Java 为什么针对我的项目中不再存在的文件强化SCA报告问题？

我使用SCAMaven插件为我的项目设置了SCA扫描，该插件是我从源代码构建并安装到本地存储库中的。我的构建通过安装了Fortify的服务器上的TeamCity构建代理运行

我在运行扫描时没有任何问题，我很高兴使用ReportGenerator从生成的.fpr生成报告。早期的报告表明，我有一些PHP文件的漏洞，这些漏洞被错误地包含在项目中（这是一个Java项目）。既然删除了这些文件，为什么Fortify仍然报告这些文件的漏洞，即使它们不再存在于我的项目中

我已经确认构建代理被配置为在签出最新版本之前清除所有源代码，事实上，我可以在服务器上看到这些PHP文件不再存在，但报告和.fpr仍在报告它们的问题

是否有一些我也需要清除的跟踪/趋势问题持续存在的地方，或者是否有其他我遗漏的地方

生成的输出，显示文件确实丢失，但仍包括在分析范围内，如下所示：

[07:40:16][com.....myapp:web] [INFO] --- sca-maven-plugin:3.90:scan (default-cli) @ web ---
[07:40:16][com.....myapp:web] [INFO]                    Packaging -> war
[07:40:16][com.....myapp:web] [INFO]        Top-Level Artifact ID -> web
[07:40:16][com.....myapp:web] [INFO]                  Build Label -> web-2.0.0-SNAPSHOT
[07:40:16][com.....myapp:web] [INFO]                Build Version -> 2.0.0-SNAPSHOT
[07:40:16][com.....myapp:web] [INFO]           Build Project Name -> web
[07:40:16][com.....myapp:web] [INFO]                     Build ID -> web-2.0.0-SNAPSHOT
[07:40:16][com.....myapp:web] [INFO]                 Results File -> C:\...\buildAgent\work\c649372994269e88/myapp.fpr
[07:40:16][com.....myapp:web] [INFO]   Location of SCA Executable -> sourceanalyzer
[07:40:16][com.....myapp:web] [INFO]                     Scan Log -> C:\...\buildAgent\work\c649372994269e88\web\target/sca-scan.log
[07:40:16][com.....myapp:web] [INFO]             FindBugs Results -> false
[07:40:16][com.....myapp:web] [INFO]                Fail on Error -> false
[07:40:16][com.....myapp:web] [INFO]                Upload to SSC -> false
[07:40:16][com.....myapp:web] [INFO] Issues will not be tracked and trended without uploading to SSC.
[07:40:16][com.....myapp:web] [INFO] *** !! Scanning aggregate project - web !! ***
[07:40:16][com.....myapp:web] [INFO] Created output dir C:\...\buildAgent\work\c649372994269e88\web\target
[07:40:16][com.....myapp:web] [INFO] cmd: "cmd.exe /X /C "sourceanalyzer -scan @C:\...\buildAgent\work\c649372994269e88\web\target/sca-scan-args.txt""
[07:40:19][com.....myapp:web] Fortify Static Code Analyzer 6.00.0096
[07:40:25][com.....myapp:web] [error]: File C:/.../buildAgent/work/c649372994269e88/web/target/myapp/WEB-INF/views/components/datatables/media/unit_testing/templates/dom_data_th.php not found
[07:40:25][com.....myapp:web] [error]: File C:/.../buildAgent/work/c649372994269e88/web/target/myapp/WEB-INF/views/components/datatables/media/unit_testing/controller.php not found
[07:40:25][com.....myapp:web] [error]: File C:/.../buildAgent/work/c649372994269e88/web/target/myapp/WEB-INF/views/components/datatables/media/unit_testing/performance/large.php not found
[07:40:25][com.....myapp:web] [error]: File C:/.../buildAgent/work/c649372994269e88/web/target/myapp/WEB-INF/views/components/datatables/media/unit_testing/templates/-complex_header.php not found
[07:40:25][com.....myapp:web] [error]: File C:/.../buildAgent/work/c649372994269e88/web/target/myapp/WEB-INF/views/components/datatables/media/unit_testing/templates/2512.php not found
[07:40:25][com.....myapp:web] [error]: File C:/.../buildAgent/work/c649372994269e88/web/target/myapp/WEB-INF/views/components/datatables/media/unit_testing/templates/6776.php not found
[07:40:25][com.....myapp:web] [error]: File C:/.../buildAgent/work/c649372994269e88/web/target/myapp/WEB-INF/views/components/datatables/media/unit_testing/templates/complex_header_2.php not found
[07:40:25][com.....myapp:web] [error]: File C:/.../buildAgent/work/c649372994269e88/web/target/myapp/WEB-INF/views/components/datatables/media/unit_testing/templates/deferred_table.php not found
[07:40:25][com.....myapp:web] [error]: File C:/.../buildAgent/work/c649372994269e88/web/target/myapp/WEB-INF/views/components/datatables/media/unit_testing/templates/dom_data.php not found

---

SCA正在使用构建缓存。你也应该用刷子把这个擦干净

sourceanalyzer -b buildID -clean

指挥部。当然，您可以通过调用scamaven-plugin:clean-goal或将scamaven-plugin:clean-goal附加到maven-phase“clean”并调用clean-goal来使用maven插件

---

不过，运行此操作时要小心。它将删除第一次扫描创建的所有现有文件。

你说得很对。我应该使用的顺序是

scamaven插件：cleanscamaven插件：translatescamaven插件：scan