S4 Visual Studio Code Extension
The S4 VS Code plugin allows developers to bring S4 directly into their VS Code workflow. We have integrated several important commands directly into the VSCode Command Palette, allowing Developers to quickly connect to S4 and start running scans on their entire project code base, a single file, or with every "Save" command. Vulnerability Reports are delivered within the VS Code IDE with clickable links to find flagged code snippets and with access to remediation guidance. Developers who rely on VSCode can now leverage S4 without ever leaving their IDE.
Installation Instructions
- Please launch Visual Studio code and select the extension icon
- In the Extensions Marketplace Search Bar, please enter "digitsec"
- Click the install button. After the extension has completed installation, please press "CTRL + SHIFT + P" to open the Command Palette and use the command “Reload Window”.
Details
This is the Digitsec S4 scan extension. You can install this extension and run scans on your current working directory to find issues within your code. This extension will scan all Salesforce files looking for vulnerabilities that could have been coded into your program.
Features
This Extension can be run against the current working directory to find vulnerabilities in your software.
Create Credentials
To start using this plugin, please make sure to use the Command Palette and select "DigitSec: Login to S4". This command will create a file called s4creds.json after it has verified the validity of your credentials. You can retrieve your S4 Org ID by logging into S4, and clicking on "View Scans" for the Salesforce Org you see. On the resulting page, look at the URL Address bar in your browser and it should be the string of characters following "https://s4.digitsec.com/index#org/".
Once you have that information, you will be able to enter your Username, Password and S4 Org ID in the dialog box that appears below.
Run S4 Scan on root directory
To run this extension, please open the Command Palette and then type in DigitSec. Click the “Run Security Scan” command. Wait a few minutes. Once the scan is completed, VSCode will display popups showing the findings results.
After your scan has completed, you will get a breakdown of your findings that looks like this:
If you would like to get a more in-depth breakdown of your vulnerability scan, the results of your scan will be added to the problems tab within VScode. These links can be clicked to take you to the line in your code where the vulnerability was found.
If you would like to find remediation steps for each of the vulnerabilities found within your code base, you can look at the Output tab, and from the drop-down menu select "DigitSec".
Run S4 Scan on open file
To run this extension, please open the Command Palette, then type in "DigitSec". Select the “Security Scan Open File” command. Wait a few minutes. Once the scan is completed, VSCode will display popups showing the findings results.
Run S4 Scan on file save
To enable this extension to scan your open file whenever you save a file, please open the S4 extension settings and check the box that says “Turns on/off scan on save functionality”. You can access the extension settings by accessing your installed extensions, finding "digitsec" in the list and clicking on the sprocket icon to open the context menu, then select "Extension Settings."
FAQ
Q. I'm using a remote repository for my code. Are there any special considerations I should keep in mind?
A. When you add an s4creds.json file to your project after using the Login to S4 command, you are storing an authenticated token in your codebase. For best practice, you will need to make sure you add s4creds.json to your .gitignore file so that file isn't synchronized back to your remote repository.
Q: When trying to run commands, we get an error message that says there is an error with our certs, what are we supposed to do to correct this?
A: Sometimes the certificates stored on your computer expire. We need to go in and remove some of our expired certificates for this extension to run properly. Please open up the certificate store on your computer and follow the instructions for your appropriate operating system:
Mac:
- Open Keychain Access
- Click View > Show Expired Certificates
- Sort login keychain by expiry date
- Find the AddTrust certificate that has already expired and delete it
- Your extension should work as intended now
Windows:
- Open Manage User Certificates. You can do this by pressing Windows+R and entering certmgr.msc
- In the left-hand menu, expand the "Trusted Root Certification Authorities" node.
- Find the AddTrust certificate that has already expired and delete it
- Your extension should work as intended now
Linux:
- Open terminal
- Run the command “sudo apt-get upgrade”
- Run the command “sudo apt-get update”
