forcedotcom / sfdx-scanner

MIT License
208 stars 49 forks source link

[BUG] DFA Scan InternalExecutionError on Decimal.divide method #1462

Open OpenWaccaCH opened 2 months ago

OpenWaccaCH commented 2 months ago

Description: Getting an InternalExecutionError during DFA scan on code that includes a call to the Decimal.divide instance method.

Documentation: sfge.log

The Apex class file contains the following code block:

if(reportRows != null && reportRows.size() > 0){ Integer reportRowsSize = reportRows.size(); Decimal countReportRows = Decimal.valueOf(reportRowsSize); Decimal oneHundred = 100.00; Decimal totalDetailRows = countReportRows.divide(oneHundred, 2);

The scanner throws an InternalExecutionError on the line with the call to the 'divide' method

Steps To Reproduce: Scan Apex code that includes a call to the Decimal.divide instance method using this command sf scanner run dfa --format csv --outfile CodeAnalyzerDFA.csv --target ./ --projectdir ./ --category Security

The scanner generates a report that includes an InternalExecutionError at the code line that calls the divide method.

Expected Behavior: I expect the scanner not to produce an error for calls to the divide method

Screenshots: N/A

Desktop:

Additional Context: Based on the code in https://github.com/forcedotcom/sfdx-scanner, it looks like the 'apply' methods in the ApexDecimalValue.java, and ApexNumberValue.java classes do not include support for any methods other than longValue, intValue and format. The default is to bubble up to ApexSimleValue.java, where the 'apply' method simply throws an exception.

Workaround: I can write an explanation of the error into our submission for AppExchange security review.

Urgency: There is a work-around, but it would be great to implement support for all of the apex Decimal methods so people don't spend a bunch of time trying to troubleshoot things that aren't actually a problem.