[BUG][vscode-extension] Getting Stuck on rule-selector AppExchange

[NumaanMohd]

Have you tried to resolve this issue yourself first?

• I confirm I have gone through the above steps and still have an issue to report.

Bug Description

When running sf code-analyzer run --rule-selector AppExchange command, it is getting stuck at 55%. I tried updating and restarting but it is not working.

Output / Logs

I have attached the log file.

sfca-2025_07_11_11_39_57_998.log

Steps To Reproduce

run sf code-analyzer run --rule-selector AppExchange command

Expected Behavior

It needs to generate a file for security review

Operating System

win32-x64

Visual Studio Code Version

1.102.0

Salesforce CLI Version

@salesforce/cli/2.96.4 win32-x64

Using v4

No

Code Analyzer CLI Plugin Version

code-analyzer 5.2.2 (5.2.2)

Node Version

v22.17.0

Java Version

java 21.0.4 2024-07-16 LTS

Python Version

Python 3.12.4

Additional Context (Screenshots, Files, etc)

Error Screenshot:

Workaround

No response

Urgency

High

[randi274]

Hi @NumaanMohd - can you double check that your plugin version is 5.2.2? We released a fix for a frozen PMD rule with #1841 and were hopeful that issue may have been resolved. You can confirm your plugin version by running sf plugins and can upgrade with sf plugins install code-analyzer.

If you are on the latest version, would you be able to run each of the AppExchange rules individually (one at a time) to see which one is hanging for you? The one causing an issue previously was pmd:AvoidChangeProtectionUnprotected if you'd like to start with that one.

[NumaanMohd]

Hi @randi274, I have checked the plugin version. It is 5.2.2.

Running one at a time is working but when I try to run the whole is it stuck. Tried the following commands.

sf code-analyzer run --rule-selector pmd --output-file CodeAnalyzerReport.html

sf code-analyzer run --rule-selector AppExchange --output-file CodeAnalyzerReport.html

sfca-2025_07_11_17_43_54_892.log

[randi274]

Thanks for confirming that version number!

To confirm the rules that you ran, you ran for example:

1. sf code-analyzer run -r AppExchange:AvoidApiSessionId
2. sf code-analyzer run -r AppExchange:AvoidAuraWithLockerDisabled
3. sf code-analyzer run -r AppExchange:AvoidChangeProtectionUnprotected
4. sf code-analyzer run -r AppExchange:AvoidCreateElementScriptLinkTag

... etc from the App Exchange rules, and none of them failed individually? The full list is also available from sf code-analyzer rules -r AppExchange.

[randi274]

Hi @NumaanMohd - were you able to run those rules individually? We'll go ahead and close this if we don't hear back in a few days. Thanks!

[NumaanMohd]

@randi274 - I tried running individually and found the issue is still there.
When I ran sf code-analyzer run -r AppExchange:AvoidHardCodedCredentialsInAura for the first time it got stuck but when I ran it again it was successful.

First time log (Stuck):

sfca-2025_07_26_11_46_30_125.log

Second time log (Success):

sfca-2025_07_26_11_46_59_548.log

The issue is not persistent with the rules.

[randi274]

@NumaanMohd thank you, this is very helpful in narrowing down the issue! Can you help us in troubleshooting this a bit further? You seem to have stumbled upon an interesting corner case!

Could you try adding the -t target flag to run this against specific files to see if it hangs on any file in particular? Then we can analyze the code and see if we're able to reproduce and get a bug filed to fix this.

1. sf code-analyzer run -r AppExchange:AvoidHardCodedCredentialsInAura -t ./force-app/**/**/aura/myCmp1/**
2. sf code-analyzer run -r AppExchange:AvoidHardCodedCredentialsInAura -t ./force-app/**/**/aura/myCmp2/**
3. sf code-analyzer run -r AppExchange:AvoidHardCodedCredentialsInAura -t ./force-app/**/**/aura/myCmp3/**
   ... etc

[NumaanMohd]

@randi274 I didn't find any issue when running for individual files. I think it is related to memory. Because when I ran the following command it was stuck but when I ran it again it was successful.

sf code-analyzer run -r AppExchange:AvoidInsecureHttpRemoteSiteSetting,AvoidInvalidCrudContentDistribution,AvoidJavaScriptCustomObject,AvoidJavaScriptHomePageComponent,AvoidJavaScriptInUrls,AvoidJavaScriptWebLink,AvoidLmcIsExposedTrue

Error Log:
sfca-2025_08_04_14_02_51_061.log

Success log:
sfca-2025_08_04_14_16_47_789.log

[randi274]

Hi @NumaanMohd - interesting, the AppExchange:AvoidHardCodedCredentialsInAura wasn't in that follow-up list that caused another issue for you. Are you able to reproduce this in any other projects? It looks like you're running this on Windows - how much memory does your computer have? How many files are you scanning?

One more thing for you to try - if you can create a code-analyzer.yml file with "Fine" level debugging:
log_level: 5

We may be able to see more into what's happening.

Finally, is it possible for you to provide us a repo we might be able to use to reproduce the issue? We're unable to reproduce this one, so short of being able to do that we would have you install PMD directly, if you'd like to try that as well (let me know if you'd like to go that route), or we can close this one as an intermittent issue.