Skip to content

Commit 131ee28

Browse files
jfeingold35jfeingold35
authored
Merge pull request #704 from forcedotcom/dev-3
@W-11203369@: Release activity for v3.1.2
2 parents e162bdc + 2d8125e commit 131ee28

File tree

9 files changed

+125
-21
lines changed

9 files changed

+125
-21
lines changed

‎html-templates/dfa-simple.mustache‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -298,7 +298,7 @@
298298
</head>
299299

300300
<body>
301-
<h1 id="reportTitle">Salesforce CLI Scanner Report</h1>
301+
<h1 id="reportTitle">Salesforce Code Analyzer Report</h1>
302302
<div id="summaryChart"/></div>
303303
<h4 id="summaryFiles"></h4>
304304
<h4 id="summaryViolations"></h4>

‎html-templates/simple.mustache‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -297,7 +297,7 @@
297297
</head>
298298

299299
<body>
300-
<h1 id="reportTitle">Salesforce CLI Scanner Report</h1>
300+
<h1 id="reportTitle">Salesforce Code Analyzer Report</h1>
301301
<div id="summaryChart"/></div>
302302
<h4 id="summaryFiles"></h4>
303303
<h4 id="summaryViolations"></h4>

‎package.json‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
{
22
"name": "@salesforce/sfdx-scanner",
33
"description": "Static code scanner that applies quality and security rules to Apex code, and provides feedback.",
4-
"version": "3.1.1",
4+
"version": "3.1.2",
55
"author": "ISV SWAT",
66
"bugs": "https://github.com/forcedotcom/sfdx-scanner/issues",
77
"dependencies": {

‎retire-js/RetireJsVulns.json‎

Lines changed: 99 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -2992,7 +2992,7 @@
29922992
"filecontent": []
29932993
}
29942994
},
2995-
"axois": {
2995+
"axios": {
29962996
"vulnerabilities": [
29972997
{
29982998
"below": "0.21.3",
@@ -3039,7 +3039,7 @@
30393039
],
30403040
"extractors": {
30413041
"uri": [
3042-
"/axois/(§§version§§)/.*\\.js"
3042+
"/axios/(§§version§§)/.*\\.js"
30433043
],
30443044
"filename": [
30453045
"axios-(§§version§§)(\\.min)?\\.js"
@@ -3049,6 +3049,103 @@
30493049
]
30503050
}
30513051
},
3052+
"markdown-it": {
3053+
"vulnerabilities": [
3054+
{
3055+
"below": "12.3.2",
3056+
"severity": "medium",
3057+
"identifiers": {
3058+
"summary": "Regular Expression Denial of Service (ReDoS)",
3059+
"CVE": [
3060+
"CVE-2022-21670"
3061+
]
3062+
},
3063+
"info": [
3064+
"https://security.snyk.io/vuln/SNYK-JS-MARKDOWNIT-2331914",
3065+
"https://github.com/markdown-it/markdown-it/blob/master/CHANGELOG.md",
3066+
"https://nvd.nist.gov/vuln/detail/CVE-2022-21670"
3067+
]
3068+
},
3069+
{
3070+
"below": "10.0.0",
3071+
"severity": "medium",
3072+
"identifiers": {
3073+
"summary": "Regular Expression Denial of Service (ReDoS)"
3074+
},
3075+
"info": [
3076+
"https://security.snyk.io/vuln/SNYK-JS-MARKDOWNIT-459438",
3077+
"https://github.com/markdown-it/markdown-it/blob/master/CHANGELOG.md"
3078+
]
3079+
},
3080+
{
3081+
"below": "4.3.1",
3082+
"atOrAbove": "4.0.0",
3083+
"severity": "medium",
3084+
"identifiers": {
3085+
"summary": "Cross-site Scripting (XSS)"
3086+
},
3087+
"info": [
3088+
"https://security.snyk.io/vuln/npm:markdown-it:20150702",
3089+
"https://github.com/markdown-it/markdown-it/blob/master/CHANGELOG.md"
3090+
]
3091+
},
3092+
{
3093+
"below": "4.1.0",
3094+
"severity": "medium",
3095+
"identifiers": {
3096+
"summary": "Cross-site Scripting (XSS)",
3097+
"CVE": [
3098+
"CVE-2015-3295"
3099+
]
3100+
},
3101+
"info": [
3102+
"https://security.snyk.io/vuln/npm:markdown-it:20160912",
3103+
"https://cve.mitre.org/cgi-bin/cvename.cgi?name=2015-3295",
3104+
"https://github.com/markdown-it/markdown-it/blob/master/CHANGELOG.md"
3105+
]
3106+
}
3107+
],
3108+
"extractors": {
3109+
"uri": [
3110+
"/markdown-it[/@](§§version§§)/?.*\\.js"
3111+
],
3112+
"filename": [
3113+
"markdown-it-(§§version§§)(\\.min)?\\.js"
3114+
],
3115+
"filecontent": [
3116+
"/\\*! markdown-it(?:-ins)? (§§version§§)"
3117+
]
3118+
}
3119+
},
3120+
"jszip": {
3121+
"vulnerabilities": [
3122+
{
3123+
"below": "3.7.0",
3124+
"severity": "medium",
3125+
"identifiers": {
3126+
"summary": "Denial of Service (DoS)",
3127+
"CVE": [
3128+
"CVE-2021-23413"
3129+
]
3130+
},
3131+
"info": [
3132+
"https://security.snyk.io/vuln/SNYK-JS-JSZIP-1251497",
3133+
"https://nvd.nist.gov/vuln/detail/CVE-2021-23413"
3134+
]
3135+
}
3136+
],
3137+
"extractors": {
3138+
"uri": [
3139+
"/jszip[/@](§§version§§)/.*\\.js"
3140+
],
3141+
"filename": [
3142+
"jszip-(§§version§§)(\\.min)?\\.js"
3143+
],
3144+
"filecontent": [
3145+
"/\\*![ \n]+JSZip v(§§version§§) "
3146+
]
3147+
}
3148+
},
30523149
"dont check": {
30533150
"extractors": {
30543151
"uri": [

‎src/lib/ScannerRunCommand.ts‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -126,7 +126,7 @@ export abstract class ScannerRunCommand extends ScannerCommand {
126126
throw new SfdxError(messages.getMessage('validations.outfileMustBeValid'), null, null, INTERNAL_ERROR_CODE);
127127
} else {
128128
// Look at the file extension, and infer a corresponding output format.
129-
const fileExtension = outfile.slice(lastPeriod + 1);
129+
const fileExtension = outfile.slice(lastPeriod + 1).toLowerCase();
130130
switch (fileExtension) {
131131
case OUTPUT_FORMAT.CSV:
132132
case OUTPUT_FORMAT.HTML:

‎src/lib/formatter/RuleResultRecombinator.ts‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -403,8 +403,8 @@ URL: ${url}`;
403403
const fileHandler = new FileHandler();
404404
const templateName = isDfa ? 'dfa-simple.mustache' : 'simple.mustache';
405405
const template = await fileHandler.readFile(path.resolve(__dirname, '..', '..', '..', 'html-templates', templateName));
406-
const args = ['sfdx'];
407-
for (const arg of process.argv.slice(2)) {
406+
const args = ['sfdx', process.argv[2]];
407+
for (const arg of process.argv.slice(3)) {
408408
if (arg.startsWith('-')) {
409409
// Pass flags as-is
410410
args.push(arg);

