PMD AppExchange Rules Reference

The PMD AppExchange rules help you prepare your second-generation managed packages (managed 2GP) for security review. To select these rules, use --rule-selector AppExchange. For example, to run the AppExchange rules:

sf code-analyzer run --rule-selector AppExchange

AvoidApiSessionId

Description: Detects use of Api.Session_ID or GETSESSIONID() to retrieve a session ID.

Severity: High (2)

Tags: AppExchange, Security, XML

Example(s):

[Bad] Code that causes a violation:

<?xml version="1.0" encoding="UTF-8"?>
<CustomObject xmlns="http://soap.sforce.com/2006/04/metadata">
    <!-- ... -->
    <webLinks>
        <!-- ... -->
	    <url>{!REQUIRESCRIPT(&apos;/soap/ajax/26.0/connection.js&apos;)}
		    sforce.connection.sessionId = &apos;{!GETSESSIONID()}&apos;;
	    </url>
    </webLinks>
</CustomObject>

[Bad] Code that causes a violation:

<?xml version="1.0" encoding="UTF-8"?>
<CustomObject xmlns="http://soap.sforce.com/2006/04/metadata">
    <!-- ... -->
    <webLinks>
        <!-- ... -->
        <url>
            /apex/something?id={!something__c.Id}&amp;sessionId={!$Api.Session_ID}&amp;instance={!$Api.Partner_Server_URL_260}
        </url>
    </webLinks>
</CustomObject>

[Bad] Code that causes a violation:

<?xml version="1.0" encoding="UTF-8"?>
<CustomTab xmlns="http://soap.sforce.com/2006/04/metadata">
    <!-- ... -->
    <url>
        https://test.example.com/dummy.ph?param1={!API.Enterprise_Server_URL_540}&amp;sessionId={!API.Session_ID}&amp;param2={!Organization.Name}&amp;param3={!User.Email}
    </url>
</CustomTab>

AvoidAuraWithLockerDisabled

Description: Detects use of API versions with Lightning Locker disabled in Aura components. Use API version 40 or greater.

Severity: Critical (1)

Tags: AppExchange, Security, XML

Example(s):

[Bad] Code that causes a violation:

<?xml version="1.0" encoding="UTF-8"?>
<AuraDefinitionBundle xmlns="http://soap.sforce.com/2006/04/metadata">
    <apiVersion>39.0</apiVersion>
    <!-- ... -->
</AuraDefinitionBundle>

[Good] Code that does not cause a violation:

<?xml version="1.0" encoding="UTF-8"?>
<AuraDefinitionBundle xmlns="http://soap.sforce.com/2006/04/metadata">
    <apiVersion>53.0</apiVersion>
    <!-- ... -->
</AuraDefinitionBundle>

AvoidChangeProtectionUnprotected

Description: Detects potential misuse of FeatureManagement.changeProtection.

Severity: Critical (1)

Tags: AppExchange, Security, Apex

Example(s):

[Bad] Code that causes a violation:

public with sharing class ProtectedObjectController {
    @AuraEnabled
    public static void changeObjectToUnprotected(String objectName){
        try {
            FeatureManagement.changeProtection(objectName, 'CustomObject', 'Unprotected');
            System.FeatureManagement.changeProtection(objectName, 'CustomObject', 'Unprotected');
        } catch (Exception e) {
            throw new AuraHandledException(e.getMessage());
        }
    }
}

[Good] Code that does not cause a violation:

public with sharing class ProtectedObjectController {
    @AuraEnabled
    public static void changeObjectToUnprotected(String objectName){
        try {
            SomeOther.changeProtection(objectName, 'CustomObject', 'Unprotected');
        } catch (Exception e) {
            throw new AuraHandledException(e.getMessage());
        }
    }
}

AvoidCreateElementScriptLinkTag

Description: Detects dynamic creation of script or link tags Note: This rule identifies the <script> block where createElement is detected; but can only show the line number where the <script> tag begins and not the line number for createElement. That means if there are multiple createElement calls with script as input, you'll see multiple issues... Learn more: https://developer.salesforce.com/docs/platform/salesforce-code-analyzer/guide/rules-pmd-appexchange.html#avoidcreateelementscriptlinktag

Severity: High (2)

Tags: AppExchange, Security, Visualforce

Example(s):

[Bad] Code that causes a violation:

<apex:page controller="VFFutureMethodCtrl" >
    <script>
        var s = document.createElement("script");
        s.src="https://something.example.com/test.js";
    </script>
</apex:page>

AvoidDisableProtocolSecurityRemoteSiteSetting

Description: Detects if "Disable Protocol Security" setting is true.

