{"id":2818,"date":"2022-08-24T10:15:01","date_gmt":"2022-08-24T10:15:01","guid":{"rendered":"https:\/\/sdf-docs.clevr.com\/?docs=acr\/custom-code-preview"},"modified":"2023-03-09T09:16:52","modified_gmt":"2023-03-09T09:16:52","slug":"custom-code-preview","status":"publish","type":"docs","link":"https:\/\/sdf-docs.clevr.com\/?docs=acr\/custom-code-preview","title":{"rendered":"Custom code (preview)"},"content":{"rendered":"\n

Introduction<\/strong><\/h1>\n\n\n\n

Mendix drastically simplifies the software development lifecycle through abstraction. Software quality is a part of this life cycle. The most significant risk for software quality is human error; by abstracting most of the code away from the developer (through building blocks), Mendix reduces the risk of human error and improves the overall software quality. Of course, connecting these components is still risky, but way less than designing everything from scratch. Now, why is this relevant?\u202f<\/p>\n\n\n\n

Custom code in Mendix and its risks<\/strong> <\/h1>\n\n\n\n

Within Mendix, you can also add\u202fcustom code.<\/em>\u202fWhat is custom code? Custom code is every instance where a developer introduces Java or Javascript actions instead of using standard platform capabilities.\u202f <\/p>\n\n\n\n

Custom code is a significant risk in every Mendix application. It poses a quality risk because the responsibility of writing proper code falls on the Mendix developer instead of the Mendix platform (which is the case with platform components). Custom code can significantly impact quality, for example, using Java libraries that contain\u202fsecurity vulnerabilities<\/u><\/a>\u202for not escaping user input resulting in the risk of\u202fmalicious injection<\/u><\/a>\u202fduring the runtime. <\/p>\n\n\n\n

Custom Code feature in CDS<\/strong><\/h1>\n\n\n\n

Inside CDS, we\u2019ve developed the feature Custom code<\/em> that analyzes the customized high-code integrations of the Java and JavaScript actions in your Mendix application so that you get insight into your Java and JavaScript code quality. The evaluation of the code is executed through a well-known open-source code analyzer called PMD<\/a>.<\/p>\n\n\n\n

How it works<\/h2>\n\n\n\n

The moment you download a model for your revision, the custom code<\/em> feature<\/em> automatically starts analyzing your custom code. In a designated place (which we will show you below), CDS presents the results, providing you insight into its risk severity and coding categories like best practices, code style, and error-prone. To help you understand the potential impact of the vulnerability, we provide a link to PDM\u2019s documentation so that you can examine how to solve the issue. Of course, we present to you the location, the specific file and the line on which the violation occurs.<\/p>\n\n\n\n

Navigation & Functionality<\/h2>\n\n\n\n

After downloading a model, you can access the Custom code feature <\/em>from everywhere in CDS! Just navigate to the main menu and click on the curly brackets ({ }<\/strong>)<\/p>\n\n\n\n

\"\"<\/figure><\/div>\n\n\n\n

When you open the Custom Code<\/em> page, you see two tabs: one for Java vulneratbilities and one for JavaScript results.<\/p>\n\n\n\n

Search bar<\/h3>\n\n\n\n
\"\"<\/figure>\n\n\n\n

Above the results, you find a search bar that is pretty extensive! It helps you filter the results by every data item in the list. These could be the violation\u2019s severity, categories, and keywords within rules (like \u201clocal\u201d, \u201cvariable\u201d or \u201cfoo\u201d), so feel free to play around with it (and let us know what you think!). When you hit enter, you could see your results after opening the file.<\/p>\n\n\n\n

List of contaminated files<\/h3>\n\n\n\n

Below the search box, you see a list of files (.java<\/em> or .js<\/em>) that contain potential risks. The file name is presented as the path starting from the javasource<\/em> or javascriptsource<\/em> folder in your Mendix project, so you can easily find the concerning file.<\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n

Custom Code Violations<\/h3>\n\n\n\n

To open a file in the list, click anywhere on the item to expand it. It will show you violations in each of the files (Java\/JavaScript actions).<\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n

As you can see in this example, the ConvertGrantsToCommaSepString.java<\/code> file has 5 violations. Each violation is presented in a list of items with information about the violation\u2019s priority, rule, and category.<\/p>\n\n\n\n

Violation Details<\/h3>\n\n\n\n

To see the details of a violation, simply click on them.<\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n

In the details section, the violation is shown in detail. Details of a violation include:<\/p>\n\n\n\n