency-analysis-generating-and-scanning-sboms-with-trivy-for-java/
Explains using Trivy to generate SBOMs and scan Java dependencies and container images for vulnerabilities, integrating security checks into CI/CD pipelines.
https://macronepal.com/blog/dependabot-for-java-in-java/
Explains GitHub Dependabot for Java projects, which automatically detects vulnerable dependencies and creates pull requests to update them securely.
https://macronepal.com/blog/parasoft-jtest-in-java-comprehensive-guide-to-code-analysis-and-testing/
Explains Parasoft Jtest, a static analysis and testing tool for Java that helps detect bugs, security issues, and code quality problems early in development.
https://macronepal.com/blog/snyk-open-source-in-java-comprehensive-dependency-vulnerability-management-2/
Explains Snyk Open Source for Java, which continuously scans dependencies for vulnerabilities and provides automated fix suggestions and monitoring.
https://macronepal.com/blog/owasp-dependency-check-in-java-complete-vulnerability-scanning-guide/
Explains OWASP Dependency-Check, which scans Java dependencies against the National Vulnerability Database (NVD) to detect known security vulnerabilities.
https://macronepal.com/blog/securing-your-dependencies-a-java-developers-guide-to-whitesource-mend-bolt/
Explains Mend (WhiteSource) Bolt for Java, a dependency management and SCA tool that provides vulnerability detection, license compliance, and security policy enforcement in enterprise environments.