1

Under the requirements for the Force.com Security Source Scanner it states:

Source code that lives inside of managed or unmanaged packages is not scanned to avoid inadvertently scanning code unrelated to your application.

I am interested in running the scanner on the Nonprofit Starter Pack, but they're open source managed (and unmanaged) packages. Does this mean it's not possible to scan the code using this tool, or is there a way around this?

Improve this question

3 Answers 3

Reset to default
2

We've been working on NPSP 3.0 for the last 9 months and are getting very close to a release. The new version is currently under security review as part of the standard process for listing on the AppExchange. I'm not sure if the security scan results are allowed to be published but will check to see if that's possible and/or advisable. We're an open source project and definitely err on the side of sharing information where possible. Our whole development process can be publicly tracked on GitHub.

We put a lot of effort into making deployment to a Developer Edition org a lot easier with the new version. If you want to run a scanner against the new version, all the code and deployment scripts to deploy it into a DE org are at https://github.com/SalesforceFoundation/Cumulus

Once deployed into a DE org, you could run whatever scans you want against it. It's worth noting that this is far more access to the security scan than you'd get with most managed packages as most packages do not publish the underlying code publicly.

Improve this answer
2

It means that if your application uses a managed package then that managed package will not be scanned

The scanner will only scan the namespace of the org that the scan is being run on. So if you are installing the Starter Pack into your org, it will not be scanned.

Also, in order for a package (Managed) to be approved, it basically meets the criteria of the scanner as you are required to run it in order to submit the package for approval. An unmanaged package may or may not have been scanned.

Improve this answer
2
  • +1 Is there a way around this, for example locally running the scanner - or another free static code analysis tools that would be comparable to CheckMarx's analysis? Would the dev-team for the NPSP be able to run the test and release the results?
    – blunders
    Commented May 28, 2014 at 2:32
  • 1
    Yes, the dev team for the NPSP could run it and provide you a copy of the report if they were so inclined to do so
    – Eric
    Commented May 28, 2014 at 2:33
2

No packaged code is scanned, whether managed or unmanaged.

There is a legitimate use case to scan unmanaged packages, but there is a workaround to deploying the code into a DE org directly, so this is not a high priority at the moment.

We cannot scan managed packages because there are IP protections in place that prevent disclosure of source code, whereas the scanner report contains source code excerpts.

However whenever you upload a package for security review, then this package is scanned.

You can get around this restriction by purchasing a license for a local Checkmarx scanner install, in which case you can scan whatever code you have access to.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .