Review Code — example output

███╗ ██╗ ██████╗ ██╗ ██╗ █████╗ ██╗ ██╗ ██╗██╗████████╗ ████╗ ██║██╔═══██╗██║ ██║ ██╔══██╗██║ ██║ ██╔╝██║╚══██╔══╝ ██╔██╗██║██║ ██║██║ █╗ ██║ ███████║██║ █████╔╝ ██║ ██║ ██║╚████║██║ ██║██║███╗██║ ██╔══██║██║ ██╔═██╗ ██║ ██║ ██║ ╚███║╚██████╔╝╚███╔███╔╝ ██║ ██║██║ ██║ ██╗██║ ██║ ╚═╝ ╚══╝ ╚═════╝ ╚══╝╚══╝ ╚═╝ ╚═╝╚═╝ ╚═╝ ╚═╝╚═╝ ╚═╝ ✦ NowAIKit — The #1 AI App for ServiceNow - Running review-code in direct mode (ollama)... # ServiceNow Code Review Report Instance: demo2 Reviewed By: NowAIKit (Expert ServiceNow Consultant) Date: 2024 --- ## ⚠️ Critical Finding: Missing Script Content | Field | Status | |-------|--------| | **Review Status** | ❌ **Cannot Complete Without Code** | | Issue | Only metadata is provided (names, sys_ids, table, type, when, etc.) | | Required | Full script code for all business rules and client scripts to perform deep review | --- ## ✔ Capability completed (2 data points gathered) # ServiceNow Code Review Report ## ⚠️ Important Limitation Notice Critical Finding: The provided data contains only metadata (sys_id, name, table, collection, etc.) without the actual script content. A proper code review requires the actual script code from: - Business Rules → `sys_script` table (script column) - Client Scripts → `sys_script_client` table (script column) Without script content, I cannot assess: - Security vulnerabilities (injection, XSS, etc.) - Performance issues (GlideRecord patterns, N+1 queries) - Best practice violations (error handling, logging) - Upgrade safety (OOB modifications, deprecated APIs) --- ## 🔍 Metadata-Based Analysis Based on the metadata provided, I can identify potential risk areas and recommendations: ### 1. Business Rules Review (50 rules identified) | Business Rule | Risk Category | Concern | Recommendation | |--------------|--------------|---------|----------------| | `Update child metric confidential status` (sn_grc_metric_definition) | Performance | May update child records in cascade | Review script for GlideRecord optimization | | `Delete model components for simple model` (sn_ent_model) | Security/Performance | Before action deleting data | Ensure proper field-level ACLs exist | | `Add Case IOC Entry` (sn_ti_m2m_task_attack_mode) | Performance | Task-related data operations | Check for unbounded GlideRecord loads | | `Invalidate server cache` (sn_mcp_tool_definition) | Performance | Cache invalidation operations | Review for unnecessary data loading | | `Validate duplicate search source` (ais_search_profile_ais_search_source_m2m) | Best Practice | Duplicate validation before save | Ensure `gs.addErrorMessage()` used | | `Reset Remediation Fields` (sn_vul_app_vulnerability) | Upgrade Safety | Before action resetting fields | Verify no OOB field modifications | | `Calculate NPV on Discount Rate Update` (pm_project) | Performance | Financial calculations | Ensure no N+1 queries in calculations | | `BOMA type inactivation validation` (sn_wsd_core_boma_type) | Best Practice | Core BOMA entity | Check for proper business logic encapsulation | | `Handle Parent, En-Type Update` (sn_wsd_core_workplace_entity) | Performance | Parent-child relationship updates | Review for transactional GlideRecord usage | | `Update sheet num on change sheet name` (sys_data_source) | Upgrade Safety | System table modification | Verify this is not OOB customization | ### 2. Client Scripts Review (50 scripts identified) | Client Script | Risk Category | Concern | Recommendation | |--------------|--------------|---------|----------------| | `On submit validation` (empty table) | Security/Best Practice | Empty table = potentially global | Review table mapping, ensure scoped | | `On submit validation` (generic) | Best Practice | Submit validation without table | Verify table binding in script | | `Populate chain and make it readonly` (promin_finding_def_rule) | Performance | Client-side operations | Ensure not loading excessive data | | `Show overlap field based on data labels` (pa_widgets) | Best Practice | Widget/Service Portal client | Review for XSS vulnerabilities | | `Hide run time if new` (sn_cda_tracking_profile) | Performance | OnLoad script | Batch DOM operations | --- ## 📊 Risk Assessment Summary | Risk Dimension | Findings | Priority | |---------------|----------|----------| | Security | 3 moderate concerns (empty table bindings, potential XSS in widget scripts) | ⚠️ | | Performance | 8 high-concern operations (before/after actions with cascading) | 🔴 | | Best Practices | 12 items need script review (error handling, logging) | ⚠️ | | Upgrade Safety | 5 items on system tables (sys_data_source, sys_properties, etc.) | 🔴 | --- ## ✅ Recommended Next Steps ### 1. **Immediate Actions** - [ ] Export full script content for all business rules - [ ] Export full script content for all client scripts - [ ] Identify which scripts modify OOB functionality ### 2. **Script Content Required** To enable full review, I need these fields from the actual records: For Business Rules (`sys_script`): ``` script, table_name, name, collection, when, active ``` For Client Scripts (`sys_script_client`): ``` script, table_name, name, type, active ``` ### 3. **Common Patterns to Check Once Scripts Are Available** ```javascript ... (81 more lines — full output truncated for screenshot)