Guide to Using Synopsys Polaris SaaS for Static Application Security Testing (SAST)

Polaris is a SaaS platform for static application security testing (SAST) provided by Synopsys, offering a web interface to classify, fix, and report vulnerabilities.

SAST analyzes source code or build artifacts to find security flaws early in the software development lifecycle.

Polaris supports many languages such as C/C++, C#, Java, JavaScript, TypeScript, PHP, Python, Swift, and more.

The SaaS instance is accessed via a URL like https://organization.polaris.synopsys.com , where projects can be linked to Git repositories.

To run scans, download and install the polaris_cli-linux64.zip client, add its bin directory to PATH , and configure a polaris.yml file at the project root.

The YAML file defines capture settings (Build, Filesystem, Buildless) and analyze options; examples are provided for C/C++, Java, and C# projects.

Typical capture configurations are shown in a table mapping languages to recommended capture types.

Run analysis with a command such as polaris -c polaris.yml analyze -w --coverity-ignore-capture-failure . The console output reports success and a summary of issues by severity, with a link ( SummaryUrl ) to view detailed results in the Polaris UI.

Example C/C++ YAML configuration:

version: "1"
project:
  name: test-cplus-demo
  branch: ${scm.git.branch}
  revision:
    name: ${scm.git.commit}
    date: ${scm.git.commit.date}
capture:
  build:
    cleanCommands:
      - shell: [make, -f, GNUmakefile, clean]
    buildCommands:
      - shell: [make, -f, GNUmakefile]
analyze:
  mode: central
install:
  coverity:
    version: default
serverUrl: https://organization.polaris.synopsys.com

Example Java YAML configuration (truncated for brevity):

version: "1"
project:
  name: test-java-demo
  ...
capture:
  build:
    cleanCommands:
      - shell: [gradle, -b, build.gradle, --no-daemon, clean]
    buildCommands:
      - shell: [gradle, -b, build.gradle, --no-daemon, shadowJar]
fileSystem:
  ears:
    extensions: [ear]
  ...
analyze:
  mode: central
install:
  coverity:
    version: default
serverUrl: https://organization.polaris.synopsys.com

Example C# YAML configuration (truncated for brevity):

version: "1"
project:
  name: test-ssharp-demo
  ...
capture:
  build:
    buildCommands:
      - shell: ['script\polaris.bat']
    skipFiles:
      - "*.java"
      - "*.text"
      - "*.js"
analyze:
  mode: central
install:
  coverity:
    version: default
serverUrl: https://organization.polaris.synopsys.com