Appendix H: Guide for CodeScan¶

This appendix is for an organisation that uses AutoRABIT CodeScan to check its code. It recommends a severity for each CodeScan rule, so that CodeScan enforces the standards of this reference. There is nothing to download. Set each rule in the quality profile of your organisation in CodeScan.

Section 5 compares CodeScan with the other tools. This reference enforces its standards with Salesforce Code Analyzer, and Appendix F lists those rules.

How to Read the Tables¶

There is one table for each CodeScan language. Each row is a CodeScan rule:

CodeScan rule and Name are the rule's id and name in CodeScan. CodeScan's description of a rule is AutoRABIT's text, and it is not copied here. Read it in CodeScan.
CodeScan default is the severity that CodeScan gives the rule. Two numbers mean that the CodeScan list had the rule twice, at two severities.
Recommended is the severity to set in CodeScan, or Off.
Project rule is the rule of this reference that checks the same thing, with a link to it.

A severity is a number with CodeScan's word: 1 (Blocker), 2 (Critical), 3 (Major), 4 (Minor), and 5 (Info). A finding at severity 1 or 2 blocks the pull request (Severity Levels).

How the Recommendation Is Set¶

The recommendation of each row follows from what this reference decided for the rule:

What the reference decided	Recommended
A project rule checks it	The severity of the project rule. When several project rules check it, the most severe of them
The rule is wanted, and the project rule is not written yet	On, at CodeScan's default, because CodeScan can enforce it now
The JavaScript page refers the check to the SonarJS plugin	On, at CodeScan's default, because a CodeScan user does not need the plugin for it
Reviewers check it, and no rule does	On, at CodeScan's default
The rule is left out	Off
The rule is not applicable: a metric, CodeScan housekeeping, or a check that another tool settles	Off

The tables are generated from scripts/codescan-guide.json, and the severity of each project rule is read from the rulesets. So when a project rule changes its severity, its rows change with it.

Connect CodeScan to GitHub¶

TODO(David)

David supplies the CodeScan workflow YAML file. This section then explains how to run CodeScan in GitHub Actions with it, and the other ways that CodeScan connects to a repository.

