Skip to content

Commit abb87f6

Browse files
jfeingold35jfeingold35
authored
Merge pull request #1089 from forcedotcom/dev
RELEASE: @W-13537298@: Merging dev to release for 3.13.0
2 parents 18110f4 + f267158 commit abb87f6

File tree

83 files changed

+3524
-1055
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

83 files changed

+3524
-1055
lines changed

‎package.json‎

Lines changed: 2 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
{
22
"name": "@salesforce/sfdx-scanner",
33
"description": "Static code scanner that applies quality and security rules to Apex code, and provides feedback.",
4-
"version": "3.12.0",
4+
"version": "3.13.0",
55
"author": "ISV SWAT",
66
"bugs": "https://github.com/forcedotcom/sfdx-scanner/issues",
77
"dependencies": {
@@ -119,10 +119,7 @@
119119
},
120120
"devPlugins": [
121121
"@oclif/plugin-help"
122-
],
123-
"hooks": {
124-
"init": "./lib/lib/hooks/init"
125-
}
122+
]
126123
},
127124
"nyc": {
128125
"branches": "80",

‎retire-js/RetireJsVulns.json‎

Lines changed: 137 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -559,6 +559,7 @@
559559
"jquery-ui",
560560
"jquery.ui"
561561
],
562+
"npmname": "jquery-ui",
562563
"vulnerabilities": [
563564
{
564565
"below": "1.13.2",
@@ -671,6 +672,7 @@
671672
"jquery-ui",
672673
"jquery.ui"
673674
],
675+
"npmname": "jquery-ui",
674676
"vulnerabilities": [
675677
{
676678
"atOrAbove": "1.8.9",
@@ -728,6 +730,7 @@
728730
"jquery-ui",
729731
"jquery.ui"
730732
],
733+
"npmname": "jquery-ui",
731734
"vulnerabilities": [],
732735
"extractors": {
733736
"filecontent": [
@@ -744,6 +747,7 @@
744747
"jquery-ui",
745748
"jquery.ui"
746749
],
750+
"npmname": "jquery-ui",
747751
"vulnerabilities": [
748752
{
749753
"atOrAbove": "1.9.2",
@@ -779,6 +783,7 @@
779783
"bowername": [
780784
"jquery-prettyPhoto"
781785
],
786+
"basePurl": "pkg:github/scaron/prettyphoto",
782787
"vulnerabilities": [
783788
{
784789
"below": "3.1.5",
@@ -826,6 +831,7 @@
826831
"bowername": [
827832
"jPlayer"
828833
],
834+
"npmname": "jplayer",
829835
"vulnerabilities": [
830836
{
831837
"below": "2.3.1",
@@ -987,6 +993,7 @@
987993
"tinymce",
988994
"tinymce-dist"
989995
],
996+
"npmname": "tinymce",
990997
"vulnerabilities": [
991998
{
992999
"below": "1.4.2",
@@ -1196,6 +1203,7 @@
11961203
"yui",
11971204
"yui3"
11981205
],
1206+
"npmname": "yui",
11991207
"vulnerabilities": [
12001208
{
12011209
"atOrAbove": "3.5.0",
@@ -2307,6 +2315,7 @@
23072315
"angularjs",
23082316
"angular.js"
23092317
],
2318+
"npmname": "angular",
23102319
"vulnerabilities": [
23112320
{
23122321
"below": "1.8.0",
@@ -2496,6 +2505,8 @@
24962505
"backbonejs",
24972506
"backbone"
24982507
],
2508+
"npmname": "backbone",
2509+
"basePurl": "npm:npm/backbone",
24992510
"vulnerabilities": [
25002511
{
25012512
"below": "0.5.0",
@@ -2532,6 +2543,8 @@
25322543
"mustache.js",
25332544
"mustache"
25342545
],
2546+
"npmname": "mustache",
2547+
"basePurl": "npm:npm/mustache",
25352548
"vulnerabilities": [
25362549
{
25372550
"below": "0.3.1",
@@ -2925,6 +2938,7 @@
29252938
}
29262939
},
29272940
"easyXDM": {
2941+
"npmname": "easyxdm",
29282942
"vulnerabilities": [
29292943
{
29302944
"below": "2.4.18",
@@ -3166,6 +3180,7 @@
31663180
"dompurify",
31673181
"DOMPurify"
31683182
],
3183+
"npmname": "dompurify",
31693184
"vulnerabilities": [
31703185
{
31713186
"below": "0.6.1",
@@ -3514,6 +3529,7 @@
35143529
}
35153530
},
35163531
"DWR": {
3532+
"npmname": "dwr",
35173533
"vulnerabilities": [
35183534
{
35193535
"below": "1.1.4",
@@ -3578,6 +3594,8 @@
35783594
"moment",
35793595
"momentjs"
35803596
],
3597+
"npmname": "moment",
3598+
"basePurl": "pkg:npm/moment",
35813599
"vulnerabilities": [
35823600
{
35833601
"below": "2.11.2",
