diff --git a/.github/ISSUE_TEMPLATE/0-scanner_run_bug.yml b/.github/ISSUE_TEMPLATE/0-scanner_run_bug.yml index 1af86319a..cbacd1a18 100644 --- a/.github/ISSUE_TEMPLATE/0-scanner_run_bug.yml +++ b/.github/ISSUE_TEMPLATE/0-scanner_run_bug.yml @@ -77,7 +77,7 @@ body: description: | What do you get from the command "sf plugins"? placeholder: | - Example: @salesforce/sfdx-scanner 4.1.0 (latest-beta) + Example: @salesforce/sfdx-scanner 4.3.0 (latest) validations: required: true - type: textarea diff --git a/.github/ISSUE_TEMPLATE/1-scanner_run_dfa_bug.yml b/.github/ISSUE_TEMPLATE/1-scanner_run_dfa_bug.yml index 928089ae9..cee2cb8cf 100644 --- a/.github/ISSUE_TEMPLATE/1-scanner_run_dfa_bug.yml +++ b/.github/ISSUE_TEMPLATE/1-scanner_run_dfa_bug.yml @@ -81,7 +81,7 @@ body: description: | What do you get from the command "sf plugins"? placeholder: | - Example: @salesforce/sfdx-scanner 4.1.0 (latest-beta) + Example: @salesforce/sfdx-scanner 4.3.0 (latest) validations: required: true - type: input diff --git a/.github/ISSUE_TEMPLATE/2-scanner_run_false_result.yml b/.github/ISSUE_TEMPLATE/2-scanner_run_false_result.yml index 729fb7684..a27802a2a 100644 --- a/.github/ISSUE_TEMPLATE/2-scanner_run_false_result.yml +++ b/.github/ISSUE_TEMPLATE/2-scanner_run_false_result.yml @@ -71,7 +71,7 @@ body: description: | What do you get from the command "sf plugins"? placeholder: | - Example: @salesforce/sfdx-scanner 4.1.0 (latest-beta) + Example: @salesforce/sfdx-scanner 4.3.0 (latest) validations: required: true - type: textarea diff --git a/.github/ISSUE_TEMPLATE/3-scanner_run_dfa_false_result.yml b/.github/ISSUE_TEMPLATE/3-scanner_run_dfa_false_result.yml index fee67e2ab..f2017f7db 100644 --- a/.github/ISSUE_TEMPLATE/3-scanner_run_dfa_false_result.yml +++ b/.github/ISSUE_TEMPLATE/3-scanner_run_dfa_false_result.yml @@ -58,7 +58,7 @@ body: description: | What do you get from the command "sf plugins"? placeholder: | - Example: @salesforce/sfdx-scanner 4.1.0 (latest-beta) + Example: @salesforce/sfdx-scanner 4.3.0 (latest) validations: required: true - type: input diff --git a/.github/workflows/publish-to-npm.yml b/.github/workflows/publish-to-npm.yml index 5f89a4133..0689b8070 100644 --- a/.github/workflows/publish-to-npm.yml +++ b/.github/workflows/publish-to-npm.yml @@ -53,7 +53,7 @@ jobs: with: ctc: false # We've been told we don't have to care about this until someone makes us care. sign: true - tag: latest-beta-rc # Publish as a release candidate, so we can do our validations against it. + tag: latest-rc # Publish as a release candidate, so we can do our validations against it. githubTag: ${{ github.event.release.tag_name || inputs.tag }} secrets: inherit # Step 3: Run smoke tests against the release candidate. @@ -81,7 +81,7 @@ jobs: java-version: '11' # For now, Java version is hardcoded. # Install SF, and the release candidate version. - run: npm install -g @salesforce/cli - - run: sf plugins install @salesforce/sfdx-scanner@latest-beta-rc + - run: sf plugins install @salesforce/sfdx-scanner@latest-rc # Log the installed plugins for easier debugging. - run: sf plugins # Attempt to run the smoke tests. @@ -102,7 +102,7 @@ jobs: node-version: 'lts/*' - run: | echo "//registry.npmjs.org/:_authToken=${{ secrets.NPM_TOKEN }}" > ~/.npmrc - npm dist-tag add @salesforce/sfdx-scanner@${{ github.event.release.tag_name || inputs.tag }} latest-beta + npm dist-tag add @salesforce/sfdx-scanner@${{ github.event.release.tag_name || inputs.tag }} latest # Step 5: Create a Pull Request for merging `main` into `dev` create-main2dev-pull-request: needs: promote-to-latest diff --git a/.gitignore b/.gitignore index ef7fe04da..2b561613e 100644 --- a/.gitignore +++ b/.gitignore @@ -159,3 +159,7 @@ pmd-cataloger/bin sfge*.log.gz npm-shrinkwrap.json +/cli-messaging/out/ + +# Cache file(s) +/.sfge-cache/fileToEntryMapData.json diff --git a/package.json b/package.json index bbbb005fe..562e06344 100644 --- a/package.json +++ b/package.json @@ -1,7 +1,7 @@ { "name": "@salesforce/sfdx-scanner", "description": "Static code scanner that applies quality and security rules to Apex code, and provides feedback.", - "version": "4.2.0", + "version": "4.3.0", "author": "Salesforce Code Analyzer Team", "bugs": "https://github.com/forcedotcom/sfdx-scanner/issues", "dependencies": { diff --git a/pmd-appexchange/docs/AvoidApiSessionId.md b/pmd-appexchange/docs/AvoidApiSessionId.md index 0f4a66bd4..97a2490a5 100644 --- a/pmd-appexchange/docs/AvoidApiSessionId.md +++ b/pmd-appexchange/docs/AvoidApiSessionId.md @@ -3,14 +3,14 @@ AvoidApiSessionId[](#avoidapisessionid) **Violation:** - Session ID use is not approved. + Session ID use may not be approved. **Priority:** High (2) **Description:** - Detects use of Api.Session_ID to retrieve a session ID. + Detects use of Api.Session_ID to retrieve a session ID. For more guidance on approved use cases, read the [Session Id Guidance][https://partners.salesforce.com/sfc/servlet.shepherd/version/download/0684V00000O83jT?asPdf=false&operationContext=CHATTER] document. **Example(s):** diff --git a/pmd-appexchange/docs/AvoidApiSessionIdInXML.md b/pmd-appexchange/docs/AvoidApiSessionIdInXML.md index dec547b97..a8b810832 100644 --- a/pmd-appexchange/docs/AvoidApiSessionIdInXML.md +++ b/pmd-appexchange/docs/AvoidApiSessionIdInXML.md @@ -10,7 +10,7 @@ AvoidApiSessionIdInXML[](#avoidapisessionidinxml) **Description:** - Detects use of Api.Session_ID to retrieve a session ID. + Detects use of Api.Session_ID to retrieve a session ID. For more guidance on approved use cases, read the [Session Id Guidance][https://partners.salesforce.com/sfc/servlet.shepherd/version/download/0684V00000O83jT?asPdf=false&operationContext=CHATTER] document. **Example(s):** diff --git a/pmd-appexchange/docs/AvoidAuraWithLockerDisabled.md b/pmd-appexchange/docs/AvoidAuraWithLockerDisabled.md deleted file mode 100644 index 487d9fd31..000000000 --- a/pmd-appexchange/docs/AvoidAuraWithLockerDisabled.md +++ /dev/null @@ -1,18 +0,0 @@ -AvoidAuraWithLockerDisabled[](#avoidaurawithlockerdisabled) ------------------------------------------------------------------------------------------------------------------------------------------------------- - -**Violation:** - - To enable Lightning Locker, update the apiVersion to version 40 or greater. - - -**Priority:** Critical (1) - -**Description:** - - Detects use of API versions with Lightning Locker disabled in Aura components. Use API version 40 or greater. - -**Example(s):** - - - diff --git a/pmd-appexchange/docs/AvoidCallingSystemResetPasswordWithEmailTemplate.md b/pmd-appexchange/docs/AvoidCallingSystemResetPasswordWithEmailTemplate.md deleted file mode 100644 index d522f0b12..000000000 --- a/pmd-appexchange/docs/AvoidCallingSystemResetPasswordWithEmailTemplate.md +++ /dev/null @@ -1,18 +0,0 @@ -AvoidCallingSystemResetPasswordWithEmailTemplate[](#avoidcallingsystemresetpasswordwithemailtemplate) ------------------------------------------------------------------------------------------------------------------------------------------------------- - -**Violation:** - - Before calling System.resetPasswordWithEmailTemplate(), perform the necessary authorization checks. - - -**Priority:** Critical (1) - -**Description:** - - Detects where System.resetPasswordWithEmailTemplate() exists in Apex code. Use this method with caution. - -**Example(s):** - - - diff --git a/pmd-appexchange/docs/AvoidChangeProtection.md b/pmd-appexchange/docs/AvoidChangeProtection.md deleted file mode 100644 index ea3644f55..000000000 --- a/pmd-appexchange/docs/AvoidChangeProtection.md +++ /dev/null @@ -1,18 +0,0 @@ -AvoidChangeProtection[](#avoidchangeprotection) ------------------------------------------------------------------------------------------------------------------------------------------------------- - -**Violation:** - - Update your code to avoid using FeatureManagement.changeProtection. - - -**Priority:** High (2) - -**Description:** - - Detects potential misuse of FeatureManagement.changeProtection. - -**Example(s):** - - - diff --git a/pmd-appexchange/docs/AvoidChangeProtectionUnprotected.md b/pmd-appexchange/docs/AvoidChangeProtectionUnprotected.md index 3abed876f..c66a30f3d 100644 --- a/pmd-appexchange/docs/AvoidChangeProtectionUnprotected.md +++ b/pmd-appexchange/docs/AvoidChangeProtectionUnprotected.md @@ -3,7 +3,7 @@ AvoidChangeProtectionUnprotected[](#avoidchangeprotectionunprotected) **Violation:** - Update your code to avoid using FeatureManagement.changeProtection called by an UnProtected argument. + Ensure appropriate authorization checks are in-place before invoking FeatureManagement.changeProtection called with 'UnProtected' argument. **Priority:** Critical (1) diff --git a/pmd-appexchange/docs/AvoidCreateElementScriptLinkTag.md b/pmd-appexchange/docs/AvoidCreateElementScriptLinkTag.md new file mode 100644 index 000000000..38dd0388f --- /dev/null +++ b/pmd-appexchange/docs/AvoidCreateElementScriptLinkTag.md @@ -0,0 +1,26 @@ +AvoidCreateElementScriptLinkTag[](#avoidcreateelementscriptlinktag) +------------------------------------------------------------------------------------------------------------------------------------------------------ + +**Violation:** + + Load JavaScript/CSS only from static resources. + + +**Priority:** High (2) + +**Description:** + + Detects dynamic creation of script or link tags + +**Example(s):** + + + +``` +