Apex¶

CodeScan rule	Name	CodeScan default	Recommended	Project rule
`sf:AbstractClassWithoutAbstractMethod`	Abstract Class Without Abstract Method	3 (Major)	Off	None: left out
`sf:AbstractClassWithoutAnyMethod`	Abstract Class without any Methods	1 (Blocker)	1 (Blocker)	`AbstractClassWithoutAnyMethodApex`
`sf:APIVersionsRetired`	API Versions Retired	3 (Major)	2 (Critical)	`BumpApiVersion`
`sf:AuraControllerNaming`	Aura Controller Naming Convention	4 (Minor)	4 (Minor)	`AuraEnabledControllerNaming`
`sf:AvoidAbsoluteURL`	URLs of Salesforce pages should be relative, not absolute	2 (Critical)	3 (Major)	`AvoidAbsoluteSalesforceUrl`
`sf:AvoidDeeplyNestedIfStmts`	Avoid Deeply Nested If Statements	4 (Minor)	3 (Major)	`AvoidDeeplyNestedIfStmts`
`sf:AvoidEmailInLoops`	Avoid Sending Emails in Loops	2 (Critical)	2 (Critical)	`OperationWithLimitsInLoop`
`sf:AvoidFieldNameMatchingMethodName`	Avoid Field Name Matching Method Name	4 (Minor)	4 (Minor)	`FieldNameMatchesMethodName`
`sf:AvoidFieldNameMatchingTypeName`	Avoid Field Name Matching Type Name	4 (Minor)	4 (Minor)	`FieldNameMatchesClassName`
`sf:AvoidGlobalModifier`	Avoid Using Global Modifier	4 (Minor)	4 (Minor)	`AvoidGlobalModifier`
`sf:AvoidHardCodedCredential`	Use Named Credentials	1 (Blocker)	1 (Blocker)	`ApexSuggestUsingNamedCred`
`sf:AvoidHttpReferer`	Avoid Using HTTP Referer Headers	2 (Critical)	2 (Critical)	`AvoidHttpReferer`
`sf:AvoidInsecureCookies`	Avoid Creating Cookies with isSecure Disabled	3 (Major)	3 (Major)	`AvoidInsecureCookies`
`sf:AvoidInsecureMessageDigests`	Avoid Insecure Digest Algorithms	3 (Major)	3 (Major)	`AvoidWeakCryptoAlgorithms`
`sf:AvoidLogicInTrigger`	Avoid Logic in Triggers	3 (Major)	2 (Critical)	`AvoidLogicInTrigger`
`sf:AvoidNestedSwitchStmts`	Avoid Nested Switch Statements	3 (Major)	3 (Major)	`AvoidNestedSwitchStmts`
`sf:AvoidOutboundCallsInBatchApex`	Using Database.AllowsCallouts interface in Batch Apex.	5 (Info)	Off	None: left out
`sf:AvoidSalesforceSystemClassNames`	Avoid Salesforce System Class Names	2 (Critical)	2 (Critical)	`TypeShadowsBuiltInNamespace`
`sf:AvoidSizeOfSoql`	Avoid Calling sizeOf on a SOQL Statement.	3 (Major)	3 (Major)	`AvoidSizeOfSoql`
`sf:AvoidSoqlAggregate`	Avoid Calling Aggregate Functions on Non-Grouped Query	3 (Major)	Off	None: left out
`sf:AvoidSOQLInControllerGetter`	Avoid SOQL in Controller Getter Methods	4 (Minor)	4 (Minor)	`RequireLazyLoadingInGetters`
`sf:AvoidSoqlInLoops`	Avoid Calling SOQL and DML Inside Loops.	2 (Critical)	2 (Critical)	`OperationWithLimitsInLoop`
`sf:AvoidSoqlWithNegativeLogic`	Avoid Calling SOQL with Negative Expressions	3 (Major)	3 (Major)	None yet: wanted, not written
`sf:AvoidSoqlWithoutLimits`	Avoid Calling SOQL Without a Where Clause or Limit Statement	2 (Critical)	2 (Critical)	`AvoidNonRestrictiveQueries`
`sf:AvoidUsingBatchApexInTrigger`	Using Batch Apex from a trigger is dangerous	2 (Critical)	Off	None: left out
`sf:AvoidUsingHardCodedId`	Avoid Using Hard Coded Salesforce Id	1 (Blocker)	1 (Blocker)	`AvoidHardcodingId`
`sf:AvoidUsingHardCodedIP`	Avoid Using Hard Coded IP	1 (Blocker)	1 (Blocker)	`AvoidHardcodedIpAddressApex` `AvoidHardcodedIpAddressMetadata`
`sf:AvoidUsingSeeAllData`	Avoid Using @IsTest(SeeAllData=true)	1 (Blocker)	2 (Critical)	`ApexUnitTestShouldNotUseSeeAllDataTrue`
`sf:AvoidUsingTestIsRunningTest`	Avoid Using Test.isRunningTest()	4 (Minor)	4 (Minor)	`AvoidUsingTestIsRunningTest`
`sf:BadCrypto`	Apex Classes should use Random IV/Key	1 (Blocker)	1 (Blocker)	`ApexBadCrypto`
`sf:BooleanGetMethodName`	Boolean Get Method Name	4 (Minor)	4 (Minor)	`BooleanGetMethodNameApex`
`sf:BrokenNullCheck`	Broken Null Check	2 (Critical)	2 (Critical)	`BrokenNullCheckApex`
`sf:CallSuperInConstructor`	Call Super In Constructor	4 (Minor)	Off	None: left out
`sf:ClassNamedException`	Exception Classes Should Extend an Exception	2 (Critical)	Off	None: left out
`sf:ClassNamingConventions`	Class Naming Conventions	2 (Critical)	1 (Blocker)	`ClassNamingConventions`
`sf:ClassWithoutTestCases`	Test Methods in Non-Test Class	2 (Critical)	1 (Blocker)	`TestMethodsMustBeInTestClasses`
`sf:CollapsibleIfStatements`	Collapsible If Statements	3 (Major)	4 (Minor)	`CombineNestedIfStatements`
`sf:CommentContent`	Invalid Comment Words or Phrases Found	3 (Major)	4 (Minor)	`AvoidTermsWithImplicitBias`
`sf:CommentedTodo`	Avoid leaving TODO/FIXME comments in code	5 (Info)	5 (Info)	`NoUnresolvedTodosApex`
`sf:CommentRequired`	Comment is Required	4 (Minor)	4 (Minor)	`ApexDoc`
`sf:ConfusingTernary`	Confusing Ternary	3 (Major)	Off	None: left out
`sf:ControllerNaming`	Controller Naming Convention	4 (Minor)	4 (Minor)	`VisualforceControllerNaming`
`sf:Csrf`	Avoid Making DML Operations in Controller Constructor/Action Method	3 (Major)	1 (Blocker)	`ApexCSRF`
`sf:Declare_Scope_on_All_Methods`	Declare Access on Non-Test Methods (public, private, protected, global)	1 (Blocker)	2 (Critical)	`DeclareAccessOnMethods`
`sf:DivisionByZeroPossible`	Division by Zero	2 (Critical)	Off	None: left out
`sf:DMLWithoutSharingEnabled`	Sharing should be Configured on Classes with DML	2 (Critical)	1 (Blocker)	`RequireExplicitSharing` `DoNotUseWithoutSharing`
`sf:DUDataflowAnomalyAnalysis`	Potentially Unused Variable	3 (Major)	Off	None: left out
`sf:EmailAddressInLiteral`	Hard Coded Email Address	1 (Blocker)	1 (Blocker)	`EmailAddressInLiteral`
`sf:EmptyCatchBlock`	Empty Catch Block	2 (Critical)	2 (Critical)	`EmptyCatchBlock`
`sf:EmptyFinallyBlock`	Empty Finally Block	2 (Critical)	2 (Critical)	`EmptyTryOrFinallyBlock`
`sf:EmptyIfStmt`	Empty If Statement	3 (Major)	2 (Critical)	`EmptyIfStmt`
`sf:EmptyInitializer`	Empty Initializer	4 (Minor)	4 (Minor)	`EmptyInitializer`
`sf:EmptyStatementBlock`	Avoid Empty Statement Blocks	3 (Major)	2 (Critical)	`EmptyStatementBlock`
`sf:EmptyStatementNotInLoop`	Empty Statement Not in Loop	3 (Major)	Off	None: left out
`sf:EmptyStaticInitializer`	Empty Static Initializer	4 (Minor)	2 (Critical)	`EmptyStatementBlock`
`sf:EmptySwitchLabel`	Empty Switch Label	4 (Minor)	2 (Critical)	`EmptyStatementBlock`
`sf:EmptySwitchStatements`	Switch Statements Should Not Be Empty	3 (Major)	Off	None: left out
`sf:EmptyTryBlock`	Empty Try Block	3 (Major)	2 (Critical)	`EmptyTryOrFinallyBlock`
`sf:EmptyWhileStmt`	Empty While Statement	4 (Minor)	2 (Critical)	`EmptyWhileStmt`
`sf:ExceptionClassNaming`	Exception Class Naming	2 (Critical)	Off	None: not applicable
`sf:FailedUnitTest`	Failing Unit Tests	2 (Critical)	Off	None: not applicable
`sf:FieldLevelSecurity`	Field Level Security Vulnerabilities	3 (Major)	2 (Critical)	`RequireAccessMode` `FlagSystemMode`
`sf:FixDuplicateConditions`	Avoid duplicate conditions in "if"/"else if" and "switch" statements to eliminate dead code	3 (Major)	3 (Major)	`FixDuplicateConditions`
`sf:ForLoopShouldBeWhileLoop`	For Loop Should Be While Loop	3 (Major)	Off	None: left out
`sf:ForLoopsMustUseBraces`	For Loops Must Use Braces	3 (Major)	2 (Critical)	`ForLoopsMustUseBraces`
`sf:FutureMethodInLoop`	Avoid Calling @Future Methods Inside Loops	2 (Critical)	2 (Critical)	None: reviewers check it
`sf:HotspotDeserializeJson`	Deserializing JSON Is Security-Sensitive	2 (Critical)	2 (Critical)	`HotspotDeserializeJson`
`sf:HotspotEncrypt`	Encrypting Data Is Security-Sensitive	2 (Critical)	2 (Critical)	`HotspotEncrypt`
`sf:HotspotTypeReflection`	Type Reflection Is Security Sensitive	2 (Critical)	Off	None: left out
`sf:HotspotUserInfoGetSessionIdUsage`	Using UserInfo.GetSessionId() Is Security-Sensitive	2 (Critical)	2 (Critical)	`AvoidUnauthorizedGetSessionIdInApex`
`sf:IdempotentOperations`	Assignment Has No Effect	3 (Major)	3 (Major)	`IdempotentOperationsApex`
`sf:IfElseStmtsMustUseBraces`	If Else Statements Must Use Braces	3 (Major)	2 (Critical)	`IfElseStmtsMustUseBraces`
`sf:IfStmtsMustUseBraces`	If Statements Must Use Braces	3 (Major)	2 (Critical)	`IfStmtsMustUseBraces`
`sf:InefficientEmptyStringCheck`	Inefficient Empty String Check	4 (Minor)	4 (Minor)	`InefficientEmptyStringCheckApex`
`sf:InsecureEndpoint`	Avoid Cleartext Transmission of Sensitive Information	2 (Critical)	2 (Critical)	`ApexInsecureEndpoint`
`sf:LogicInversion`	Logic Inversion	3 (Major)	3 (Major)	`LogicInversionApex`
`sf:MaximumNumberOfCase`	Switch statements should not have too many case clauses	3 (Major)	Off	None: left out
`sf:Method_Naming_Convention`	Method Naming Convention	2 (Critical)	1 (Blocker)	`MethodNamingConventions`
`sf:MethodWithSameNameAsEnclosingClass`	Method with Same Name as Enclosing Class	2 (Critical)	3 (Major)	`MethodWithSameNameAsEnclosingClass`
`sf:MissingStaticMethodInNonInstantiatableClass`	Missing Static Method in Non Instantiatable Class	3 (Major)	3 (Major)	`MissingStaticMethodInNonInstantiatableClassApex`
`sf:MisuseOfAssertClass`	Misuse of Assert Class	2 (Critical)	2 (Critical)	`MisuseOfAssertClass`
`sf:MultiLineComment`	Multi-line comments should not be empty	3 (Major)	3 (Major)	`NoEmptyBlockComments`
`sf:MultipleTriggersOnObject`	Avoid creating multiple triggers on the same object	1 (Blocker)	1 (Blocker)	`MultipleTriggersOnObject`
`sf:NcinoAvoidDescribeMapInLoops`	Avoid using methods getDescribe and getMap inside Loops	4 (Minor)	3 (Major)	`AvoidDescribeInLoops`
`sf:NonUnitTestContainsAsserts`	Non Test Method Contains Asserts	2 (Critical)	2 (Critical)	`NonUnitTestContainsAsserts`
`sf:NullAssignment`	Null Assignment	3 (Major)	Off	None: left out
`sf:NullCoalescingOperator`	Use the null coalescing operator instead of the ternary operator	3 (Major)	4 (Minor)	`PreferNullCoalescingOverTernary`
`sf:OldApiVersion`	API Version is too old	3 (Major)	2 (Critical)	`BumpApiVersion`
`sf:OnlyOneReturn`	Methods Should Not Have Too Many Return Statements	3 (Major)	Off	None: left out
`sf:OpenRedirect`	URL Redirection to Untrusted Site	1 (Blocker)	2 (Critical)	`ApexOpenRedirect`
`sf:Outer_Class_Explicit_Sharing`	Outer Class Explicit Sharing Required	1 (Blocker)	1 (Blocker)	`RequireExplicitSharing`
`sf:PositionLiteralsFirstInComparisons`	Position Literals First in Comparisons	3 (Major)	3 (Major)	`PositionLiteralsFirstInComparisons`
`sf:RefactorAssert`	Consider Using Assert in place of System.Assert	4 (Minor)	4 (Minor)	`RefactorAssert`
`sf:Require_NoPhiNoPii_Logging_Approval`	Require NoPhiNoPii Logging Approval	2 (Critical)	Off	None: left out
`sf:Require_Outer_Class_Access`	Require Outer Class Access Modifier (public, private, global)	1 (Blocker)	1 (Blocker)	`RequireOuterClassAccess`
`sf:ReturnEmptyArrayRatherThanNull`	Return Empty Array, Not Null	3 (Major)	3 (Major)	`ReturnEmptyArrayRatherThanNull`
`sf:SimplifiedTernary`	Ternary Operators Can Be Simplified With \|\| or &&	3 (Major)	4 (Minor)	`SimplifiedTernaryApex`
`sf:SimplifyBooleanReturns`	Simplify Boolean Returns	3 (Major)	4 (Minor)	`SimplifyBooleanReturnsApex`
`sf:SimplifyConditional`	Unnecessary Null Check with instanceOf	4 (Minor)	4 (Minor)	`SimplifyConditionalApex`
`sf:SOQL_System_Mode`	SOQL System Mode	2 (Critical)	2 (Critical)	`RequireAccessMode` `FlagSystemMode` `NoSecurityEnforced`
`sf:SOQLInjection`	Avoid Untrusted/Unescaped Variables in DML Query	2 (Critical)	2 (Critical)	`ApexSOQLInjection`
`sf:StatementsShouldBeOnSeparateLines`	Statements Should Be On Separate Lines	2 (Critical)	2 (Critical)	`StatementsShouldBeOnSeparateLines`
`sf:SuspiciousConstantFieldName`	Suspicious Constant Field Name	3 (Major)	1 (Blocker)	`FieldNamingConventions`
`sf:SystemDebug`	Avoid calling System.debug()	3 (Major)	2 (Critical)	`AvoidDebugStatements`
`sf:SystemRunAs`	Use System.runAs to test user permissions	3 (Major)	2 (Critical)	`ApexUnitTestClassShouldHaveRunAs`
`sf:TestClassNaming`	Test Class Names Should Include 'Test'	4 (Minor)	1 (Blocker)	`ClassNamingConventions`
`sf:TestClassWithoutTestCases`	Test Class without Test Methods	3 (Major)	3 (Major)	`TestClassWithoutTestCasesApex`
`sf:Tests_Run_as_Running_User`	Tests Should Not Run as Running User	1 (Blocker)	2 (Critical)	`DoNotRunAsCurrentUser`
`sf:TrackNoSonar`	Track Usage of //NOSONAR	2 (Critical)	2 (Critical)	`NoUnapprovedSuppression`
`sf:TrackSuppressWarnings`	Track Usage of @SuppressWarnings	2 (Critical)	2 (Critical)	`NoUnapprovedSuppression`
`sf:UncommentedEmptyConstructor`	Uncommented Empty Constructor	3 (Major)	2 (Critical)	`EmptyStatementBlock`
`sf:UncommentedEmptyMethod`	Uncommented Empty Method	3 (Major)	2 (Critical)	`EmptyStatementBlock`
`sf:UnconditionalIfStatement`	Unconditional If Statement	3 (Major)	3 (Major)	`UnconditionalIfStatementApex`
`sf:UnescapedOutput`	Unescaped Error Message XSS	2 (Critical)	2 (Critical)	`ApexXSSFromEscapeFalse`
`sf:UnescapedSource`	URL Parameters should be Escaped/Sanitized	2 (Critical)	2 (Critical)	`ApexXSSFromURLParam`
`sf:UnitAssertionsShouldIncludeMessage`	Unit Assertions should include a Message	4 (Minor) and 3 (Major)	3 (Major)	`ApexAssertionsShouldIncludeMessage`
`sf:UnitTestsShouldIncludeAssert`	Unit Test Method should include an assertion	2 (Critical)	2 (Critical)	`ApexUnitTestClassShouldHaveAsserts`
`sf:UnitTestsShouldIncludeStartTest`	Unit Test Method should include Test.StartTest() and Test.StopTest()	4 (Minor)	4 (Minor)	`UnitTestsShouldIncludeStartTest`
`sf:UnnecessaryBooleanAssertion`	Unnecessary Boolean Assertion	3 (Major)	2 (Critical)	`UnnecessaryBooleanAssertionApex`
`sf:UnnecessaryLocalBeforeReturn`	Unnecessary Local Before Return	4 (Minor)	5 (Info)	`NoUnnecessaryReturnVariables`
`sf:UnnecessaryReturn`	Unnecessary Return	3 (Major)	Off	None: left out
`sf:UnreachableCode`	Unreachable Code	3 (Major)	Off	None: left out
`sf:UnusedFormalParameter`	Unused Formal Parameter	4 (Minor)	Off	None: left out
`sf:UnusedLocalVariable`	Unused Local Variable	4 (Minor)	3 (Major)	`UnusedLocalVariable`
`sf:UnusedNullCheckInEquals`	Unused Null Check in Equals	4 (Minor)	4 (Minor)	`UnusedNullCheckInEqualsApex`
`sf:UnusedPrivateField`	Unused Private Field	4 (Minor)	Off	None: left out
`sf:UnusedPrivateMethod`	Unused Private Method	4 (Minor)	3 (Major)	`UnusedMethod`
`sf:UseAnnotationOnTestClass`	Use the @IsTest annotation	3 (Major)	1 (Blocker)	`TestMethodsMustBeInTestClasses`
`sf:UseAreEqualInsteadOfAssertBoolean`	Use Assert Equals Instead Of Boolean Equality Assertion	3 (Major)	3 (Major)	`UseAreEqualInsteadOfAssertBoolean`
`sf:UseAreEqualInsteadOfIsTrue`	Use Assert.areEqual instead of Assert.isTrue	3 (Major)	3 (Major)	`UseAreEqualInsteadOfIsTrue`
`sf:UseCollectionIsEmpty`	Use Collection isEmpty	4 (Minor)	4 (Minor)	`UseCollectionIsEmptyApex`
`sf:UseIsTrueInsteadOfAreEqual`	Use Assert.isTrue instead of Assert.areEqual	3 (Major)	3 (Major)	`UseIsTrueInsteadOfAreEqual`
`sf:VariableNamingConventions`	Variable Naming Conventions	3 (Major)	1 (Blocker)	`LocalVariableNamingConventions` `FieldNamingConventions`
`sf:WhileLoopsMustUseBraces`	While Loops Must Use Braces	3 (Major)	2 (Critical)	`WhileLoopsMustUseBraces`