@@ -3664,8 +3682,11 @@
36643682
"uri": [
36653683
"/moment\\.js/(§§version§§)/moment(.min)?\\.js"
36663684
],
3685+
"filename": [
3686+
"moment(?:-|\\.)(§§version§§)(?:-min)?\\.js"
3687+
],
36673688
"filecontent": [
3668-
"//! moment.js(?:[\n\r]+)//! version : (§§version§§)",
3689+
"//!? moment.js(?:[\n\r]+)//!? version : (§§version§§)",
36693690
"\\.version=\"(§§version§§)\".{300,500}\\.isMoment="
36703691
]
36713692
}
@@ -3675,6 +3696,7 @@
36753696
"Underscore",
36763697
"underscore"
36773698
],
3699+
"npmname": "underscore",
36783700
"vulnerabilities": [
36793701
{
36803702
"below": "1.12.1",
@@ -4726,6 +4748,7 @@
47264748
}
47274749
},
47284750
"AlaSQL": {
4751+
"npmname": "alasql",
47294752
"vulnerabilities": [
47304753
{
47314754
"below": "0.7.0",
@@ -4755,6 +4778,7 @@
47554778
}
47564779
},
47574780
"jquery.datatables": {
4781+
"npmname": "datatables",
47584782
"vulnerabilities": [
47594783
{
47604784
"below": "1.11.3",
@@ -5009,6 +5033,118 @@
50095033
]
50105034
}
50115035
},
5036+
"froala": {
5037+
"npmname": "froala-editor",
5038+
"vulnerabilities": [
5039+
{
5040+
"below": "4.0.11",
5041+
"severity": "medium",
5042+
"cwe": [
5043+
"CWE-79"
5044+
],
5045+
"identifiers": {
5046+
"summary": "XSS vulnerability in [insert video]",
5047+
"issue": "3880"
5048+
},
5049+
"info": [
5050+
"https://github.com/froala/wysiwyg-editor/releases/tag/v4.0.11"
5051+
]
5052+
},
5053+
{
5054+
"below": "3.2.7",
5055+
"severity": "high",
5056+
"cwe": [
5057+
"CWE-79"
5058+
],
5059+
"identifiers": {
5060+
"summary": "Froala WYSIWYG Editor 3.2.6-1 is affected by XSS due to a namespace confusion during parsing.",
5061+
"CVE": [
5062+
"CVE-2021-28114"
5063+
]
5064+
},
5065+
"info": [
5066+
"https://bishopfox.com/blog/froala-editor-v3-2-6-advisory"
5067+
]
5068+
},
5069+
{
5070+
"below": "3.2.7",
5071+
"severity": "medium",
5072+
"cwe": [
5073+
"CWE-79"
5074+
],
5075+
"identifiers": {
5076+
"summary": "Froala WYSIWYG Editor 3.2.6 is affected by Cross Site Scripting (XSS). Under certain conditions, a base64 crafted string leads to persistent XSS.",
5077+
"CVE": [
5078+
"CVE-2021-30109"
5079+
]
5080+
},
5081+
"info": [
5082+
"https://github.com/froala/wysiwyg-editor/releases/tag/v4.0.11"
5083+
]
5084+
},
5085+
{
5086+
"below": "3.2.2",
5087+
"severity": "medium",
5088+
"cwe": [
5089+
"CWE-79"
5090+
],
5091+
"identifiers": {
5092+
"summary": "Security issue: XSS via pasted content",
5093+
"issue": "3880"
5094+
},
5095+
"info": [
5096+
"https://froala.com/wysiwyg-editor/changelog/#3.2.2"
5097+
]
5098+
},
5099+
{
5100+
"below": "3.2.2",
5101+
"severity": "medium",
5102+
"cwe": [
5103+
"CWE-79"
5104+
],
5105+
"identifiers": {
5106+
"summary": "XSS Issue In Link Insertion",
5107+
"issue": "3270"
5108+
},
5109+
"info": [
5110+
"https://github.com/froala/wysiwyg-editor/issues/3270"
5111+
]
5112+
}
5113+
],
5114+
"extractors": {
5115+
"uri": [
5116+
"/froala-editor/(§§version§§)/",
5117+
"/froala-editor@(§§version§§)/"
5118+
],
5119+
"filecontent": [
5120+
"/\\*![\\s]+\\* froala_editor v(§§version§§)",
5121+
"VERSION:\"(§§version§§)\",INSTANCES:\\[\\],OPTS_MAPPING:\\{\\}"
5122+
]
5123+
}
5124+
},
5125+
"pendo": {
5126+
"vulnerabilities": [
5127+
{
5128+
"below": "2.15.18",
5129+
"severity": "medium",
5130+
"cwe": [
5131+
"CWE-79"
5132+
],
5133+
"identifiers": {
5134+
"summary": "Patched XSS vulnerability around script loading",
5135+
"retid": "74"
5136+
},
5137+
"info": [
5138+
"https://developers.pendo.io/agent-version-2-15-18/"
5139+
]
5140+
}
5141+
],
5142+
"extractors": {
5143+
"filecontent": [
5144+
"// Pendo Agent Wrapper\n//[\\s]+Environment:[\\s]+[^\n]+\n// Agent Version:[\\s]+(§§version§§)"
5145+
]
5146+
}
5147+
},
50125148
"dont check": {
50135149
"extractors": {
50145150
"uri": [

