Appendix F.1: Stock PMD Rules¶
The rules in The Custom Rules ruleset are the ones this reference compiled or wrote. PMD also ships rules of its own, and the reference adopts them in {N} stock rules files: pmd-stock-rules.xml, for Apex, HTML, Visualforce, and XML metadata, and pmd-stock-rules-javascript.xml, for JavaScript. Each name is a link to the file in full, on a page of its own. Together the files take every Apex, JavaScript, HTML, and Visualforce rule that PMD ships, except those under Stock PMD Rules Not Adopted. This page lists every rule the {N} files adopt. Every PMD rule that Code Analyzer ships, adopted here or not, is in Appendix F.5.
What the Stock Rules Cover¶
The stock rules cover five languages. These are the languages of a Salesforce project that PMD has rules for, and each name below is a link to the table of that language.
- Apex: classes and triggers (
.clsand.trigger). - HTML: the templates of Lightning web components, and the markup of Aura components (
.html,.cmp, and four other HTML file types). - JavaScript: the JavaScript of Lightning web components and of Aura components (
.js,.cjs, and.mjs). PMD names this languageecmascript. - Visualforce: pages and components (
.pageand.component). - XML: metadata files (
.xml). PMD ships {N} XML rules, and the reference adopts none of them, since Salesforce writes the metadata XML itself; both are under Stock PMD Rules Not Adopted.
The file types are those that the PMD engine of Code Analyzer reads for each language, under engines.pmd.file_extensions in the sample code-analyzer.yml. That setting also names TypeScript, which has no table: PMD has no rules for TypeScript, and reads it for copy-paste detection only (JavaScript and TypeScript Support).
The JavaScript rules have a file of their own for one reason. PMD ships the {N} brace rules (ForLoopsMustUseBraces, IfElseStmtsMustUseBraces, IfStmtsMustUseBraces, and WhileLoopsMustUseBraces) under one name for Apex and for JavaScript, and Salesforce Code Analyzer runs only the first of two rules that share a name in one ruleset file (Appendix E). In one file, the {N} JavaScript rules would never run, and nothing would say so. With {N} files, Code Analyzer runs all {N}, and so does PMD on its own when it is given both files, or the one file that imports them (pmd-all-rules.xml).
How to Read the Tables¶
There is one table for each language. The rules in a table are listed most severe first, then by name.
- Rule links to PMD's own documentation of the rule, which says what it reports.
- Category is the PMD category the rule belongs to.
- Priority is how strictly the rule is enforced, on PMD's scale of 1 to 5, as its file sets it. Salesforce Code Analyzer's severity is the same scale with another name:
code-analyzer.ymlsets each rule's severity to its priority, so a priority 2 rule is a severity 2 rule (Priority Reference). - PMD default is the priority PMD ships the rule with. Where it differs from the Priority column, the rule's file has changed it. The defaults are those of PMD 7.26.0, the version that Salesforce Code Analyzer 5.16.0 bundles.
- Properties changed names each property that the rule's file sets to something other than PMD's default. The file lists every property of every rule, so that a reader sees each setting; a property that differs from PMD's default has a comment above it that gives the default.
- Standard links to where the standard that the rule enforces is written. "Not yet written" marks a rule whose standard this guide does not state yet.
The two files adopt 80 stock PMD rules, in 4 languages.
Apex¶
HTML¶
| Rule | Category | Priority | PMD default | Properties changed | Standard |
|---|---|---|---|---|---|
AvoidInlineStyles |
Best practices | 3 | 3 | HTML and Visualforce: CSS |
JavaScript¶
Visualforce¶
| Rule | Category | Priority | PMD default | Properties changed | Standard |
|---|---|---|---|---|---|
VfCsrf |
Security | 2 | 3 | HTML and Visualforce: Cross-Site Request Forgery | |
VfHtmlStyleTagXss |
Security | 2 | 3 | HTML and Visualforce: Cross-Site Scripting | |
VfUnescapeEl |
Security | 2 | 3 | HTML and Visualforce: Cross-Site Scripting |