Merge pull request #1519 from forcedotcom/release-4.3.0

RELEASE @W-16039195@: Conducting v4.3.0 release.

.github/ISSUE_TEMPLATE/0-scanner_run_bug.yml

@@ -77,7 +77,7 @@ body:
     description: |
       What do you get from the command "sf plugins"?
     placeholder: |
-      Example: @salesforce/sfdx-scanner 4.1.0 (latest-beta)
+      Example: @salesforce/sfdx-scanner 4.3.0 (latest)
   validations:
     required: true
 - type: textarea

.github/ISSUE_TEMPLATE/1-scanner_run_dfa_bug.yml

@@ -81,7 +81,7 @@ body:
     description: |
       What do you get from the command "sf plugins"?
     placeholder: |
-      Example: @salesforce/sfdx-scanner 4.1.0 (latest-beta)
+      Example: @salesforce/sfdx-scanner 4.3.0 (latest)
   validations:
     required: true
 - type: input

.github/ISSUE_TEMPLATE/2-scanner_run_false_result.yml

@@ -71,7 +71,7 @@ body:
     description: |
       What do you get from the command "sf plugins"?
     placeholder: |
-      Example: @salesforce/sfdx-scanner 4.1.0 (latest-beta)
+      Example: @salesforce/sfdx-scanner 4.3.0 (latest)
   validations:
     required: true
 - type: textarea

.github/ISSUE_TEMPLATE/3-scanner_run_dfa_false_result.yml

@@ -58,7 +58,7 @@ body:
     description: |
       What do you get from the command "sf plugins"?
     placeholder: |
-      Example: @salesforce/sfdx-scanner 4.1.0 (latest-beta)
+      Example: @salesforce/sfdx-scanner 4.3.0 (latest)
   validations:
     required: true
 - type: input

.github/workflows/publish-to-npm.yml

@@ -53,7 +53,7 @@ jobs:
     with:
       ctc: false # We've been told we don't have to care about this until someone makes us care.
       sign: true
-      tag: latest-beta-rc # Publish as a release candidate, so we can do our validations against it.
+      tag: latest-rc # Publish as a release candidate, so we can do our validations against it.
       githubTag: ${{ github.event.release.tag_name || inputs.tag }}
     secrets: inherit
   # Step 3: Run smoke tests against the release candidate.
@@ -81,7 +81,7 @@ jobs:
           java-version: '11' # For now, Java version is hardcoded.
       # Install SF, and the release candidate version.
       - run: npm install -g @salesforce/cli
-      - run: sf plugins install @salesforce/sfdx-scanner@latest-beta-rc
+      - run: sf plugins install @salesforce/sfdx-scanner@latest-rc
       # Log the installed plugins for easier debugging.
       - run: sf plugins
       # Attempt to run the smoke tests.
@@ -102,7 +102,7 @@ jobs:
           node-version: 'lts/*'
       - run: |
           echo "//registry.npmjs.org/:_authToken=${{ secrets.NPM_TOKEN }}" > ~/.npmrc
-          npm dist-tag add @salesforce/sfdx-scanner@${{ github.event.release.tag_name || inputs.tag }} latest-beta
+          npm dist-tag add @salesforce/sfdx-scanner@${{ github.event.release.tag_name || inputs.tag }} latest
   # Step 5: Create a Pull Request for merging `main` into `dev`
   create-main2dev-pull-request:
     needs: promote-to-latest

.gitignore

@@ -159,3 +159,7 @@ pmd-cataloger/bin
 sfge*.log.gz
 
 npm-shrinkwrap.json
+/cli-messaging/out/
+
+# Cache file(s)
+/.sfge-cache/fileToEntryMapData.json

package.json

@@ -1,7 +1,7 @@
 {
 	"name": "@salesforce/sfdx-scanner",
 	"description": "Static code scanner that applies quality and security rules to Apex code, and provides feedback.",
-	"version": "4.2.0",
+	"version": "4.3.0",
 	"author": "Salesforce Code Analyzer Team",
 	"bugs": "https://github.com/forcedotcom/sfdx-scanner/issues",
 	"dependencies": {

pmd-appexchange/docs/AvoidApiSessionId.md

@@ -3,14 +3,14 @@ AvoidApiSessionId[](#avoidapisessionid)
 
 **Violation:**
 
-   Session ID use is not approved.
+   Session ID use may not be approved.
 
