PMD AppExchange Rules Reference

The PMD AppExchange rules help you prepare your second-generation managed packages (managed 2GP) for security review. To select these rules, use --rule-selector AppExchange. For example, to run the AppExchange rules:

1sf code-analyzer run --rule-selector AppExchange

Description: Detects use of Api.Session_ID or GETSESSIONID() to retrieve a session ID.

Severity: High (2)

Tags: AppExchange, Security, XML

Example(s):

• [Bad] Code that causes a violation:

  1<?xml version="1.0" encoding="UTF-8"?>
  2<CustomObject xmlns="http://soap.sforce.com/2006/04/metadata">
  3    <!-- ... -->
  4    <webLinks>
  5        <!-- ... -->
  6	    <url>{!REQUIRESCRIPT(&apos;/soap/ajax/26.0/connection.js&apos;)}
  7		    sforce.connection.sessionId = &apos;{!GETSESSIONID()}&apos;;
  8	    </url>
  9    </webLinks>
  10</CustomObject>

• [Bad] Code that causes a violation:

  1<?xml version="1.0" encoding="UTF-8"?>
  2<CustomObject xmlns="http://soap.sforce.com/2006/04/metadata">
  3    <!-- ... -->
  4    <webLinks>
  5        <!-- ... -->
  6        <url>
  7            /apex/something?id={!something__c.Id}&amp;sessionId={!$Api.Session_ID}&amp;instance={!$Api.Partner_Server_URL_260}
  8        </url>
  9    </webLinks>
  10</CustomObject>

• [Bad] Code that causes a violation:

  1<?xml version="1.0" encoding="UTF-8"?>
  2<CustomTab xmlns="http://soap.sforce.com/2006/04/metadata">
  3    <!-- ... -->
  4    <url>
  5        https://test.example.com/dummy.ph?param1={!API.Enterprise_Server_URL_540}&amp;sessionId={!API.Session_ID}&amp;param2={!Organization.Name}&amp;param3={!User.Email}
  6    </url>
  7</CustomTab>

Description: Detects use of API versions with Lightning Locker disabled in Aura components. Use API version 40 or greater.

Severity: Critical (1)

Tags: AppExchange, Security, XML

Example(s):

• [Bad] Code that causes a violation:

  1<?xml version="1.0" encoding="UTF-8"?>
  2<AuraDefinitionBundle xmlns="http://soap.sforce.com/2006/04/metadata">
  3    <apiVersion>39.0</apiVersion>
  4    <!-- ... -->
  5</AuraDefinitionBundle>

• [Good] Code that does not cause a violation:

  1<?xml version="1.0" encoding="UTF-8"?>
  2<AuraDefinitionBundle xmlns="http://soap.sforce.com/2006/04/metadata">
  3    <apiVersion>53.0</apiVersion>
  4    <!-- ... -->
  5</AuraDefinitionBundle>

Description: Detects potential misuse of FeatureManagement.changeProtection.

Severity: Critical (1)

Tags: AppExchange, Security, Apex

Example(s):

• [Bad] Code that causes a violation:

  1public with sharing class ProtectedObjectController {
  2    @AuraEnabled
  3    public static void changeObjectToUnprotected(String objectName){
  4        try {
  5            FeatureManagement.changeProtection(objectName, 'CustomObject', 'Unprotected');
  6            System.FeatureManagement.changeProtection(objectName, 'CustomObject', 'Unprotected');
  7        } catch (Exception e) {
  8            throw new AuraHandledException(e.getMessage());
  9        }
  10    }
  11}

• [Good] Code that does not cause a violation:

  1public with sharing class ProtectedObjectController {
  2    @AuraEnabled
  3    public static void changeObjectToUnprotected(String objectName){
  4        try {
  5            SomeOther.changeProtection(objectName, 'CustomObject', 'Unprotected');
  6        } catch (Exception e) {
  7            throw new AuraHandledException(e.getMessage());
  8        }
  9    }
  10}

Description: Detects dynamic creation of script or link tags Note: This rule identifies the <script> block where createElement is detected; but can only show the line number where the <script> tag begins and not the line number for createElement. That means if there are multiple createElement calls with script as input, you’ll see multiple issues… Learn more: https://developer.salesforce.com/docs/platform/salesforce-code-analyzer/guide/rules-pmd-appexchange.html#avoidcreateelementscriptlinktag

Severity: High (2)

Tags: AppExchange, Security, Visualforce

Example(s):

• [Bad] Code that causes a violation:

  1<apex:page controller="VFFutureMethodCtrl" >
  2    <script>
  3        var s = document.createElement("script");
  4        s.src="https://something.example.com/test.js";
  5    </script>
  6</apex:page>

Description: Detects if “Disable Protocol Security” setting is true.

Severity: Moderate (3)

Tags: AppExchange, Security, XML

Example(s):

• [Bad] Code that causes a violation:

  1<?xml version="1.0" encoding="UTF-8"?>
  2<RemoteSiteSetting xmlns="http://soap.sforce.com/2006/04/metadata">
  3    <disableProtocolSecurity>true</disableProtocolSecurity>
  4    <!-- ... -->
  5</RemoteSiteSetting>

• [Good] Code that does not cause a violation:

  1<?xml version="1.0" encoding="UTF-8"?>
  2<RemoteSiteSetting xmlns="http://soap.sforce.com/2006/04/metadata">
  3    <disableProtocolSecurity>false</disableProtocolSecurity>
  4    <!-- ... -->
  5</RemoteSiteSetting>

Description: Detects use of getInstance(userId)/getInstance(profileId). Hierarchy Custom Settings return the record owned by the current user when getInstance() is invoked without any parameters. But if a tainted or end-user controlled userId or profileId is passed as a parameter to getInstance() that will allow the code to access records owned by other users on… Learn more: https://developer.salesforce.com/docs/platform/salesforce-code-analyzer/guide/rules-pmd-appexchange.html#avoidgetinstancewithtaint

Severity: Moderate (3)

Tags: AppExchange, Security, Apex

Example(s):

• [Bad] Code that causes a violation:

  1public with sharing class ProtectedCustomSettingsHierarchyCtrl {
  2    @AuraEnabled
  3    public static Protected_API_Key_Hierarchy__c getInstanceUserId(Id userId){
  4        return Protected_API_Key_Hierarchy__c.getInstance(userId); // NEVER return secrets back to the end user
  5    }
  6}

• [Good] Code that does not cause a violation:

  1public with sharing class ProtectedCustomSettingsHierarchyCtrl {
  2    @AuraEnabled
  3    public static Some_Other_Class__c getInstanceUserId(Id userId){
  4        return SomeOtherClass.getInstance(userId);
  5    }
  6}

Description: Detects Install and Uninstall handlers declared as global. Install and Uninstall Handlers don’t need to be global classes. Using global for these handlers means global methods in these classes act as controllers and can be invoked by untrusted code outside the context of post-install/uninstall scenarios. Depending on the logic in these… Learn more: https://developer.salesforce.com/docs/platform/salesforce-code-analyzer/guide/rules-pmd-appexchange.html#avoidglobalinstalluninstallhandlers

Severity: Critical (1)

Tags: AppExchange, Security, Apex

Example(s):

• [Bad] Code that causes a violation:

  1global class PackageInstallHandler implements InstallHandler {
  2    global void onInstall(InstallContext context) {
  3        //code to run onInstall
  4    }
  5}

• [Bad] Code that causes a violation:

  1global with sharing class PackageUninstallHandler implements UninstallHandler{
  2    global void onUninstall(UninstallContext context) {
  3        //code to run onUninstall
  4    }
  5}

• [Good] Code that does not cause a violation:

  1public class PackageInstallHandler implements InstallHandler{
  2    public void onInstall(InstallContext context) {
  3        //code to run onInstall
  4    }
  5}

• [Good] Code that does not cause a violation:

  1public with sharing class PackageUninstallHandler implements UninstallHandler{
  2    public void onUninstall(UninstallContext context) {
  3        //code to run onUninstall
  4    }
  5}

Description: Detects use of hard coded credentials in Aura components.

Severity: High (2)

Tags: AppExchange, Security, HTML

Example(s):

• [Bad] Code that causes a violation:

  1<aura:component>
  2    <c:someComponent password="testpassword" apikey="123xyzabcd" authtoken="helloworld"/>
  3</aura:component>

• [Bad] Code that causes a violation:

  1<aura:component>
  2    <aura:attribute name="password" type="string" default="123456890"/>
  3    <aura:attribute name="apikey" type="string" default="123456890"/>
  4    <aura:attribute name="authtoken" type="string" default="123456890"/>
  5</aura:component>

• [Good] Code that does not cause a violation:

  1<aura:component>
  2    <c:someComponent color="red"/>
  3</aura:component>

• [Good] Code that does not cause a violation:

  1<aura:component>
  2    <aura:attribute name="color" type="string" default="red"/>
  3    <aura:attribute name="authkey" type="string"/>
  4</aura:component>

Description: Identifies hard-coded credentials in source code that must be protected using Protected Custom metadata or Protected Custom settings. Protected custom settings or protected custom metadata should be used to store secrets. Refer to the Protect Secrets Using Platform Features Trailhead module for more guidance.

Severity: Moderate (3)

Tags: AppExchange, Security, Apex

Example(s):

• [Bad] Code that causes a violation:

  1public with sharing class ProtectedObjectController {
  2    public static final String password='test11';
  3    public static final String apikey='something';
  4    public final Integer passcode=11111;
  5}

Description: Identifies hard-coded credentials in source code that must be protected using Protected Custom metadata or Protected Custom settings. Protected custom settings or protected custom metadata should be used to store secrets. Refer to the Protect Secrets Using Platform Features Trailhead module for more guidance.

Severity: Moderate (3)

Tags: AppExchange, Security, Apex

Example(s):

• [Bad] Code that causes a violation:

  1public with sharing class HttpEndPointCall {
  2    public static void makeHttpCall(String partAuth) {
  3        HttpRequest req = new HttpRequest();
  4        req.setHeader('Authorization', 'Bearer ' + partAuth + 'base64encodedhardcodedvalue');
  5        req.setHeader('APIKey', 'Bearer ' + partAuth);
  6        req.setHeader('APIPassword', 'Bearer ' + partAuth + 'base64encodedhardcodedvalue');
  7    }
  8}

Description: Detects hard-coded credentials in the call to setPassword().

Severity: Critical (1)

Tags: AppExchange, Security, Apex

Example(s):

• [Bad] Code that causes a violation:

  1public with sharing class HttpEndPointCall {
  2    public static void makeHttpCall(String userId) {
  3        setPassword(userId, 'hard coded password');
  4        System.setPassword(userId, 'hard coded password');   
  5    }
  6}

Description: Identifies hard-coded credentials in source code that must be protected using Protected Custom metadata or Protected Custom settings. Protected custom settings or protected custom metadata should be used to store secrets. Refer to the Protect Secrets Using Platform Features Trailhead module for more guidance.

Severity: Moderate (3)

Tags: AppExchange, Security, Apex

Example(s):

• [Bad] Code that causes a violation:

  1public with sharing class HttpEndPointCall {
  2    public static void makeHttpCall(String userId) {
  3        String newPassword = '';
  4        newPassword = 'hardcoded password';
  5        setPassword(userId, newPassword);
  6        newPassword = newPassword + 'some other value';
  7        System.setPassword(userId, newPassword);
  8    }
  9}

Description: Identifies hard-coded credentials in source code that must be protected using Protected Custom metadata or Protected Custom settings. Protected custom settings or protected custom metadata should be used to store secrets. Refer to the Protect Secrets Using Platform Features Trailhead module for more guidance.

