{"revision":"c10276e953456835cdbb1f3a60d58ae1980be353","document":{"id":19997,"path":"impact/proactive-code-check-scan-suite.md","title":"Proactive Code Check scan suite matrix for the Impact Store Application","bundle":null,"doc_type":null,"release":"australia","body":"\n# Proactive Code Check scan suite matrix for the Impact Store Application\n\nRefer to the Proactive Code Check \\(PCC\\) scan suite matrix for details on the checks performed during a PCC scan.\n\n**Note:** Starting with Impact Zurich version 6.0.8 ServiceNow Store release, Proactive Code Check is being prepared for future deprecation. It will be hidden and no longer installed on new instances but will continue to be supported. For details, see the [Deprecation Process \\[KB0867184\\]](https://support.servicenow.com/kb_view.do?sysparm_article=KB0867184) article in the Now Support Knowledge Base.\n\n\n
\n\nCategory\n\n\n\nName\n\n\n\nShort\\_description\n\n\n\nDescription\n\n
\n\nPerformance\n\n\n\nHSD0001049 Avoid Global UI Scripts\n\n\n\nAvoid Global UI Scripts\n\n\n\nGlobal UI scripts are loaded on every single page/form in ServiceNow even if the code within them is not called.\n\n
\n\nManageability\n\n\n\nHSD0001058 SCRIPT Scoped app uses logging utils or deprecated methods\n\n\n\nScoped app uses logging utils or deprecated method - gs.log\n\n\n\nScoped applications should use scoped logging APIs rather than legacy methods.\n\n
\n\nManageability\n\n\n\nHSD0001058 XML Scoped app uses logging utils or deprecated methods\n\n\n\nScoped app uses logging utils or deprecated method - gs.log\n\n\n\nScoped applications should use scoped logging APIs rather than legacy methods.\n\n
\n\nPerformance\n\n\n\nHSD0001116 Client Scripts should not be defined against the Global table\n\n\n\nClient Scripts should not be defined against the Global table\n\n\n\nA global client script is any client script where the selected Table is Global. Global client scripts have no table restrictions; therefore they will load on every page in the system introducing browser load delay in the process. There is no benefit to loading this kind of scripts on every page.\n\n
\n\nPerformance\n\n\n\nHSD0001126 SCRIPT Unnecessary dot walking to sys\\_id from current object\n\n\n\nUnnecessary dot walking to sys\\_id from current object\n\n\n\nReference fields already store the Sys ID of the referenced record. Using gr.fieldname.sys\\_id is a dot-walk and instructs the platform to perform another query only to return the same value. This is an unnecessary overhead.\n\n
\n\nPerformance\n\n\n\nHSD0001126 XML Unnecessary dot walking to sys\\_id from current object\n\n\n\nUnnecessary dot walking to sys\\_id from current object\n\n\n\nReference fields already store the Sys ID of the referenced record. Using gr.fieldname.sys\\_id is a dot-walk and instructs the platform to perform another query only to return the same value. This is an unnecessary overhead.\n\n
\n\nPerformance\n\n\n\nHSD0001128 SCRIPT Client-side code should not use synchronous AJAX methods\n\n\n\nClient-side code should not use synchronous AJAX methods\n\n\n\nCode that uses synchronous AJAX can possibly cause delays in processing UI events. It can be detrimental to performance and negatively impact user experience. Wherever possible, we should try to employ asynchronous AJAX.\n\n
\n\nUpgradability\n\n\n\nHSD0001142 SCRIPT Client-side code should not use DOM manipulation technique\n\n\n\nClient-side code should not use DOM manipulation technique\n\n\n\nThis customization technique gives a lot of control, but does frequently cause upgrade challenges. It is recommended not to use jQuery, PrototypeJS, gel and other techniques.\n\n
\n\nManageability\n\n\n\nHSD0001153 SCRIPT Hard coded instance URL\n\n\n\nHard coded instance URL\n\n\n\nRaises a finding for hard coded instance URLs as their use can be detrimental to functionality across environments.\n\n
\n\nManageability\n\n\n\nHSD0001153 XML Hard coded instance URL\n\n\n\nHard coded instance URL\n\n\n\nRaises a finding for hard coded instance URLs as their use can be detrimental to functionality across environments.\n\n
\n\nManageability\n\n\n\nHSD0001174 REST Scripted Web Services writing data directly\n\n\n\nScripted Web Services writing data directly\n\n\n\nScripted Web Services insert/update/delete data directly, whereas it is recommended to utilize Script Includes because it provides a structured and documented approach for managing data operations, ensuring consistency, security, and maintainability within the platform.\n\n
\n\nManageability\n\n\n\nHSD0001174 SOAP Scripted Web Services writing data directly\n\n\n\nScripted Web Services writing data directly\n\n\n\nScripted Web Services insert/update/delete data directly, whereas it is recommended to utilize Script Includes because it provides a structured and documented approach for managing data operations, ensuring consistency, security, and maintainability within the platform.\n\n
\n\nSecurity\n\n\n\nHSD0001235 XML Avoid Dynamic JEXL Expressions inside Jelly tag\n\n\n\nAvoid Dynamic JEXL Expressions inside Jelly tag\n\n\n\nWhen writing Jelly code, avoid using dynamic JEXL expressions inside the Jelly tag \\(or <g2:evaluate> for phase two\\). While the code appears to work, it affects a memory resource \\(called PermGen\\) in the Java Virtual Machine, which can lead to performance issues and even system outages over time. The exception to using JEXL expressions inside <g:evaluate> tags is with static values, including: $\\{AMP\\}\\\\, $\\{AND\\}, $\\{GT\\}, $\\{LT\\}, and $\\{SP\\} \\(and their phase two counterparts: $\\[AMP\\], $\\[AND\\], and so on\\).\n\n
\n\nUpgradability\n\n\n\nHSD0001247 Use of deprecated API RESTMessage \\(V1\\)\n\n\n\nUse of deprecated API RESTMessage \\(V1\\)\n\n\n\nThe API allowed to send outbound REST messages using JavaScript.\n\n However the version 1 of RESTMessage has been deprecated.\n\n
\n\nManageability\n\n\n\nHSD0001275 Scripts should not contain hard-coded IDs\n\n\n\nScripts should not contain hard-coded IDs\n\n\n\nHard coding sys\\_ids makes the system more difficult to manage, and less able to move functionality between instances.\n\n
\n\nManageability\n\n\n\nHSD0001278 Before Business Rules should not update\\(\\) or insert\\(\\) on other tables\n\n\n\nBefore Business Rules should not update\\(\\) or insert\\(\\) records on other tables\n\n\n\nRunning an insert\\(\\) or update\\(\\) in a onBefore BR will cause updates to other tables, even though the update may be cancelled.\n\n
\n\nManageability\n\n\n\nHSD0001281 getMessage\\(\\) called in Client Script without preloading message key\n\n\n\ngetMessage\\(\\) called in Client Script without preloading message key\n\n\n\ngetMessage used in a client script needs to have the message key added to the Messages field on the script record.\n\n
\n\nManageability\n\n\n\nHSD0001312 SCRIPT Avoid console.log\\(\\) usage in code\n\n\n\nCode should not contain the console.log\\(\\) debugging method\n\n\n\nThe client-side function console.log could cause errors in certain browser versions. Furthermore, there is a good chance that what's being logged is information you would not want publicly exposed, and that persons with malicious intent could manipulate the script to reflect PII. It is never a good idea to go to production with console logging enabled. Console.log is invalid server side and therefore should not be there either.\n\n
\n\nManageability\n\n\n\nHSD0001312 XML Avoid console.log\\(\\) usage in code\n\n\n\nCode should not contain the console.log\\(\\) debugging method\n\n\n\nThe client-side function console.log could cause errors in certain browser versions. Furthermore, there is a good chance that what's being logged is information you would not want publicly exposed, and that persons with malicious intent could manipulate the script to reflect PII. It is never a good idea to go to production with console logging enabled. Console.log is invalid server side and therefore should not be there either.\n\n
\n\nPerformance\n\n\n\nHSD0001338 Business Rules should not be defined on the Global table\n\n\n\nBusiness Rules should not be defined on the Global table \\(Global Business Rule\\)\n\n\n\nA Global Business Rule is any Business Rule where the selected table is Global. Any other script can call Global Business Rules. Global Business Rules have no condition or table restrictions and load on every page in the system.\n\n
\n\nPerformance\n\n\n\nHSD0001347 SCRIPT Client-side code should not use GlideRecord\n\n\n\nClient-side code should not use GlideRecord\n\n\n\nThe client side GlideRecord object is often inefficent, because it returns lots of unecessary data. GlideRecord and g\\_form.getReference are both involved.\n\n
\n\nPerformance\n\n\n\nHSD0001358 SCRIPT Server-side code should not use GlideRecord.getRowCount\\(\\)\n\n\n\nServer-side code should not use GlideRecord.getRowCount\\(\\) to count records\n\n\n\nThe GlideRecord.getRowCount\\(\\) works by getting the whole result set without using the build-in arithmetic functions of the database. GlideAggregate does use the database, therefore is often drastically faster. The exception to this recommendation is if you intend to loop through the records and process them anyway.\n\n
\n\nPerformance\n\n\n\nHSD0001358 XML Server-side code should not use GlideRecord.getRowCount\\(\\)\n\n\n\nServer-side code should not use GlideRecord.getRowCount\\(\\) to count records\n\n\n\nThe GlideRecord.getRowCount\\(\\) works by getting the whole result set without using the build-in arithmetic functions of the database. GlideAggregate does use the database, therefore is often drastically faster. The exception to this recommendation is if you intend to loop through the records and process them anyway.\n\n
\n\nManageability\n\n\n\nHSD0001392 Scripts should not use the eval\\(\\) method\n\n\n\nScripts should not use the eval\\(\\) method\n\n\n\nThe eval\\(\\) function evaluates or executes an argument. Improper use of eval\\(\\) opens up your code for injection attacks and debugging can be more challenging, as no line numbers are displayed with an error.\n\n
\n\nPerformance\n\n\n\nHSD0001554a JDBC Data Srcs with \"Use last run datetime\" disabled for update sets\n\n\n\nJDBC Data Sources should have the \"Use last run datetime\" option check\n\n\n\nRepeatedly importing data that has not changed leads to many skipped rows and unnecessarily bounds system resources.\n\n
\n\nPerformance\n\n\n\nHSD0001560 Use 'track by' in ngRepeat loops\n\n\n\nUse 'track by' in ngRepeat loops\n\n\n\nWhen using the ngRepeat directive without a 'track by' clause, the DOM elements are destroyed and rebuilt every time the source data is updated. Adding a 'track by' clause with a unique key \\(such as a sys\\_id\\) allows the DOM elements to be reused rather than rebuilt, which significantly improves the performance of pages with large, complex lists.\n\n
\n\nManageability\n\n\n\nHSD0001578 Business Rules should not use the SOAP getResponse\\(\\) method\n\n\n\nBusiness Rules should not use the SOAP getResponse\\(\\) method\n\n\n\ngetResponse blocks the transaction, waiting until a response is received. This is better done asynchronously.\n\n
\n\nPerformance\n\n\n\nHSD0001623 Read ACLs \\(Security rules\\) should not have GlideRecord/GlideAggregate\n\n\n\nRead ACLs \\(Security rules\\) should not have GlideRecord/GlideAggregate\n\n\n\nRead ACLs are frequently executed. Having complex database lookups can harm performance.\n\n
