Static Code Security Analisys tool suggestions? (C# in BPMs and customizations)

[Alek_MDA (Alek S.)]

Need a tool to perform static application code analisys, for an IT security audit. Something like SonarCube or Fortify, to go over all our custom C# in BPM/customizations/UBAQs in on-prem E10.2. (We have ~10KLoCs in BPMs and such)
Any suggestions would be much appreciated! Thanks!

[timshuwy (Tim Shoemaker)]

I dont have a tool suggestion, but I can suggest that you can use a BAQ to Query the BPM tables in Epicor and extract all the code with the BAQ. I have used this technique to search out BPMs for certain field or logic that I cannot find.

[Alek_MDA (Alek S.)]

Thank you!

[josecgomez]

You can go to BPM and select the generate source code checkbox which takes the custom code and drops it to a file then you can easily attach it to a visual studio project and have it scanned

Should work for BPM Functions and UBAQs

[hkeric.wci (Haso Keric)]

On that note if you are on the latest versions.

Are your BPM Sources Missing?

[BPM Sources] If you are like me, you benefit from the Server\BPM\Sources folder. You can use it to learn how Epicor generates code when using Widgets You can keep track of revisions to your BPM (until an upgrade) You can keep track when someone changed a BPM (until an upgrade) You can easily grep them and find all BPMs you are using certain column [image] You would be able to find generated sources and a wealth of code samples here for: Method Directives BPM Data Directives Updatable B…