 
 **Priority:** High (2)
 
 **Description:**
 
-   Detects use of Api.Session_ID to retrieve a session ID.
+   Detects use of Api.Session_ID to retrieve a session ID. For more guidance on approved use cases, read the [Session Id Guidance][https://partners.salesforce.com/sfc/servlet.shepherd/version/download/0684V00000O83jT?asPdf=false&operationContext=CHATTER] document.
 
 **Example(s):**
 

pmd-appexchange/docs/AvoidApiSessionIdInXML.md

@@ -10,7 +10,7 @@ AvoidApiSessionIdInXML[](#avoidapisessionidinxml)
 
 **Description:**
 
-   Detects use of Api.Session_ID to retrieve a session ID.
+   Detects use of Api.Session_ID to retrieve a session ID. For more guidance on approved use cases, read the [Session Id Guidance][https://partners.salesforce.com/sfc/servlet.shepherd/version/download/0684V00000O83jT?asPdf=false&operationContext=CHATTER] document.
 
 **Example(s):**
 

pmd-appexchange/docs/AvoidChangeProtectionUnprotected.md

@@ -3,7 +3,7 @@ AvoidChangeProtectionUnprotected[](#avoidchangeprotectionunprotected)
 
 **Violation:**
 
-   Update your code to avoid using FeatureManagement.changeProtection called by an UnProtected argument.
+   Ensure appropriate authorization checks are in-place before invoking FeatureManagement.changeProtection called with 'UnProtected' argument.
 
 
 **Priority:** Critical (1)

pmd-appexchange/docs/AvoidCreateElementScriptLinkTag.md

@@ -0,0 +1,26 @@
+AvoidCreateElementScriptLinkTag[](#avoidcreateelementscriptlinktag)
+------------------------------------------------------------------------------------------------------------------------------------------------------
+
+**Violation:**
+
+   Load JavaScript/CSS only from static resources.
+
+
+**Priority:** High (2)
+
+**Description:**
+
+   Detects dynamic creation of script or link tags
+
+**Example(s):**
+
+
+
+```
+<script src="{!$Resource.jquery}"/>
+```
+
+See more examples on properly using static resources here: https://developer.salesforce.com/docs/atlas.en-us.236.0.secure_coding_guide.meta/secure_coding_guide/secure_coding_cross_site_scripting.htm
+
+        
+

pmd-appexchange/docs/AvoidGetInstanceWithTaint.md

@@ -0,0 +1,20 @@
+AvoidGetInstanceWithTaint[](#avoidgetinstancewithtaint)
+------------------------------------------------------------------------------------------------------------------------------------------------------
+
+**Violation:**
+
+   getInstance() is invoked with a potentially tainted parameter.
+
+
+**Priority:** Medium (3)
+
+**Description:**
+
+   Detects use of getInstance(userId)/getInstance(profileId). Hierarchy Custom Settings return the record owned by the current user when `getInstance()` is invoked without any parameters.
+But if a tainted/end-user controlled `userId` or `profileId` is passed as a parameter to `getInstance()` that will allow the code to access records owned by other users on the org.
+Protected Custom Settings are the recommended approach to store subscriber owned secrets. Passing `userId` or `proileId` parameters to `getInstance()` could allow a user access to secrets that belong other other users on the org.
+
+**Example(s):**
+
+
+

pmd-appexchange/docs/AvoidGlobalInstallUninstallHandlers.md

@@ -10,7 +10,12 @@ AvoidGlobalInstallUninstallHandlers[](#avoidglobalinstalluninstallhandlers)
 
 **Description:**
 
-   Detects Install and Uninstall handlers declared as global
+   Detects Install and Uninstall handlers declared as global. Install and Uninstall Handlers don't need to be global classes. 
+Using `global` for these handlers means global methods in these classes act as controllers and can be invoked by untrusted code outside the context of post-install/uninstall scenarios.
+Depending on the logic in these handlers, there could potentially unintended consequences. 
+For ex: Sometimes post install handlers are used to generate an encryption key to be stored in a protected custom settings object. But if the classes are global, then other untrusted code in the org can invoke the global method and the encryption key may be over-written.
+Or
+Helper classes for post-install handlers are recommended to be used "without sharing" - which is acceptable in the context of post-install exectution; but could lead to potential security concerns if "without sharing" classes are invoked by untrusted code.
 
 **Example(s):**
 

pmd-appexchange/docs/AvoidHardcodedCredentialsInFieldDecls.md

@@ -0,0 +1,19 @@
+AvoidHardcodedCredentialsInFieldDecls[](#avoidhardcodedcredentialsinfielddecls)
+------------------------------------------------------------------------------------------------------------------------------------------------------
+
+**Violation:**
+
+   Hard-coded credentials found in source code.
+
+
+**Priority:** Medium (3)
+
+**Description:**
+
+   Identifies hard-coded credentials in source code that must be protected using Protected Custom metadata or Protected Custom settings.
+Protected custom setttings or protected custom metadata should be used to store secrets.
+Refer to the [Protect Secrets Using Platform Features](https://trailhead.salesforce.com/content/learn/modules/secure-secrets-storage/protect-secrets-using-platform-features) Trailhead module for more guidance.
+
+
+**Example(s):**
+

pmd-appexchange/docs/AvoidHardcodedCredentialsInHttpHeader.md

@@ -0,0 +1,17 @@
+AvoidHardcodedCredentialsInHttpHeader[](#avoidhardcodedcredentialsinhttpheader)
+------------------------------------------------------------------------------------------------------------------------------------------------------
+
+**Violation:**
+
+   Hard-coded credentials found in source code.
+
+
+**Priority:** Medium (3)
+
+**Description:**
+
+   Identifies hard-coded credentials in source code that must be protected using Protected Custom metadata or Protected Custom settings.
+Protected custom setttings or protected custom metadata should be used to store secrets.
+Refer to the [Protect Secrets Using Platform Features](https://trailhead.salesforce.com/content/learn/modules/secure-secrets-storage/protect-secrets-using-platform-features) Trailhead module for more guidance.
+
+**Example(s):**

pmd-appexchange/docs/AvoidHardcodedCredentialsInVarAssign.md

@@ -0,0 +1,23 @@
+AvoidHardcodedCredentialsInVarAssign[](#avoidhardcodedcredentialsinvarassign)
+------------------------------------------------------------------------------------------------------------------------------------------------------
+
+**Violation:**
+
+   Hard-coded credentials found in source code.
+
+
+**Priority:** Medium (3)
+
+**Description:**
+
+   Identifies hard-coded credentials in source code that must be protected using Protected Custom metadata or Protected Custom settings.
+Protected custom setttings or protected custom metadata should be used to store secrets.
+Refer to the [Protect Secrets Using Platform Features](https://trailhead.salesforce.com/content/learn/modules/secure-secrets-storage/protect-secrets-using-platform-features) Trailhead module for more guidance.
+
+**Example(s):**
+```
+
+
+
+        
+

pmd-appexchange/docs/AvoidHardcodedCredentialsInVarDecls.md

@@ -0,0 +1,19 @@
+AvoidHardcodedCredentialsInVarDecls[](#avoidhardcodedcredentialsinvardecls)
+------------------------------------------------------------------------------------------------------------------------------------------------------
+
+**Violation:**
+
+   Hard-coded credentials found in source code.
+
+
+**Priority:** Medium (3)
+
+**Description:**
+
+   Identifies hard-coded credentials in source code that must be protected using Protected Custom metadata or Protected Custom settings.
+Protected custom setttings or protected custom metadata should be used to store secrets.
+Refer to the [Protect Secrets Using Platform Features](https://trailhead.salesforce.com/content/learn/modules/secure-secrets-storage/protect-secrets-using-platform-features) Trailhead module for more guidance.
+
+
+**Example(s):**
+

pmd-appexchange/docs/AvoidInvalidCrudContentDistribution.md

@@ -0,0 +1,33 @@
+AvoidInvalidCrudContentDistribution[](#avoidinvalidcrudcontentdistribution)
+------------------------------------------------------------------------------------------------------------------------------------------------------
+
+**Violation:**
+
+   Do not use Schema.DescribeSObjectResult methods to enforce CRUD check on ContentDistribution
+
+
+**Priority:** Medium (3)
+
+**Description:**
+
+
+Detects the use of `Schema.DescribeSObjectResult` methods to enforce CRUD check on `ContentDistribution`.
+Developers should use `USER MODE` operations or use the custom below to enforce CRUD check against the `ContentDistribution` object.
+
+```
+ Boolean userCanCreatePublicLinks = 0 <
+        [SELECT COUNT() FROM PermissionSetAssignment
+        WHERE PermissionSet.PermissionsDistributeFromPersWksp = TRUE
+        AND AssigneeId = :UserInfo.getUserId()];
+if(userCanCreatePublicLinks){
+//had CRUD permissions 
+}
+else{
+//handle error
+}
+```
+
+**Example(s):**
+
+
+