registry / @xrmforge/devkit / 0.7.37

@xrmforge/devkit@0.7.37

Build orchestration and project tooling for Dynamics 365 WebResources

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 8 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessEvalFilesystemShell

Supply chain

HighEntropyStrings

ManifestNo manifest risk signals triggered.

scanned 9 file(s), 47.2 KB of source

Source & flagged code

3 flagged

dist/templates/validate-form.mjsView file

Lines 1-61javascript

1/**

2 * validate-form.mjs - Quality Gate for XrmForge Form Scripts

3 *

4 * Runs three checks in one command:

5 * 1. TypeScript Compiler (tsc --noEmit)

6 * 2. ESLint (src/ --max-warnings=0)

7 * 3. Pattern Compliance (critical rule violations via text search)

8 *

9 * Exit code: 0 = all green, 1 = errors found

10 *

11 * Usage:

12 * node scripts/validate-form.mjs

13 * npm run validate

14 */

16import { execSync } from 'node:child_process';

17import { readdirSync, readFileSync } from 'node:fs';

High

Child Process

Package source references child process execution.

dist/templates/validate-form.mjsView on unpkg · L15

18import { join, relative } from 'node:path';

20const RED = '\x1b[31m';

21const GREEN = '\x1b[32m';

22const YELLOW = '\x1b[33m';

23const NC = '\x1b[0m';

25// Error-handling wrappers an exported entry point may use (Check 3l). Single

26// source of truth - keep in sync with src/shared/error-handler.ts. wrapGridCommand

27// (subgrid ribbon commands, F-MK9-02) and wrapWebResource (HTML WebResource init,

28// Runde 10 F-LMA10-02) are NOT substrings of wrapCommand, so they must be listed

29// explicitly or the gate false-flags correct code (FW-3 / F-LMA10-02).

30const HANDLER_WRAPPERS = ['wrapHandler', 'wrapCommand', 'wrapGridCommand', 'wrapWebResource'];

32let totalErrors = 0;

34// ============================================================

35// 1. TypeScript Compiler

36// ============================================================

38console.log('=== XrmForge Quality Gate ===\n');

39console.log('--- TypeScript ---');

41try {

42 execSync('npx tsc --noEmit', { stdio: 'pipe', encoding: 'utf-8' });

43 console.log(`${GREEN}OK${NC} tsc --noEmit`);

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/templates/validate-form.mjsView on unpkg · L41

44} catch (err) {

45 const output = (err.stdout || '') + (err.stderr || '');

46 const errorCount = (output.match(/error TS/g) || []).length;

47 console.log(`${RED}FAIL${NC} tsc --noEmit (${errorCount} errors)`);

48 console.log(output.split('\n').slice(0, 20).join('\n'));

49 totalErrors += errorCount || 1;

50}

52// ============================================================

53// 2. ESLint

54// ============================================================

56console.log('\n--- ESLint ---');

58try {

59 execSync('npx eslint src/ --max-warnings=0', { stdio: 'pipe', encoding: 'utf-8' });

60 console.log(`${GREEN}OK${NC} eslint src/ --max-warnings=0`);

61} catch (err) {

Lines 193-233javascript

193 'Magic number 86400000 (use named constant MS_PER_DAY)',

194 allSrcFiles,

195 /86400000/,

196);

197

198// 3h. Raw notification level strings (must use FormNotificationLevel)

199checkPattern(

200 'Raw notification level strings (use FormNotificationLevel from @xrmforge/helpers)',

201 allSrcFiles,

202 /setFormNotification\s*\([^)]*

Source & flagged code

3 flagged · loading source

dist/templates/validate-form.mjsView file

15L16: import { execSync } from 'node:child_process'; L17: import { readdirSync, readFileSync } from 'node:fs';

High

Child Process

Package source references child process execution.

