CtrlK
BlogDocsLog inGet started
Tessl Logo

testland/pmd-apex-rules

Runs PMD's built-in Apex security ruleset (`category/apex/security.xml`) against Salesforce Apex source to detect injection, privilege-escalation, cryptographic, and XSS vulnerabilities; configures custom rulesets for regulated-industry Apex codebases; emits SARIF for GitHub Code Scanning upload; integrates `pmd check` as a PR-blocking CI gate. Use when the codebase contains Salesforce Apex and the team needs SAST coverage for ApexSOQLInjection, ApexCRUDViolation, ApexSharingViolations, or the full 10-rule security category.

79

Quality

99%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

SecuritybySnyk

Low

Low-risk findings worth noting

Overview
Quality
Evals
Security
Files

apex-security-rules.mdreferences/

PMD Apex security rules

The 10-rule category/apex/security.xml catalog plus per-rule detail for pmd-apex-rules. All entries per pmd.github.io - Apex Security Rules.

RuleWhat it detects
ApexSOQLInjectionDynamic SOQL/DML built by string concatenation with untrusted input
ApexCRUDViolationMissing object/field permission check before SOQL, SOSL, or DML
ApexSharingViolationsClasses performing DML without an explicit sharing keyword
ApexBadCryptoHard-coded IVs or keys in cryptographic operations
ApexDangerousMethodsCalls to Configuration.disableTriggerCRUDSecurity() or sensitive System.debug()
ApexInsecureEndpointPlain HTTP (non-HTTPS) callout endpoints
ApexOpenRedirectRedirects using unsanitized user-controlled input
ApexSuggestUsingNamedCredHard-coded credentials in HTTP headers; suggests Named Credentials
ApexXSSFromEscapeFalseaddError() called with escape disabled, exposing raw user content
ApexXSSFromURLParamURL parameters used in output contexts without escaping

ApexSOQLInjection

Per pmd-apex-sec: "Detects the usage of untrusted / unescaped variables in DML queries."

Non-compliant:

public class Foo {
    public void test1(String t1) {
        Database.query('SELECT Id FROM Account' + t1);
    }
}

Compliant (bind variable - automatically sanitized by the Apex runtime):

public class Foo {
    public void test1(String accountName) {
        List<Account> accounts = [SELECT Id FROM Account WHERE Name = :accountName];
    }
}

ApexCRUDViolation

Per pmd-apex-sec: "The rule validates you are checking for access permissions before a SOQL/SOSL/DML operation." Accepted remediation paths include DescribeSObjectResult system checks, WITH SECURITY_ENFORCED, or (since Winter '23 / API v56) WITH USER_MODE.

The rule is configurable for custom authorization facades via regex properties (createAuthMethodPattern, readAuthMethodPattern, etc.) so teams using an internal ESAPI wrapper can still pass the check.

ApexSharingViolations

Per pmd-apex-sec: "Detect classes declared without explicit sharing mode if DML methods are used." The three accepted keywords are with sharing, without sharing, and inherited sharing. The intent is to force a conscious declaration of sharing posture, not to mandate a specific value.

references

apex-security-rules.md

SKILL.md

tile.json