Salesforce Docs Portal

XML Run Output Schema Reference

This example shows how to create a XML-formatted output file when using the --output-file flag of the code-analyzer run command.

sf code-analyzer run --output-file results.xml

Sample XML Run Output

This sample output shows 3 violations with different severities from different engines.

<?xml version="1.0" encoding="UTF-8"?>
<results>
  <runDir>/Users/lisa.simpson/sfdx/coral-cloud-afdx/</runDir>
  <violationCounts>
    <total>3</total>
    <sev1>0</sev1>
    <sev2>1</sev2>
    <sev3>1</sev3>
    <sev4>1</sev4>
    <sev5>0</sev5>
  </violationCounts>
  <versions>
    <code-analyzer>0.25.1</code-analyzer>
    <eslint>0.20.1</eslint>
    <retire-js>0.18.1</retire-js>
    <regex>0.18.1</regex>
    <flow>0.18.1</flow>
    <pmd>0.21.0</pmd>
  </versions>
  <violations>
    <violation>
      <rule>@lwc/lwc/no-inner-html</rule>
      <engine>eslint</engine>
      <severity>2</severity>
      <tags>
        <tag>Recommended</tag>
        <tag>LWC</tag>
        <tag>Security</tag>
        <tag>Javascript</tag>
      </tags>
      <primaryLocationIndex>0</primaryLocationIndex>
      <locations>
        <location>
          <file>force-app/main/default/staticresources/highlight/highlight/prism.js</file>
          <startLine>571</startLine>
          <startColumn>17</startColumn>
          <endLine>571</endLine>
          <endColumn>26</endColumn>
        </location>
      </locations>
      <message>Using 'innerHTML/outputHTML/insertAdjacentHTML' is not allowed</message>
      <resources>
        <resource>https://github.com/salesforce/eslint-plugin-lwc/blob/v2.1.0/docs/rules/no-inner-html.md</resource>
      </resources>
    </violation>
    <violation>
      <rule>PreventPassingUserDataIntoElementWithSharing</rule>
      <engine>flow</engine>
      <severity>4</severity>
      <tags>
        <tag>Recommended</tag>
        <tag>Security</tag>
        <tag>Xml</tag>
      </tags>
      <primaryLocationIndex>1</primaryLocationIndex>
      <locations>
        <location>
          <file>force-app/main/default/flows/Get_Customer_Details.flow-meta.xml</file>
          <startLine>90</startLine>
          <startColumn>1</startColumn>
          <comment>email.email: Initialization</comment>
        </location>
        <location>
          <file>force-app/main/default/flows/Get_Customer_Details.flow-meta.xml</file>
          <startLine>41</startLine>
          <startColumn>1</startColumn>
          <comment>email.email influences Get_Contact_by_Email_and_Member_Number.Email: flow into recordLookups via influence over Email in run mode SystemModeWithSharing</comment>
        </location>
      </locations>
      <message>User controlled data flows into recordLookups element selector in run mode: SystemModeWithSharing</message>
      <resources></resources>
    </violation>
    <violation>
      <rule>ApexSharingViolations</rule>
      <engine>pmd</engine>
      <severity>3</severity>
      <tags>
        <tag>Recommended</tag>
        <tag>Security</tag>
        <tag>Apex</tag>
      </tags>
      <primaryLocationIndex>0</primaryLocationIndex>
      <locations>
        <location>
          <file>force-app/main/default/classes/ExperienceBookingHelper.cls</file>
          <startLine>1</startLine>
          <startColumn>1</startColumn>
          <endLine>1</endLine>
          <endColumn>7</endColumn>
        </location>
      </locations>
      <message>Apex classes should declare a sharing model if DML or SOQL/SOSL is used</message>
      <resources>
        <resource>https://docs.pmd-code.org/pmd-doc-7.11.0/pmd_rules_apex_security.html#apexsharingviolations</resource>
      </resources>
    </violation>
  </violations>
</results>

Elements in the Top-Level <results> Element

Element Data Type Description
<runDir> string The directory from which the Code Analyzer analysis ran.
<violationCounts> complexType Contains elements that show the total number of violations and the aggregate counts for each severity level. See <violationCounts> Element for details.
<versions> complexType Contains elements that show the versions of the core Code Analyzer module and each engine module that ran in the analysis. See <versions> Element for details.
<violations> complexType[] An array of <violation> elements, where each element corresponds to a violation that was detected in the analysis. See <violation> Element for details.

<violationCounts> Element

Element Data Type Description
<total> number Total number of violations found in the analysis.
<sev1> number Number of severity 1 (Critical) violations found.
<sev2> number Number of severity 2 (High) violations found.
<sev3> number Number of severity 3 (Moderate) violations found.
<sev4> number Number of severity 4 (Low) violations found.
<sev5> number Number of severity 5 (Info) violations found.

<versions> Element

Element Data Type Description
<code-analyzer> string Version of the core Code Analyzer module.
<cpd> string Version of the CPD module.
<eslint> string Version of the ESLint module.
<flow> string Version of the Flow Scanner module.
<pmd> string Version of the PMD module.
<retire-js> string Version of the RetireJS module.
<regex> string Version of the Regex module.
<sfge> string Version of the Salesforce Graph module.

<violation> Element

Element Data Type Description
<rule> string The name of the rule that's associated with the violation.
<engine> string The engine that's associated with the violation.
<severity> number The severity level of the violation: 1 (Critical), 2 (High), 3 (Moderate), 4 (Low), 5 (Info)
<tags> string[] An array of <tag> elements that contain the tags that are associated with the rule that's associated with the violation.
<primaryLocationIndex> number The index of the primary code location within the code locations array.
<locations> complexType[] An array of <location> elements, where each element corresponds to a location in your code that's associated with the violation. See location Object Properties for details.
<message> string The violation message.
<resources> string[] An array of <resource> elements that contain URLs for additional resources and information about the violation.

<location> Element

Some rules, such as those that have a PathBased tag, can produce multiple code locations. These code locations make up the code path associated with the violation.

Property Name Data Type Description
<file> string The pathname of the file in which the violation occurred, relative to the runDir directory.
<startLine> number The line where the violating code starts.
<startColumn> number The column in the startLine where the violating code starts.
<endLine> number The line where the violating code ends.
<endColumn> number The column in the endLine where the violating code ends.
<comment> string Comment that provides additional context associated with this line or block of code.