Getting Instance Scan Linter Check working

Articles, Blogs, Videos, Podcasts, Share projects - Experiences from the field

Hi there,

Linter Check, one of the last undocumented and unrevealed parts of Instance Scan. Or actually, not undocumented anymore… ServiceNow published a bit more documentation on Instance Scan two weeks ago. The documentation does help, though might still be a puzzle to get working, or even to visualize what it could bring.

So let's dig into this!

Linter Check

With the Quebec release, the Linter Check has been added as the fourth Scan Check type. In short, Linter Check is described as "Linter check scripts helps you in writing checks that look for issues in scripts". This sounds potentially interesting, checking for certain incorrect statements for example. With the Column Type Check you could also achieve this, though it would need some advanced regex, find, replace, etcetera. And still, it might not be bulletproof. What if the part you are after is in a comment, leading spaces or tabs are used, etcetera. Linter Check should be able to make this a lot easier and robust.

Node functions

Looking at the Docs, there are several Node functions available that can be used for the Linter Check. I won't repeat all of them here, though the interesting ones to get Linter Check working:

getRootNode()
getParent()
getTypeName()
getNameIdentifier()

For getNameIdentifier() good to know, if this isn't "NAME", then the result is null. You might want to filter on this, else the System Log will go nuts 😀.

Good to take note of this combination:

getParent().getTypeName()

Debugging

To get a visual feel for what this might bring you, let's just debug! For example creating a Linter Check with below script:

(function (engine) {

	engine.rootNode.visit(function(node) {
		if(node.getNameIdentifier()) {
			gs.info('>>> DEBUG: ' + node.getTypeName() + ' / ' + node.getNameIdentifier() + ' / ' + node.getParent().getTypeName());
		}
	});

})(engine);

If you would run this on a Business Rule for example, with script like below:

(function executeRule(current, previous /*null when async*/) {

	new MLSolutionResult().findActiveSolution('dummy');
	
})(current, previous);

The debugging would provide us with:

>>> DEBUG: NAME / executeRule / FUNCTION
>>> DEBUG: NAME / current/ FUNCTION
>>> DEBUG: NAME / previous / FUNCTION
>>> DEBUG: NAME / MLSolutionResult / NEW
>>> DEBUG: NAME / findActiveSolution / GETPROP
>>> DEBUG: NAME / current / CALL
>>> DEBUG: NAME / previous / CALL

Good to know: Out-of-the-box objects which haven't been touched, won't be scanned. Also a Business Rule which is active is false, won't be scanned.

Debugging could also be done with use of tools like AST Explorer. I'm debugging within ServiceNow, as this would give the literal values we are after, we don't need to interpret anything. Though using the AST Explorer, you would see a full tree, very quickly to debug, etcetera. Just play around with this to get a bit more familiar.

Scan Check

You might want to create Scan Checks to check for reserved words used, deprecated API's, etcetera. For this example, checking "MLSolutionResult()", an API that has been deprecated with the Orlando release.

Column Type Check

If using a Column Type Check (of type Script), to check for "MLSolutionResult()" usage, we could use something like:

(function (finding, columnValue) {

	// Define variables
	var regex = /\bMLSolutionResult\s*\(\)/g;

	// Create scan finding
	if(columnValue && columnValue.match(regex)) {
		finding.increment();
	}

})(finding, columnValue);

For most cases, this would work. Though it's not completely bulletproof, for example commented code will also be evaluated.

Linter Check

So knowing the example script from the Docs, the debugging done above, we should be able to come up with a Linter Check to check for "MLSolutionResult()":

(function (engine) {

	engine.rootNode.visit(function(node) {
		if(node.getTypeName() === "NAME" &&
		   node.getNameIdentifier() === "MLSolutionResult" &&
		   node.getParent().getTypeName() === "NEW") {
			engine.finding.incrementWithNode(node);
		}
	});

})(engine);

Not sure if it's 100% bulletproof, though it's more robust than the RegEx used, and… if "MLSolutionResult" would be commented, it won't be listed as Finding, nice!

A thing I haven't sorted out yet, what if the API is called without using "new"? Then debugging would show is "CALL" instead of "NEW". I'm not sure yet if we should expand our Linter Check with this, for example using:

(node.getParent().getTypeName() === "NEW" || node.getParent().getTypeName() === "CALL")

Recap

I've described a bit more background on the Linter Check, how to debug, and getting an example working. Ones understanding the structure a bit better, building a basic Linter Checks isn't that tough to do. It does look promising, and now I can look into transforming some of my Column Type Checks into a Linter Check.

Though… I'm still missing some small bits. For example, what if I would like to check for "gs.now()". I haven't got a clue yet. Or what if I would like to use the Linter Check on Client Scripts though not on UI Policies. I haven't found a property yet that might provide us with the table name or class of the objects where scanning ☹️.

Anyway, there will be multiple good use cases for using the Linter Check!

---

And that's it. Hope you like it. If any questions or remarks, let me know!

Kind regards,

Mark Roethof

ServiceNow Technical Platform Architect @ Quint Technology

2x ServiceNow Developer MVP

2x ServiceNow Community MVP

---

LinkedIn