DigitSec Visual Studio Code Extension
The VS Code plugin allows developers to bring DigitSec directly into their VS Code workflow. We have integrated several important commands directly into the VSCode Command Palette, allowing Developers to quickly connect to DigitSec and start running scans on their entire project code base, a single file, or with every "Save" command. Vulnerability Reports are delivered within the VS Code IDE with clickable links to find flagged code snippets and with access to remediation guidance. Developers who rely on VSCode can now leverage security scan data without ever leaving their IDE.
Installation Instructions
- Please launch Visual Studio code and select the extension icon
- In the Extensions Marketplace Search Bar, please enter "digitsec"
- Click the install button. After the extension has completed installation, please press "CTRL + SHIFT + P" to open the Command Palette and use the command “Reload Window”.
Details
This is the Digitsec Security Plugin scan extension. You can install this extension and run scans on your current working directory to find issues within your code. This extension will scan all Salesforce files looking for vulnerabilities that could have been coded into your program.
Features
This Extension can be run against the current working directory to find vulnerabilities in your software.
Create Credentials
To start using this plugin, please make sure to use the Command Palette and select "DigitSec: Login to App". This command will create a file called s4creds.json after it has verified the validity of your credentials. You can retrieve your DigitSec Org ID by logging into the web app and reviewing the Dashboard screen. Find the Workspace you wish to connect to VS Code and copy the Workspace ID.Once you have that information, you will be able to enter your Username, Password and S4 Org ID in the dialog box that appears below.
Run Security Scan on root directory
To run this extension, please open the Command Palette and then type in DigitSec. Click the “Run Security Scan” command. Wait a few minutes. Once the scan is completed, VSCode will display popups showing the findings results.
After your scan has completed, you will get a breakdown of your findings that looks like this:
Note that these scan results are saved to the Workspace environment in the Web App. If you would like to get a more in-depth breakdown of your vulnerability scan, the results of your scan will be added to the problems tab within VScode. These links can be clicked to take you to the line in your code where the vulnerability was found.
If you would like to find remediation steps for each of the vulnerabilities found within your code base, you can look at the Output tab, and from the drop-down menu select "DigitSec".
Run Security Scan open file
To run this extension, please open the Command Palette, then type in "DigitSec". Select the “Security Scan Open File” command. Wait a few minutes. Once the scan is completed, VSCode will display popups showing the findings results.
Run S4 Scan on file save
To enable this extension to scan your open file whenever you save a file, please open the DigitSec extension settings and check the box that says “Turns on/off scan on save functionality”. You can access the extension settings by accessing your installed extensions, finding "digitsec" in the list and clicking on the sprocket icon to open the context menu, then select "Extension Settings."
FAQ
Q. I'm using a remote repository for my code. Are there any special considerations I should keep in mind?
A. When you add an s4creds.json file to your project after using the Login to S4 command, you are storing an authenticated token in your codebase. For best practice, you will need to make sure you add s4creds.json to your .gitignore file so that file isn't synchronized back to your remote repository.
Q: When trying to run commands, we get an error message that says there is an error with our certs, what are we supposed to do to correct this?
A: Sometimes the certificates stored on your computer expire. You will need to remove expired certificates for this extension to run properly. Please open the certificate store on your computer and follow the instructions for your appropriate operating system:
Mac:
- Open Keychain Access
- Click View > Show Expired Certificates
- Sort login keychain by expiry date
- Find the AddTrust certificate that has already expired and delete it
- Your extension should work as intended now
Windows:
- Open Manage User Certificates. You can do this by pressing Windows+R and entering certmgr.msc
- In the left-hand menu, expand the "Trusted Root Certification Authorities" node.
- Find the AddTrust certificate that has already expired and delete it
- Your extension should work as intended now
Linux:
- Open terminal
- Run the command “sudo apt-get upgrade”
- Run the command “sudo apt-get update”
Q: Is there a setting I can toggle that governs whether my scan results are saved back to my Workspace?
A: Currently, this is a feature request that we are actively evaluating. DigitSec suggests creating a Workspace for a single developer to use as they quickly develop code and scan. In that way, other team members aren't forced to sort through many scans to find particular results.