‎sfge/lib/apex-jorje-lsp-sfge.jar‎

13.4 KB
Binary file not shown.

‎sfge/src/main/java/com/salesforce/apex/jorje/UserTriggerWrapper.java‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -18,5 +18,7 @@ public void accept(JorjeNodeVisitor visitor) {
1818
@Override
1919
protected void fillProperties(Map<String, Object> properties) {
2020
properties.put(Schema.NAME, getName());
21+
properties.put(Schema.TARGET_NAME, getNode().getTargetName().get(0).getValue());
22+
properties.put(Schema.USAGES, getNode().getUsages().toString());
2123
}
2224
}

‎sfge/src/main/java/com/salesforce/collections/CollectionUtil.java‎

Lines changed: 16 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -3,12 +3,7 @@
33
import com.google.common.collect.ImmutableList;
44
import com.salesforce.exception.UnexpectedException;
55
import com.salesforce.graph.ops.TypeableUtil;
6-
import java.util.Arrays;
7-
import java.util.Collection;
8-
import java.util.List;
9-
import java.util.Map;
10-
import java.util.TreeMap;
11-
import java.util.TreeSet;
6+
import java.util.*;
127
import java.util.concurrent.ConcurrentMap;
138
import java.util.concurrent.ConcurrentSkipListMap;
149
import java.util.function.BiFunction;
@@ -186,5 +181,20 @@ public static <T, U> List<U> newImmutableListOf(
186181
.collect(Collectors.collectingAndThen(Collectors.toList(), ImmutableList::copyOf));
187182
}
188183

