Rationale
According to OWASP, one of the Top 10 vulnerability risks is using open components with known vulnerabilities. This easily overlooked risk is very relevant for Salesforce developers, as they might unknowingly include vulnerable JavaScript libraries in their Visualforce, Aura or Lightning components.
What does this rule do?
This rule checks any open source library used by any Visualforce page or component, Aura Component, or Lightning Web Component with a known vulnerability.
How does the rule work?
We use various strategies to determine whether a Salesforce application actively uses any third-party library. These depend on the language and type of component and include:
Libraries embedded via URL (e.g. from CDN networks)
Libraries imported from static resources
Libraries referenced in
packages.json
We maintain a database of signatures from many open source libraries and their various versions, along with any known vulnerabilities. We determine which libraries and versions are used by looking at:
Filenames (when the original file names of the libraries are preserved)
URLs (when included from a known CDN)
File content (e.g. when libraries are loaded as static resources, but the original filenames are not preserved)
When we identify a known library, we check for any known vulnerabilities related to that version. If a match is found, a violation is flagged.
Code Reviews support libraries and vulnerabilities listed at https://retirejs.github.io/retire.js/