\n\nSecurity\n\n\n\nHSD0002016 Server scripts in widgets should use GlideRecordSecure\n\n\n\nServer scripts in widgets should use GlideRecordSecure instead of GlideRecord\n\n\n\nThe best practice should be that server scripts in widgets should use GlideRecordSecure rather than GlideRecord. This is to ensure that security ACLs are considered in all server interactions. To detect deviation from this, any instantiation of GlideRecord should be marked as a finding.\n\n Note that $sp.getRecord\\(\\) currently returns a GlideRecord object. This call should actually return a GlideRecordSecure object to be as secure as possible. While that is a separate enhancement outside of the HealthScan tool, it does pose a challenge in that it will be harder for HealthScan to detect the use of the GlideRecord object returned by $sp.getRecord.\n\n
\n\nPerformance\n\n\n\nHSD0002144 Leverage c.server.get\\(\\) for better widget performance\n\n\n\nLeverage c.server.get\\(\\) for better widget performance\n\n\n\nOn the client script, c.server.get\\(\\) allows you to pass specific data to the server script. Doing this can have performance improvements over c.server.update\\(\\), which sends the entire data object.\n\n
\n\nPerformance\n\n\n\nHSD0002150 Remove unused services from widget client script.\n\n\n\nRemove unused services from widget client script.\n\n\n\nIf injected services are not used in a widget's client controller script, consider removing them. Services which are injected and not used will be instantiated, which may have a performance impact. It is also good practice from a code readability perspective to only inject services that are required.\n\n
\n\nPerformance\n\n\n\nHSD0002154 Don't use $rootScope.$on in a widget's client script.\n\n\n\nDon't use $rootScope.$on in a widget's client script.\n\n\n\n$rootScope.$on should only be used in a service. Using event listeners on $rootScope in a widget's client controller script can cause memory leaks if the listeners are not manually destroyed. Every time a widget is loaded, the controller is initialized, and every listener initialized on the $rootScope will not be destroyed with the controller, unless done so manually.\n\n Services have no other alternative but to fire events on $rootScope, and the listen for events on $rootScope. This is because services are initialized once across the app and do not have their own scope. It is okay to use $rootScope.$on in a service.\n\n
\n\nManageability\n\n\n\nHSD0002808 Client Scripts without description\n\n\n\nClient Scripts without description\n\n\n\nClient Scripts where the description is either empty, very short or the same as the script name.\n\n
\n\nManageability\n\n\n\nHSD0002808 Script Includes without description\n\n\n\nScript Includes without description\n\n\n\nScript Includes where the description is either empty, very short or the same as the script name.\n\n
\n\nManageability\n\n\n\nHSD0002827 All events should have a description\n\n\n\nAll events should have a description\n\n\n\nAll custom events in the event registry should have the \"description\" field populated. This will ensure that the event's purpose is easily identifiable by administrators who did not create the registry entry and improve maintainability of the instance.\n\n
\n\nManageability\n\n\n\nHSD0002828 All events should have the \"fired by\" field populated\n\n\n\nAll events should have the \"fired by\" field populated\n\n\n\nAll custom events in the event registry should have the \"fired\\_by\" field populated. This will ensure that the event's trigger is easily identifiable by administrators who did not create the registry entry and improve maintainability of the instance.\n\n
\n\nManageability\n\n\n\nHSD0003076 Basic authentication credentials on SOAP Message definition\n\n\n\nBasic authentication credentials on SOAP Message definition\n\n\n\nBasic Authentication for outbound SOAP Messages should use Basic Auth Profiles instead of putting the credentials on the function definition itself.\n\n
\n\nManageability\n\n\n\nHSD0003081 Basic authentication credentials on REST Message definition\n\n\n\nBasic authentication credentials on REST Message definition\n\n\n\nBasic Authentication for outbound REST Messages should use Basic Auth Profiles instead of putting the credentials on the function definition itself.\n\n