Metadata¶

CodeScan rule	Name	CodeScan default	Recommended	Project rule
`sfmeta:APIVersionsRetired`	API Versions Retired	3 (Major)	2 (Critical)	`BumpApiVersion`
`sfmeta:AutoLayoutFlows`	Set Flows to Auto Layout	4 (Minor)	4 (Minor)	`FlowNotAutoLayout`
`sfmeta:AvoidNestedFlowLoops`	Avoid Nested Loops In Flows	3 (Major)	3 (Major)	`AvoidNestedFlowLoops`
`sfmeta:AvoidUsingPolyfillConfiguration`	Avoid Configuration References to Polyfill.io	2 (Critical)	2 (Critical)	`NoPolyfillIo`
`sfmeta:Compliance_Category_Required`	All fields require a Compliance Category	2 (Critical)	3 (Major)	`FieldComplianceCategory`
`sfmeta:CustomProfilesPermission`	Limit number of Custom Profiles with Modify All Data Permission	2 (Critical)	1 (Blocker)	`ModifyOrViewAllData`
`sfmeta:DmlInFlowLoop`	Flow DML Should Not Be Called In Loops	2 (Critical)	2 (Critical)	`DbInLoop`
`sfmeta:EnableLWS`	Enable Salesforce Lightning Web Security (LWS)	3 (Major)	3 (Major)	`LightningWebSecurityNotEnabled`
`sfmeta:ExceedsMaxAllowedComponentsPerType`	Avoid Excess Components for Objects	4 (Minor)	Off	None: left out
`sfmeta:ExcessiveWorkflowsOrgWide`	Avoid Excess Workflow Rules in Org	4 (Minor)	2 (Critical)	`DoNotUseWorkflow`
`sfmeta:ExcessWorkflowsPerObject`	Avoid Excess Workflow Rules per Object	4 (Minor)	Off	None: left out
`sfmeta:ExposedLightningMessageChannel`	Exposed Lightning Message Channel	3 (Major)	2 (Critical)	`AvoidLmcIsExposedTrue`
`sfmeta:FastFieldUpdates`	Use Fast Field Updates	3 (Major)	3 (Major)	`SameRecordUpdate`
`sfmeta:FaultPathsInFlow`	Flows Should Include Fault Paths	3 (Major)	3 (Major)	`MissingFaultHandler`
`sfmeta:Field_Sensitivity_Required`	All fields require a Sensitivity Level	2 (Critical)	3 (Major)	`FieldDataSensitivity`
`sfmeta:FilterGetRecords`	Get Records Should Be Filtered (Flow)	2 (Critical)	2 (Critical)	`FlowGetRecordsWithoutFilter`
`sfmeta:Hardcoded_Object_Custom_Links`	Hardcoded Object Custom Links	2 (Critical)	3 (Major)	`NoHardcodedWeblinkURLs`
`sfmeta:ICULocaleFormats`	Adopt the ICU Locale Formats instead of JDK locale formats	3 (Major)	Off	None: left out
`sfmeta:Manage_Users_Permissions`	Manage Users Permissions	1 (Blocker)	1 (Blocker)	`ManageUsers`
`sfmeta:Master_Detail_reparentable`	Master-Detail relationships must be reparentable	2 (Critical)	3 (Major)	`MasterDetailReparentable`
`sfmeta:Metadata_Requiring_Approval`	Metadata Requiring Approval	2 (Critical)	Off	None: left out
`sfmeta:MigrateToFlow`	Migrate Workflows and Processes To Flows	3 (Major)	2 (Critical)	`DoNotUseProcessBuilder`
`sfmeta:ModifyView_All_CustomObject`	ModifyView All Records (Custom )	2 (Critical)	2 (Critical)	`ModifyOrViewAllRecordsCustom`
`sfmeta:ModifyViewAll_Records_standard`	ModifyView All Records (Standard Object)	2 (Critical)	2 (Critical)	`ModifyOrViewAllRecordsStandard`
`sfmeta:OldFlowApi`	Flows API Version Is Too Old	4 (Minor)	2 (Critical)	`BumpApiVersion`
`sfmeta:PIIPHI_Minimum_Sensitivity`	PII/HIPAA Field Minimum Sensitivity Requirement	2 (Critical)	3 (Major)	`FieldPiiMinimumSensitivity`
`sfmeta:Process_Builder_to_Flow`	Process Builder to Flow	3 (Major)	2 (Critical)	`DoNotUseProcessBuilder`
`sfmeta:Prohibited_Metadata_Types`	Prohibited Metadata Types	1 (Blocker)	1 (Blocker)	`ProhibitedMetadataType`
`sfmeta:RemoveInactiveFlows`	Inactive flows should be removed	3 (Major)	3 (Major)	`ObsoleteFlow`
`sfmeta:RequireDescriptionComponent`	Custom Metadata components must have a description field	3 (Major) and 2 (Critical)	2 (Critical)	`MetadataDescriptionAnalytics` `MetadataDescriptionComponent` `MetadataDescriptionCore` `MetadataDescriptionCustomField` `MetadataDescriptionCustomObject` `MetadataDescriptionData` `MetadataDescriptionEinstein` `MetadataDescriptionFlow` `MetadataDescriptionIntegration` `MetadataDescriptionPermission` `MetadataDescriptionSharing` `MetadataDescriptionStandardField` `MetadataDescriptionUserInterface`
`sfmeta:Scheduled_Flow_Minimum_API_Version`	Scheduled Flow Minimum API Version	3 (Major)	1 (Blocker)	`ScheduledFlowMinimumApiVersion`
`sfmeta:Sharing_Custom_Object_NonPrivate`	Sharing - Non-Private Custom Object	1 (Blocker)	1 (Blocker)	`NonPrivateCustomObjectSharing`
`sfmeta:Sharing_Standard_Object_NonPrivate`	Sharing - Non-Private Standard Object	1 (Blocker)	1 (Blocker)	`NonPrivateStandardObjectSharing`
`sfmeta:SharingRecordTypeId`	Record Type ID is Missing	4 (Minor)	Off	None: left out
`sfmeta:ViewModifyAll_Data`	View/Modify All Data Profile/PermSet	1 (Blocker)	1 (Blocker)	`ModifyOrViewAllData`
`sfmeta:ViewSetup_Permission_Set`	ViewSetup Prohibited in PermissionSets	1 (Blocker)	1 (Blocker)	`ViewSetupPermissionSet`
`sfmeta:ViewSetup_Profile`	ViewSetup Prohibited in Profiles	1 (Blocker)	1 (Blocker)	`ViewSetupProfile`
`sfmeta:Workflow_to_Flow`	Workflow to Flow	3 (Major)	2 (Critical)	`DoNotUseWorkflow`

Visualforce and Lightning¶

CodeScan rule	Name	CodeScan default	Recommended	Project rule
`common-vf:DuplicatedBlocks`	Source files should not have any duplicated blocks	3 (Major)	5 (Info)	`DetectCopyPasteForVisualforce` `DetectCopyPasteForHtml`
`common-vf:FailedUnitTests`	Failed unit tests should be fixed	3 (Major)	Off	None: not applicable
`common-vf:InsufficientBranchCoverage`	Branches should have sufficient coverage by tests	3 (Major)	Off	None: not applicable
`common-vf:InsufficientCommentDensity`	Source files should have a sufficient density of comment lines	3 (Major)	Off	None: not applicable
`common-vf:InsufficientLineCoverage`	Lines should have sufficient coverage by tests	3 (Major)	Off	None: not applicable
`common-vf:SkippedUnitTests`	Skipped unit tests should be either removed or fixed	3 (Major)	Off	None: not applicable
`cs-vf:aura-api`	validate Aura API	1 (Blocker)	1 (Blocker)	`@salesforce/aura/aura-api`
`cs-vf:dot-notation`	enforce dot notation	4 (Minor)	3 (Major)	`dot-notation`
`cs-vf:ecma-intrinsics`	validate javascript APIs	3 (Major)	3 (Major)	`@salesforce/aura/ecma-intrinsics`
`cs-vf:eqeqeq`	require the use of `===` and `!==`	4 (Minor)	2 (Critical)	`eqeqeq`
`cs-vf:exception`	Tracks CodeScan Eslint Exceptions	1 (Blocker)	Off	None: not applicable
`cs-vf:handle-callback-err`	require error handling in callbacks	4 (Minor)	Off	None: left out
`cs-vf:new-parens`	require parentheses when invoking a constructor with no arguments	4 (Minor)	Off	None: left out
`cs-vf:no-catch-shadow`	disallow `catch` clause parameters from shadowing variables in the outer scope	3 (Major)	3 (Major)	`no-shadow`
`cs-vf:no-console`	disallow the use of `console`	2 (Critical)	2 (Critical)	`NoConsoleInVisualforce`
`cs-vf:no-constant-condition`	disallow constant expressions in conditions	3 (Major)	2 (Critical)	`no-constant-condition`
`cs-vf:no-control-regex`	disallow control characters in regular expressions	4 (Minor)	2 (Critical)	`no-control-regex`
`cs-vf:no-div-regex`	disallow division operators explicitly at the beginning of regular expressions	4 (Minor)	Off	None: left out
`cs-vf:no-else-return`	disallow `else` blocks after `return` statements in `if` statements	4 (Minor)	2 (Critical)	`no-else-return`
`cs-vf:no-empty-character-class`	disallow empty character classes in regular expressions	4 (Minor)	2 (Critical)	`no-empty-character-class`
`cs-vf:no-eq-null`	disallow `null` comparisons without type-checking operators	3 (Major)	Off	None: left out
`cs-vf:no-ex-assign`	disallow reassigning exceptions in `catch` clauses	3 (Major)	2 (Critical)	`no-ex-assign`
`cs-vf:no-extend-native`	disallow extending native types	3 (Major)	2 (Critical)	`no-extend-native`
`cs-vf:no-extra-bind`	disallow unnecessary calls to `.bind()`	4 (Minor)	3 (Major)	`no-extra-bind`
`cs-vf:no-extra-boolean-cast`	disallow unnecessary boolean casts	4 (Minor)	3 (Major)	`no-extra-boolean-cast`
`cs-vf:no-floating-decimal`	disallow leading or trailing decimal points in numeric literals	4 (Minor)	Off	None: left out
`cs-vf:no-func-assign`	disallow reassigning `function` declarations	3 (Major)	2 (Critical)	`no-func-assign`
`cs-vf:no-global-assign`	disallow assignment to native objects	3 (Major)	2 (Critical)	`no-global-assign`
`cs-vf:no-implied-eval`	disallow the use of `eval()`-like methods	3 (Major)	2 (Critical)	`no-implied-eval`
`cs-vf:no-invalid-regexp`	disallow invalid regular expression strings in `RegExp` constructors	4 (Minor)	2 (Critical)	`no-invalid-regexp`
`cs-vf:no-irregular-whitespace`	disallow irregular whitespace outside of strings and comments	3 (Major)	2 (Critical)	`no-irregular-whitespace`
`cs-vf:no-iterator`	disallow the use of the `__iterator__` property	3 (Major)	3 (Major)	`no-iterator`
`cs-vf:no-label-var`	disallow labels that share a name with a variable	4 (Minor)	3 (Major)	`no-label-var`
`cs-vf:no-new`	disallow `new` operators outside of assignments or comparisons	3 (Major)	3 (Major)	`no-new`
`cs-vf:no-new-object`	disallow `Object` constructors	4 (Minor)	Off	None: left out
`cs-vf:no-new-wrappers`	disallow `new` operators with the `String`, `Number`, and `Boolean` objects	4 (Minor)	3 (Major)	`no-new-wrappers`
`cs-vf:no-obj-calls`	disallow calling global object properties as functions	4 (Minor)	2 (Critical)	`no-obj-calls`
`cs-vf:no-octal-escape`	disallow octal escape sequences in string literals	4 (Minor)	3 (Major)	`no-octal-escape`
`cs-vf:no-param-reassign`	disallow reassigning `function` parameters	3 (Major)	3 (Major)	`no-param-reassign`
`cs-vf:no-plusplus`	disallow the unary operators `++` and `--`	4 (Minor)	Off	None: left out
`cs-vf:no-proto`	disallow the use of the `__proto__` property	2 (Critical)	3 (Major)	`no-proto`
`cs-vf:no-regex-spaces`	disallow multiple spaces in regular expressions	4 (Minor)	3 (Major)	`no-regex-spaces`
`cs-vf:no-return-assign`	disallow assignment operators in `return` statements	3 (Major)	3 (Major)	`no-return-assign`
`cs-vf:no-script-url`	disallow `javascript:` urls	3 (Major)	2 (Critical)	`AvoidJavaScriptUrlVf` `AvoidJavaScriptUrlHtmlLwcAura`
`cs-vf:no-self-compare`	disallow comparisons where both sides are exactly the same	3 (Major)	2 (Critical)	`no-self-compare`
`cs-vf:no-shadow-restricted-names`	disallow identifiers from shadowing restricted names	2 (Critical)	2 (Critical)	`no-shadow-restricted-names`
`cs-vf:no-sparse-arrays`	disallow sparse arrays	3 (Major)	2 (Critical)	`no-sparse-arrays`
`cs-vf:no-throw-literal`	disallow throwing literals as exceptions	4 (Minor)	3 (Major)	`no-throw-literal`
`cs-vf:no-undef`	disallow the use of undeclared variables unless mentioned in `/global /` comments	3 (Major)	2 (Critical)	`no-undef`
`cs-vf:no-underscore-dangle`	disallow dangling underscores in identifiers	4 (Minor)	Off	None: left out
`cs-vf:no-unreachable`	disallow unreachable code after `return`, `throw`, `continue`, and `break` statements	3 (Major)	2 (Critical)	`no-unreachable`
`cs-vf:no-unused-expressions`	disallow unused expressions	3 (Major)	3 (Major)	`no-unused-expressions`
`cs-vf:npm-audit`	Auditing npm dependencies for security vulnerabilities	3 (Major)	Off	None: not applicable
`cs-vf:secure-document`	validate document global access	1 (Blocker)	Off	None: left out
`cs-vf:secure-window`	validate window global access	1 (Blocker)	Off	None: left out
`cs-vf:unknown`	CodeScan Other Rules	3 (Major)	Off	None: not applicable
`cs-vf:unsecure-js-dependency`	Auditing js dependencies for security vulnerabilities	3 (Major)	1 (Blocker)	`LibraryWithKnownCriticalSeverityVulnerability` `LibraryWithKnownHighSeverityVulnerability` `LibraryWithKnownMediumSeverityVulnerability` `LibraryWithKnownLowSeverityVulnerability`
`cs-vf:valid-typeof`	enforce comparing `typeof` expressions against valid strings	3 (Major)	2 (Critical)	`valid-typeof`
`cs-vf:wrap-iife`	require parentheses around immediate `function` invocations	4 (Minor)	Off	None: left out
`vf:APIVersionsRetired`	API Versions Retired (7-20)	3 (Major)	2 (Critical)	`BumpApiVersion`
`vf:AvoidApexInScript`	Avoid Apex Tags Within Script	3 (Major)	Off	None: left out
`vf:AvoidDotNamespace`	Avoid Using Dot Namespace	3 (Major)	Off	None: left out
`vf:AvoidExternalResources`	External Script and Style Resources Should Be Avoided	2 (Critical)	2 (Critical)	`LoadJavaScriptHtmlScript` `LoadJavaScriptIncludeScript` `LoadCSSLinkHref` `LoadCSSApexStylesheet`
`vf:AvoidHardCodedPageLink`	Avoid Hard-Coded Page Links	3 (Major)	3 (Major)	`AvoidHardcodedPageLinkVf`
`vf:AvoidHardCodedResourceReferences`	Avoid Hard Coded Resource References	3 (Major)	3 (Major)	`AvoidHardcodedResourcePathVf`
`vf:AvoidHighActionPollerInterval`	Avoid High apex:actionpoller Interval	3 (Major)	Off	None: left out
`vf:AvoidHtmlCommentCheck`	Avoid HTML Comments	3 (Major)	Off	None: left out
`vf:AvoidLinkingToRecordIds`	Check for Lightning Migration Issues for Hard Coded ID Links	1 (Blocker)	1 (Blocker)	`AvoidHardcodedIdVf`
`vf:AvoidMultipleForms`	Avoid Multiple Forms	3 (Major)	3 (Major)	`AvoidMultipleFormsVf`
`vf:AvoidTabCharacter`	Avoid using Tab Characters Check	2 (Critical)	Off	None: left out
`vf:AvoidUsingPolyfill`	Avoid Script References to Polyfill.io	2 (Critical)	2 (Critical)	`NoPolyfillIo`
`vf:BoldTagsCheck`	"strong" Tags Should Be Used Instead of "b"	3 (Major)	Off	None: left out
`vf:CrossSiteScriptingReflected`	JavaScript Reflected XSS	2 (Critical)	2 (Critical)	`VfUnescapeEl`
`vf:DoubleQuotesCheck`	Use Double Quotes to Define Attributes	3 (Major)	Off	None: left out
`vf:exception`	Tracks CodeScan Parser Problems	3 (Major)	Off	None: not applicable
`vf:HeaderCheck`	Files Should Have a Header Comment	3 (Major)	4 (Minor)	`VisualforceHeaderComment`
`vf:HotspotGetSessionIdUsage`	Using GETSESSIONID() and $API.Session_Id is security-sensitive	3 (Major)	2 (Critical)	`AvoidUnauthorizedGetSessionIdInVisualforce` `AvoidUnauthorizedApiSessionIdInVisualforce`
`vf:ImgWithoutAltCheck`	Images Tags Should Have an "alt" Attribute	3 (Major)	2 (Critical)	`ImageWithoutAltVf`
`vf:ImgWithoutWidthOrHeightCheck`	Images Tags Should Always Have a "width" and a "height" Attribute	3 (Major)	Off	None: left out
`vf:InlineStyleAttributesCheck`	Avoid Inline CSS Style Attributes	3 (Major)	3 (Major)	`AvoidInlineStylesInVisualforce` `AvoidInlineStyles`
`vf:InlineStyleCheck`	Avoid Inline CSS Styles	4 (Minor)	3 (Major)	`AvoidInlineStylesInVisualforce`
`vf:InputImgWithoutAltCheck`	Image Buttons Should Have an "alt" Attribute	3 (Major)	2 (Critical)	`ButtonWithoutNameVf` `ButtonWithoutNameHtmlLwcAura`
`vf:InputImgWithoutWidthOrHeightCheck`	Image buttons should always have a "width" and a "height" attribute	3 (Major)	Off	None: left out
`vf:ItalicTagsCheck`	"em" Tags Should Be Used Instead of "i"	3 (Major)	Off	None: left out
`vf:LightningAvoidHardcodedSalesforceDomain`	Check for Lightning Migration Issues for Salesforce.com and Force.com Links	3 (Major)	3 (Major)	`AvoidAbsoluteSalesforceUrlVf` `AvoidAbsoluteSalesforceUrlHtml`
`vf:LightningAvoidUsingSession`	Avoid using GETSESSIONID() and $API.Session_Id	3 (Major)	2 (Critical)	`AvoidUnauthorizedGetSessionIdInVisualforce` `AvoidUnauthorizedApiSessionIdInVisualforce`
`vf:LightningEnhancedListCheck`	Check for Lightning Migration Issues for apex:enhancedList	3 (Major)	Off	None: left out
`vf:LightningIframeCheck`	Check for Lightning Migration Issues for apex:iframe	3 (Major)	4 (Minor)	`AvoidIframeVf`
`vf:LightningPageCheck`	Check for Lightning Migration Issues for apex:page attributes	3 (Major)	Off	None: left out
`vf:LongJavaScriptCheck`	Avoid Large Javascript Scriptlets	3 (Major)	Off	None: left out
`vf:MaxLineLengthCheck`	Avoid Long Lines	3 (Major)	Off	None: left out
`vf:MetaRefreshCheck`	Meta Tags Should Not Be Used to Refresh or Redirect	3 (Major)	Off	None: left out
`vf:MouseEventWithoutKeyboardEquivalentCheck`	Mouse Events should have Equivalent Keyboard Events	3 (Major)	3 (Major)	`MouseEventWithoutKeyboardEventVf` `MouseEventWithoutKeyboardEventHtml`
`vf:NonConsecutiveHeadingCheck`	Avoid Non Consecutive Heading Tags	3 (Major)	Off	None: left out
`vf:NoOnClickJavascript`	Remove OnClick Javascript	3 (Major)	3 (Major)	`NoInlineEventHandlerAura`
`vf:OldPageApiVersion`	API Version is too old	3 (Major)	2 (Critical)	`BumpApiVersion`
`vf:PasswordAutocompleteCheck`	"autocomplete" Should Be Set to "off" on Input Elements of Type "password"	3 (Major)	Off	None: left out
`vf:RequireConfirmationToken`	Require CSRF Protection On GET Requests	4 (Minor)	Off	None: left out
`vf:UnencodedScript`	Unencoded Formulas in Script Tags XSS	2 (Critical)	2 (Critical)	`VfUnescapeEl`
`vf:UnencodedStyle`	Unencoded Formulas In Style Tags XSS	2 (Critical)	2 (Critical)	`VfHtmlStyleTagXss`
`vf:UnescapedAttributes`	Unescaped Value Could Cause XSS	2 (Critical)	2 (Critical)	`VfUnescapeEl`
`vf:UnsupportedTagsInHtml5Check`	Tags No Longer Supported in HTML5 Should Not Be Used	3 (Major)	Off	None: left out
`vf:XPathRule`	XPath rule template	3 (Major)	Off	None: not applicable

JavaScript¶

CodeScan rule	Name	CodeScan default	Recommended	Project rule
`cs-js:no-console`	disallow the use of `console`	2 (Critical)	2 (Critical)	`no-console`
`cs-js:no-implied-eval`	disallow the use of `eval()`-like methods	3 (Major)	2 (Critical)	`no-implied-eval`
`cs-js:no-script-url`	disallow `javascript:` urls	3 (Major)	2 (Critical)	`no-script-url`
`cs-js:no-unreachable`	disallow unreachable code after `return`, `throw`, `continue`, and `break` statements	3 (Major)	2 (Critical)	`no-unreachable`
`javascript:S121`	Control structures should use curly braces	2 (Critical)	2 (Critical)	`curly`
`javascript:S1313`	Using hardcoded IP addresses is security-sensitive	3 (Major)	3 (Major)	None: the JavaScript page refers it to `eslint-plugin-sonarjs`
`javascript:S2068`	Hard-coded credentials are security-sensitive	1 (Blocker)	1 (Blocker)	None: the JavaScript page refers it to `eslint-plugin-sonarjs`
`javascript:S2092`	Creating cookies without the "secure" flag is security-sensitive	3 (Major)	2 (Critical)	`RequireSecureCookie`
`javascript:S3923`	All branches in a conditional structure should not have exactly the same implementation	3 (Major)	3 (Major)	None: the JavaScript page refers it to `eslint-plugin-sonarjs`
`javascript:S4502`	Disabling CSRF protections is security-sensitive	2 (Critical)	Off	None: not applicable
`javascript:S4507`	Delivering code in production with debug features activated is security-sensitive	1 (Blocker)	2 (Critical)	`no-debugger`
`javascript:S4790`	Using weak hashing algorithms is security-sensitive	2 (Critical)	2 (Critical)	None: the JavaScript page refers it to `eslint-plugin-sonarjs`
`javascript:S5122`	Having a permissive Cross-Origin Resource Sharing policy is security-sensitive	3 (Major)	Off	None: not applicable
`javascript:S5332`	Using clear-text protocols is security-sensitive	2 (Critical)	2 (Critical)	None: the JavaScript page refers it to `eslint-plugin-sonarjs`
`javascript:S5757`	Allowing confidential information to be logged is security-sensitive	2 (Critical)	Off	None: not applicable
`javascript:S5852`	Using slow regular expressions is security-sensitive	2 (Critical)	Off	None: not applicable

HTML¶

CodeScan rule	Name	CodeScan default	Recommended	Project rule
`Web:AvoidCommentedOutCodeCheck`	Sections of code should not be commented out	3 (Major)	Off	None: left out
`Web:DoctypePresenceCheck`	"<!DOCTYPE>" declarations should appear before "<html>" tags	3 (Major)	Off	None: not applicable
`Web:FieldsetWithoutLegendCheck`	"<fieldset>" tags should contain a "<legend>"	4 (Minor)	4 (Minor)	`FieldsetWithoutLegendVf` `FieldsetWithoutLegendHtml`
`Web:FlashUsesBothObjectAndEmbedCheck`	Flash animations should be embedded using both "<object>" and "<embed>"	4 (Minor)	Off	None: not applicable
`Web:FrameWithoutTitleCheck`	"<frames>" should have a "title" attribute	4 (Minor)	4 (Minor)	`FrameWithoutTitleVf` `FrameWithoutTitleHtml`
`Web:ImgWithoutAltCheck`	Image, area and button with image tags should have an "alt" attribute	4 (Minor)	2 (Critical)	`ImageWithoutAltHtmlLwcAura` `ButtonWithoutNameHtmlLwcAura`
`Web:ItemTagNotWithinContainerTagCheck`	"<li>" and "<dt>" item tags should be in "<ul>", "<ol>" or "<dl>" container tags	4 (Minor)	4 (Minor)	`ListItemOutsideListVf` `ListItemOutsideListHtml`
`Web:LinkToImageCheck`	Meta tags should not be used to refresh or redirect	3 (Major)	Off	None: left out
`Web:MetaRefreshCheck`	Meta tags should not be used to refresh or redirect	3 (Major)	Off	None: left out
`Web:PageWithoutTitleCheck`	"<title>" should be present in all pages	3 (Major)	Off	None: not applicable
`Web:S1134`	Track uses of "FIXME" tags	3 (Major)	5 (Info)	`NoUnresolvedTodosMarkup`
`Web:S1135`	Track uses of "TODO" tags	5 (Info)	5 (Info)	`NoUnresolvedTodosMarkup`
`Web:S1827`	Attributes deprecated in HTML5 should not be used	3 (Major)	Off	None: left out
`Web:S4084`	Videos should have subtitles	3 (Major)	3 (Major)	`VideoWithoutCaptionsVf` `VideoWithoutCaptionsHtml`
`Web:S4645`	<script>...</script> elements should not be nested	3 (Major)	3 (Major)	`NestedScriptElement`
`Web:S5148`	Authorizing an opened window to access back to the originating window is security-sensitive	4 (Minor)	Off	None: left out
`Web:S5254`	"<html>" element should have a language attribute	3 (Major)	Off	None: not applicable
`Web:S5255`	"aria-label" or "aria-labelledby" attributes should be used to differentiate similar elements	3 (Major)	4 (Minor)	`RepeatedLandmarkWithoutUniqueLabelVf` `RepeatedLandmarkWithoutUniqueLabelHtml`
`Web:S5256`	Tables should have headers	3 (Major)	4 (Minor)	`TableWithoutHeadersVf` `TableWithoutHeadersHtml`
`Web:S5257`	HTML "<table>" should not be used for layout purposes	3 (Major)	3 (Major)	`LayoutTableVf` `LayoutTableHtml`
`Web:S5258`	Tables used for layout should not include semantic markup	2 (Critical)	2 (Critical)	`LayoutTableWithSemanticMarkupVf` `LayoutTableWithSemanticMarkupHtml`
`Web:S5260`	Table cells should reference their headers	2 (Critical)	4 (Minor)	`TableCellHeaderNotFoundVf` `TableCellHeaderNotFoundHtml`
`Web:S5264`	"<object>" tags should provide an alternative content	4 (Minor)	4 (Minor)	`ObjectWithoutAlternativeVf` `ObjectWithoutAlternativeHtml`
`Web:S5725`	Disabling resource integrity features is security-sensitive	4 (Minor)	Off	None: left out
`Web:ServerSideImageMapsCheck`	Server-side image maps ("ismap" attribute) should not be used	4 (Minor)	2 (Critical)	`ServerSideImageMapVf` `ServerSideImageMapHtml`
`Web:TableHeaderHasIdOrScopeCheck`	"<th>" tags should have "id" or "scope" attributes	3 (Major)	4 (Minor)	`TableHeaderWithoutScopeVf` `TableHeaderWithoutScopeHtml`
`Web:TableWithoutCaptionCheck`	"<table>" tags should have a description	4 (Minor)	4 (Minor)	`TableWithoutCaptionVf` `TableWithoutCaptionHtml`
`Web:UnsupportedTagsInHtml5Check`	Elements deprecated in HTML5 should not be used	3 (Major)	Off	None: left out

CSS¶

The project has no CSS rules yet, because PMD has no CSS parser (Valid CSS). Until it has, CodeScan can enforce these rules.

CodeScan rule	Name	CodeScan default	Recommended	Project rule
`css:S1116`	Extra semicolons should be removed	4 (Minor)	4 (Minor)	None yet: wanted, not written
`css:S1128`	Duplicate imports should be removed	4 (Minor)	4 (Minor)	None yet: wanted, not written
`css:S4647`	Color definitions should be valid	1 (Blocker)	1 (Blocker)	None yet: wanted, not written
`css:S4648`	Duplicated font names should be removed	3 (Major)	3 (Major)	None yet: wanted, not written
`css:S4649`	Font declarations should contain at least one generic font family	3 (Major)	3 (Major)	None yet: wanted, not written
`css:S4650`	"calc" operands should be correctly spaced	1 (Blocker)	1 (Blocker)	None yet: wanted, not written
`css:S4651`	"linear-gradient" directions should be valid	2 (Critical)	2 (Critical)	None yet: wanted, not written
`css:S4652`	Strings should not contain new lines	3 (Major)	3 (Major)	None yet: wanted, not written
`css:S4653`	Units should be valid	1 (Blocker)	1 (Blocker)	None yet: wanted, not written
`css:S4654`	CSS properties should be valid	1 (Blocker)	1 (Blocker)	None yet: wanted, not written
`css:S4655`	"!important" should not be used on "keyframes"	3 (Major)	3 (Major)	None yet: wanted, not written
`css:S4656`	Properties should not be duplicated	3 (Major)	3 (Major)	None yet: wanted, not written
`css:S4657`	Shorthand properties that override related longhand properties should be avoided	2 (Critical)	2 (Critical)	None yet: wanted, not written
`css:S4659`	Pseudo-class selectors should be valid	3 (Major)	3 (Major)	None yet: wanted, not written
`css:S4660`	Pseudo-element selectors should be valid	3 (Major)	3 (Major)	None yet: wanted, not written
`css:S4661`	Media features should be valid	3 (Major)	3 (Major)	None yet: wanted, not written
`css:S4662`	"at-rules" should be valid	3 (Major)	3 (Major)	None yet: wanted, not written
`css:S4663`	Multi-line comments should not be empty	4 (Minor)	4 (Minor)	None yet: wanted, not written
`css:S4666`	Selectors should not be duplicated	3 (Major)	3 (Major)	None yet: wanted, not written
`css:S4667`	CSS files should not be empty	3 (Major)	3 (Major)	None yet: wanted, not written
`css:S4668`	Single line comment syntax should not be used	1 (Blocker)	1 (Blocker)	None yet: wanted, not written
`css:S4670`	Selectors should be known	2 (Critical)	2 (Critical)	None yet: wanted, not written