‎src/lib/retire-js/RetireJsEngine.ts‎

Lines changed: 9 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -72,10 +72,14 @@ type RetireJsOutput = {
7272
export class RetireJsEngine extends AbstractRuleEngine {
7373
public static ENGINE_ENUM: ENGINE = ENGINE.RETIRE_JS;
7474
public static ENGINE_NAME: string = ENGINE.RETIRE_JS.valueOf();
75-
// RetireJS isn't really built to be invoked programmatically, so we'll need to invoke it as a CLI command. However, we
76-
// can't assume that they have the module installed globally. So what we're doing here is identifying the path to the
77-
// locally-scoped `retire` module, and then using that to derive a path to the CLI-executable JS script.
75+
// RetireJS isn't really built to be invoked programmatically, so we need to invoke it as a CLI command. However, we
76+
// can't assume that the user has `retire` globally installed. So we identify the path to the locally-scoped `retire`
77+
// module, and then use that to derive a path to the CLI-executable JS script.
7878
private static RETIRE_JS_PATH: string = require.resolve('retire').replace(path.join('lib', 'retire.js'), path.join('bin', 'retire'));
79+
// We also can't assume that the user actually has Node globally installed on their machine. So we need to figure out
80+
// the version of node that's being executed right now (which may or may not be the version bundled with SFDX), so we
81+
// can use that.
82+
private static NODE_EXEC_PATH: string = process.execPath;
7983
// RetireJS typically loads a JSON of all vulnerabilities from the Github repo. We want to override that, using this
8084
// local path instead.
8185
private static VULN_JSON_PATH: string = require.resolve(path.join('..', '..', '..', 'retire-js', 'RetireJsVulns.json'));
@@ -184,7 +188,7 @@ export class RetireJsEngine extends AbstractRuleEngine {
184188
// So we use --js and --jspath to make retire-js only examine JS files and skip node modules.
185189
// We also hardcode a locally-stored vulnerability repo instead of allowing use of the default one.
186190
invocationArray.push({
187-
args: ['--js', '--jspath', target, '--outputformat', 'json', '--jsrepo', RetireJsEngine.VULN_JSON_PATH],
191+
args: [RetireJsEngine.RETIRE_JS_PATH, '--js', '--jspath', target, '--outputformat', 'json', '--jsrepo', RetireJsEngine.VULN_JSON_PATH],
188192
rule: rule.name
189193
});
190194
break;
@@ -197,7 +201,7 @@ export class RetireJsEngine extends AbstractRuleEngine {
197201

198202
private async executeRetireJs(invocation: RetireJsInvocation): Promise<RuleResult[]> {
199203
return new Promise<RuleResult[]>((res, rej) => {
200-
const cp = cspawn(RetireJsEngine.RETIRE_JS_PATH, invocation.args);
204+
const cp = cspawn(RetireJsEngine.NODE_EXEC_PATH, invocation.args);
201205

202206
// Initialize both stdout and stderr as empty strings to which we can append data as we receive it.
203207
let stdout = '';

‎test/commands/scanner/run.test.ts‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -272,7 +272,7 @@ describe('scanner:run', function () {
272272
});
273273

274274
describe('Output Type: HTML', () => {
275-
const outputFile = 'testout.html';
275+
const outputFile = 'testout.hTmL';
276276
function validateHtmlOutput(html: string): void {
277277
const result = html.match(/const violations = (\[.*);/);
278278
expect(result).to.be.not.null;

‎test/lib/retire-js/RetireJsEngine.test.ts‎

Lines changed: 10 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -484,13 +484,16 @@ describe('RetireJsEngine', () => {
484484
expect(invocations.length).to.equal(1, 'Should be one invocation');
485485
const invocation = invocations[0];
486486
expect(invocation.rule).to.equal('insecure-bundled-dependencies', 'Invocation is for incorrect rule');
487-
expect(invocation.args[0]).to.equal('--js');
488-
expect(invocation.args[1]).to.equal('--jspath');
489-
expect(invocation.args[2]).to.equal(target);
490-
expect(invocation.args[3]).to.equal('--outputformat');
491-
expect(invocation.args[4]).to.equal('json');
492-
expect(invocation.args[5]).to.equal('--jsrepo');
493-
expect(invocation.args[6]).to.equal((RetireJsEngine as any).VULN_JSON_PATH);
487+
expect(invocation.args.length).to.equal(8, 'Wrong number of args provided');
488+
// The first argument should be a node executable.
489+
expect(invocation.args[0]).to.include('node', 'Node executable');
490+
expect(invocation.args[1]).to.equal('--js');
491+
expect(invocation.args[2]).to.equal('--jspath');
492+
expect(invocation.args[3]).to.equal(target);
493+
expect(invocation.args[4]).to.equal('--outputformat');
494+
expect(invocation.args[5]).to.equal('json');
495+
expect(invocation.args[6]).to.equal('--jsrepo');
496+
expect(invocation.args[7]).to.equal((RetireJsEngine as any).VULN_JSON_PATH);
494497
});
495498
});
496499
});

0 commit comments

Comments
 (0)