\n\nUpgradability\n\n\n\nHSD0003307 Change Request table should not be extended\n\n\n\nChange Request table should not be extended\n\n\n\nAt least one child table extending Change Request has been created.\n\n Extending Change Request with custom child tables should not be done:\n\n- To support a custom Change Request table a high amount of customization to the other ITSM processes is required\n- New functionality in future releases might not work on extended tables or would require further customization\n\n
\n\nManageability\n\n\n\nHSD0003625 Business Rule script should be encapsulated in executeRule function\n\n\n\nScript code in Business Rules should be encapsulated in the executeRule function\n\n\n\nThe code should check if there is any business rule that have some code that is not encapsulated in the executeRule function.\n\n
\n\nUpgradability\n\n\n\nHSD0004147 Use of GlideDialogWindow and GlideOverlay\n\n\n\nUse of GlideDialogWindow and GlideOverlay\n\n\n\nChecks for the use of GlideDialogWindow and GlideOverlay, which cannot be tested by ATF.\n\n
\n\nPerformance\n\n\n\nHSD0004365 SCRIPT Cache flushed as part of scripts\n\n\n\nCache flushed as part of scripts\n\n\n\nIf a cache flush is triggered as part of a non-ootb script execution this will require the platform to rebuild the cache before returning to its BAU state. This activity has a significant performance impact.\n\n
\n\nPerformance\n\n\n\nHSD0004726 SCRIPT Debugger should not be used in scripts\n\n\n\nDebugger should not be used in scripts\n\n\n\nThe debugger statement is used to tell the executing JavaScript environment to stop execution and start up a debugger at the current point in the code. This has fallen out of favor as a good practice with the advent of modern debugging and development tools. Production code should definitely not contain debugger, as it will cause the browser to stop executing code and open an appropriate debugger.\n\n
\n\nPerformance\n\n\n\nHSD0006666 Check if current.update\\(\\) is used in a business rule\n\n\n\nCheck if current.update\\(\\) is used in a business rule\n\n\n\nCurrent.update\\(\\) used in a business rule causes recursive updates and can significantly impact performance.\n\n
\n\nManageability\n\n\n\nHSD0013213 SCRIPT Detecting hard-coded strings in addInfoMessage\\(\\) usage\n\n\n\nDetecting hard-coded strings in addInfoMessage\\(\\) usage\n\n\n\nHard-coded messages/strings in the code will not be localized. Detecting such occurrences in addInfoMessage\\(\\) on both the client and server side.\n\n
\n\nManageability\n\n\n\nHSD0013213 XML Detecting hard-coded strings in addInfoMessage\\(\\) usage\n\n\n\nDetecting hard-coded strings in addInfoMessage\\(\\) usage\n\n\n\nHard-coded messages/strings in the code will not be localized. Detecting such occurrences in addInfoMessage\\(\\) on both the client and server side.\n\n
\n\nManageability\n\n\n\nHSD0013215 SCRIPT Detecting hard-coded strings in alert\\(\\) usage\n\n\n\nDetecting hard-coded strings in alert\\(\\) usage\n\n\n\nHard-coded messages/strings in the code will not be localized. Detecting such occurrences in alert\\(\\) on the client side.\n\n
\n\nManageability\n\n\n\nHSD0013215 XML Detecting hard-coded strings in alert\\(\\) usage\n\n\n\nDetecting hard-coded strings in alert\\(\\) usage\n\n\n\nHard-coded messages/strings in the code will not be localized. Detecting such occurrences in alert\\(\\) on the client side.\n\n
\n\nManageability\n\n\n\nHSD0014228 SCRIPT Detecting hard-coded strings in addErrorMessage\\(\\) usage\n\n\n\nDetecting hard-coded strings in addErrorMessage\\(\\) usage\n\n\n\nHard-coded messages/strings in the code will not be localized. Detecting such occurrences in addErrorMessage\\(\\) on both the client and server side.\n\n
\n\nManageability\n\n\n\nHSD0014228 XML Detecting hard-coded strings in addErrorMessage\\(\\) usage\n\n\n\nDetecting hard-coded strings in addErrorMessage\\(\\) usage\n\n\n\nHard-coded messages/strings in the code will not be localized. Detecting such occurrences in addErrorMessage\\(\\) on both the client and server side.\n\n
