Skip to content

Commit a16e847

Browse files
Merge pull request #1518 from forcedotcom/dev-3
RELEASE @W-16039195@: Conducting v3.26.0 release.
2 parents 414885c + ee0a195 commit a16e847

File tree

5 files changed

+165
-29
lines changed

5 files changed

+165
-29
lines changed

messages/common.md

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -12,4 +12,4 @@ We're continually improving Salesforce Code Analyzer. Tell us what you think! Gi
1212

1313
# upgradeTo4xRecommendation
1414

15-
To use the most up-to-date Code Analyzer features including PMD 7.x, install Code Analyzer v4.x (Beta) by running this command: "sf plugins install @salesforce/sfdx-scanner@latest-beta". You are currently using Code Analyzer v3, which we plan to stop supporting soon.
15+
You are using Code Analyzer v3, which we no longer support. Update to v4 of Code Analyzer by running this command: "sf plugins install @salesforce/sfdx-scanner". Version 4 of Code Analyzer has the most up-to-date features, including PMD 7.x.

messages/jreSetupManager.md

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -2,19 +2,19 @@
22

33
We couldn't find Java Home.
44
Please verify that Java 1.8 or later is installed on your machine and try again.
5-
If the problem persists, please manually add a 'javaHome' property to your Config.json file, referencing your Java home directory.
5+
If the problem persists, please manually add a 'javaHome' property to your `%s` file, referencing your Java home directory.
66

77
# InvalidJavaHome
88

99
The Java Home is invalid: %s. Error code: %s.
1010
Please verify that Java 1.8 or later is installed on your machine and try again.
11-
If the problem persists, please manually add a 'javaHome' property to your Config.json file, referencing your Java home directory.
11+
If the problem persists, please manually add a 'javaHome' property to your `%s` file, referencing your Java home directory.
1212

1313
# VersionNotFound
1414

1515
We couldn't find the Java version.
1616
Please verify that Java 1.8 or later is installed on your machine and try again.
17-
If the problem persists, please manually add a 'javaHome' property to your Config.json file, referencing your Java home directory.
17+
If the problem persists, please manually add a 'javaHome' property to your `%s` file, referencing your Java home directory.
1818

1919
# InvalidVersion
2020

package.json

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,8 +1,8 @@
11
{
22
"name": "@salesforce/sfdx-scanner",
33
"description": "Static code scanner that applies quality and security rules to Apex code, and provides feedback.",
4-
"version": "3.25.0",
5-
"author": "ISV SWAT",
4+
"version": "3.26.0",
5+
"author": "Salesforce Code Analyzer Team",
66
"bugs": "https://github.com/forcedotcom/sfdx-scanner/issues",
77
"dependencies": {
88
"@babel/core": "^7.11.0",