Severity: Moderate (3)

Tags: AppExchange, Security, Apex

Example(s):

• [Bad] Code that causes a violation:

  1public with sharing class HttpEndPointCall {
  2    public static void makeHttpCall(String userId) {
  3        String apiKey = 'newapikey';
  4        String newPassword1 = '';
  5        Integer passwordIndex = 5;
  6    }
  7}

Description: Detects hardcoded secrets in VF attributes

Severity: High (2)

Tags: AppExchange, Security, Visualforce

Example(s):

• [Bad] Code that causes a violation:

  1<apex:page controller="VFFutureMethodCtrl" >
  2    <apex:attribute name="apikey" description="This is the value for the component." type="String" default="secretapikey" required="true"/>
  3    <apex:attribute name="passwordIndex" description="This is color for the border." type="Integer" default="2" required="true"/>
  4    <apex:attribute name="showpassword" description="This is color for the border." type="Boolean" default="true" required="true"/>
  5    <c:myComponent apikey="Hardcoded secret api key here" />
  6</apex:page>

Description: Detects instances of a Remote Site Settings that use HTTP. Use HTTPS instead.

Severity: Moderate (3)

Tags: AppExchange, Security, XML

Example(s):

• [Bad] Code that causes a violation:

  1<?xml version="1.0" encoding="UTF-8"?>
  2<RemoteSiteSetting xmlns="http://soap.sforce.com/2006/04/metadata">
  3    <!-- ... -->
  4    <url>http://www.maptestsite.net/mapping1</url>
  5</RemoteSiteSetting>

• [Good] Code that does not cause a violation:

  1<?xml version="1.0" encoding="UTF-8"?>
  2<RemoteSiteSetting xmlns="http://soap.sforce.com/2006/04/metadata">
  3    <!-- ... -->
  4    <url>https://www.maptestsite.net/mapping1</url>
  5</RemoteSiteSetting>

Description: Detects the use of Schema.DescribeSObjectResult methods to enforce CRUD check on ContentDistribution. Developers should use USER MODE operations or use the custom below to enforce CRUD check against the ContentDistribution object.

Severity: Moderate (3)

Tags: AppExchange, Security, Apex

Example(s):

• [Bad] Code that causes a violation:

  1public with sharing class ContentDistributionCheck {
  2    public void hasAccess(){
  3        if(Schema.SObjectType.ContentDistribution.isCreateable()){
  4            System.debug('User has INSERT access on ContentDistribution Object');
  5        }
  6        if(Schema.SObjectType.ContentDistribution.isAccessible()){
  7            System.debug('User has READ access on ContentDistribution Object');
  8        }
  9        if(Schema.SObjectType.ContentDistribution.isUpdateable()){
  10            System.debug('User has UPDATE access on ContentDistribution Object');
  11        }
  12        if(Schema.SObjectType.ContentDistribution.isDeletable()){
  13            System.debug('User has DELETE access on ContentDistribution Object');
  14        }
  15    }
  16}

Description: Detects use of custom JavaScript actions in custom rules.

Severity: High (2)

Tags: AppExchange, Security, XML

Example(s):

• [Bad] Code that causes a violation:

  1<?xml version="1.0" encoding="UTF-8"?>
  2<WebLink xmlns="http://soap.sforce.com/2006/04/metadata">
  3    <!-- ... -->
  4    <openType>onClickJavaScript</openType>
  5    <url>alert(&quot;Show this alert!&quot;);</url>
  6</WebLink>

• [Good] Code that does not cause a violation:

  1<?xml version="1.0" encoding="UTF-8"?>
  2<WebLink xmlns="http://soap.sforce.com/2006/04/metadata">
  3    <!-- ... -->
  4    <openType>newWindow</openType>
  5    <url>https://example.com</url>
  6</WebLink>

Description: Detects use of custom JavaScript actions in home page components.

Severity: High (2)

Tags: AppExchange, Security, XML

Example(s):

• [Bad] Code that causes a violation:

  1<?xml version="1.0" encoding="UTF-8"?>
  2<HomePageComponent xmlns="http://soap.sforce.com/2006/04/metadata">
  3	<body>&lt;a href=javascript:alert(11)&gt;Hello World &lt;/a&gt;</body>
  4    <pageComponentType>htmlArea</pageComponentType>
  5</HomePageComponent>

• [Bad] Code that causes a violation:

  1<?xml version="1.0" encoding="UTF-8"?>
  2<HomePageComponent xmlns="http://soap.sforce.com/2006/04/metadata">
  3	<body>&lt;b&gt;Hello World &lt;/b&gt;
  4		&lt;script&gt;
  5		alert(99);
  6		&lt;/script&gt;
  7	</body>
  8    <pageComponentType>htmlArea</pageComponentType>
  9</HomePageComponent>

• [Good] Code that does not cause a violation:

  1<?xml version="1.0" encoding="UTF-8"?>
  2<HomePageComponent xmlns="http://soap.sforce.com/2006/04/metadata">
  3	<body>&lt;b&gt;Hello World &lt;/b&gt;</body>
  4    <pageComponentType>htmlArea</pageComponentType>
  5</HomePageComponent>

Description: Detects use of JavaScript-style URLs (javascript:) in components, such as web links and buttons. Avoid JavaScript-style URLs in managed packages.

Severity: Critical (1)

Tags: AppExchange, Security, XML

Example(s):

• [Bad] Code that causes a violation:

  1<CustomPageWebLink xmlns="http://soap.sforce.com/2006/04/metadata">
  2    <!-- ... -->
  3    <url>javascript:doSomething();</url>
  4</CustomPageWebLink>

• [Bad] Code that causes a violation:

  1<WebLink xmlns="http://soap.sforce.com/2006/04/metadata">
  2    <!-- ... -->
  3    <url>javascript:helloWorld();</url>
  4</WebLink>

• [Good] Code that does not cause a violation:

  1<CustomPageWebLink xmlns="http://soap.sforce.com/2006/04/metadata">
  2    <!-- ... -->
  3    <url>/apex/test</url>
  4</CustomPageWebLink>

Description: Detects use of custom JavaScript actions in web links.

Severity: High (2)

Tags: AppExchange, Security, XML

Example(s):

• [Bad] Code that causes a violation:

  1<CustomPageWebLink xmlns="http://soap.sforce.com/2006/04/metadata">
  2    <!-- ... -->
  3    <openType>onClickJavaScript</openType>
  4</CustomPageWebLink>

• [Good] Code that does not cause a violation:

  1<CustomPageWebLink xmlns="http://soap.sforce.com/2006/04/metadata">
  2    <!-- ... -->
  3    <openType>sidebar</openType>
  4</CustomPageWebLink>

Description: Detects a Lightning Message Channel with isExposed=true, which isn’t allowed in managed packages.

Severity: High (2)

Tags: AppExchange, Security, XML

Example(s):

• [Bad] Code that causes a violation:

  1<?xml version="1.0" encoding="UTF-8"?>
  2<LightningMessageChannel xmlns="http://soap.sforce.com/2006/04/metadata">
  3    <!-- ... -->
  4    <isExposed>true</isExposed>
  5</LightningMessageChannel>

• [Good] Code that does not cause a violation:

  1<?xml version="1.0" encoding="UTF-8"?>
  2<LightningMessageChannel xmlns="http://soap.sforce.com/2006/04/metadata">
  3    <!-- ... -->
  4    <isExposed>false</isExposed>
  5</LightningMessageChannel>

Description: Detects Lightning Web Component event configurations where bubbles and composed are both set to true. To avoid sharing sensitive information unintentionally, use this configuration with caution.

Severity: Moderate (3)

Tags: AppExchange, Security, JavaScript

Example(s):

• [Bad] Code that causes a violation:

  1import { LightningElement } from 'lwc';
  2export default class LwcNoteCreateModal extends LightningElement {
  3    handleSelected (event) {
  4        const selected = new CustomEvent('selected', {
  5            bubbles: true,
  6            composed: true,
  7            detail: event.detail
  8        });
  9        this.dispatchEvent(selected);
  10    }
  11}

• [Good] Code that does not cause a violation:

  1import { LightningElement } from 'lwc';
  2export default class LwcNoteCreateModal extends LightningElement {
  3    handleSelected (event) {
  4        const selected = new CustomEvent('selected', {
  5            bubbles: true,
  6            detail: event.detail
  7        });
  8        this.dispatchEvent(selected);
  9    }
  10}

Description: Detects if S-Controls are used since they should not be used in managed packages.

Severity: Critical (1)

Tags: AppExchange, Security, XML

Example(s):

• [Bad] Code that causes a violation:

  1<?xml version="1.0" encoding="UTF-8"?>
  2<Scontrol xmlns="http://soap.sforce.com/2006/04/metadata">
  3    <!-- ... -->
  4</Scontrol>

Description: Detects use of WITH SECURITY_ENFORCED in API version less than 48.0

Severity: Moderate (3)

Tags: AppExchange, Security, Apex

Description: Detects use of ${API.Session_Id} to retrieve a session ID. For more guidance on approved use cases, read the Session Id Guidance document.

Severity: Moderate (3)

Tags: AppExchange, Security, Apex

Example(s):

• [Bad] Code that causes a violation:

  1public with sharing class SessionIdController {
  2    public SessionIdController() {
  3        String userInfoSessionId1 = '{!API.Session_ID}';
  4        userInfoSessionId1 = '{!api.session_id}';
  5    }
  6}

• [Good] Code that does not cause a violation:

  1public with sharing class SessionIdController {
  2    public SessionIdController() {
  3        String userInfoSessionId1 = 'API.Session_ID';
  4        userInfoSessionId1 = 'api.session_id';
  5    }
  6}

Description: Detects use of Api.Session_ID to retrieve a session ID in Visualforce code. For more guidance on approved use cases, read the Session Id Guidance document.

Severity: Moderate (3)

Tags: AppExchange, Security, Visualforce

Example(s):

• [Bad] Code that causes a violation:

  1<apex:page controller="SessionIdController">
  2    <script>
  3        var vfApiSessionId = '{!$Api.Session_ID}';
  4    </script>
  5</apex:page>

Description: Detects use of UserInfo.getSessionId() to retrieve a session ID. For more guidance on approved use cases, read the Session Id Guidance document.

Severity: Moderate (3)

Tags: AppExchange, Security, Apex

Example(s):

• [Bad] Code that causes a violation:

  1public with sharing class SessionIdController {
  2    public SessionIdController() {
  3        String userInfoSessionId1 = UserInfo.getSessionId();
  4        userInfoSessionId1 = System.UserInfo.getSessionId();
  5    }
  6}

• [Good] Code that does not cause a violation:

  1public with sharing class SessionIdController {
  2    public SessionIdController() {
  3        String userInfoSessionId1 = getSessionId();
  4    }
  5}

Description: Detects use of GETSESSIONID() to retrieve a session ID in Visualforce code. For more guidance on approved use cases, read the Session Id Guidance document.

Severity: High (2)

Tags: AppExchange, Security, Visualforce

Example(s):

• [Bad] Code that causes a violation:

  1<apex:page controller="SessionIdController">
  2    <script>
  3        var vfGetSessionId = '{!GETSESSIONID()}';
  4    </script>
  5</apex:page>

Description: Detects use of aura:unescapedHtml,which should be used cautiously. Developers should ensure that the unescapedHtml should not use tainted input to protect against XSS.

Severity: High (2)

Tags: AppExchange, Security, HTML

Example(s):

• [Bad] Code that causes a violation:

  1<aura:component>
  2    <aura:attribute name="searchResult" type="List" access="private"/>
  3    <aura:attribute name="someString" type="List" access="private" default="abcd"/>
  4    <aura:iteration items="{!v.searchResult}" var="record">
  5        <aura:unescapedHtml value="{!record.Field0}"/>
  6        <aura:unescapedHtml value="{!someString}"/>
  7    </aura:iteration>
  8</aura:component>

Description: Detects where System.setPassword() exists in Apex code. Use this method with caution.

Severity: Critical (1)

Tags: AppExchange, Security, Apex

Example(s):

• [Bad] Code that causes a violation:

  1public with sharing class UserMgmt {
  2    @AuraEnabled
  3    public static void setPass(Id userId, String password) {
  4        System.setPassword(userId, password);
  5        setPassword(userId, password);
  6    }
  7    @AuraEnabled
  8    public static void resetPassword(Id userId, Boolean sendUserEmail) {
  9        System.resetPassword(userId, sendUserEmail); 
  10        resetPassword(userId, sendUserEmail); 
  11    }
  12    @AuraEnabled
  13    public static void movePassword(ID targetUserId, ID sourceUserId) {
  14        System.movePassword(targetUserId, sourceUserId);
  15        movePassword(targetUserId, sourceUserId);
  16    }
  17    @AuraEnabled
  18    public static void resetPasswordWithEmailTemplate(Id userId, Boolean sendUserEmail, String emailTemplateName) {
  19        System.resetPasswordWithEmailTemplate(userId, sendUserEmail, emailTemplateName);
  20        resetPasswordWithEmailTemplate(userId, sendUserEmail, emailTemplateName);
  21    }
  22}

• [Good] Code that does not cause a violation:

  1public with sharing class UserMgmt {
  2    @AuraEnabled
  3    public static void setPass(Id userId, String password) {
  4        Something.setPassword(userId, password); //NEVER return secrets back to the end user
  5    }
  6    @AuraEnabled
  7    public static void resetPassword(Id userId, Boolean sendUserEmail) {
  8        Something.resetPassword(userId, sendUserEmail); //NEVER return secrets back to the end user
  9    }
  10    @AuraEnabled
  11    public static void movePassword(ID targetUserId, ID sourceUserId) {
  12        Something.movePassword(targetUserId, sourceUserId);
  13    }
  14    @AuraEnabled
  15    public static void resetPasswordWithEmailTemplate(Id userId, Boolean sendUserEmail, String emailTemplateName) {
  16        Something.resetPasswordWithEmailTemplate(userId, sendUserEmail, emailTemplateName);
  17    }
  18}

Description: Detects if a connected app uses full scope instead of limited scope. Explain this use case in your AppExchange security review submission.

Severity: Moderate (3)

Tags: AppExchange, Security, XML

Example(s):

• [Bad] Code that causes a violation:

  1<?xml version="1.0" encoding="UTF-8"?>
  2<ConnectedApp xmlns="http://soap.sforce.com/2006/04/metadata">
  3    <!-- ... -->
  4    <oauthConfig>
  5        <!-- ... -->
  6        <scopes>Basic</scopes>
  7        <scopes>Api</scopes>
  8        <scopes>RefreshToken</scopes>
  9        <scopes>Full</scopes>
  10    </oauthConfig>
  11</ConnectedApp>

• [Good] Code that does not cause a violation:

  1<?xml version="1.0" encoding="UTF-8"?>
  2<ConnectedApp xmlns="http://soap.sforce.com/2006/04/metadata">
  3    <!-- ... -->
  4    <oauthConfig>
  5        <!-- ... -->
  6        <scopes>Basic</scopes>
  7        <scopes>Api</scopes>
  8        <scopes>RefreshToken</scopes>
  9    </oauthConfig>
  10</ConnectedApp>

Description: Determines where CSS must be loaded as a static resource

Severity: High (2)

Tags: AppExchange, Security, Visualforce

Example(s):

• [Bad] Code that causes a violation:

  1<apex:page controller="VFFutureMethodCtrl" >
  2    <apex:stylesheet value="https://something.example.com/styles.css"/>
  3    <apex:stylesheet value="https://something.example.com/{!myvar}.css"/>
  4    <apex:stylesheet value="{!cssUrl}"/>
  5    <apex:stylesheet value="{!URLFOR($Resource.myresource, 'something/css/something.css')}"/>
  6    <apex:stylesheet value="{!$Resource.mycss}"/>
  7</apex:page>

Description: Determines where CSS must be loaded as a static resource

Severity: High (2)

Tags: AppExchange, Security, Visualforce

Example(s):

• [Bad] Code that causes a violation:

  1<apex:page controller="VFFutureMethodCtrl" >
  2    <link rel="stylesheet" href="https://something.example.com/styles.css"/>
  3    <link rel="stylesheet" href="https://something.example.com/{!myvar}.css"/>
  4    <link rel="stylesheet" href="{!cssUrl}"/>
  5    <link rel="stylesheet" href="{!URLFOR($Resource.myresource, 'something/css/something.css')}"/>
  6    <link rel="stylesheet" href="{!$Resource.mycss}"/>
  7</apex:page>

Description: Determines HTML script locations where JavaScript code must be loaded as static resources.

Severity: High (2)

Tags: AppExchange, Security, Visualforce

Example(s):

• [Bad] Code that causes a violation: