You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
fix(deps): bump eslint from 9.32.0 to 9.36.0
fix(deps): bump chai from 5.2.1 to 6.2.0
fix(deps): bump @typescript-eslint/eslint-plugin from 8.38.0 to 8.45.0
The `lightning-flow-scanner`, was previously unpublished from the npm registry due to as remote code execution (RCE) vulnerability in its core dependency, `lightning-flow-scanner-core`. The vulnerability, caused by unsafe custom rule loading, has been addressed in the [v5 release of the core](https://github.com/Flow-Scanner/lightning-flow-scanner-core/releases/tag/v5.1.0). Prioritizing security, we've removed custom rules for a safer tool.
1
+
Since 2021, the _Lightning Flow Scanner_ has grown from its roots in CLI and VS Code tools to empower Salesforce Developers across six free and open-source platforms—from CLI tools to native Salesforce apps—delivering a unified experience for robust static analysis of Flows. Our dedicated community has shared their expertise to deepen understanding of Flow optimization. Your support can amplify our impact. Here’s how you can contribute:
2
+
3
+
- ⭐ Starring the project to show your support
4
+
- 📢 Sharing our work with your network
5
+
- 💬 Sharing feedback to help us improve
6
+
- 💻 Contributing code to drive innovation
2
7
3
8
Want to help improve Lightning Flow Scanner? See our [Contributing Guidelines](https://github.com/Flow-Scanner/lightning-flow-scanner-core/blob/main/CONTRIBUTING.md).
Lightning Flow Scanner CLI is plug-and-play. Open any project with flows and run `sf flow:scan`; all default rules and thresholds are applied automatically.
36
+
36
37
```sh-session
37
-
sfdx flow:scan [options]
38
+
sf flow:scan [options]
38
39
```
39
40
40
-
***To learn more about the default rules and options, see the [core documentation](https://flow-scanner.github.io/lightning-flow-scanner-core/).***
You can test the scanner by simply opening an existing project that contains flows and running the scan without any configurations or parameters. This way all the default rules are autmatically included in the scan.
Create a .flow-scanner.json file in order to configure:
79
62
80
-
-The ruleset to be executed.
63
+
-A defined ruleset to be executed.
81
64
- The severity of violating any specific rule.
82
65
- Custom expressions or rule implementations.
83
66
- Any known exceptions that should be ignored during scanning.
@@ -112,78 +95,87 @@ When the severity is not provided it will be `error` by default. Other available
112
95
}
113
96
```
114
97
115
-
### Specifying an exception
98
+
### Configuring an expression
116
99
117
-
Specifying exceptions can be done by flow, rule and result(s), as shown in the following example.
100
+
Some rules have additional attributes to configure, such as the expression, that will overwrite default values. These can be configured in the same way as severity as shown in the following example. For more information on the available rules and configurations, please review the [flow scanner documentation](https://flow-scanner.github.io/lightning-flow-scanner-core/).
118
101
119
102
```json
120
103
{
121
-
"exceptions": {
122
-
"AssignTaskOwner": {
123
-
"UnusedVariable": [
124
-
"somecount"
125
-
]
104
+
"rules": {
105
+
"APIVersion": {
106
+
"severity": "error",
107
+
"expression": "===58"
126
108
},
127
-
"GetAccounts":{
128
-
"UnusedVariable": [
129
-
"incvar"
130
-
]
109
+
"FlowName": {
110
+
"severity": "error",
111
+
"expression": "[A-Za-z0-9]"
131
112
}
132
113
}
133
114
}
134
115
```
135
116
136
-
### Configuring an expression
117
+
### Specifying an exception
137
118
138
-
Some rules have additional attributes to configure, such as the expression, that will overwrite default values. These can be configured in the same way as severity as shown in the following example.
119
+
Specifying exceptions can be done by flow, rule and result(s), as shown in the following example.
139
120
140
121
```json
141
122
{
142
-
"rules": {
143
-
"APIVersion":
144
-
{
145
-
"severity": "error",
146
-
"expression": "===58"
123
+
"exceptions": {
124
+
"AssignTaskOwner": {
125
+
"UnusedVariable": ["somecount"]
147
126
},
148
-
"FlowName":
149
-
{
150
-
"severity": "error",
151
-
"expression": "[A-Za-z0-9]"
127
+
"GetAccounts": {
128
+
"UnusedVariable": ["incvar"]
152
129
}
153
130
}
154
131
}
155
132
```
156
133
157
134
## Development
158
135
159
-
### Preparing for Changes
136
+
> This project optionally uses [Volta](https://volta.sh) to manage Node.js versions. Install Volta with:
137
+
>
138
+
> ```sh
139
+
> curl https://get.volta.sh | bash
140
+
>```
141
+
>
142
+
> Volta will automatically use the Node.js version defined in`package.json`.
160
143
161
-
1.**Clone Project**: Clone the Lightning Flow Scanner Salesforce CLI repository.
162
-
2.**Install Dependencies**: Open the directory and run `npm install` in the terminal to install the dependencies.
163
-
3.**Optional: Make changes**: For example, if you want to upgrade the core module using npm, you can use the command: `npm update lightning-flow-scanner-core`
164
-
4.**Prepack**: Execute `npm run prepack` to build the plugin locally and prepare for packaging.
165
-
5.**Link Plugin**: Link the plugin to your Salesforce DX environment using `sfdx plugins link .`.
1.**Linking Core Module**: You may need to clone and link the `lightning-flow-scanner-core` locally to your project. This step is necessary if you're making changes to the core module and want those changes reflected in the plugin. You can link the core module by navigating to its directory and running:
150
+
2.**Install Dependencies**
170
151
171
152
```bash
172
-
npm link
153
+
npm install
173
154
```
174
155
175
-
Then, navigate to the sfdx plugin directory and run:
156
+
3.**Build Executables**
176
157
177
158
```bash
178
-
npm link lightning-flow-scanner-core
159
+
npm run build
179
160
```
180
161
181
-
1.**Run Plugin**: In the terminal of your example flow project (or any other project intended for scanning), run the following command to start the plugin with debugging enabled:
2.**Attach Debugger**: Open your local Salesforce DX project in Visual Studio Code, set desired breakpoints, and attach the debugger to the remote session. For more detailed information, you can refer to the [wiki](https://github.com/salesforcecli/cli/wiki) of the Salesforce CLI repository.
168
+
5.**Linking****Core Module (Optional)**
169
+
170
+
If you’re developing or testing updates to the core module, you can link it locally:
171
+
172
+
- In the core module directory, run:
173
+
```bash
174
+
npm run link
175
+
```
176
+
- In this CLI project directory, run:
177
+
```bash
178
+
npm link lightning-flow-scanner-core
179
+
```
188
180
189
-
Want to help improve Lightning Flow Scanner? See our [Contributing Guidelines](https://github.com/Flow-Scanner/lightning-flow-scanner-core?tab=contributing-ov-file).
181
+
<p><strong>Want to help improve Lightning Flow Scanner? See our <ahref="https://github.com/Flow-Scanner/lightning-flow-scanner-core?tab=contributing-ov-file">Contributing Guidelines</a></strong></p>
0 commit comments