retire-js/RetireJsVulns.json

Lines changed: 126 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -7255,6 +7255,132 @@
72557255
]
72567256
}
72577257
},
7258+
"pdf.js": {
7259+
"bowername": [
7260+
"pdfjs-dist"
7261+
],
7262+
"npmname": "pdfjs-dist",
7263+
"vulnerabilities": [
7264+
{
7265+
"atOrAbove": "0",
7266+
"below": "1.10.100",
7267+
"cwe": [
7268+
"CWE-94"
7269+
],
7270+
"severity": "high",
7271+
"identifiers": {
7272+
"summary": "Malicious PDF can inject JavaScript into PDF Viewer",
7273+
"CVE": [
7274+
"CVE-2018-5158"
7275+
],
7276+
"githubID": "GHSA-7jg2-jgv3-fmr4"
7277+
},
7278+
"info": [
7279+
"https://github.com/advisories/GHSA-7jg2-jgv3-fmr4",
7280+
"https://nvd.nist.gov/vuln/detail/CVE-2018-5158",
7281+
"https://github.com/mozilla/pdf.js/pull/9659",
7282+
"https://github.com/mozilla/pdf.js/commit/2dc4af525d1612c98afcd1e6bee57d4788f78f97",
7283+
"https://access.redhat.com/errata/RHSA-2018:1414",
7284+
"https://access.redhat.com/errata/RHSA-2018:1415",
7285+
"https://bugzilla.mozilla.org/show_bug.cgi?id=1452075",
7286+
"https://github.com/mozilla/pdf.js",
7287+
"https://lists.debian.org/debian-lts-announce/2018/05/msg00007.html",
7288+
"https://security.gentoo.org/glsa/201810-01",
7289+
"https://usn.ubuntu.com/3645-1",
7290+
"https://www.debian.org/security/2018/dsa-4199",
7291+
"https://www.mozilla.org/security/advisories/mfsa2018-11",
7292+
"https://www.mozilla.org/security/advisories/mfsa2018-12",
7293+
"http://www.securityfocus.com/bid/104136",
7294+
"http://www.securitytracker.com/id/1040896"
7295+
]
7296+
},
7297+
{
7298+
"atOrAbove": "2.0.0",
7299+
"below": "2.0.550",
7300+
"cwe": [
7301+
"CWE-94"
7302+
],
7303+
"severity": "high",
7304+
"identifiers": {
7305+
"summary": "Malicious PDF can inject JavaScript into PDF Viewer",
7306+
"CVE": [
7307+
"CVE-2018-5158"
7308+
],
7309+
"githubID": "GHSA-7jg2-jgv3-fmr4"
7310+
},
7311+
"info": [
7312+
"https://github.com/advisories/GHSA-7jg2-jgv3-fmr4",
7313+
"https://nvd.nist.gov/vuln/detail/CVE-2018-5158",
7314+
"https://github.com/mozilla/pdf.js/pull/9659",
7315+
"https://github.com/mozilla/pdf.js/commit/2dc4af525d1612c98afcd1e6bee57d4788f78f97",
7316+
"https://access.redhat.com/errata/RHSA-2018:1414",
7317+
"https://access.redhat.com/errata/RHSA-2018:1415",
7318+
"https://bugzilla.mozilla.org/show_bug.cgi?id=1452075",
7319+
"https://github.com/mozilla/pdf.js",
7320+
"https://lists.debian.org/debian-lts-announce/2018/05/msg00007.html",
7321+
"https://security.gentoo.org/glsa/201810-01",
7322+
"https://usn.ubuntu.com/3645-1",
7323+
"https://www.debian.org/security/2018/dsa-4199",
7324+
"https://www.mozilla.org/security/advisories/mfsa2018-11",
7325+
"https://www.mozilla.org/security/advisories/mfsa2018-12",
7326+
"http://www.securityfocus.com/bid/104136",
7327+
"http://www.securitytracker.com/id/1040896"
7328+
]
7329+
},
7330+
{
7331+
"atOrAbove": "0",
7332+
"below": "4.2.67",
7333+
"cwe": [
7334+
"CWE-79"
7335+
],
7336+
"severity": "high",
7337+
"identifiers": {
7338+
"summary": "PDF.js vulnerable to arbitrary JavaScript execution upon opening a malicious PDF",
7339+
"CVE": [
7340+
"CVE-2024-34342",
7341+
"CVE-2024-4367"
7342+
],
7343+
"githubID": "GHSA-wgrm-67xf-hhpq"
7344+
},
7345+
"info": [
7346+
"https://github.com/advisories/GHSA-wgrm-67xf-hhpq",
7347+
"https://github.com/mozilla/pdf.js/security/advisories/GHSA-wgrm-67xf-hhpq",
7348+
"https://github.com/mozilla/pdf.js/pull/18015",
7349+
"https://github.com/mozilla/pdf.js/commit/85e64b5c16c9aaef738f421733c12911a441cec6",
7350+
"https://bugzilla.mozilla.org/show_bug.cgi?id=1893645",
7351+
"https://github.com/mozilla/pdf.js"
7352+
]
7353+
}
7354+
],
7355+
"extractors": {
7356+
"uri": [
7357+
"/pdf\\.js/(§§version§§)/",
7358+
"/pdfjs-dist@(§§version§§)/"
7359+
],
7360+
"filecontent": [
7361+
" pdfjs-dist@(§§version§§) ",
7362+
"(?:const|var) pdfjsVersion = ['\"](§§version§§)['\"];",
7363+
"PDFJS.version ?= ?['\"](§§version§§)['\"]",
7364+
"apiVersion: ?['\"](§§version§§)['\"][\\s\\S]*,data(:[a-zA-Z.]{1,6})?,[\\s\\S]*password(:[a-zA-Z.]{1,10})?,[\\s\\S]*disableAutoFetch(:[a-zA-Z.]{1,22})?,[\\s\\S]*rangeChunkSize",
7365+
"messageHandler\\.sendWithPromise\\(\"GetDocRequest\",\\{docId:[a-zA-Z],apiVersion:\"(§§version§§)\""
7366+
]
7367+
}
7368+
},
7369+
"pdfobject": {
7370+
"vulnerabilities": [],
7371+
"extractors": {
7372+
"uri": [
7373+
"/pdfobject@(§§version§§)/",
7374+
"/pdfobject/(§§version§§)/pdfobject(\\.min)?\\.js"
7375+
],
7376+
"filecontent": [
7377+
"\\* +PDFObject v(§§version§§)",
7378+
"/*[\\s]+PDFObject v(§§version§§)",
7379+
"let pdfobjectversion = \"(§§version§§)\";",
7380+
"pdfobjectversion:\"(§§version§§)\""
7381+
]
7382+
}
7383+
},
72587384
"dont check": {
72597385
"vulnerabilities": [],
72607386
"extractors": {

