4

We have AWS Lambda jobs, created and maintained by a contracted company, that use jsforce for communication with our Salesforce instance. After a serverless code security scan of the Lambda code, a couple of vulnerabilities have been identified in jsforce.

According to the contractors, the vulnerabilities are not fixed in the last 1.x version of jsforce, and 2.x & 3.x are still in beta/not a stable release. Our "powers that be" would prefer not to use libraries still in beta (even though they've been that way for some time) in our production.

I've been asked to provide some direction, but this is outside of my wheelhouse.

Questions

  1. As I understand it, jsforce is not directly a Salesforce created/provided library, but they support it. Is that correct?
  2. What are some options that our contractors could use in Lambda as an alternative to jsforce?
Improve this question
1
  • 1
    1. No, it's open source, not officially supported by SF. It communicates to SF via APIs. 2. You don't need a library to call REST APIs from Javascript.
    – identigral
    Commented Mar 27 at 20:58

1 Answer 1

Reset to default
3

As I understand it, jsforce is not directly a Salesforce created/provided library, but they support it. Is that correct?

No, it is neither maintained or supported by Salesforce. It is open source, so you could fix the bugs yourself if you wanted to.

What are some options that our contractors could use in Lambda as an alternative to jsforce?

You can get most of what you need directly from the AJAX toolkit. You just need to patch out XmlHttpRequest for a suitable HTTPS connection and figure out authentication.

Or, you can just write it yourself. As you can see, there's not a lot of code in jsForce, and it's mostly just a handful of utility methods. There's no need to use a utility library if you have just a handful of specific functions you want to implement.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .