Skip to content

Commit 85789b1

Browse files
jag-jjag-j
authored
Merge pull request #1628 from forcedotcom/release-4.6.0
RELEASE @W-16608399@: Conducting v4.6.0 release
2 parents bee8a67 + be427d8 commit 85789b1

File tree

9 files changed

+1184
-941
lines changed

9 files changed

+1184
-941
lines changed

‎package.json‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
{
22
"name": "@salesforce/sfdx-scanner",
33
"description": "Static code scanner that applies quality and security rules to Apex code, and provides feedback.",
4-
"version": "4.5.0",
4+
"version": "4.6.0",
55
"author": "Salesforce Code Analyzer Team",
66
"bugs": "https://github.com/forcedotcom/sfdx-scanner/issues",
77
"dependencies": {

‎pmd7/build.gradle.kts‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -10,7 +10,7 @@ repositories {
1010
}
1111

1212
// Keep this in sync with src/Constants.ts > PMD7_VERSION
13-
var pmd7Version = "7.4.0"
13+
var pmd7Version = "7.5.0"
1414

1515
val pmdDist7Dir = "$buildDir/../../dist/pmd7"
1616

‎retire-js/RetireJsVulns.json‎

Lines changed: 163 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -3223,6 +3223,28 @@
32233223
"https://github.com/advisories/GHSA-qwqh-hm9m-p5hr"
32243224
]
32253225
},
3226+
{
3227+
"atOrAbove": "0",
3228+
"below": "1.8.4",
3229+
"cwe": [
3230+
"CWE-791"
3231+
],
3232+
"severity": "low",
3233+
"identifiers": {
3234+
"summary": "AngularJS allows attackers to bypass common image source restrictions",
3235+
"CVE": [
3236+
"CVE-2024-8373"
3237+
],
3238+
"githubID": "GHSA-mqm9-c95h-x2p6"
3239+
},
3240+
"info": [
3241+
"https://github.com/advisories/GHSA-mqm9-c95h-x2p6",
3242+
"https://nvd.nist.gov/vuln/detail/CVE-2024-8373",
3243+
"https://codepen.io/herodevs/full/bGPQgMp/8da9ce87e99403ee13a295c305ebfa0b",
3244+
"https://github.com/angular/angular.js",
3245+
"https://www.herodevs.com/vulnerability-directory/cve-2024-8373"
3246+
]
3247+
},
32263248
{
32273249
"atOrAbove": "1.3.0",
32283250
"below": "1.8.4",
@@ -3247,6 +3269,28 @@
32473269
"https://stackblitz.com/edit/angularjs-vulnerability-ng-srcset-redos"
32483270
]
32493271
},
3272+
{
3273+
"atOrAbove": "1.3.0-rc.4",
3274+
"below": "1.8.4",
3275+
"cwe": [
3276+
"CWE-1289"
3277+
],
3278+
"severity": "low",
3279+
"identifiers": {
3280+
"summary": "AngularJS allows attackers to bypass common image source restrictions",
3281+
"CVE": [
3282+
"CVE-2024-8372"
3283+
],
3284+
"githubID": "GHSA-m9gf-397r-hwpg"
3285+
},
3286+
"info": [
3287+
"https://github.com/advisories/GHSA-m9gf-397r-hwpg",
3288+
"https://nvd.nist.gov/vuln/detail/CVE-2024-8372",
3289+
"https://codepen.io/herodevs/full/xxoQRNL/0072e627abe03e9cda373bc75b4c1017",
3290+
"https://github.com/angular/angular.js",
3291+
"https://www.herodevs.com/vulnerability-directory/cve-2024-8372"
3292+
]
3293+
},
32503294
{
32513295
"below": "1.999",
32523296
"severity": "low",
@@ -4318,6 +4362,54 @@
43184362
"info": [
43194363
"https://github.com/cure53/DOMPurify/releases"
43204364
]
4365+
},
4366+
{
4367+
"atOrAbove": "0",
4368+
"below": "2.5.4",
4369+
"cwe": [
4370+
"CWE-1321",
4371+
"CWE-1333"
4372+
],
4373+
"severity": "high",
4374+
"identifiers": {
4375+
"summary": "DOMPurify allows tampering by prototype pollution",
4376+
"CVE": [
4377+
"CVE-2024-45801"
4378+
],
4379+
"githubID": "GHSA-mmhx-hmjr-r674"
4380+
},
4381+
"info": [
4382+
"https://github.com/advisories/GHSA-mmhx-hmjr-r674",
4383+
"https://github.com/cure53/DOMPurify/security/advisories/GHSA-mmhx-hmjr-r674",
4384+
"https://nvd.nist.gov/vuln/detail/CVE-2024-45801",
4385+
"https://github.com/cure53/DOMPurify/commit/1e520262bf4c66b5efda49e2316d6d1246ca7b21",
4386+
"https://github.com/cure53/DOMPurify/commit/26e1d69ca7f769f5c558619d644d90dd8bf26ebc",
4387+
"https://github.com/cure53/DOMPurify"
4388+
]
4389+
},
4390+
{
4391+
"atOrAbove": "3.0.0",
4392+
"below": "3.1.3",
4393+
"cwe": [
4394+
"CWE-1321",
4395+
"CWE-1333"
4396+
],
4397+
"severity": "high",
4398+
"identifiers": {
4399+
"summary": "DOMPurify allows tampering by prototype pollution",
4400+
"CVE": [
4401+
"CVE-2024-45801"
4402+
],
4403+
"githubID": "GHSA-mmhx-hmjr-r674"
4404+
},
4405+
"info": [
4406+
"https://github.com/advisories/GHSA-mmhx-hmjr-r674",
4407+
"https://github.com/cure53/DOMPurify/security/advisories/GHSA-mmhx-hmjr-r674",
4408+
"https://nvd.nist.gov/vuln/detail/CVE-2024-45801",
4409+
"https://github.com/cure53/DOMPurify/commit/1e520262bf4c66b5efda49e2316d6d1246ca7b21",
4410+
"https://github.com/cure53/DOMPurify/commit/26e1d69ca7f769f5c558619d644d90dd8bf26ebc",
4411+
"https://github.com/cure53/DOMPurify"
4412+
]
43214413
}
43224414
],
43234415
"extractors": {
@@ -5119,7 +5211,7 @@
51195211
},
51205212
{
51215213
"atOrAbove": "4.0.0",
5122-
"below": "4.6.3",
5214+
"below": "5.0.0",
51235215
"cwe": [
51245216
"CWE-79"
51255217
],
@@ -5723,6 +5815,27 @@
57235815
"info": [
57245816
"https://github.com/sveltejs/svelte/pull/7530"
57255817
]
5818+
},
5819+
{
5820+
"below": "4.2.19",
5821+
"cwe": [
5822+
"CWE-79"
5823+
],
5824+
"severity": "medium",
5825+
"identifiers": {
5826+
"summary": "Svelte has a potential mXSS vulnerability due to improper HTML escaping",
5827+
"CVE": [
5828+
"CVE-2024-45047"
5829+
],
5830+
"githubID": "GHSA-8266-84wp-wv5c"
5831+
},
5832+
"info": [
5833+
"https://github.com/advisories/GHSA-8266-84wp-wv5c",
5834+
"https://github.com/sveltejs/svelte/security/advisories/GHSA-8266-84wp-wv5c",
5835+
"https://nvd.nist.gov/vuln/detail/CVE-2024-45047",
5836+
"https://github.com/sveltejs/svelte/commit/83e96e044deb5ecbae2af361ae9e31d3e1ac43a3",
5837+
"https://github.com/sveltejs/svelte"
5838+
]
57265839
}
57275840
],
57285841
"extractors": {
@@ -5734,6 +5847,7 @@
57345847
],
57355848
"filecontent": [
57365849
"generated by Svelte v\\$\\{['\"](§§version§§)['\"]\\}",
5850+
"generated by Svelte v(§§version§§) \\*/",
57375851
"version: '(§§version§§)' [\\s\\S]{80,200}'SvelteDOMInsert'",
57385852
"VERSION = '(§§version§§)'[\\s\\S]{21,200}parse\\$[0-9][\\s\\S]{10,80}preprocess",
57395853
"var version\\$[0-9] = \"(§§version§§)\";[\\s\\S]{10,30}normalizeOptions\\(options\\)[\\s\\S]{80,200}'SvelteComponent.html'"
@@ -6536,6 +6650,30 @@
65366650
"https://github.com/vercel/next.js/compare/v13.5.0...v13.5.1"
65376651
]
65386652
},
6653+
{
6654+
"atOrAbove": "13.5.1",
6655+
"below": "13.5.7",
6656+
"cwe": [
6657+
"CWE-349",
6658+
"CWE-639"
6659+
],
6660+
"severity": "high",
6661+
"identifiers": {
6662+
"summary": "Next.js Cache Poisoning",
6663+
"CVE": [
6664+
"CVE-2024-46982"
6665+
],
6666+
"githubID": "GHSA-gp8f-8m3g-qvj9"
6667+
},
6668+
"info": [
6669+
"https://github.com/advisories/GHSA-gp8f-8m3g-qvj9",
6670+
"https://github.com/vercel/next.js/security/advisories/GHSA-gp8f-8m3g-qvj9",
6671+
"https://nvd.nist.gov/vuln/detail/CVE-2024-46982",
6672+
"https://github.com/vercel/next.js/commit/7ed7f125e07ef0517a331009ed7e32691ba403d3",
6673+
"https://github.com/vercel/next.js/commit/bd164d53af259c05f1ab434004bcfdd3837d7cda",
6674+
"https://github.com/vercel/next.js"
6675+
]
6676+
},
65396677
{
65406678
"atOrAbove": "13.4.0",
65416679
"below": "14.1.1",
@@ -6558,6 +6696,30 @@
65586696
"https://github.com/vercel/next.js/commit/8f7a6ca7d21a97bc9f7a1bbe10427b5ad74b9085",
65596697
"https://github.com/vercel/next.js"
65606698
]
6699+
},
6700+
{
6701+
"atOrAbove": "14.0.0",
6702+
"below": "14.2.10",
6703+
"cwe": [
6704+
"CWE-349",
6705+
"CWE-639"
6706+
],
6707+
"severity": "high",
6708+
"identifiers": {
6709+
"summary": "Next.js Cache Poisoning",
6710+
"CVE": [
6711+
"CVE-2024-46982"
6712+
],
6713+
"githubID": "GHSA-gp8f-8m3g-qvj9"
6714+
},
6715+
"info": [
6716+
"https://github.com/advisories/GHSA-gp8f-8m3g-qvj9",
6717+
"https://github.com/vercel/next.js/security/advisories/GHSA-gp8f-8m3g-qvj9",
6718+
"https://nvd.nist.gov/vuln/detail/CVE-2024-46982",
6719+
"https://github.com/vercel/next.js/commit/7ed7f125e07ef0517a331009ed7e32691ba403d3",
6720+
"https://github.com/vercel/next.js/commit/bd164d53af259c05f1ab434004bcfdd3837d7cda",
6721+
"https://github.com/vercel/next.js"
6722+
]
65616723
}
65626724
],
65636725
"extractors": {