src/lib/JreSetupManager.ts

Lines changed: 33 additions & 23 deletions
Original file line numberDiff line numberDiff line change
@@ -30,6 +30,7 @@ export class JreSetupManagerDependencies {
3030
class JreSetupManager extends AsyncCreatable {
3131
private logger!: Logger;
3232
private config!: Config;
33+
private configFile: string;
3334
private dependencies: JreSetupManagerDependencies;
3435
private initialized: boolean;
3536

@@ -40,6 +41,7 @@ class JreSetupManager extends AsyncCreatable {
4041
this.logger = await Logger.child('verifyJRE');
4142

4243
this.config = await Controller.getConfig();
44+
this.configFile = path.join(Controller.getSfdxScannerPath(), CONFIG_FILE)
4345
this.dependencies = new JreSetupManagerDependencies();
4446

4547
this.initialized = true;
@@ -80,7 +82,7 @@ class JreSetupManager extends AsyncCreatable {
8082
// So we'll just throw an error telling the user to set it themselves.
8183
if (!javaHome) {
8284
const errName = 'NoJavaHomeFound';
83-
throw new SfError(getMessage(BundleName.JreSetupManager, errName, []), errName);
85+
throw new SfError(getMessage(BundleName.JreSetupManager, errName, [this.configFile]), errName);
8486
}
8587

8688
return javaHome;
@@ -110,42 +112,50 @@ class JreSetupManager extends AsyncCreatable {
110112
} catch (e) {
111113
const error: NodeJS.ErrnoException = e as NodeJS.ErrnoException;
112114
const errName = 'InvalidJavaHome';
113-
throw new SfError(getMessage(BundleName.JreSetupManager, errName, [javaHome, error.code]), errName);
115+
throw new SfError(getMessage(BundleName.JreSetupManager, errName, [javaHome, error.code, this.configFile]), errName);
114116
}
115117
}
116118

