I am currently trying to implement a simple gallery plugin, in a lightning component in my org. As I am still trying to figure out how can I improve and fixes the problem that this plugin might have, I came across of suggested tool, like Salesforce Lightning CLI.

I performed a scan of the component controllers and my javascript library too.

The screen of git tool, that I used gave me this feedback:

enter image description here

The problem is that I am not able to understand what countermeasures should I take in order to solve this errors signaled by CLI tool. I would like to know for example, what is the workaround of secure-window error. Is there any concrete reference on this errors?

Thanks. E.

  • Hi! Can you share the controller or some part of the code, so that I can better understand what the issue is. Commented Feb 15, 2017 at 17:57
  • Through this link, you can install the unmanaged package with the sample components: login.salesforce.com/packaging/… Commented Feb 15, 2017 at 20:12
  • The log that I've showed above, is relative to the file(static resource) lightgallery.js. Commented Feb 15, 2017 at 20:12

1 Answer 1


The Lightning CLI isn't currently designed to work with 3rd party libraries. As you can see, there's a bit too much noise. It looks like you copy/pasted your lib into your controller to get the CLI to run against it.

From the screenshot you shared, none of those errors look like real issues. Also, jquery version 2.2.4 has been the most reliable inside LockerService (no reported issues currently). Newer versions 3.x also don't have any outstanding issues reported.

Anything reporting a global variable as being invalid that you know is defined can be ignored. Feel free to edit your answer to provide any other errors you're not sure about.

  • Actually that's a scan of the lightgallery plug in itself. If I am not wrong that code too, should be compliant with the Locker Service, right? Is the same code version of lightgallery that you recommended me to use, in this post: salesforce.stackexchange.com/questions/160319/… Commented Feb 15, 2017 at 20:01
  • Unfortunately, there's no silver bullet to know if a 3rd party lib will work for all use cases without running the code itself. There's no way (from what I've researched) to use static analysis tools to be sure a library is 100% strict mode compliant, does not break CSP rules, and only modifies DOM elements it has access to (created by same namespace). You can look at the source code and github issues etc. to try to figure that out but there's no single tool to use figure that out. Commented Feb 15, 2017 at 20:43
  • Ok, but at least solving those problems reported by that tool, should be somehow kind of progress right? So, you're basically saying that, even if we "reengineer" the library itsel(which will be trmendously tedious), according to the Locker Service compliance, still there is no assurance that the code might work as it would in a normal web page? Commented Feb 15, 2017 at 20:49
  • These specific errors reported by the CLI tool probably shoudn't be reported as errors. Commented Feb 21, 2017 at 18:44
  • Ok, let's take for example the error that shows, after enabling Locker Service feature: "'CustomEvent' shouldn't be used as a function, but as a Constructor". Like I have pointed out in my question: Is there any clear documentation how to come around this kind of errors? I know that this means plenty of work in reengineering the libraries, but I need to know what is the way out here. Commented Feb 22, 2017 at 11:00

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .