# XML Run Output Schema Reference

This example shows how to create a XML-formatted output file when using the `--output-file` flag of the `code-analyzer run` command.

```bash
sf code-analyzer run --output-file results.xml
```

## Sample XML Run Output

This sample output shows 3 violations with different severities from different engines.

```xml
<?xml version="1.0" encoding="UTF-8"?>
<results>
  <runDir>/Users/lisa.simpson/sfdx/coral-cloud-afdx/</runDir>
  <violationCounts>
    <total>3</total>
    <sev1>0</sev1>
    <sev2>1</sev2>
    <sev3>1</sev3>
    <sev4>1</sev4>
    <sev5>0</sev5>
  </violationCounts>
  <versions>
    <code-analyzer>0.25.1</code-analyzer>
    <eslint>0.20.1</eslint>
    <retire-js>0.18.1</retire-js>
    <regex>0.18.1</regex>
    <flow>0.18.1</flow>
    <pmd>0.21.0</pmd>
  </versions>
  <violations>
    <violation>
      <rule>@lwc/lwc/no-inner-html</rule>
      <engine>eslint</engine>
      <severity>2</severity>
      <tags>
        <tag>Recommended</tag>
        <tag>LWC</tag>
        <tag>Security</tag>
        <tag>Javascript</tag>
      </tags>
      <primaryLocationIndex>0</primaryLocationIndex>
      <locations>
        <location>
          <file>force-app/main/default/staticresources/highlight/highlight/prism.js</file>
          <startLine>571</startLine>
          <startColumn>17</startColumn>
          <endLine>571</endLine>
          <endColumn>26</endColumn>
        </location>
      </locations>
      <message>Using 'innerHTML/outputHTML/insertAdjacentHTML' is not allowed</message>
      <resources>
        <resource>https://github.com/salesforce/eslint-plugin-lwc/blob/v2.1.0/docs/rules/no-inner-html.md</resource>
      </resources>
    </violation>
    <violation>
      <rule>PreventPassingUserDataIntoElementWithSharing</rule>
      <engine>flow</engine>
      <severity>4</severity>
      <tags>
        <tag>Recommended</tag>
        <tag>Security</tag>
        <tag>Xml</tag>
      </tags>
      <primaryLocationIndex>1</primaryLocationIndex>
      <locations>
        <location>
          <file>force-app/main/default/flows/Get_Customer_Details.flow-meta.xml</file>
          <startLine>90</startLine>
          <startColumn>1</startColumn>
          <comment>email.email: Initialization</comment>
        </location>
        <location>
          <file>force-app/main/default/flows/Get_Customer_Details.flow-meta.xml</file>
          <startLine>41</startLine>
          <startColumn>1</startColumn>
          <comment>email.email influences Get_Contact_by_Email_and_Member_Number.Email: flow into recordLookups via influence over Email in run mode SystemModeWithSharing</comment>
        </location>
      </locations>
      <message>User controlled data flows into recordLookups element selector in run mode: SystemModeWithSharing</message>
      <resources></resources>
    </violation>
    <violation>
      <rule>ApexSharingViolations</rule>
      <engine>pmd</engine>
      <severity>3</severity>
      <tags>
        <tag>Recommended</tag>
        <tag>Security</tag>
        <tag>Apex</tag>
      </tags>
      <primaryLocationIndex>0</primaryLocationIndex>
      <locations>
        <location>
          <file>force-app/main/default/classes/ExperienceBookingHelper.cls</file>
          <startLine>1</startLine>
          <startColumn>1</startColumn>
          <endLine>1</endLine>
          <endColumn>7</endColumn>
        </location>
      </locations>
      <message>Apex classes should declare a sharing model if DML or SOQL/SOSL is used</message>
      <resources>
        <resource>https://docs.pmd-code.org/pmd-doc-7.11.0/pmd_rules_apex_security.html#apexsharingviolations</resource>
      </resources>
    </violation>
  </violations>
</results>
```

## Elements in the Top-Level <results> Element

| Element             | Data Type     | Description                                                                                                                                                                         |
| ------------------- | ------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| `<runDir>`          | string        | The directory from which the Code Analyzer analysis ran.                                                                                                                            |
| `<violationCounts>` | complexType   | Contains elements that show the total number of violations and the aggregate counts for each severity level. See [<violationCounts> Element](#violationcounts-element) for details. |
| `<versions>`        | complexType   | Contains elements that show the versions of the core Code Analyzer module and each engine module that ran in the analysis. See [<versions> Element](#versions-element) for details. |
| `<violations>`      | complexType[] | An array of `<violation>` elements, where each element corresponds to a violation that was detected in the analysis. See [<violation> Element](#violation-element) for details.     |

## <violationCounts> Element

| Element   | Data Type | Description                                       |
| --------- | --------- | ------------------------------------------------- |
| `<total>` | number    | Total number of violations found in the analysis. |
| `<sev1>`  | number    | Number of severity 1 (Critical) violations found. |
| `<sev2>`  | number    | Number of severity 2 (High) violations found.     |
| `<sev3>`  | number    | Number of severity 3 (Moderate) violations found. |
| `<sev4>`  | number    | Number of severity 4 (Low) violations found.      |
| `<sev5>`  | number    | Number of severity 5 (Info) violations found.     |

## <versions> Element

| Element           | Data Type | Description                                                                                             |
| ----------------- | --------- | ------------------------------------------------------------------------------------------------------- |
| `<code-analyzer>` | string    | Version of the core Code Analyzer module.                                                               |
| `<cpd>`           | string    | Version of the [CPD module](/docs/platform/salesforce-code-analyzer/guide/engine-cpd.md).               |
| `<eslint>`        | string    | Version of the [ESLint module](/docs/platform/salesforce-code-analyzer/guide/engine-eslint.md).         |
| `<flow>`          | string    | Version of the [Flow Scanner module](/docs/platform/salesforce-code-analyzer/guide/engine-flow.md).     |
| `<pmd>`           | string    | Version of the [PMD module](/docs/platform/salesforce-code-analyzer/guide/engine-pmd.md).               |
| `<retire-js>`     | string    | Version of the [RetireJS module](/docs/platform/salesforce-code-analyzer/guide/engine-retire-js.md).    |
| `<regex>`         | string    | Version of the [Regex module](/docs/platform/salesforce-code-analyzer/guide/engine-regex.md).           |
| `<sfge>`          | string    | Version of the [Salesforce Graph module](/docs/platform/salesforce-code-analyzer/guide/engine-sfge.md). |

## <violation> Element

| Element                  | Data Type     | Description                                                                                                                                                                                         |
| ------------------------ | ------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| `<rule>`                 | string        | The name of the rule that's associated with the violation.                                                                                                                                          |
| `<engine>`               | string        | The [engine](/docs/platform/salesforce-code-analyzer/guide/engines.md) that's associated with the violation.                                                                                        |
| `<severity>`             | number        | The severity level of the violation: 1 (Critical), 2 (High), 3 (Moderate), 4 (Low), 5 (Info)                                                                                                        |
| `<tags>`                 | string[]      | An array of <tag> elements that contain the tags that are associated with the rule that's associated with the violation.                                                                            |
| `<primaryLocationIndex>` | number        | The index of the primary code location within the code locations array.                                                                                                                             |
| `<locations>`            | complexType[] | An array of `<location>` elements, where each element corresponds to a location in your code that's associated with the violation. See [location Object Properties](#location-element) for details. |
| `<message>`              | string        | The violation message.                                                                                                                                                                              |
| `<resources>`            | string[]      | An array of <resource> elements that contain URLs for additional resources and information about the violation.                                                                                     |

## <location> Element

Some rules, such as those that have a `PathBased` tag, can produce multiple code locations. These code locations make up the code path associated with the violation.

| Property Name   | Data Type | Description                                                                                   |
| --------------- | --------- | --------------------------------------------------------------------------------------------- |
| `<file>`        | string    | The pathname of the file in which the violation occurred, relative to the `runDir` directory. |
| `<startLine>`   | number    | The line where the violating code starts.                                                     |
| `<startColumn>` | number    | The column in the `startLine` where the violating code starts.                                |
| `<endLine>`     | number    | The line where the violating code ends.                                                       |
| `<endColumn>`   | number    | The column in the `endLine` where the violating code ends.                                    |
| `<comment>`     | string    | Comment that provides additional context associated with this line or block of code.          |