Security News
Research
Data Theft Repackaged: A Case Study in Malicious Wrapper Packages on npm
The Socket Research Team breaks down a malicious wrapper package that uses obfuscation to harvest credentials and exfiltrate sensitive data.
lightning-flow-scanner-core
Advanced tools
##### _This the rule engine is used in both the [VSCode extension](https://marketplace.visualstudio.com/items?itemName=ForceConfigControl.lightningflowscanner&ssr=false#review-details) and the [SFDX plugin](https://www.npmjs.com/package/lightning-flow-sca
Newer API components may cause older versions of Flows to start behaving incorrectly due to differences in the underlying mechanics. The Api Version has been available as an attribute on the Flow since API v50.0 and it is recommended to limit variation and to update them on a regular basis.
Default Value: >50.0
Configuration example:
APIVersion:
{
severity: 'error',
expression: '===58'
}
Configuration ID: APIVersion
(View source code)
To avoid hitting Apex governor limits, we recommend grouping all of your changes together at the end of the flow, whether those changes create, update, or delete records.
Configuration ID: DMLStatementInLoop
(View source code)
If the flow commits changes to the database or performs actions between two screens, don't let users navigate back between screen. Otherwise, the flow may perform duplicate database operations.
Configuration ID: DuplicateDMLOperations
(View source code)
IDs are org-specific, so don’t hard-code IDs. Instead, pass them into variables when the flow starts. You can do so, for example, by using merge fields in URL parameters or by using a Get Records element.
Configuration ID: HardcodedIds
(View source code)
Readability of a flow is very important. Setting a naming convention for the Flow Name will improve the findability/searchability and overall consistency. It is recommended to at least provide a domain and a short description of the actions undertaken in the flow, in example Service_OrderFulfillment.
Default Value: [A-Za-z0-9]+_[A-Za-z0-9]+
Configuration example:
FlowName:
{
severity: 'error',
expression: '[A-Za-z0-9]'
}
Configuration ID: FlowName
(View source code)
Descriptions are useful for documentation purposes. It is recommended to provide information about where it is used and what it will do.
Configuration ID: FlowDescription
(View source code)
Sometimes a flow doesn’t perform an operation that you configured it to do. By default, the flow shows an error message to the user and emails the admin who created the flow. However, you can control that behavior.
Configuration ID: MissingFaultPath
(View source code)
If a Get Records operation does not find any data it will return null. Use a decision element on the operation result variable to validate that the result is not null.
Configuration ID: MissingNullHandler
(View source code)
Unconnected elements which are not being used by the Flow should be avoided to keep Flows efficient and maintainable.
Configuration ID: UnconnectedElements
(View source code)
Unconnected variables which are not being used by the Flow should be avoided to keep Flow more efficient and maintainable.
Configuration ID: UnusedVariables
(View source code)
getRules(ruleNames? : string[]): IRuleDefinition[];
Returns all rules that are currently available if there are no ruleNames specified. In case ruleNames are specified, it will only return rules which are included by name.
scan(flows: Flow[], ruleOptions?: IRulesConfig): ScanResult[];
If there are no rules specified, the scan will run all available rules by default. In case that there are ruleNames specified, only the specified rules will be ran. Specified exceptions will be ignored from the results altogether.
fix(flows :Flow[]): ScanResult[];
Removes unused variables and unconnected elements from selected flows automatically.
FAQs
A rule engine capable of conducting static analysis on the metadata associated with Salesforce Lightning Flows, Process Builders, and Workflows.
The npm package lightning-flow-scanner-core receives a total of 3,830 weekly downloads. As such, lightning-flow-scanner-core popularity was classified as popular.
We found that lightning-flow-scanner-core demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 0 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
Research
The Socket Research Team breaks down a malicious wrapper package that uses obfuscation to harvest credentials and exfiltrate sensitive data.
Research
Security News
Attackers used a malicious npm package typosquatting a popular ESLint plugin to steal sensitive data, execute commands, and exploit developer systems.
Security News
The Ultralytics' PyPI Package was compromised four times in one weekend through GitHub Actions cache poisoning and failure to rotate previously compromised API tokens.