Checkmarx 扫描报告 Springboot 应用程序中 main 方法的剩余调试代码

Question

Checkmarx扫描在我的Springboot Application上作为CI/CD中的一个步骤运行。

在扫描结果中， Checkmarx报告了Leftover Debug Code问题，因为我将main方法作为Springboot Application的入口点。

如何通过Checkmarx扫描？

@SpringBootApplication(exclude = {JNDIConnectionFactoryAutoConfiguration.class, HibernateJpaAutoConfiguration.class, JpaRepositoriesAutoConfiguration.class, DataSourceTransactionManagerAutoConfiguration.class, TransactionAutoConfiguration.class})
@ImportResource({"classpath:applicatiomContext.xml"})
public class MyApplication extends SpringBootServletInitializer {

 public static void main(String args []) {

     SpringApplication springApplication = new SpringApplication(MyApplication.class);
     springApplication.run(args);

    }
}

Answer 1

Leftover Debug Code Checkmarx 查询显然是在寻找“public”和“static”关键字，因此请尝试将修饰符更改为 private 或 protected：

@SpringBootApplication(exclude = {JNDIConnectionFactoryAutoConfiguration.class, HibernateJpaAutoConfiguration.class, JpaRepositoriesAutoConfiguration.class, DataSourceTransactionManagerAutoConfiguration.class, TransactionAutoConfiguration.class})
@ImportResource({"classpath:applicatiomContext.xml"})
public class MyApplication extends SpringBootServletInitializer {

 protected static void main(String args []) {

     SpringApplication springApplication = new SpringApplication(MyApplication.class);
     springApplication.run(args);

    }
}