forcedotcom / forcedotcom/code-analyzer

[BUG][code-analyzer] sfge: Decimal.setScale() — and every other unmodelled numeric method — aborts the entry point

Offen
#2,092 0 Kommentare 0 Reaktionen 0 zugewiesene Personen Auf GitHub ansehen
Vorherrschende Sprache
TypeScript
Sterne
240
Forks
52
Ø Merge
1 T. 23 Std.
Gemergte PRs (30 T.)
5

Beschreibung

### Have you tried to resolve this issue yourself first?

- [x] I confirm I have gone through the above steps and still have an issue to report.

### Bug Description

**Engine:** `sfge` (Salesforce Graph Engine) · **Rule:** `ApexFlsViolation` (DevPreview) · **Selector:** `--rule-selector sfge`

`ApexSimpleValue.apply` is an unconditional `throw new UnexpectedException(vertex);` (`ApexSimpleValue.java:55`). `ApexStringValue` and `ApexNumberValue` override it, but `ApexNumberValue` handles only `format()` and `intValue()` before delegating back to `super.apply`:

```java
// ApexNumberValue.java:41-43
} else {
return super.apply(vertex, symbols); // -> ApexSimpleValue.apply -> throw
}
```

So every other `Decimal`/`Integer`/`Double`/`Long` method — `setScale`, `round`, `divide`, `pow`, `abs`, `stripTrailingZeros`, … — aborts the entry point. `ApexBooleanValue` has no override at all.

```apex
Decimal v = value;
a.AnnualRevenue = v.setScale(2);
```

### Output / Logs

```shell
UnexpectedException: MethodCallExpressionVertex{fullMethodName=v.setScale, ... MethodName=setScale}:
com.salesforce.graph.symbols.apex.ApexSimpleValue.apply(ApexSimpleValue.java:55);
com.salesforce.graph.symbols.apex.ApexNumberValue.apply(ApexNumberValue.java:42);
com.salesforce.graph.symbols.apex.ApexDecimalValue.apply(ApexDecimalValue.java:49); ...
```

### Steps To Reproduce

1. Create an empty SFDX project (`sfdx-project.json` with a single `force-app` package directory).
2. Add `force-app/main/default/classes/DecimalSetScale.cls` with the class shown below, plus a standard `DecimalSetScale.cls-meta.xml` (apiVersion 62.0).
3. Add `code-analyzer.yml`:
```yaml
engines:
sfge:
java_thread_timeout: 900000
java_thread_count: 4
```
4. Run:
```
sf code-analyzer run --rule-selector sfge --workspace . --config-file code-analyzer.yml
```
5. The run reports an `InternalExecutionError` for the entry point instead of analysing it. That entry point yields no `ApexFlsViolation` findings at all, and nothing in the summary indicates coverage was lost.

```apex
public with sharing class DecimalSetScale {
@AuraEnabled
public static void run(Decimal value) {
Decimal v = value;
Account a = new Account();
a.AnnualRevenue = v.setScale(2);
insert a;
}
}
```

### Expected Behavior

An unmodelled method on a scalar should degrade to an indeterminate value of the appropriate type, not abort the entry point. Changing `ApexSimpleValue.apply` to return an indeterminate value instead of throwing would cover the whole family at once, including the `ApexBooleanValue` gap.

### Operating System

macOS 26.5.2

### Salesforce CLI Version

@salesforce/cli/2.147.7 darwin-arm64 node-v24.5.0

### Code Analyzer Plugin (code-analyzer) Version

code-analyzer 5.15.0

### Node Version

v24.5.0

### Java Version

openjdk version "11.0.32" 2026-07-21

### Python Version

N/A

### Additional Context (Screenshots, Files, etc)

Previously reported as #1409 (`Decimal.valueOf(...).setScale(scale)`), closed NOT_PLANNED as a duplicate in 2024. Still reproduces on 5.15.0.

This one is broad rather than frequent — it is one signature in our codebase, but it covers every unmodelled numeric method, so the surface is large.

### Workaround

Avoid the method call on the path to a DML operation, or compute the value in a helper whose result sfge treats as indeterminate. Neither is a real fix.

### Urgency

Moderate

Beitragsleitfaden

Beitragsleitfaden öffnen

Rechercherichtung

Beginne mit com.salesforce.graph.symbols.apex.ApexSimpleValue.java:55 und vergleiche anschließend die Delegationspfade in ApexNumberValue.java und ApexDecimalValue.java. Führe das DecimalSetScale-Beispiel mit dem bereitgestellten sfge-Befehl erneut aus und verifiziere, dass eine nicht modellierte skalare Methode den Einstiegspunkt nicht mehr abbricht und dass die Analyse Befunde melden kann.

Vom Indexierungsmodell aus dem Issue-Text verfasst.

Bewertung

Tech-Stack
java
Bereich
devtools, security
Issue-Typ
Bug
Schwierigkeit
3/5
Geschätzter Aufwand
1-2 Tage
Aktivitätsstatus
Aktiv
Klarheit
Klar beschrieben
Anfängerfreundlichkeit
74/100

Neue Issues direkt in Ihr Postfach

Eine kurze Übersicht über anfängerfreundliche GitHub-Issues.