Add New Rule - HardcodedOrgUrl #204
Description
I'd like to suggest adding a new rule to help users identify hardcoded Salesforce instance URLs within their Flows e.g. 'Click Here' links to records or pages in Screen Flows
Current Behaviour:
The scanner currently doesn't specifically flag hardcoded Salesforce URLs (e.g., https://mydomain.my.salesforce.com) found within formulas, text templates or other Flow metadata components.
Proposed Enhancement:
Adding a new rule named HardcodedOrgUrl
- Description: Detects hardcoded Salesforce instance URLs within Flow formulas, text templates, or potentially constants/element inputs.
- Expected Behaviour: The scanner flags these hardcoded URLs with a
warning. - Justification: Hardcoding URLs hinders portability between environments (sandboxes > production) and makes maintenance difficult. Best practice encourages using dynamic methods like
$Apiglobal variables, Custom Labels or Custom Metadata. - Implementation Notes: Rule would need to scan relevant string properties using regex
Purpose:
This rule would directly address a issue of deploying Flow between environments with changing environment URLs. By encouraging the use of dynamic references, it helps users build Flows that are easier to deploy and manage across different Salesforce orgs. This aligns with the project's goal of improving Flow quality through static analysis.
Docs:
- The Ultimate Guide to Flow Best Practices and Standards - https://admin.salesforce.com/blog/2021/the-ultimate-guide-to-flow-best-practices-and-standards
- Why You Should Avoid Hard Coding and Three Alternative Solutions - (https://admin.salesforce.com/blog/2022/create-a-record-link-dynamically-in-flow)](https://admin.salesforce.com/blog/2021/why-you-should-avoid-hard-coding-and-three-alternative-solutions)