‎src/Constants.ts‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,7 @@ import os = require('os');
22
import path = require('path');
33

44
// Keep this in sync with <repoRoot>/pmd7/build.gradle.kts > pmd7Version
5-
export const PMD7_VERSION = '7.4.0';
5+
export const PMD7_VERSION = '7.5.0';
66

77
export const PMD_APPEXCHANGE_RULES_VERSION = '0.15';
88

‎src/commands/scanner/run/dfa.ts‎

Lines changed: 13 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -69,7 +69,19 @@ export default class Dfa extends ScannerRunCommand {
6969
summary: getMessage(BundleName.RunDfa, 'flags.pathexplimitSummary'),
7070
description: getMessage(BundleName.RunDfa, 'flags.pathexplimitDescription'),
7171
env: 'SFGE_PATH_EXPANSION_LIMIT'
72-
})
72+
}),
73+
'enablecaching': Flags.boolean({
74+
summary: '',
75+
description: '',
76+
env: 'SFGE_ENABLE_CACHING',
77+
hidden: true
78+
}),
79+
'cachepath': Flags.string({
80+
summary: '',
81+
description: '',
82+
env: 'SFGE_FILES_TO_ENTRIES_CACHE_LOCATION',
83+
hidden: true
84+
}),
7385
// END: Config-overrideable engine flags.
7486
};
7587

