Skip to content

Appendix F.1: Stock PMD Rules

The rules in The Custom Rules ruleset are the ones this reference compiled or wrote. PMD also ships rules of its own, and the reference adopts them in {N} stock rules files: pmd-stock-rules.xml, for Apex, HTML, Visualforce, and XML metadata, and pmd-stock-rules-javascript.xml, for JavaScript. Each name is a link to the file in full, on a page of its own. Together the files take every Apex, JavaScript, HTML, and Visualforce rule that PMD ships, except those under Stock PMD Rules Not Adopted. This page lists every rule the {N} files adopt. Every PMD rule that Code Analyzer ships, adopted here or not, is in Appendix F.5.

What the Stock Rules Cover

The stock rules cover five languages. These are the languages of a Salesforce project that PMD has rules for, and each name below is a link to the table of that language.

  • Apex: classes and triggers (.cls and .trigger).
  • HTML: the templates of Lightning web components, and the markup of Aura components (.html, .cmp, and four other HTML file types).
  • JavaScript: the JavaScript of Lightning web components and of Aura components (.js, .cjs, and .mjs). PMD names this language ecmascript.
  • Visualforce: pages and components (.page and .component).
  • XML: metadata files (.xml). PMD ships {N} XML rules, and the reference adopts none of them, since Salesforce writes the metadata XML itself; both are under Stock PMD Rules Not Adopted.

The file types are those that the PMD engine of Code Analyzer reads for each language, under engines.pmd.file_extensions in the sample code-analyzer.yml. That setting also names TypeScript, which has no table: PMD has no rules for TypeScript, and reads it for copy-paste detection only (JavaScript and TypeScript Support).

The JavaScript rules have a file of their own for one reason. PMD ships the {N} brace rules (ForLoopsMustUseBraces, IfElseStmtsMustUseBraces, IfStmtsMustUseBraces, and WhileLoopsMustUseBraces) under one name for Apex and for JavaScript, and Salesforce Code Analyzer runs only the first of two rules that share a name in one ruleset file (Appendix E). In one file, the {N} JavaScript rules would never run, and nothing would say so. With {N} files, Code Analyzer runs all {N}, and so does PMD on its own when it is given both files, or the one file that imports them (pmd-all-rules.xml).

How to Read the Tables

There is one table for each language. The rules in a table are listed most severe first, then by name.

  • Rule links to PMD's own documentation of the rule, which says what it reports.
  • Category is the PMD category the rule belongs to.
  • Priority is how strictly the rule is enforced, on PMD's scale of 1 to 5, as its file sets it. Salesforce Code Analyzer's severity is the same scale with another name: code-analyzer.yml sets each rule's severity to its priority, so a priority 2 rule is a severity 2 rule (Priority Reference).
  • PMD default is the priority PMD ships the rule with. Where it differs from the Priority column, the rule's file has changed it. The defaults are those of PMD 7.26.0, the version that Salesforce Code Analyzer 5.16.0 bundles.
  • Properties changed names each property that the rule's file sets to something other than PMD's default. The file lists every property of every rule, so that a reader sees each setting; a property that differs from PMD's default has a comment above it that gives the default.
  • Standard links to where the standard that the rule enforces is written. "Not yet written" marks a rule whose standard this guide does not state yet.

The two files adopt 80 stock PMD rules, in 4 languages.

Apex

Rule Category Priority PMD default Properties changed Standard
AnnotationsNamingConventions Code style 1 3 General: Apex
ApexBadCrypto Security 1 3 Apex: Cookies and Cryptography
ApexCSRF Error prone 1 3 Apex: Cross-Site Request Forgery
ApexSuggestUsingNamedCred Security 1 3 Apex: Callouts
AvoidHardcodingId Error prone 1 3 Apex: Record IDs
ClassNamingConventions Code style 1 1 abstractClassPattern, innerInterfacePattern, interfacePattern, testClassPattern General: Apex
Metadata Standards: Naming
FieldNamingConventions Code style 1 1 General: Apex
Metadata Standards: Naming
FormalParameterNamingConventions Code style 1 1 General: Apex
Metadata Standards: Naming
LocalVariableNamingConventions Code style 1 1 finalLocalPattern General: Apex
Metadata Standards: Naming
MethodNamingConventions Code style 1 1 testPattern General: Apex
Metadata Standards: Naming
OneDeclarationPerLine Code style 1 1 Apex: Formatting
PropertyNamingConventions Code style 1 1 General: Apex
Metadata Standards: Naming
TestMethodsMustBeInTestClasses Error prone 1 3 Apex: Test Methods
ApexDangerousMethods Security 2 3 Apex: Debug Output and Error Disclosure
ApexInsecureEndpoint Security 2 3 Apex: Callouts
ApexOpenRedirect Security 2 3 Apex: Open Redirects
ApexSOQLInjection Security 2 3 Apex: SOQL Injection
ApexUnitTestClassShouldHaveAsserts Best practices 2 3 Apex: Assertions
ApexUnitTestClassShouldHaveRunAs Best practices 2 3 Apex: Running As a User
ApexUnitTestMethodShouldHaveIsTestAnnotation Best practices 2 3 Apex: Test Methods
ApexUnitTestShouldNotUseSeeAllDataTrue Best practices 2 3 Apex: Test Classes
ApexXSSFromEscapeFalse Security 2 3 Apex: Cross-Site Scripting
ApexXSSFromURLParam Security 2 3 Apex: Cross-Site Scripting
AvoidDebugStatements Performance 2 3 Apex: Debug Output and Error Disclosure
AvoidDirectAccessTriggerMap Error prone 2 3 Apex: Bulkification
AvoidLogicInTrigger Best practices 2 3 Apex: Triggers
AvoidNonRestrictiveQueries Performance 2 3 violationSuppressXPath Apex: Queries
EagerlyLoadedDescribeSObjectResult Performance 2 3 Apex: Efficient Code
EmptyCatchBlock Error prone 2 3 Apex: Empty Blocks
EmptyIfStmt Error prone 2 3 Apex: Empty Blocks
EmptyStatementBlock Error prone 2 3 reportEmptyPrivateNoArgConstructor, reportEmptyVirtualMethod, violationSuppressXPath Apex: Empty Blocks
EmptyTryOrFinallyBlock Error prone 2 3 Apex: Empty Blocks
EmptyWhileStmt Error prone 2 3 Apex: Empty Blocks
ForLoopsMustUseBraces Code style 2 3 Apex: Braces
IfElseStmtsMustUseBraces Code style 2 3 Apex: Braces
IfStmtsMustUseBraces Code style 2 3 Apex: Braces
InvocableClassNoArgConstructor Error prone 2 3 Apex: Constructors
OperationWithLimitsInLoop Performance 2 3 Apex: Bulkification
Apex: Asynchronous Apex
OverrideBothEqualsAndHashcode Error prone 2 3 Apex: Equality
TypeShadowsBuiltInNamespace Error prone 2 1 General: Apex
WhileLoopsMustUseBraces Code style 2 3 Apex: Braces
ApexAssertionsShouldIncludeMessage Best practices 3 3 Apex: Assertions
AvoidDeeplyNestedIfStmts Design 3 3 Apex: Complexity and Unused Code
AvoidInterfaceAsMapKey Error prone 3 3 Apex: Equality
AvoidNonExistentAnnotations Error prone 3 3 Apex: Annotations
AvoidStatefulDatabaseResult Error prone 3 2 Apex: Asynchronous Apex
CognitiveComplexity Design 3 3 Apex: Complexity and Unused Code
CyclomaticComplexity Design 3 3 Apex: Complexity and Unused Code
InaccessibleAuraEnabledGetter Error prone 3 3 Apex: Access Modifiers
MethodWithSameNameAsEnclosingClass Error prone 3 3 Apex: Constructors
OperationWithHighCostInLoop Performance 3 3 Apex: Efficient Code
UnusedLocalVariable Best practices 3 5 Apex: Complexity and Unused Code
UnusedMethod Design 3 3 Apex: Complexity and Unused Code
ApexDoc Documentation 4 3 reportPrivate, reportProperty, reportProtected Apex: ApexDoc
AvoidBooleanMethodParameters Design 4 2 Apex: Architecture
AvoidFutureAnnotation Best practices 4 4 Apex: Asynchronous Apex
AvoidGlobalModifier Best practices 4 3 Apex: Access Modifiers
DebugsShouldUseLoggingLevel Best practices 4 3 Apex: Debug Output and Error Disclosure
FieldDeclarationsShouldBeAtStart Code style 4 3 Apex: Formatting
NcssCount Design 4 3 Apex: Complexity and Unused Code
TooManyFields Design 4 3 Apex: Complexity and Unused Code
QueueableWithoutFinalizer Best practices 5 5 Apex: Asynchronous Apex

HTML

Rule Category Priority PMD default Properties changed Standard
AvoidInlineStyles Best practices 3 3 HTML and Visualforce: CSS

JavaScript

Rule Category Priority PMD default Properties changed Standard
AssignmentInOperand Code style 2 2 JavaScript: Assignments in Conditions
AvoidConsoleStatements Performance 2 3 JavaScript: Console and Debugger Statements
AvoidTrailingComma Error prone 2 1 Lightning Web Components and Aura: Code Style
Lightning Web Components and Aura: Required Formatting
AvoidWithStatement Best practices 2 1 JavaScript: With Statements
ConsistentReturn Best practices 2 2 JavaScript: Return Values
EqualComparison Error prone 2 3 JavaScript: Equality
ForLoopsMustUseBraces Code style 2 3 JavaScript: Braces
IfElseStmtsMustUseBraces Code style 2 3 JavaScript: Braces
IfStmtsMustUseBraces Code style 2 3 JavaScript: Braces
NoElseReturn Code style 2 3 JavaScript: Code Style
UnreachableCode Code style 2 1 JavaScript: Unreachable Code
UseBaseWithParseInt Best practices 2 1 JavaScript: Number Parsing
WhileLoopsMustUseBraces Code style 2 3 JavaScript: Braces
UnnecessaryParentheses Code style 4 4 JavaScript: Code Style

Visualforce

Rule Category Priority PMD default Properties changed Standard
VfCsrf Security 2 3 HTML and Visualforce: Cross-Site Request Forgery
VfHtmlStyleTagXss Security 2 3 HTML and Visualforce: Cross-Site Scripting
VfUnescapeEl Security 2 3 HTML and Visualforce: Cross-Site Scripting