# PMD AppExchange Rules Reference

The PMD AppExchange rules help you prepare your second-generation managed packages (managed 2GP) for security review. To select these rules, use `--rule-selector AppExchange`. For example, to run the AppExchange rules:

```bash
sf code-analyzer run --rule-selector AppExchange
```

## AvoidApiSessionId

**Description:** Detects use of Api.Session_ID or GETSESSIONID() to retrieve a session ID.

**Severity:** High (2)

**Tags:** `AppExchange`, `Security`, `XML`

**Example(s):**

- \[Bad] Code that causes a violation:

  ```
  <?xml version="1.0" encoding="UTF-8"?>
  <CustomObject xmlns="http://soap.sforce.com/2006/04/metadata">
      <!-- ... -->
      <webLinks>
          <!-- ... -->
  	    <url>{!REQUIRESCRIPT(&apos;/soap/ajax/26.0/connection.js&apos;)}
  		    sforce.connection.sessionId = &apos;{!GETSESSIONID()}&apos;;
  	    </url>
      </webLinks>
  </CustomObject>
  ```

- \[Bad] Code that causes a violation:

  ```
  <?xml version="1.0" encoding="UTF-8"?>
  <CustomObject xmlns="http://soap.sforce.com/2006/04/metadata">
      <!-- ... -->
      <webLinks>
          <!-- ... -->
          <url>
              /apex/something?id={!something__c.Id}&amp;sessionId={!$Api.Session_ID}&amp;instance={!$Api.Partner_Server_URL_260}
          </url>
      </webLinks>
  </CustomObject>
  ```

- \[Bad] Code that causes a violation:

  ```
  <?xml version="1.0" encoding="UTF-8"?>
  <CustomTab xmlns="http://soap.sforce.com/2006/04/metadata">
      <!-- ... -->
      <url>
          https://test.example.com/dummy.ph?param1={!API.Enterprise_Server_URL_540}&amp;sessionId={!API.Session_ID}&amp;param2={!Organization.Name}&amp;param3={!User.Email}
      </url>
  </CustomTab>
  ```

## AvoidAuraWithLockerDisabled

**Description:** Detects use of API versions with Lightning Locker disabled in Aura components. Use API version 40 or greater.

**Severity:** Critical (1)

**Tags:** `AppExchange`, `Security`, `XML`

**Example(s):**

- \[Bad] Code that causes a violation:

  ```
  <?xml version="1.0" encoding="UTF-8"?>
  <AuraDefinitionBundle xmlns="http://soap.sforce.com/2006/04/metadata">
      <apiVersion>39.0</apiVersion>
      <!-- ... -->
  </AuraDefinitionBundle>
  ```

- \[Good] Code that does not cause a violation:

  ```
  <?xml version="1.0" encoding="UTF-8"?>
  <AuraDefinitionBundle xmlns="http://soap.sforce.com/2006/04/metadata">
      <apiVersion>53.0</apiVersion>
      <!-- ... -->
  </AuraDefinitionBundle>
  ```

## AvoidChangeProtectionUnprotected

**Description:** Detects potential misuse of FeatureManagement.changeProtection.

**Severity:** Critical (1)

**Tags:** `AppExchange`, `Security`, `Apex`

**Example(s):**

- \[Bad] Code that causes a violation:

  ```
  public with sharing class ProtectedObjectController {
      @AuraEnabled
      public static void changeObjectToUnprotected(String objectName){
          try {
              FeatureManagement.changeProtection(objectName, 'CustomObject', 'Unprotected');
              System.FeatureManagement.changeProtection(objectName, 'CustomObject', 'Unprotected');
          } catch (Exception e) {
              throw new AuraHandledException(e.getMessage());
          }
      }
  }
  ```

- \[Good] Code that does not cause a violation:

  ```
  public with sharing class ProtectedObjectController {
      @AuraEnabled
      public static void changeObjectToUnprotected(String objectName){
          try {
              SomeOther.changeProtection(objectName, 'CustomObject', 'Unprotected');
          } catch (Exception e) {
              throw new AuraHandledException(e.getMessage());
          }
      }
  }
  ```

