This example shows how to create a comma-separated values (CSV) formatted output file when using the --output-file flag of the code-analyzer run command.
sf code-analyzer run --output-file results.csv
Sample CSV Run Output
This sample output shows 3 violations with different severities from different engines.
"rule","engine","severity","tags","file","startLine","startColumn","endLine","endColumn","message","resources"
"@lwc/lwc/no-inner-html","eslint",2,"Recommended,LWC,Security,Javascript","force-app/main/default/staticresources/highlight/highlight/prism.js",571,17,571,26,"Using 'innerHTML/outputHTML/insertAdjacentHTML' is not allowed","https://github.com/salesforce/eslint-plugin-lwc/blob/v2.1.0/docs/rules/no-inner-html.md"
"PreventPassingUserDataIntoElementWithSharing","flow",4,"Recommended,Security,Xml","force-app/main/default/flows/Get_Customer_Details.flow-meta.xml",41,1,,,"User controlled data flows into recordLookups element selector in run mode: SystemModeWithSharing",
"ApexSharingViolations","pmd",3,"Recommended,Security,Apex","force-app/main/default/classes/ExperienceBookingHelper.cls",1,1,1,7,"Apex classes should declare a sharing model if DML or SOQL/SOSL is used","https://docs.pmd-code.org/pmd-doc-7.11.0/pmd_rules_apex_security.html#apexsharingviolations"
Properties of the CSV Run Output File
All property values are wrapped in double quotes which allows for comma-separated properties, such as the list of tags associated with the violation.
CSV output includes only the primary location of a violation. If a violation has multiple locations, you must rerun the scan and specify any other output format, such as SARIF or JSON, to see all the locations.
| Property Name | Data Type | Description |
|---|---|---|
rule |
string | The name of the rule that's associated with the violation. |
engine |
string | The engine that's associated with the violation. |
severity |
number | The severity level of the violation: 1 (Critical), 2 (High), 3 (Moderate), 4 (Low), 5 (Info) |
tags |
string | The tags that are associated with the rule that's associated with the violation. Multiple tags are separated by commas. |
file |
string | The pathname of the file in which the violation occurred, relative to the runDir directory. |
startLine |
number | The line where the violating code starts. |
startColumn |
number | The column in the startLine where the violating code starts. |
endLine |
number | The line where the violating code ends. |
endColumn |
number | The column in the endLine where the violating code ends. |
message |
string | The violation message. |
resources |
string | The URLs for additional resources and information about the violation. Multiple resources are separated by commas. |