117119
private async verifyJavaVersion(javaHome: string): Promise<void> {
118-
const versionOut = await this.fetchJavaVersion(javaHome);
119-
120-
// Version output looks like this:
121-
// MacOS: "openjdk version "11.0.6" 2020-01-14 LTS\nOpenJDK Runtime Environment Zulu11.37+17-CA (build 11.0.6+10-LTS)\nOpenJDK 64-Bit Server VM Zulu11.37+17-CA (build 11.0.6+10-LTS, mixed mode)\n"
122-
// Win10: "openjdk 14 2020-03-17\r\nOpenJDK Runtime Environment (build 14+36-1461)\r\nOpenJDK 64-Bit Server VM (build 14+36-1461, mixed mode, sharing)\r\n"
123-
// We want to get the "11.0" or "14" part
124-
// The version number could be of the format 11.0 or 1.8 or 14
125-
const regex = /(\d+)(\.(\d+))?/;
126-
const matchedParts = regex.exec(versionOut);
127-
this.logger.trace(`Version output match for pattern ${regex.toString()} is ${JSON.stringify(matchedParts)}`);
128-
129-
// matchedParts should have four groups: "11.0", "11", ".0", "0" or "14", "14", undefined, undefined
130-
if (!matchedParts || matchedParts.length < 4) {
131-
throw new SfError(getMessage(BundleName.JreSetupManager, 'VersionNotFound', []));
120+
const versionCommandOut = await this.fetchJavaVersion(javaHome);
121+
122+
// We are using "java -version" below which has output that typically looks like:
123+
// * (from MacOS): "openjdk version "11.0.6" 2020-01-14 LTS\nOpenJDK Runtime Environment Zulu11.37+17-CA (build 11.0.6+10-LTS)\nOpenJDK 64-Bit Server VM Zulu11.37+17-CA (build 11.0.6+10-LTS, mixed mode)\n"
124+
// From much research it should ideally say "version " and then either a number with or without quotes.
125+
// If instead we used java --version then the output would look something like:
126+
// * (from Win10): "openjdk 14 2020-03-17\r\nOpenJDK Runtime Environment (build 14+36-1461)\r\nOpenJDK 64-Bit Server VM (build 14+36-1461, mixed mode, sharing)\r\n"
127+
// Notice it doesn't have the word "version" but again, we don't call "--version". But for sanity sakes,
128+
// we will attempt to support this as well. Basically we want to get the "11.0.6" or "14" part.
129+
130+
// First we'll see if the word "version" exists with the version number and use that first.
131+
const matchedParts = versionCommandOut.match(/version\s+"?(\d+(\.\d+)*)"?/i);
132+
this.logger.trace(`Attempt 1: Java version output match results is ${JSON.stringify(matchedParts)}`);
133+
let version: string;
134+
if (matchedParts && matchedParts.length > 1) {
135+
version = matchedParts[1];
136+
} else {
137+
// Otherwise we'll try to get the version number the old way just be looking for the first number
138+
const matchedParts = versionCommandOut.match(/\s+(\d+(\.\d+)*)/);
139+
this.logger.trace(`Attempt 2: Java version output match results is ${JSON.stringify(matchedParts)}`);
140+
if (!matchedParts || matchedParts.length < 2) {
141+
throw new SfError(getMessage(BundleName.JreSetupManager, 'VersionNotFound', [this.configFile]));
142+
}
143+
version = matchedParts[1];
132144
}
133145

134-
const majorVersion = parseInt(matchedParts[1]);
135-
const minorVersion = matchedParts[3] ? parseInt(matchedParts[3]) : '';
136-
const version = `${majorVersion}${minorVersion ? `.${minorVersion}` : ''}`;
137-
138-
// We want to allow 1.8 and greater.
139146
// Up to JDK8, the version scheme is 1.blah
140147
// Starting JDK 9, the version scheme is 9.blah for 9, 10.blah for 10, etc.
141-
// If either version part clicks, we should be good.
148+
const versionParts: string[] = version.split('.');
149+
const majorVersion = parseInt(versionParts[0]);
150+
const minorVersion: number = versionParts.length > 1 ? parseInt(versionParts[1]) : 0;
151+
142152
if (majorVersion === 1 && minorVersion === 8) {
143153
// Accommodating 1.8
144154
uxEvents.emit(EVENTS.WARNING_ALWAYS_UNIQUE, getMessage(BundleName.JreSetupManager, 'warning.JavaV8Deprecated', [path.join(Controller.getSfdxScannerPath(), CONFIG_FILE)]));
145155
} else if (majorVersion < 9) {
146156
// Not matching what we are looking for
147157
const errName = 'InvalidVersion';
148-
throw new SfError(getMessage(BundleName.JreSetupManager, errName, [version]), errName);
158+
throw new SfError(getMessage(BundleName.JreSetupManager, errName, [version, this.configFile]), errName);
149159
}
150160

151161
this.logger.trace(`Java version found as ${version}`);

0 commit comments

Comments
 (0)