## AvoidCreateElementScriptLinkTag

**Description:** Detects dynamic creation of script or link tags Note: This rule identifies the `<script>` block where `createElement` is detected; but can only show the line number where the `<script>` tag begins and not the line number for `createElement`. That means if there are multiple `createElement` calls with `script` as input, you'll see multiple issues... Learn more: [https://developer.salesforce.com/docs/platform/salesforce-code-analyzer/guide/rules-pmd-appexchange.html#avoidcreateelementscriptlinktag](https://developer.salesforce.com/docs/platform/salesforce-code-analyzer/guide/rules-pmd-appexchange.md#avoidcreateelementscriptlinktag)

**Severity:** High (2)

**Tags:** `AppExchange`, `Security`, `Visualforce`

**Example(s):**

- \[Bad] Code that causes a violation:

  ```
  <apex:page controller="VFFutureMethodCtrl" >
      <script>
          var s = document.createElement("script");
          s.src="https://something.example.com/test.js";
      </script>
  </apex:page>
  ```

## AvoidDisableProtocolSecurityRemoteSiteSetting

**Description:** Detects if "Disable Protocol Security" setting is true.

**Severity:** Moderate (3)

**Tags:** `AppExchange`, `Security`, `XML`

**Example(s):**

- \[Bad] Code that causes a violation:

  ```
  <?xml version="1.0" encoding="UTF-8"?>
  <RemoteSiteSetting xmlns="http://soap.sforce.com/2006/04/metadata">
      <disableProtocolSecurity>true</disableProtocolSecurity>
      <!-- ... -->
  </RemoteSiteSetting>
  ```

- \[Good] Code that does not cause a violation:

  ```
  <?xml version="1.0" encoding="UTF-8"?>
  <RemoteSiteSetting xmlns="http://soap.sforce.com/2006/04/metadata">
      <disableProtocolSecurity>false</disableProtocolSecurity>
      <!-- ... -->
  </RemoteSiteSetting>
  ```

## AvoidGetInstanceWithTaint

**Description:** Detects use of getInstance(userId)/getInstance(profileId). Hierarchy Custom Settings return the record owned by the current user when getInstance() is invoked without any parameters. But if a tainted or end-user controlled userId or profileId is passed as a parameter to getInstance() that will allow the code to access records owned by other users on... Learn more: [https://developer.salesforce.com/docs/platform/salesforce-code-analyzer/guide/rules-pmd-appexchange.html#avoidgetinstancewithtaint](https://developer.salesforce.com/docs/platform/salesforce-code-analyzer/guide/rules-pmd-appexchange.md#avoidgetinstancewithtaint)

**Severity:** Moderate (3)

**Tags:** `AppExchange`, `Security`, `Apex`

**Example(s):**

- \[Bad] Code that causes a violation:

  ```
  public with sharing class ProtectedCustomSettingsHierarchyCtrl {
      @AuraEnabled
      public static Protected_API_Key_Hierarchy__c getInstanceUserId(Id userId){
          return Protected_API_Key_Hierarchy__c.getInstance(userId); // NEVER return secrets back to the end user
      }
  }
  ```

- \[Good] Code that does not cause a violation:

  ```
  public with sharing class ProtectedCustomSettingsHierarchyCtrl {
      @AuraEnabled
      public static Some_Other_Class__c getInstanceUserId(Id userId){
          return SomeOtherClass.getInstance(userId);
      }
  }
  ```

## AvoidGlobalInstallUninstallHandlers

**Description:** Detects Install and Uninstall handlers declared as global. Install and Uninstall Handlers don't need to be global classes. Using global for these handlers means global methods in these classes act as controllers and can be invoked by untrusted code outside the context of post-install/uninstall scenarios. Depending on the logic in these... Learn more: [https://developer.salesforce.com/docs/platform/salesforce-code-analyzer/guide/rules-pmd-appexchange.html#avoidglobalinstalluninstallhandlers](https://developer.salesforce.com/docs/platform/salesforce-code-analyzer/guide/rules-pmd-appexchange.md#avoidglobalinstalluninstallhandlers)

**Severity:** Critical (1)

**Tags:** `AppExchange`, `Security`, `Apex`

**Example(s):**

- \[Bad] Code that causes a violation:

  ```
  global class PackageInstallHandler implements InstallHandler {
      global void onInstall(InstallContext context) {
          //code to run onInstall
      }
  }
  ```

- \[Bad] Code that causes a violation:

  ```
  global with sharing class PackageUninstallHandler implements UninstallHandler{
      global void onUninstall(UninstallContext context) {
          //code to run onUninstall
      }
  }
  ```

- \[Good] Code that does not cause a violation:

  ```
  public class PackageInstallHandler implements InstallHandler{
      public void onInstall(InstallContext context) {
          //code to run onInstall
      }
  }
  ```

- \[Good] Code that does not cause a violation:

  ```
  public with sharing class PackageUninstallHandler implements UninstallHandler{
      public void onUninstall(UninstallContext context) {
          //code to run onUninstall
      }
  }
  ```

## AvoidHardCodedCredentialsInAura

**Description:** Detects use of hard coded credentials in Aura components.

**Severity:** High (2)

**Tags:** `AppExchange`, `Security`, `HTML`

**Example(s):**

- \[Bad] Code that causes a violation:

  ```
  <aura:component>
      <c:someComponent password="testpassword" apikey="123xyzabcd" authtoken="helloworld"/>
  </aura:component>
  ```

- \[Bad] Code that causes a violation:

  ```
  <aura:component>
      <aura:attribute name="password" type="string" default="123456890"/>
      <aura:attribute name="apikey" type="string" default="123456890"/>
      <aura:attribute name="authtoken" type="string" default="123456890"/>
  </aura:component>
  ```

- \[Good] Code that does not cause a violation:

  ```
  <aura:component>
      <c:someComponent color="red"/>
  </aura:component>
  ```

- \[Good] Code that does not cause a violation:

  ```
  <aura:component>
      <aura:attribute name="color" type="string" default="red"/>
      <aura:attribute name="authkey" type="string"/>
  </aura:component>
  ```

## AvoidHardcodedCredentialsInFieldDecls

**Description:** Identifies hard-coded credentials in source code that must be protected using Protected Custom metadata or Protected Custom settings. Protected custom settings or protected custom metadata should be used to store secrets. Refer to the Protect Secrets Using Platform Features Trailhead module for more guidance.

**Severity:** Moderate (3)

**Tags:** `AppExchange`, `Security`, `Apex`

**Example(s):**

- \[Bad] Code that causes a violation:

  ```
  public with sharing class ProtectedObjectController {
      public static final String password='test11';
      public static final String apikey='something';
      public final Integer passcode=11111;
  }
  ```

## AvoidHardcodedCredentialsInHttpHeader

**Description:** Identifies hard-coded credentials in source code that must be protected using Protected Custom metadata or Protected Custom settings. Protected custom settings or protected custom metadata should be used to store secrets. Refer to the Protect Secrets Using Platform Features Trailhead module for more guidance.

**Severity:** Moderate (3)

**Tags:** `AppExchange`, `Security`, `Apex`

**Example(s):**

- \[Bad] Code that causes a violation:

  ```
  public with sharing class HttpEndPointCall {
      public static void makeHttpCall(String partAuth) {
          HttpRequest req = new HttpRequest();
          req.setHeader('Authorization', 'Bearer ' + partAuth + 'base64encodedhardcodedvalue');
          req.setHeader('APIKey', 'Bearer ' + partAuth);
          req.setHeader('APIPassword', 'Bearer ' + partAuth + 'base64encodedhardcodedvalue');
      }
  }
  ```

## AvoidHardcodedCredentialsInSetPassword

**Description:** Detects hard-coded credentials in the call to setPassword().

**Severity:** Critical (1)

**Tags:** `AppExchange`, `Security`, `Apex`

**Example(s):**

- \[Bad] Code that causes a violation:

  ```
  public with sharing class HttpEndPointCall {
      public static void makeHttpCall(String userId) {
          setPassword(userId, 'hard coded password');
          System.setPassword(userId, 'hard coded password');   
      }
  }
  ```

## AvoidHardcodedCredentialsInVarAssign

**Description:** Identifies hard-coded credentials in source code that must be protected using Protected Custom metadata or Protected Custom settings. Protected custom settings or protected custom metadata should be used to store secrets. Refer to the Protect Secrets Using Platform Features Trailhead module for more guidance.

**Severity:** Moderate (3)

**Tags:** `AppExchange`, `Security`, `Apex`

**Example(s):**

- \[Bad] Code that causes a violation:

  ```
  public with sharing class HttpEndPointCall {
      public static void makeHttpCall(String userId) {
          String newPassword = '';
          newPassword = 'hardcoded password';
          setPassword(userId, newPassword);
          newPassword = newPassword + 'some other value';
          System.setPassword(userId, newPassword);
      }
  }
  ```

## AvoidHardcodedCredentialsInVarDecls

**Description:** Identifies hard-coded credentials in source code that must be protected using Protected Custom metadata or Protected Custom settings. Protected custom settings or protected custom metadata should be used to store secrets. Refer to the Protect Secrets Using Platform Features Trailhead module for more guidance.

**Severity:** Moderate (3)

**Tags:** `AppExchange`, `Security`, `Apex`

**Example(s):**

- \[Bad] Code that causes a violation:

  ```
  public with sharing class HttpEndPointCall {
      public static void makeHttpCall(String userId) {
          String apiKey = 'newapikey';
          String newPassword1 = '';
          Integer passwordIndex = 5;
      }
  }
  ```

## AvoidHardcodedSecretsInVFAttrs

**Description:** Detects hardcoded secrets in VF attributes

**Severity:** High (2)

**Tags:** `AppExchange`, `Security`, `Visualforce`

**Example(s):**

- \[Bad] Code that causes a violation:

  ```
  <apex:page controller="VFFutureMethodCtrl" >
      <apex:attribute name="apikey" description="This is the value for the component." type="String" default="secretapikey" required="true"/>
      <apex:attribute name="passwordIndex" description="This is color for the border." type="Integer" default="2" required="true"/>
      <apex:attribute name="showpassword" description="This is color for the border." type="Boolean" default="true" required="true"/>
      <c:myComponent apikey="Hardcoded secret api key here" />
  </apex:page>
  ```

## AvoidInsecureHttpRemoteSiteSetting

**Description:** Detects instances of a Remote Site Settings that use HTTP. Use HTTPS instead.

**Severity:** Moderate (3)

**Tags:** `AppExchange`, `Security`, `XML`

**Example(s):**

- \[Bad] Code that causes a violation:

  ```
  <?xml version="1.0" encoding="UTF-8"?>
  <RemoteSiteSetting xmlns="http://soap.sforce.com/2006/04/metadata">
      <!-- ... -->
      <url>http://www.maptestsite.net/mapping1</url>
  </RemoteSiteSetting>
  ```

- \[Good] Code that does not cause a violation:

  ```
  <?xml version="1.0" encoding="UTF-8"?>
  <RemoteSiteSetting xmlns="http://soap.sforce.com/2006/04/metadata">
      <!-- ... -->
      <url>https://www.maptestsite.net/mapping1</url>
  </RemoteSiteSetting>
  ```

## AvoidInvalidCrudContentDistribution

**Description:** Detects the use of `Schema.DescribeSObjectResult` methods to enforce CRUD check on `ContentDistribution`. Developers should use `USER MODE` operations or use the custom below to enforce CRUD check against the `ContentDistribution` object.

**Severity:** Moderate (3)

**Tags:** `AppExchange`, `Security`, `Apex`

**Example(s):**

- \[Bad] Code that causes a violation:

  ```
  public with sharing class ContentDistributionCheck {
      public void hasAccess(){
          if(Schema.SObjectType.ContentDistribution.isCreateable()){
              System.debug('User has INSERT access on ContentDistribution Object');
          }
          if(Schema.SObjectType.ContentDistribution.isAccessible()){
              System.debug('User has READ access on ContentDistribution Object');
          }
          if(Schema.SObjectType.ContentDistribution.isUpdateable()){
              System.debug('User has UPDATE access on ContentDistribution Object');
          }
          if(Schema.SObjectType.ContentDistribution.isDeletable()){
              System.debug('User has DELETE access on ContentDistribution Object');
          }
      }
  }
  ```

## AvoidJavaScriptCustomObject

**Description:** Detects use of custom JavaScript actions in custom rules.

**Severity:** High (2)

**Tags:** `AppExchange`, `Security`, `XML`

**Example(s):**

- \[Bad] Code that causes a violation:

  ```
  <?xml version="1.0" encoding="UTF-8"?>
  <WebLink xmlns="http://soap.sforce.com/2006/04/metadata">
      <!-- ... -->
      <openType>onClickJavaScript</openType>
      <url>alert(&quot;Show this alert!&quot;);</url>
  </WebLink>
  ```

- \[Good] Code that does not cause a violation:

  ```
  <?xml version="1.0" encoding="UTF-8"?>
  <WebLink xmlns="http://soap.sforce.com/2006/04/metadata">
      <!-- ... -->
      <openType>newWindow</openType>
      <url>https://example.com</url>
  </WebLink>
  ```

## AvoidJavaScriptHomePageComponent

**Description:** Detects use of custom JavaScript actions in home page components.

**Severity:** High (2)

**Tags:** `AppExchange`, `Security`, `XML`

**Example(s):**

- \[Bad] Code that causes a violation:

  ```
  <?xml version="1.0" encoding="UTF-8"?>
  <HomePageComponent xmlns="http://soap.sforce.com/2006/04/metadata">
  	<body>&lt;a href=javascript:alert(11)&gt;Hello World &lt;/a&gt;</body>
      <pageComponentType>htmlArea</pageComponentType>
  </HomePageComponent>
  ```

- \[Bad] Code that causes a violation:

  ```
  <?xml version="1.0" encoding="UTF-8"?>
  <HomePageComponent xmlns="http://soap.sforce.com/2006/04/metadata">
  	<body>&lt;b&gt;Hello World &lt;/b&gt;
  		&lt;script&gt;
  		alert(99);
  		&lt;/script&gt;
  	</body>
      <pageComponentType>htmlArea</pageComponentType>
  </HomePageComponent>
  ```

- \[Good] Code that does not cause a violation:

  ```
  <?xml version="1.0" encoding="UTF-8"?>
  <HomePageComponent xmlns="http://soap.sforce.com/2006/04/metadata">
  	<body>&lt;b&gt;Hello World &lt;/b&gt;</body>
      <pageComponentType>htmlArea</pageComponentType>
  </HomePageComponent>
  ```

## AvoidJavaScriptInUrls

**Description:** Detects use of JavaScript-style URLs (javascript:) in components, such as web links and buttons. Avoid JavaScript-style URLs in managed packages.

**Severity:** Critical (1)

**Tags:** `AppExchange`, `Security`, `XML`

**Example(s):**

- \[Bad] Code that causes a violation:

  ```
  <CustomPageWebLink xmlns="http://soap.sforce.com/2006/04/metadata">
      <!-- ... -->
      <url>javascript:doSomething();</url>
  </CustomPageWebLink>
  ```

- \[Bad] Code that causes a violation:

  ```
  <WebLink xmlns="http://soap.sforce.com/2006/04/metadata">
      <!-- ... -->
      <url>javascript:helloWorld();</url>
  </WebLink>
  ```

- \[Good] Code that does not cause a violation:

  ```
  <CustomPageWebLink xmlns="http://soap.sforce.com/2006/04/metadata">
      <!-- ... -->
      <url>/apex/test</url>
  </CustomPageWebLink>
  ```

## AvoidJavaScriptWebLink

**Description:** Detects use of custom JavaScript actions in web links.

**Severity:** High (2)

**Tags:** `AppExchange`, `Security`, `XML`

**Example(s):**

- \[Bad] Code that causes a violation:

  ```
  <CustomPageWebLink xmlns="http://soap.sforce.com/2006/04/metadata">
      <!-- ... -->
      <openType>onClickJavaScript</openType>
  </CustomPageWebLink>
  ```

- \[Good] Code that does not cause a violation:

  ```
  <CustomPageWebLink xmlns="http://soap.sforce.com/2006/04/metadata">
      <!-- ... -->
      <openType>sidebar</openType>
  </CustomPageWebLink>
  ```

## AvoidLmcIsExposedTrue

**Description:** Detects a Lightning Message Channel with isExposed=true, which isn’t allowed in managed packages.

**Severity:** High (2)

**Tags:** `AppExchange`, `Security`, `XML`

**Example(s):**

- \[Bad] Code that causes a violation:

  ```
  <?xml version="1.0" encoding="UTF-8"?>
  <LightningMessageChannel xmlns="http://soap.sforce.com/2006/04/metadata">
      <!-- ... -->
      <isExposed>true</isExposed>
  </LightningMessageChannel>
  ```

- \[Good] Code that does not cause a violation:

  ```
  <?xml version="1.0" encoding="UTF-8"?>
  <LightningMessageChannel xmlns="http://soap.sforce.com/2006/04/metadata">
      <!-- ... -->
      <isExposed>false</isExposed>
  </LightningMessageChannel>
  ```

## AvoidLwcBubblesComposedTrue

**Description:** Detects Lightning Web Component event configurations where bubbles and composed are both set to true. To avoid sharing sensitive information unintentionally, use this configuration with caution.

**Severity:** Moderate (3)

**Tags:** `AppExchange`, `Security`, `JavaScript`

**Example(s):**

- \[Bad] Code that causes a violation:

  ```
  import { LightningElement } from 'lwc';
  export default class LwcNoteCreateModal extends LightningElement {
      handleSelected (event) {
          const selected = new CustomEvent('selected', {
              bubbles: true,
              composed: true,
              detail: event.detail
          });
          this.dispatchEvent(selected);
      }
  }
  ```

- \[Good] Code that does not cause a violation:

  ```
  import { LightningElement } from 'lwc';
  export default class LwcNoteCreateModal extends LightningElement {
      handleSelected (event) {
          const selected = new CustomEvent('selected', {
              bubbles: true,
              detail: event.detail
          });
          this.dispatchEvent(selected);
      }
  }
  ```

## AvoidSControls

**Description:** Detects if S-Controls are used since they should not be used in managed packages.

**Severity:** Critical (1)

**Tags:** `AppExchange`, `Security`, `XML`

**Example(s):**

- \[Bad] Code that causes a violation:

  ```
  <?xml version="1.0" encoding="UTF-8"?>
  <Scontrol xmlns="http://soap.sforce.com/2006/04/metadata">
      <!-- ... -->
  </Scontrol>
  ```

## AvoidSecurityEnforcedOldApiVersion

**Description:** Detects use of WITH SECURITY_ENFORCED in API version less than 48.0

**Severity:** Moderate (3)

**Tags:** `AppExchange`, `Security`, `Apex`

## AvoidUnauthorizedApiSessionIdInApex

**Description:** Detects use of ${API.Session_Id} to retrieve a session ID. For more guidance on approved use cases, read the Session Id Guidance document.

**Severity:** Moderate (3)

**Tags:** `AppExchange`, `Security`, `Apex`

**Example(s):**

- \[Bad] Code that causes a violation:

  ```
  public with sharing class SessionIdController {
      public SessionIdController() {
          String userInfoSessionId1 = '{!API.Session_ID}';
          userInfoSessionId1 = '{!api.session_id}';
      }
  }
  ```

- \[Good] Code that does not cause a violation:

  ```
  public with sharing class SessionIdController {
      public SessionIdController() {
          String userInfoSessionId1 = 'API.Session_ID';
          userInfoSessionId1 = 'api.session_id';
      }
  }
  ```

## AvoidUnauthorizedApiSessionIdInVisualforce

**Description:** Detects use of Api.Session_ID to retrieve a session ID in Visualforce code. For more guidance on approved use cases, read the Session Id Guidance document.

**Severity:** Moderate (3)

**Tags:** `AppExchange`, `Security`, `Visualforce`

**Example(s):**

- \[Bad] Code that causes a violation:

  ```
  <apex:page controller="SessionIdController">
      <script>
          var vfApiSessionId = '{!$Api.Session_ID}';
      </script>
  </apex:page>
  ```

## AvoidUnauthorizedGetSessionIdInApex

**Description:** Detects use of UserInfo.getSessionId() to retrieve a session ID. For more guidance on approved use cases, read the Session Id Guidance document.

**Severity:** Moderate (3)

**Tags:** `AppExchange`, `Security`, `Apex`

**Example(s):**

- \[Bad] Code that causes a violation:

  ```
  public with sharing class SessionIdController {
      public SessionIdController() {
          String userInfoSessionId1 = UserInfo.getSessionId();
          userInfoSessionId1 = System.UserInfo.getSessionId();
      }
  }
  ```

- \[Good] Code that does not cause a violation:

  ```
  public with sharing class SessionIdController {
      public SessionIdController() {
          String userInfoSessionId1 = getSessionId();
      }
  }
  ```

## AvoidUnauthorizedGetSessionIdInVisualforce

**Description:** Detects use of GETSESSIONID() to retrieve a session ID in Visualforce code. For more guidance on approved use cases, read the Session Id Guidance document.

**Severity:** High (2)

**Tags:** `AppExchange`, `Security`, `Visualforce`

**Example(s):**

- \[Bad] Code that causes a violation:

  ```
  <apex:page controller="SessionIdController">
      <script>
          var vfGetSessionId = '{!GETSESSIONID()}';
      </script>
  </apex:page>
  ```

## AvoidUnescapedHtmlInAura

**Description:** Detects use of aura:unescapedHtml,which should be used cautiously. Developers should ensure that the unescapedHtml should not use tainted input to protect against XSS.

**Severity:** High (2)

**Tags:** `AppExchange`, `Security`, `HTML`

**Example(s):**

- \[Bad] Code that causes a violation:

  ```
  <aura:component>
      <aura:attribute name="searchResult" type="List" access="private"/>
      <aura:attribute name="someString" type="List" access="private" default="abcd"/>
      <aura:iteration items="{!v.searchResult}" var="record">
          <aura:unescapedHtml value="{!record.Field0}"/>
          <aura:unescapedHtml value="{!someString}"/>
      </aura:iteration>
  </aura:component>
  ```

## AvoidUnsafePasswordManagementUse

**Description:** Detects where System.setPassword() exists in Apex code. Use this method with caution.

**Severity:** Critical (1)

**Tags:** `AppExchange`, `Security`, `Apex`

**Example(s):**

- \[Bad] Code that causes a violation:

  ```
  public with sharing class UserMgmt {
      @AuraEnabled
      public static void setPass(Id userId, String password) {
          System.setPassword(userId, password);
          setPassword(userId, password);
      }
      @AuraEnabled
      public static void resetPassword(Id userId, Boolean sendUserEmail) {
          System.resetPassword(userId, sendUserEmail); 
          resetPassword(userId, sendUserEmail); 
      }
      @AuraEnabled
      public static void movePassword(ID targetUserId, ID sourceUserId) {
          System.movePassword(targetUserId, sourceUserId);
          movePassword(targetUserId, sourceUserId);
      }
      @AuraEnabled
      public static void resetPasswordWithEmailTemplate(Id userId, Boolean sendUserEmail, String emailTemplateName) {
          System.resetPasswordWithEmailTemplate(userId, sendUserEmail, emailTemplateName);
          resetPasswordWithEmailTemplate(userId, sendUserEmail, emailTemplateName);
      }
  }
  ```

- \[Good] Code that does not cause a violation:

  ```
  public with sharing class UserMgmt {
      @AuraEnabled
      public static void setPass(Id userId, String password) {
          Something.setPassword(userId, password); //NEVER return secrets back to the end user
      }
      @AuraEnabled
      public static void resetPassword(Id userId, Boolean sendUserEmail) {
          Something.resetPassword(userId, sendUserEmail); //NEVER return secrets back to the end user
      }
      @AuraEnabled
      public static void movePassword(ID targetUserId, ID sourceUserId) {
          Something.movePassword(targetUserId, sourceUserId);
      }
      @AuraEnabled
      public static void resetPasswordWithEmailTemplate(Id userId, Boolean sendUserEmail, String emailTemplateName) {
          Something.resetPasswordWithEmailTemplate(userId, sendUserEmail, emailTemplateName);
      }
  }
  ```

## LimitConnectedAppScope

**Description:** Detects if a connected app uses full scope instead of limited scope. Explain this use case in your AppExchange security review submission.

**Severity:** Moderate (3)

**Tags:** `AppExchange`, `Security`, `XML`

**Example(s):**

- \[Bad] Code that causes a violation:

  ```
  <?xml version="1.0" encoding="UTF-8"?>
  <ConnectedApp xmlns="http://soap.sforce.com/2006/04/metadata">
      <!-- ... -->
      <oauthConfig>
          <!-- ... -->
          <scopes>Basic</scopes>
          <scopes>Api</scopes>
          <scopes>RefreshToken</scopes>
          <scopes>Full</scopes>
      </oauthConfig>
  </ConnectedApp>
  ```

- \[Good] Code that does not cause a violation:

  ```
  <?xml version="1.0" encoding="UTF-8"?>
  <ConnectedApp xmlns="http://soap.sforce.com/2006/04/metadata">
      <!-- ... -->
      <oauthConfig>
          <!-- ... -->
          <scopes>Basic</scopes>
          <scopes>Api</scopes>
          <scopes>RefreshToken</scopes>
      </oauthConfig>
  </ConnectedApp>
  ```

## LoadCSSApexStylesheet

**Description:** Determines where CSS must be loaded as a static resource

**Severity:** High (2)

**Tags:** `AppExchange`, `Security`, `Visualforce`

**Example(s):**

- \[Bad] Code that causes a violation:

  ```
  <apex:page controller="VFFutureMethodCtrl" >
      <apex:stylesheet value="https://something.example.com/styles.css"/>
      <apex:stylesheet value="https://something.example.com/{!myvar}.css"/>
      <apex:stylesheet value="{!cssUrl}"/>
      <apex:stylesheet value="{!URLFOR($Resource.myresource, 'something/css/something.css')}"/>
      <apex:stylesheet value="{!$Resource.mycss}"/>
  </apex:page>
  ```

## LoadCSSLinkHref

**Description:** Determines where CSS must be loaded as a static resource

**Severity:** High (2)

**Tags:** `AppExchange`, `Security`, `Visualforce`

**Example(s):**

- \[Bad] Code that causes a violation:

  ```
  <apex:page controller="VFFutureMethodCtrl" >
      <link rel="stylesheet" href="https://something.example.com/styles.css"/>
      <link rel="stylesheet" href="https://something.example.com/{!myvar}.css"/>
      <link rel="stylesheet" href="{!cssUrl}"/>
      <link rel="stylesheet" href="{!URLFOR($Resource.myresource, 'something/css/something.css')}"/>
      <link rel="stylesheet" href="{!$Resource.mycss}"/>
  </apex:page>
  ```

## LoadJavaScriptHtmlScript

**Description:** Determines HTML script locations where JavaScript code must be loaded as static resources.

**Severity:** High (2)

**Tags:** `AppExchange`, `Security`, `Visualforce`

**Example(s):**

- \[Bad] Code that causes a violation:

  ```
  <apex:page controller="VFFutureMethodCtrl">
      <script src="https://something.example.com/styles.js"/>
      <script src="https://something.example.com/{!myvar}"/>
      <script src="{!jsUrl}"/>
      <script src="{!URLFOR($Resource.myresource, 'something/js/something.js')}"/>
      <script src="{!$Resource.myjs}"/>
  </apex:page>
  ```

## LoadJavaScriptIncludeScript

**Description:** Determines include script locations where JavaScript code must be loaded as static resources.

**Severity:** High (2)

**Tags:** `AppExchange`, `Security`, `Visualforce`

**Example(s):**

- \[Bad] Code that causes a violation:

  ```
  <apex:page controller="VFFutureMethodCtrl">
      <apex:includescript value="https://something.example.com/styles.js"/>
      <apex:includescript value="https://something.example.com/{!myvar}"/>
      <apex:includescript value="{!jsUrl}"/>
      <apex:includescript value="{!URLFOR($Resource.myresource, 'something/js/something.js')}"/>
      <apex:includescript value="{!$Resource.myjs}"/>
  </apex:page>
  ```

## ProtectSensitiveData

**Description:** Detects where sensitive data must be stored with Protected Custom metadata or Protected Custom settings. Protected custom settings or protected custom metadata should be used to store secrets. Refer to the "Protect Secrets Using Platform Features" Trailhead module for more guidance.

**Severity:** Moderate (3)

**Tags:** `AppExchange`, `Security`, `XML`

## UseHttpsCallbackUrlConnectedApp

**Description:** Detects instances of an OAuth callback URL that uses HTTP. Use HTTPS instead.

**Severity:** Moderate (3)

**Tags:** `AppExchange`, `Security`, `XML`

**Example(s):**

- \[Bad] Code that causes a violation:

  ```
  <?xml version="1.0" encoding="UTF-8"?>
  <ConnectedApp xmlns="http://soap.sforce.com/2006/04/metadata">
      <!-- ... -->
      <oauthConfig>
          <!-- ... -->
  	    <callbackUrl>http://example.com/redirect</callbackUrl>
      </oauthConfig>
  </ConnectedApp>
  ```

- \[Bad] Code that causes a violation:

  ```
  <?xml version="1.0" encoding="UTF-8"?>
  <ConnectedApp xmlns="http://soap.sforce.com/2006/04/metadata">
      <!-- ... -->
      <oauthConfig>
          <!-- ... -->
  	    <callbackUrl>
  	        https://test.example.com/redirect
              http://test.example.com:8080/redirect
              https://api.example.com:8080/redirect
          </callbackUrl>
      </oauthConfig>
  </ConnectedApp>
  ```

- \[Good] Code that does not cause a violation:

  ```
  <?xml version="1.0" encoding="UTF-8"?>
  <ConnectedApp xmlns="http://soap.sforce.com/2006/04/metadata">
      <!-- ... -->
      <oauthConfig>
          <!-- ... -->
          <callbackUrl>https://login.salesforce.com/services/oauth2/callback</callbackUrl>
      </oauthConfig>
  </ConnectedApp>
  ```