184+
/**
185+
* Peek into the stack to get the last element. Converts value into an Optional instead of
186+
* throwing an {@link EmptyStackException} when stack is empty.
187+
*
188+
* @param stack to look at
189+
* @param <T> Stack's generic
190+
* @return last element added to the stack
191+
*/
192+
public static <T> Optional<T> peek(Stack<T> stack) {
193+
if (stack.isEmpty()) {
194+
return Optional.empty();
195+
}
196+
return Optional.of(stack.peek());
197+
}
198+
189199
private CollectionUtil() {}
190200
}

‎sfge/src/main/java/com/salesforce/config/UserFacingMessages.java‎

Lines changed: 9 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -9,11 +9,13 @@ public final class UserFacingMessages {
99

1010
public static final class RuleDescriptions {
1111
public static final String APEX_NULL_POINTER_EXCEPTION_RULE =
12-
"Identfies Apex operations that dereference null objects and throw NullPointerExceptions.";
12+
"Identifies Apex operations that dereference null objects and throw NullPointerExceptions.";
1313
public static final String UNIMPLEMENTED_TYPE_RULE =
1414
"Identifies abstract classes and interfaces that are non-global and don't have implementations or extensions.";
1515
public static final String UNUSED_METHOD_RULE =
1616
"Identifies methods that aren't invoked from recognized entry points.";
17+
public static final String MULTIPLE_MASS_SCHEMA_LOOKUP_RULE =
18+
"Detects mass schema lookups that can cause performance degradation if made more than once in a path. These methods are: Schema.getGlobalDescribe() and Schema.describeSObjects(...). Flagged lookups include those within a loop or multiple invocations in a path.";
1719
}
1820

1921
public static final class RuleViolationTemplates {
@@ -75,4 +77,10 @@ public static final class CompilationErrors {
7577
"Graph engine encountered compilation errors. Fix the errors in %s and retry.";
7678
public static final String EXCEPTION_FORMAT_TEMPLATE = "%s, Caused by:\n%s";
7779
}
80+
81+
public static final class MultipleMassSchemaLookupRuleTemplates {
82+
public static final String MESSAGE_TEMPLATE = "%s was %s at %s:%d.";
83+
public static final String OCCURRENCE_LOOP_TEMPLATE = "called inside a %s";
84+
public static final String OCCURRENCE_MULTIPLE_TEMPLATE = "preceded by a call to %s";
85+
}
7886
}

‎sfge/src/main/java/com/salesforce/graph/Schema.java‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -62,10 +62,12 @@ public class Schema {
6262
public static final String STATIC_CONSTRUCTOR_CANONICAL_NAME = "<clinit>";
6363
public static final String SUPER_CLASS_NAME = "SuperClassName";
6464
public static final String SUPER_INTERFACE_NAME = "SuperInterfaceName";
65+
public static final String TARGET_NAME = "TargetName";
6566
public static final String TYPE = "Type";
6667
/** Contains type for statements such as MyClass.class */
6768
public static final String TYPE_REF = "TypeRef";
6869

70+
public static final String USAGES = "Usages";
6971
public static final String VALUE = "Value";
7072
public static final String VIRTUAL = "Virtual";
7173
public static final String QUERY = "Query";

‎sfge/src/main/java/com/salesforce/graph/build/CaseSafePropertyUtil.java‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -47,7 +47,8 @@ public class CaseSafePropertyUtil {
4747
Schema.NAME,
4848
Schema.RETURN_TYPE,
4949
Schema.SUPER_CLASS_NAME,
50-
Schema.SUPER_INTERFACE_NAME);
50+
Schema.SUPER_INTERFACE_NAME,
51+
Schema.TARGET_NAME);
5152

5253
static void addCaseSafeProperty(
5354
GraphTraversal<Vertex, Vertex> traversal, String property, Object value) {

0 commit comments

Comments
 (0)