Ok, let see what the Salesforce CLI Scanner is and what it can do for us. The tool is a plugin that uses multiple code analysis engines in various languages (including Apex). It currently inspects your code using the PMD rule engine and ESLint, however, they have plans to add support for more rule engines in the future.
This means that the tool will help you identify potential problems, from inconsistent naming to security vulnerabilities and alert you to these problems with easy to understand results. You can run the scanner on-command in the CLI, or integrate it into your CI/CD framework to enforce rules and expect high-quality code. And you can run it against every code change.
It’s like having a code review in real-time. Following some rules the Salesforce CLI Scanner can identify issues and show them to the developers as feedback to fix the code, saving a lot of time and money.
This tool can be used by ISVs and Salesforce developers to prepare for security review processes. It can improve code quality by identifying a variety of performance and security issues in the development stage.
Another possible use is to integrate this tool with a CI/CD process to regularly monitor your code’s health.
Remember that the Salesforce CLI Scanner plugin works on all operating systems that Salesforce CLI supports. It has a one-step installation that is quite easy and fast, and if you are uncertain about the command-line commands, it has a built-in help (–help).
They have recently added new functionality that allows you to scan Salesforce Lightning Web Components using ESlint, and it’s amazing to have that.
These are some of the key features of Scanner v2.3, released in October 2020.
Static analysis
Static analysis, also called static code analysis, is a computer program method for debugging. It is done by examining the code without executing the program. The process provides an understanding of the code structure and can help ensure that the code adheres to best practices and doesn’t fall into common antipatterns and coding issues that will have a negative impact on the performance or quality of the code. Based on rules, the engine reports the suggestions for upgrading your code.
Of course, currently there are a lot of static analysis tools, but most of them work only with one or just a few sets of languages, and the most common in Salesforce packages is the use of a variety of components created in different languages. A single static analyzer is insufficient to take into account all the rules, patterns, best practices, etc. Working with multiple static analyzer tools can quickly become a headache.
To solve this, we recommend the Salesforce CLI Scanner plug-in. This plug-in shows the most relevant information to help Salesforce developers improve to the code while providing a unified experience.
It has a single and easy installation process with an intuitive set of commands to interact with multiple rule engines. You can define a unified set of rules that are checked by their respective rule engines and also get a report that includes all issues identified by all the engines.
What is PMD?
PMD is a very powerful open-source static analyzer that supports many languages. Additionally, it has a large community of developers building rules for Apex. By default, Salesforce CLI Scanner supports code written in Apex, VisualForce, Java, JavaScript, and TypeScript but you can easily extend it to support any language.
Here at Oktana, we have a set of custom rules to improve our code quality and help everyone to have better-structured code.
What is ESlint?
ESlint is an open-source JavaScript linting utility for identifying and reporting on patterns, with the goal of making code more consistent and avoiding bugs.
Because it’s very flexible in how it parses JavaScript, it can handle many use-cases related to Lightning Web Components. Additionally, with the built-in Eslint-typescript plugin, the Salesforce CLI Scanner can also analyze TypeScript out-of-the-box.
What does the Salesforce CLI Scanner do for me?
By combining two static scanners in one tool, the Salesforce CLI Scanner allows you to detect a wide variety of problems in your code.
Example Apex issues include:
- Performance issues (e.g. running SOQL or SOSL queries inside loops).
- Security issues (e.g. basic sharing violations, simplified CRUD/FLS checks, CSRF, and XSS vulnerabilities)
- Not clear code (variable names, comments in classes and methods, avoid long, and complicated methods)
- Error-prone code (e.g. empty try/catch/finally blocks)
Example issues with Lightning Web Components include:
- Unreachable code
- Unused variables
- Invalid regular expressions
- Stylistic preferences such as enforcing semi-colon at the end of a statement and expecting function names in camelcase
Catching these issues early has several advantages:
- You can fix code issues immediately and rerun Salesforce CLI Scanner right away to confirm that the issues have been resolved, saving time.
- Ensure the new developers are following the best practices, best patterns, and avoiding common issues.
- You can shorten the security review processes. These processes are faster and easier when most issues are identified and fixed before the review even begins.
Different report formats
Salesforce CLI Scanner has an array of useful reporting formats for different uses:
- Simple table-style reporting to get feedback on code you are actively writing
- CSV reporting for spreadsheet-based filtering and analytics
- JSON and XML reporting to feed into other tools for further processing
- HTML reporting for readable, searchable results
- JUnit-style test failures to use with a CI/CD setup
Conclusion
Salesforce CLI Scanner is a tool that is here to stay. It has a lot of Salesforce engineers actively implementing new features to further improve it.
An upcoming feature is the ability to detect and warn of external code dependencies that may have security vulnerabilities. They are also in the process of adding new rules to identify more security issues.
You can get started with Salesforce CLI Scanner within minutes by following this link to improve your code quality and save time.
What are you waiting for? Go ahead and give this amazing tool a try, and leave your comments about how your experience was!
Learn more from our team here, or check out our services.