‎src/lib/EngineOptionsFactory.ts‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -114,6 +114,12 @@ export class RunDfaEngineOptionsFactory extends CommonEngineOptionsFactory {
114114
if (inputs['pathexplimit'] != null) {
115115
sfgeConfig.pathexplimit = inputs['pathexplimit'] as number;
116116
}
117+
if (inputs['enablecaching'] != null) {
118+
sfgeConfig.enablecaching = inputs['enablecaching'] as boolean;
119+
}
120+
if (inputs['cachepath'] != null) {
121+
sfgeConfig.cachepath = inputs['cachepath'] as string;
122+
}
117123
sfgeConfig.ruleDisableWarningViolation = getBooleanEngineOption(inputs, RULE_DISABLE_WARNING_VIOLATION_FLAG);
118124
engineOptions.set(CUSTOM_CONFIG.SfgeConfig, JSON.stringify(sfgeConfig));
119125

‎src/lib/sfge/SfgeWrapper.ts‎

Lines changed: 17 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -46,6 +46,8 @@ type SfgeExecuteOptions = SfgeWrapperOptions & {
4646
ruleThreadCount?: number;
4747
ruleThreadTimeout?: number;
4848
ruleDisableWarningViolation?: boolean;
49+
enablecaching?: boolean;
50+
cachepath?: string;
4951
}
5052

5153
type SfgeTarget = {
@@ -57,6 +59,8 @@ type SfgeInput = {
5759
targets: SfgeTarget[];
5860
projectDirs: string[];
5961
rulesToRun: string[];
62+
enablecaching?: boolean;
63+
cachepath?: string;
6064
};
6165

6266
class SfgeSpinnerManager extends AsyncCreatable implements SpinnerManager {
@@ -209,6 +213,8 @@ export class SfgeExecuteWrapper extends AbstractSfgeWrapper {
209213
private ruleThreadCount: number;
210214
private ruleThreadTimeout: number;
211215
private ruleDisableWarningViolation: boolean;
216+
private enablecaching: boolean;
217+
private cachepath: string;
212218

213219
constructor(options: SfgeExecuteOptions) {
214220
super(options);
@@ -218,6 +224,8 @@ export class SfgeExecuteWrapper extends AbstractSfgeWrapper {
218224
this.ruleThreadCount = options.ruleThreadCount;
219225
this.ruleThreadTimeout = options.ruleThreadTimeout;
220226
this.ruleDisableWarningViolation = options.ruleDisableWarningViolation;
227+
this.enablecaching = options.enablecaching;
228+
this.cachepath = options.cachepath;
221229
}
222230

223231
protected getSupplementalFlags(): string[] {
@@ -231,6 +239,12 @@ export class SfgeExecuteWrapper extends AbstractSfgeWrapper {
231239
if (this.ruleDisableWarningViolation != null) {
232240
flags.push(`-DSFGE_RULE_DISABLE_WARNING_VIOLATION=${this.ruleDisableWarningViolation.toString()}`);
233241
}
242+
if (this.enablecaching != null && this.enablecaching) {
243+
flags.push(`-DSFGE_DISABLE_CACHING=false`);
244+
}
245+
if (this.cachepath != null) {
246+
flags.push(`-DSFGE_FILES_TO_ENTRIES_CACHE_LOCATION=${this.cachepath}`);
247+
}
234248
return flags;
235249
}
236250

@@ -291,7 +305,9 @@ export class SfgeExecuteWrapper extends AbstractSfgeWrapper {
291305
pathExpLimit: sfgeConfig.pathexplimit,
292306
ruleThreadCount: sfgeConfig.ruleThreadCount,
293307
ruleThreadTimeout: sfgeConfig.ruleThreadTimeout,
294-
ruleDisableWarningViolation: sfgeConfig.ruleDisableWarningViolation
308+
ruleDisableWarningViolation: sfgeConfig.ruleDisableWarningViolation,
309+
cachepath: sfgeConfig.cachepath,
310+
enablecaching: sfgeConfig.enablecaching
295311
});
296312
return wrapper.execute();
297313
}

‎src/types.ts‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -204,4 +204,6 @@ export type SfgeConfig = {
204204
ruleDisableWarningViolation?: boolean;
205205
jvmArgs?: string;
206206
pathexplimit?: number;
207+
enablecaching?: boolean;
208+
cachepath?: string;
207209
};

0 commit comments

Comments
 (0)