title: How do I use Fortify Annotations In Java Code?
body: <p>I have a question regarding the names and syntax for using Fortify Code Annotations.</p>
  <p>The short, short, really short version is:
  <strong>I am looking for a guide/manual that will list the available in-code annotations and provide an example for their intended use.</strong> Specifically for use in having a set of &quot;SQL Injection&quot; and &quot;SQL Injection: Persistence&quot; issues omitted from Fortify Scan results.</p>
  <p><strong>TL;DR; Details:</strong></p>
  <ul>
  <li>Fortify Version: 19.1.0</li>
  <li>Platform: Java 8; Web App (Weblogic 12.2.1.4.0 (12c)); Redhat Unix</li>
  <li>Fortify Issue: SQL Injection (WASC-19)</li>
  <li>Additional Information: The code exists as part of a web application.</li>
  </ul>
  <p>The &quot;suspect&quot; input String arrives from the client and then becomes part of a DDL Statement (&quot;ALTER SESSION ...&quot;)
  This &quot;cannot be changed&quot; and <strong>DDL statements cannot be parameterized</strong> .</p>
  <p>Sanitizing the input String is ridiculously easy.
  The (7 character) String is fed through a Regex parser: <code>Pattern.compile(HARDCODED_REGEX_CONSTANT).matcher(suspectString);</code></p>
  <p>Using an annotated method declaration that sends the input though a regex parser has also been part of the validation e.g. <code>@Pattern(regexp=HARDCODED_REGEX_CONSTANT)</code></p>
  <p>Neither of these 2 approaches are sufficient for Fortify.</p>
  <p>Additionally, the suspect input String is also validated against known and valid values (the values are pulled from the database, so Fortify also finds that those values are also &quot;suspect&quot;).</p>
  <p>Of course, none of these are satisfactory for the Fortify Scan.</p>
  <p>Creating and storing a custom rule that is external to the code and applied to the scan results is <em>&quot;not going to work&quot;</em> because of <em>&quot;reasons&quot;</em>.
  [I cannot adequately or briefly explain why this simple solution has been rejected.]
  Suffice it to say, creating a set of &quot;False Positives&quot; to import prior to a Fortify Scan; is <em>&quot;not an option&quot;</em> nor is marking &quot;known issues&quot; as &quot;Not an Issue&quot;.</p>
  <p>Placing an &quot;Ignore this&quot; comment in the code does not satisfy the goal state either.
  The end evaluation is that the issue remains in the scan results, it is critical, and therefore MUST be resolved.</p>
  <p>Restating the request:
  I would like to place an annotation (or other in-code construct) (e.g. <strong>@FortifyValidate</strong>, <code>@Fortify?????</code>, etc.) at the points at which a problem is flagged by the Fortify scan.</p>
  <p>I cannot find an adequate guide/manual online that will list the available in-code annotations and provide an example for their intended use. Specifically for use in having a set of <strong>&quot;SQL Injection&quot; and &quot;SQL Injection: Persistence&quot;</strong> issues omitted from Fortify Scan results.</p>
  <p>Thank you</p>