Skip to main content
GroupsSalesforce Code Analyzer
Group

Salesforce Code Analyzer

This is the official group for Salesforce Code Analyzer Code Analyzer helps adhere to code quality best practices. It is available for the Salesforce CLI, IDE Experience and CI/CD (including as a GitHub Action and within DevOps Center). Official Docs: https://developer.salesforce.com/docs/platform/salesforce-code-analyzer/overview Official GitHub Repo: https://github.com/forcedotcom/sfdx-scanner/issues Please raise issues directly in our GitHub repo.
Jani Ruohomaa (Lead Architect at Fluido)
Dec 19, 2024, 12:59 PM
ESLint LWC and ESLint rules

How do you run a subset of the LWC specific ESLint rules and the common ESLint rules ?

Here are the common ones: https://eslint.org/docs/latest/rules/

and here the LWC specific ones: https://github.com/salesforce/eslint-plugin-lwc

I am able to run the LWC specific ones by specifying the --eslintconfig with a json

How do I run a subset of the common ESLint in addition to the LWC specific ones ?

 

For example I want to exclude sort-imports rule which is rule in the ESLint rule set

 

If I run scanner with -category suggestion then the sort-imports is used but not with problem category

but the sort-imports is not even listed as a rule with sf scanner rule list, why is it used ?

3 answers
  1. Jani Ruohomaa (Fluido)
    Dec 31, 2024, 9:05 AM

    But I am getting this with 2 ESLInt LWC rules

    Error (1): Error while loading rule '@lwc/lwc/no-unexpected-wire-adapter-usages': Cannot read properties of undefined (reading 'adapters')

     

    and

     

    Error (1): Error while loading rule '@lwc/lwc/no-unknown-wire-adapters': Cannot read properties of undefined (reading 'adapters')

     

    so I had to put them "off"

    Any idea what is causing that ?

Write an answer...
0/9000
Sean Whalen (Manager at Amadeus)
Mar 29, 2024, 8:38 PM
parameters into CPD?

I was happy to see the new "CPD" and "pmd-appexchange" CLI scanner tools in the recent documentation. Both are great additions to the tool that I'll run regularly.

docs: SF CPD

 

For CPD, is there command line syntax to pass a parameter in? I'm interested in the "--minimum-tokens" parameter, described in the PMD link. I added that on my SF command line, but it did not parse.

 

thanks,

Sean

2 answers
  1. Stephen Carter (Salesforce)
    Dec 30, 2024, 2:30 PM

    Note, at the end of this week (Thursday afternoon) we will be releasing Code Analyzer v5 (beta) where you'll be able to have greater control over the minimum tokens arguments (per language) for the cpd engine.

     

    You'll be able to create a code-analyzer.yml file (which we recommend you place in the root folder of your sfdx project) and configure the engines. One of the configuration options that we will have will be:

    engines:
      cpd:
        # Specifies the minimum tokens threshold for each rule language.
        # The minimum tokens threshold is the number of tokens required to be in a duplicate block of code in order to be
        # reported as a violation. The concept of a token may be defined differently per language, but in general it is a
        # distinct basic element of source code. For example, this could be language specific keywords, identifiers,
        # operators, literals, and more. See https://docs.pmd-code.org/latest/pmd_userdocs_cpd.html to learn more.
        # If a value for a language is unspecified, then the default value of 100 will be used for that language.
        minimum_tokens:
          apex: 100
          html: 100
          javascript: 100
          typescript: 100
          visualforce: 100
          xml: 100

    So you'll want to be on the look out for our release this week. 

    See: https://developer.salesforce.com/docs/platform/salesforce-code-analyzer/guide/code-analyzer.html and https://developer.salesforce.com/docs/platform/salesforce-code-analyzer/guide/release-notes.html

Write an answer...
0/9000
淳二 平岡 (なし at 株式会社アマダ)
Dec 12, 2024, 9:55 AM
Running Code Analyzer without the --category option causes an error (error messages are also garbled).

If you run Salesforce Code Analyzer without the --category option as shown below, you will get the following message and exit with an error.

 

sf scanner run --target './force-app/main/default/classes/'  --format csv > ./@scanner/classes.csv

Running Code Analyzer without the --category option causes an error (error messages are also garbled).The error message is garbled, so I cannot understand the details of the error and do not know how to respond.

 

If I run it with the --category 'Security' option, the error disappears, but only the information of the Security category of the pmd engine is displayed. (Of course...)

Am I missing some action to use the “retire-js” engine from the message?

 

sf scanner run --category 'Security' --target './force-app/main/default/classes/'  --format csv > ./@scanner/classes1.csv

CodeAnalyzerOK.pngCodeAnalyzerCSVOutput.png

2 answers
  1. Stephen Carter (Salesforce)
    Dec 30, 2024, 2:25 PM

    Note that this specific node issue with the retire-js engine will be fixed with our release that will be going out at the end of this week for both Code Analyzer v4 and Code Analyzer v5.

     

    But also, I'd like to note that soon (within the next few months) we may be ending support for Code Analyzer v4. So we recommend you start using Code Analyzer v5, that is the new code-analyzer cli plugin instead: 

    https://developer.salesforce.com/docs/platform/salesforce-code-analyzer/guide/code-analyzer.html

     

    With Code Analyzer v5, rule selection is far easier using our --rule-selector argument. You can even assign your own tags to categorize your rules as you wish inside of your code-analyzer.yml configuration file.

     

    To install v5:

    sf plugins install code-analyzer

    and then do

    sf code-analyzer rulessf code-analyzer runsf code-analyzer config

    to learn more!

Write an answer...
0/9000
Ellie Matthewman (Lead Technical Developer at Collinson Group)
Jun 28, 2024, 9:36 AM
Anyone else getting warnings about "commons-text-1.9.jar" vulnerability?

I'd really love for me and my team to be able to use the scanner to improve things like the security of our code as part of our development and deployment process - however, whenever I install the plugin on my computer, I always end up getting message from my IT team that vulnerable software is installed - relating to the commons-text-1.9.jar. I started jsut trying to delete this file and the scanner seemed to work fine, but then it keeps reappearing again (maybe after doing updates, is my guess) so ended up just uninstalling the plug in. Does anyone know a way to avoid having this vulnerability installed as part of the plug-in so we can start using the scanner?

 

Thanks!

1 answer
Write an answer...
0/9000
Doug Krutsinger (Blue Ridge IT Solutions, LLC)
Oct 18, 2023, 11:56 PM
dataloader cli warning messages

I am unloading data from my organization based on my company's data retention policy.  I have CLI jobs which will query the data and create the expected csv file.  

 

I then use that same csv file to run a CLI delete script.  It works fine, but for every single row, and every single column, except for Id, I get the warning message:  

 

[DataDelete] mapping.LoadMapper mapData (LoadMapper.java:83) - Mapping for field xxx will be ignored since destination column is empty.

 

It is possible, but excessive, to have a specific extract script that only pulls the Id, but I would much rather have the ability to simply suppress these warnings.  Is this possible?

 

@Salesforce Code Analyzer 

2 answers
Write an answer...
0/9000
Nicolas Chesnel (Développeurs at .) asked in #Appexchage Apps
Aug 8, 2023, 12:01 PM
How to Pass Arguments and Varargs to Salesforce CLI?

Hello fellow community members,

I am working on a project where I need to pass arguments and variable arguments (varargs) to the Salesforce CLI. I've been searching through the documentation, but I haven't found a clear explanation or example that demonstrates how to achieve this.

Has anyone here successfully passed arguments and varargs to the Salesforce CLI? If so, could you please provide a brief explanation or point me in the direction of a tutorial or resources that cover this topic? Any insights or guidance would be greatly appreciated.

Thank you in advance for your assistance!

 

@Salesforce Code Analyzer 

2 answers
Write an answer...
0/9000
Michael Smith (Advisor at gA) posted in #Sfdx Scanner
Mar 25, 2021, 4:09 AM

@Salesforce Code Analyzer Running  sfdx scanner with  "--violations-cause-error" which exits with a code equal to the severity that now fails other steps in my pipeline. Is there a way that my pipeline continues without failing if all the severity are equal to or less than a particular severity i define. so if i define the severity threshold at 3, if while i scan and a severity is equal to or less than 3 then it processes the files and moves on to the next step in the pipeline and if its more that 3 it still scans/processes the files but doesn't move to the next step in the pipeline

1 comment
Write a comment...
0/9000