dist/templates/validate-form.mjsView on unpkg · L15

41try { L42: execSync('npx tsc --noEmit', { stdio: 'pipe', encoding: 'utf-8' }); L43: console.log(`${GREEN}OK${NC} tsc --noEmit`);

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/templates/validate-form.mjsView on unpkg · L41

213L214: // 3j. eval() usage L215: checkPattern(

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/templates/validate-form.mjsView on unpkg · L213

Findings

3 High1 Medium4 Low

HighChild Processdist/templates/validate-form.mjs

HighShell

HighRuntime Package Installdist/templates/validate-form.mjs

MediumStructural Risk Force Deep Review

LowScripts Present

LowEvaldist/templates/validate-form.mjs

LowFilesystem

LowHigh Entropy Strings

Source & flagged code

3 flagged

dist/templates/validate-form.mjsView file

Lines 1-61javascript

1/**

2 * validate-form.mjs - Quality Gate for XrmForge Form Scripts

3 *

4 * Runs three checks in one command:

5 * 1. TypeScript Compiler (tsc --noEmit)

6 * 2. ESLint (src/ --max-warnings=0)

7 * 3. Pattern Compliance (critical rule violations via text search)

8 *

9 * Exit code: 0 = all green, 1 = errors found

10 *

11 * Usage:

12 * node scripts/validate-form.mjs

13 * npm run validate

14 */

16import { execSync } from 'node:child_process';

17import { readdirSync, readFileSync } from 'node:fs';

High

Child Process

Package source references child process execution.

dist/templates/validate-form.mjsView on unpkg · L15

18import { join, relative } from 'node:path';

20const RED = '\x1b[31m';

21const GREEN = '\x1b[32m';

22const YELLOW = '\x1b[33m';

23const NC = '\x1b[0m';

25// Error-handling wrappers an exported entry point may use (Check 3l). Single

26// source of truth - keep in sync with src/shared/error-handler.ts. wrapGridCommand

27// (subgrid ribbon commands, F-MK9-02) and wrapWebResource (HTML WebResource init,

28// Runde 10 F-LMA10-02) are NOT substrings of wrapCommand, so they must be listed

29// explicitly or the gate false-flags correct code (FW-3 / F-LMA10-02).

30const HANDLER_WRAPPERS = ['wrapHandler', 'wrapCommand', 'wrapGridCommand', 'wrapWebResource'];

32let totalErrors = 0;

34// ============================================================

35// 1. TypeScript Compiler

36// ============================================================

38console.log('=== XrmForge Quality Gate ===\n');

39console.log('--- TypeScript ---');

41try {

42 execSync('npx tsc --noEmit', { stdio: 'pipe', encoding: 'utf-8' });

43 console.log(`${GREEN}OK${NC} tsc --noEmit`);

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/templates/validate-form.mjsView on unpkg · L41

44} catch (err) {

45 const output = (err.stdout || '') + (err.stderr || '');

46 const errorCount = (output.match(/error TS/g) || []).length;

47 console.log(`${RED}FAIL${NC} tsc --noEmit (${errorCount} errors)`);

48 console.log(output.split('\n').slice(0, 20).join('\n'));

49 totalErrors += errorCount || 1;

50}

52// ============================================================

53// 2. ESLint

54// ============================================================

56console.log('\n--- ESLint ---');

58try {

59 execSync('npx eslint src/ --max-warnings=0', { stdio: 'pipe', encoding: 'utf-8' });

60 console.log(`${GREEN}OK${NC} eslint src/ --max-warnings=0`);

61} catch (err) {

Lines 193-233javascript

193 'Magic number 86400000 (use named constant MS_PER_DAY)',

194 allSrcFiles,

195 /86400000/,

196);

197

198// 3h. Raw notification level strings (must use FormNotificationLevel)

199checkPattern(

200 'Raw notification level strings (use FormNotificationLevel from @xrmforge/helpers)',

201 allSrcFiles,

202 /setFormNotification\s*\([^)]*