\n\nManageability\n\n\n\nHSD0014229 SCRIPT Detecting hard-coded strings in setError\\(\\) usage\n\n\n\nDetecting hard-coded strings in setError\\(\\) usage\n\n\n\nHard-coded messages/strings in the code will not be localized. Detecting such occurrences in setError\\(\\) on the server side.\n\n
\n\nManageability\n\n\n\nHSD0014229 XML Detecting hard-coded strings in setError\\(\\) usage\n\n\n\nDetecting hard-coded strings in setError\\(\\) usage\n\n\n\nHard-coded messages/strings in the code will not be localized. Detecting such occurrences in setError\\(\\) on the server side.\n\n
\n\nManageability\n\n\n\nHSD0014231 SCRIPT Detecting hard-coded strings in confirm\\(\\) usage\n\n\n\nDetecting hard-coded strings in confirm\\(\\) usage - SCRIPT\n\n\n\nHard-coded messages/strings in the code will not be localized. Detecting such occurrences in confirm\\(\\) on the client side.\n\n
\n\nManageability\n\n\n\nHSD0014231 XML Detecting hard-coded strings in confirm\\(\\) usage\n\n\n\nDetecting hard-coded strings in confirm\\(\\) usage - XML\n\n\n\nHard-coded messages/strings in the code will not be localized. Detecting such occurrences in confirm\\(\\) on the client side.\n\n
\n\nManageability\n\n\n\nHSD0014232 SCRIPT Detecting hard-coded strings in prompt\\(\\) usage\n\n\n\nDetecting hard-coded strings in prompt\\(\\) usage\n\n\n\nHard-coded messages/strings in the code will not be localized. Detecting such occurrences in prompt\\(\\) on the client side.\n\n
\n\nManageability\n\n\n\nHSD0014232 XML Detecting hard-coded strings in prompt\\(\\) usage\n\n\n\nDetecting hard-coded strings in prompt\\(\\) usage\n\n\n\nHard-coded messages/strings in the code will not be localized. Detecting such occurrences in prompt\\(\\) on the client side.\n\n
\n\nManageability\n\n\n\nHSD0014233 SCRIPT Detecting hard-coded strings in addMessage\\(\\) usage\n\n\n\nDetecting hard-coded strings in addMessage\\(\\) usage\n\n\n\nHard-coded messages/strings in the code will not be localized. Detecting such occurrences in addMessage\\(\\) on the server side.\n\n
\n\nManageability\n\n\n\nHSD0014233 XML Detecting hard-coded strings in addMessage\\(\\) usage\n\n\n\nDetecting hard-coded strings in addMessage\\(\\) usage\n\n\n\nHard-coded messages/strings in the code will not be localized. Detecting such occurrences in addMessage\\(\\) on the server side.\n\n
\n\nManageability\n\n\n\nHSD0014234 SCRIPT Detecting hard-coded strings in addFormMessage\\(\\) usage\n\n\n\nDetecting hard-coded strings in addFormMessage\\(\\) usage\n\n\n\nHard-coded messages/strings in the code will not be localized. Detecting such occurrences in addFormMessage\\(\\) on the client side.\n\n
\n\nManageability\n\n\n\nHSD0014234 XML Detecting hard-coded strings in addFormMessage\\(\\) usage\n\n\n\nDetecting hard-coded strings in addFormMessage\\(\\) usage\n\n\n\nHard-coded messages/strings in the code will not be localized. Detecting such occurrences in addFormMessage\\(\\) on the client side.\n\n
\n\nManageability\n\n\n\nHSD0014544 SCRIPT Detecting hard-coded strings in addWarningMessage\\(\\) usage\n\n\n\nDetecting hard-coded strings in addWarningMessage\\(\\) usage\n\n\n\nHard-coded messages/strings in the code will not be localized. Detecting such occurrences in addWarningMessage\\(\\) on both the client and server side.\n\n
\n\nManageability\n\n\n\nHSD0014544 XML Detecting hard-coded strings in addWarningMessage\\(\\) usage\n\n\n\nDetecting hard-coded strings in addWarningMessage\\(\\) usage\n\n\n\nHard-coded messages/strings in the code will not be localized. Detecting such occurrences in addWarningMessage\\(\\) on both the client and server side.\n\n
**Parent Topic:**[Proactive Code Check for the Impact Store Application](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/impact/proactive-code-check.md)\n\n"}}