Severity: Moderate (3)

Tags: AppExchange, Security, XML

Example(s):

[Bad] Code that causes a violation:

<?xml version="1.0" encoding="UTF-8"?>
<RemoteSiteSetting xmlns="http://soap.sforce.com/2006/04/metadata">
    <disableProtocolSecurity>true</disableProtocolSecurity>
    <!-- ... -->
</RemoteSiteSetting>

[Good] Code that does not cause a violation:

<?xml version="1.0" encoding="UTF-8"?>
<RemoteSiteSetting xmlns="http://soap.sforce.com/2006/04/metadata">
    <disableProtocolSecurity>false</disableProtocolSecurity>
    <!-- ... -->
</RemoteSiteSetting>

AvoidGetInstanceWithTaint

Description: Detects use of getInstance(userId)/getInstance(profileId). Hierarchy Custom Settings return the record owned by the current user when getInstance() is invoked without any parameters. But if a tainted or end-user controlled userId or profileId is passed as a parameter to getInstance() that will allow the code to access records owned by other users on... Learn more: https://developer.salesforce.com/docs/platform/salesforce-code-analyzer/guide/rules-pmd-appexchange.html#avoidgetinstancewithtaint

Severity: Moderate (3)

Tags: AppExchange, Security, Apex

Example(s):

[Bad] Code that causes a violation:

public with sharing class ProtectedCustomSettingsHierarchyCtrl {
    @AuraEnabled
    public static Protected_API_Key_Hierarchy__c getInstanceUserId(Id userId){
        return Protected_API_Key_Hierarchy__c.getInstance(userId); // NEVER return secrets back to the end user
    }
}

[Good] Code that does not cause a violation:

public with sharing class ProtectedCustomSettingsHierarchyCtrl {
    @AuraEnabled
    public static Some_Other_Class__c getInstanceUserId(Id userId){
        return SomeOtherClass.getInstance(userId);
    }
}

AvoidGlobalInstallUninstallHandlers

Description: Detects Install and Uninstall handlers declared as global. Install and Uninstall Handlers don't need to be global classes. Using global for these handlers means global methods in these classes act as controllers and can be invoked by untrusted code outside the context of post-install/uninstall scenarios. Depending on the logic in these... Learn more: https://developer.salesforce.com/docs/platform/salesforce-code-analyzer/guide/rules-pmd-appexchange.html#avoidglobalinstalluninstallhandlers

Severity: Critical (1)

Tags: AppExchange, Security, Apex

Example(s):

[Bad] Code that causes a violation:

global class PackageInstallHandler implements InstallHandler {
    global void onInstall(InstallContext context) {
        //code to run onInstall
    }
}

[Bad] Code that causes a violation:

global with sharing class PackageUninstallHandler implements UninstallHandler{
    global void onUninstall(UninstallContext context) {
        //code to run onUninstall
    }
}

[Good] Code that does not cause a violation:

public class PackageInstallHandler implements InstallHandler{
    public void onInstall(InstallContext context) {
        //code to run onInstall
    }
}

[Good] Code that does not cause a violation:

public with sharing class PackageUninstallHandler implements UninstallHandler{
    public void onUninstall(UninstallContext context) {
        //code to run onUninstall
    }
}

AvoidHardCodedCredentialsInAura

Description: Detects use of hard coded credentials in Aura components.

Severity: High (2)

Tags: AppExchange, Security, HTML

Example(s):

[Bad] Code that causes a violation:

<aura:component>
    <c:someComponent password="testpassword" apikey="123xyzabcd" authtoken="helloworld"/>
</aura:component>

[Bad] Code that causes a violation:

<aura:component>
    <aura:attribute name="password" type="string" default="123456890"/>
    <aura:attribute name="apikey" type="string" default="123456890"/>
    <aura:attribute name="authtoken" type="string" default="123456890"/>
</aura:component>

[Good] Code that does not cause a violation:

<aura:component>
    <c:someComponent color="red"/>
</aura:component>

[Good] Code that does not cause a violation:

<aura:component>
    <aura:attribute name="color" type="string" default="red"/>
    <aura:attribute name="authkey" type="string"/>
</aura:component>

AvoidHardcodedCredentialsInFieldDecls

Description: Identifies hard-coded credentials in source code that must be protected using Protected Custom metadata or Protected Custom settings. Protected custom settings or protected custom metadata should be used to store secrets. Refer to the Protect Secrets Using Platform Features Trailhead module for more guidance.

Severity: Moderate (3)

Tags: AppExchange, Security, Apex

Example(s):

[Bad] Code that causes a violation:

public with sharing class ProtectedObjectController {
    public static final String password='test11';
    public static final String apikey='something';
    public final Integer passcode=11111;
}

AvoidHardcodedCredentialsInHttpHeader

Severity: Moderate (3)

Tags: AppExchange, Security, Apex

Example(s):

[Bad] Code that causes a violation:

public with sharing class HttpEndPointCall {
    public static void makeHttpCall(String partAuth) {
        HttpRequest req = new HttpRequest();
        req.setHeader('Authorization', 'Bearer ' + partAuth + 'base64encodedhardcodedvalue');
        req.setHeader('APIKey', 'Bearer ' + partAuth);
        req.setHeader('APIPassword', 'Bearer ' + partAuth + 'base64encodedhardcodedvalue');
    }
}

AvoidHardcodedCredentialsInSetPassword

Description: Detects hard-coded credentials in the call to setPassword().

Severity: Critical (1)

Tags: AppExchange, Security, Apex

Example(s):

[Bad] Code that causes a violation:

public with sharing class HttpEndPointCall {
    public static void makeHttpCall(String userId) {
        setPassword(userId, 'hard coded password');
        System.setPassword(userId, 'hard coded password');   
    }
}

AvoidHardcodedCredentialsInVarAssign

Severity: Moderate (3)

Tags: AppExchange, Security, Apex

Example(s):

[Bad] Code that causes a violation:

public with sharing class HttpEndPointCall {
    public static void makeHttpCall(String userId) {
        String newPassword = '';
        newPassword = 'hardcoded password';
        setPassword(userId, newPassword);
        newPassword = newPassword + 'some other value';
        System.setPassword(userId, newPassword);
    }
}

AvoidHardcodedCredentialsInVarDecls

Severity: Moderate (3)

Tags: AppExchange, Security, Apex

Example(s):

[Bad] Code that causes a violation:

public with sharing class HttpEndPointCall {
    public static void makeHttpCall(String userId) {
        String apiKey = 'newapikey';
        String newPassword1 = '';
        Integer passwordIndex = 5;
    }
}

AvoidHardcodedSecretsInVFAttrs

Description: Detects hardcoded secrets in VF attributes

Severity: High (2)

Tags: AppExchange, Security, Visualforce

Example(s):

[Bad] Code that causes a violation:

<apex:page controller="VFFutureMethodCtrl" >
    <apex:attribute name="apikey" description="This is the value for the component." type="String" default="secretapikey" required="true"/>
    <apex:attribute name="passwordIndex" description="This is color for the border." type="Integer" default="2" required="true"/>
    <apex:attribute name="showpassword" description="This is color for the border." type="Boolean" default="true" required="true"/>
    <c:myComponent apikey="Hardcoded secret api key here" />
</apex:page>

AvoidInsecureHttpRemoteSiteSetting

Description: Detects instances of a Remote Site Settings that use HTTP. Use HTTPS instead.

Severity: Moderate (3)

Tags: AppExchange, Security, XML

Example(s):

[Bad] Code that causes a violation:

<?xml version="1.0" encoding="UTF-8"?>
<RemoteSiteSetting xmlns="http://soap.sforce.com/2006/04/metadata">
    <!-- ... -->
    <url>http://www.maptestsite.net/mapping1</url>
</RemoteSiteSetting>

[Good] Code that does not cause a violation:

<?xml version="1.0" encoding="UTF-8"?>
<RemoteSiteSetting xmlns="http://soap.sforce.com/2006/04/metadata">
    <!-- ... -->
    <url>https://www.maptestsite.net/mapping1</url>
</RemoteSiteSetting>

AvoidInvalidCrudContentDistribution

Description: Detects the use of Schema.DescribeSObjectResult methods to enforce CRUD check on ContentDistribution. Developers should use USER MODE operations or use the custom below to enforce CRUD check against the ContentDistribution object.

Severity: Moderate (3)

Tags: AppExchange, Security, Apex

Example(s):

[Bad] Code that causes a violation:

public with sharing class ContentDistributionCheck {
    public void hasAccess(){
        if(Schema.SObjectType.ContentDistribution.isCreateable()){
            System.debug('User has INSERT access on ContentDistribution Object');
        }
        if(Schema.SObjectType.ContentDistribution.isAccessible()){
            System.debug('User has READ access on ContentDistribution Object');
        }
        if(Schema.SObjectType.ContentDistribution.isUpdateable()){
            System.debug('User has UPDATE access on ContentDistribution Object');
        }
        if(Schema.SObjectType.ContentDistribution.isDeletable()){
            System.debug('User has DELETE access on ContentDistribution Object');
        }
    }
}

AvoidJavaScriptCustomObject

Description: Detects use of custom JavaScript actions in custom rules.

Severity: High (2)

Tags: AppExchange, Security, XML

Example(s):

[Bad] Code that causes a violation:

<?xml version="1.0" encoding="UTF-8"?>
<WebLink xmlns="http://soap.sforce.com/2006/04/metadata">
    <!-- ... -->
    <openType>onClickJavaScript</openType>
    <url>alert(&quot;Show this alert!&quot;);</url>
</WebLink>

[Good] Code that does not cause a violation:

<?xml version="1.0" encoding="UTF-8"?>
<WebLink xmlns="http://soap.sforce.com/2006/04/metadata">
    <!-- ... -->
    <openType>newWindow</openType>
    <url>https://example.com</url>
</WebLink>

AvoidJavaScriptHomePageComponent

Description: Detects use of custom JavaScript actions in home page components.

Severity: High (2)

Tags: AppExchange, Security, XML

Example(s):

[Bad] Code that causes a violation:

<?xml version="1.0" encoding="UTF-8"?>
<HomePageComponent xmlns="http://soap.sforce.com/2006/04/metadata">
	<body>&lt;a href=javascript:alert(11)&gt;Hello World &lt;/a&gt;</body>
    <pageComponentType>htmlArea</pageComponentType>
</HomePageComponent>

[Bad] Code that causes a violation:

<?xml version="1.0" encoding="UTF-8"?>
<HomePageComponent xmlns="http://soap.sforce.com/2006/04/metadata">
	<body>&lt;b&gt;Hello World &lt;/b&gt;
		&lt;script&gt;
		alert(99);
		&lt;/script&gt;
	</body>
    <pageComponentType>htmlArea</pageComponentType>
</HomePageComponent>

[Good] Code that does not cause a violation:

<?xml version="1.0" encoding="UTF-8"?>
<HomePageComponent xmlns="http://soap.sforce.com/2006/04/metadata">
	<body>&lt;b&gt;Hello World &lt;/b&gt;</body>
    <pageComponentType>htmlArea</pageComponentType>
</HomePageComponent>

AvoidJavaScriptInUrls

Description: Detects use of JavaScript-style URLs (javascript:) in components, such as web links and buttons. Avoid JavaScript-style URLs in managed packages.

Severity: Critical (1)

Tags: AppExchange, Security, XML

Example(s):

[Bad] Code that causes a violation:

<CustomPageWebLink xmlns="http://soap.sforce.com/2006/04/metadata">
    <!-- ... -->
    <url>javascript:doSomething();</url>
</CustomPageWebLink>

[Bad] Code that causes a violation:

<WebLink xmlns="http://soap.sforce.com/2006/04/metadata">
    <!-- ... -->
    <url>javascript:helloWorld();</url>
</WebLink>

[Good] Code that does not cause a violation:

<CustomPageWebLink xmlns="http://soap.sforce.com/2006/04/metadata">
    <!-- ... -->
    <url>/apex/test</url>
</CustomPageWebLink>

AvoidJavaScriptWebLink

Description: Detects use of custom JavaScript actions in web links.

Severity: High (2)

Tags: AppExchange, Security, XML

Example(s):

[Bad] Code that causes a violation:

<CustomPageWebLink xmlns="http://soap.sforce.com/2006/04/metadata">
    <!-- ... -->
    <openType>onClickJavaScript</openType>
</CustomPageWebLink>

[Good] Code that does not cause a violation:

<CustomPageWebLink xmlns="http://soap.sforce.com/2006/04/metadata">
    <!-- ... -->
    <openType>sidebar</openType>
</CustomPageWebLink>

AvoidLmcIsExposedTrue

Description: Detects a Lightning Message Channel with isExposed=true, which isn’t allowed in managed packages.

Severity: High (2)

Tags: AppExchange, Security, XML

Example(s):

[Bad] Code that causes a violation:

<?xml version="1.0" encoding="UTF-8"?>
<LightningMessageChannel xmlns="http://soap.sforce.com/2006/04/metadata">
    <!-- ... -->
    <isExposed>true</isExposed>
</LightningMessageChannel>

[Good] Code that does not cause a violation:

<?xml version="1.0" encoding="UTF-8"?>
<LightningMessageChannel xmlns="http://soap.sforce.com/2006/04/metadata">
    <!-- ... -->
    <isExposed>false</isExposed>
</LightningMessageChannel>

AvoidLwcBubblesComposedTrue

Description: Detects Lightning Web Component event configurations where bubbles and composed are both set to true. To avoid sharing sensitive information unintentionally, use this configuration with caution.

Severity: Moderate (3)

Tags: AppExchange, Security, JavaScript

Example(s):

[Bad] Code that causes a violation:

import { LightningElement } from 'lwc';
export default class LwcNoteCreateModal extends LightningElement {
    handleSelected (event) {
        const selected = new CustomEvent('selected', {
            bubbles: true,
            composed: true,
            detail: event.detail
        });
        this.dispatchEvent(selected);
    }
}

[Good] Code that does not cause a violation:

import { LightningElement } from 'lwc';
export default class LwcNoteCreateModal extends LightningElement {
    handleSelected (event) {
        const selected = new CustomEvent('selected', {
            bubbles: true,
            detail: event.detail
        });
        this.dispatchEvent(selected);
    }
}

AvoidSControls

Description: Detects if S-Controls are used since they should not be used in managed packages.

Severity: Critical (1)

Tags: AppExchange, Security, XML

Example(s):

[Bad] Code that causes a violation:

<?xml version="1.0" encoding="UTF-8"?>
<Scontrol xmlns="http://soap.sforce.com/2006/04/metadata">
    <!-- ... -->
</Scontrol>

AvoidSecurityEnforcedOldApiVersion

Description: Detects use of WITH SECURITY_ENFORCED in API version less than 48.0

Severity: Moderate (3)

Tags: AppExchange, Security, Apex

AvoidUnauthorizedApiSessionIdInApex

Description: Detects use of ${API.Session_Id} to retrieve a session ID. For more guidance on approved use cases, read the Session Id Guidance document.

Severity: Moderate (3)

Tags: AppExchange, Security, Apex

Example(s):

[Bad] Code that causes a violation:

public with sharing class SessionIdController {
    public SessionIdController() {
        String userInfoSessionId1 = '{!API.Session_ID}';
        userInfoSessionId1 = '{!api.session_id}';
    }
}

[Good] Code that does not cause a violation:

public with sharing class SessionIdController {
    public SessionIdController() {
        String userInfoSessionId1 = 'API.Session_ID';
        userInfoSessionId1 = 'api.session_id';
    }
}

AvoidUnauthorizedApiSessionIdInVisualforce

Description: Detects use of Api.Session_ID to retrieve a session ID in Visualforce code. For more guidance on approved use cases, read the Session Id Guidance document.

Severity: Moderate (3)

Tags: AppExchange, Security, Visualforce

Example(s):

[Bad] Code that causes a violation:

<apex:page controller="SessionIdController">
    <script>
        var vfApiSessionId = '{!$Api.Session_ID}';
    </script>
</apex:page>

AvoidUnauthorizedGetSessionIdInApex

Description: Detects use of UserInfo.getSessionId() to retrieve a session ID. For more guidance on approved use cases, read the Session Id Guidance document.

Severity: Moderate (3)

Tags: AppExchange, Security, Apex

Example(s):

[Bad] Code that causes a violation:

public with sharing class SessionIdController {
    public SessionIdController() {
        String userInfoSessionId1 = UserInfo.getSessionId();
        userInfoSessionId1 = System.UserInfo.getSessionId();
    }
}

[Good] Code that does not cause a violation:

public with sharing class SessionIdController {
    public SessionIdController() {
        String userInfoSessionId1 = getSessionId();
    }
}

AvoidUnauthorizedGetSessionIdInVisualforce

Description: Detects use of GETSESSIONID() to retrieve a session ID in Visualforce code. For more guidance on approved use cases, read the Session Id Guidance document.

Severity: High (2)

Tags: AppExchange, Security, Visualforce

Example(s):

[Bad] Code that causes a violation:

<apex:page controller="SessionIdController">
    <script>
        var vfGetSessionId = '{!GETSESSIONID()}';
    </script>
</apex:page>

AvoidUnescapedHtmlInAura

Description: Detects use of aura:unescapedHtml,which should be used cautiously. Developers should ensure that the unescapedHtml should not use tainted input to protect against XSS.

Severity: High (2)

Tags: AppExchange, Security, HTML

Example(s):

[Bad] Code that causes a violation:

<aura:component>
    <aura:attribute name="searchResult" type="List" access="private"/>
    <aura:attribute name="someString" type="List" access="private" default="abcd"/>
    <aura:iteration items="{!v.searchResult}" var="record">
        <aura:unescapedHtml value="{!record.Field0}"/>
        <aura:unescapedHtml value="{!someString}"/>
    </aura:iteration>
</aura:component>

AvoidUnsafePasswordManagementUse

Description: Detects where System.setPassword() exists in Apex code. Use this method with caution.

Severity: Critical (1)

Tags: AppExchange, Security, Apex

Example(s):

[Bad] Code that causes a violation:

public with sharing class UserMgmt {
    @AuraEnabled
    public static void setPass(Id userId, String password) {
        System.setPassword(userId, password);
        setPassword(userId, password);
    }
    @AuraEnabled
    public static void resetPassword(Id userId, Boolean sendUserEmail) {
        System.resetPassword(userId, sendUserEmail); 
        resetPassword(userId, sendUserEmail); 
    }
    @AuraEnabled
    public static void movePassword(ID targetUserId, ID sourceUserId) {
        System.movePassword(targetUserId, sourceUserId);
        movePassword(targetUserId, sourceUserId);
    }
    @AuraEnabled
    public static void resetPasswordWithEmailTemplate(Id userId, Boolean sendUserEmail, String emailTemplateName) {
        System.resetPasswordWithEmailTemplate(userId, sendUserEmail, emailTemplateName);
        resetPasswordWithEmailTemplate(userId, sendUserEmail, emailTemplateName);
    }
}

[Good] Code that does not cause a violation:

public with sharing class UserMgmt {
    @AuraEnabled
    public static void setPass(Id userId, String password) {
        Something.setPassword(userId, password); //NEVER return secrets back to the end user
    }
    @AuraEnabled
    public static void resetPassword(Id userId, Boolean sendUserEmail) {
        Something.resetPassword(userId, sendUserEmail); //NEVER return secrets back to the end user
    }
    @AuraEnabled
    public static void movePassword(ID targetUserId, ID sourceUserId) {
        Something.movePassword(targetUserId, sourceUserId);
    }
    @AuraEnabled
    public static void resetPasswordWithEmailTemplate(Id userId, Boolean sendUserEmail, String emailTemplateName) {
        Something.resetPasswordWithEmailTemplate(userId, sendUserEmail, emailTemplateName);
    }
}

LimitConnectedAppScope

Description: Detects if a connected app uses full scope instead of limited scope. Explain this use case in your AppExchange security review submission.

Severity: Moderate (3)

Tags: AppExchange, Security, XML

Example(s):

[Bad] Code that causes a violation:

<?xml version="1.0" encoding="UTF-8"?>
<ConnectedApp xmlns="http://soap.sforce.com/2006/04/metadata">
    <!-- ... -->
    <oauthConfig>
        <!-- ... -->
        <scopes>Basic</scopes>
        <scopes>Api</scopes>
        <scopes>RefreshToken</scopes>
        <scopes>Full</scopes>
    </oauthConfig>
</ConnectedApp>

[Good] Code that does not cause a violation:

<?xml version="1.0" encoding="UTF-8"?>
<ConnectedApp xmlns="http://soap.sforce.com/2006/04/metadata">
    <!-- ... -->
    <oauthConfig>
        <!-- ... -->
        <scopes>Basic</scopes>
        <scopes>Api</scopes>
        <scopes>RefreshToken</scopes>
    </oauthConfig>
</ConnectedApp>

LoadCSSApexStylesheet

Description: Determines where CSS must be loaded as a static resource

Severity: High (2)

Tags: AppExchange, Security, Visualforce

Example(s):

[Bad] Code that causes a violation:

<apex:page controller="VFFutureMethodCtrl" >
    <apex:stylesheet value="https://something.example.com/styles.css"/>
    <apex:stylesheet value="https://something.example.com/{!myvar}.css"/>
    <apex:stylesheet value="{!cssUrl}"/>
    <apex:stylesheet value="{!URLFOR($Resource.myresource, 'something/css/something.css')}"/>
    <apex:stylesheet value="{!$Resource.mycss}"/>
</apex:page>

LoadCSSLinkHref

Description: Determines where CSS must be loaded as a static resource

Severity: High (2)

Tags: AppExchange, Security, Visualforce

Example(s):

[Bad] Code that causes a violation:

<apex:page controller="VFFutureMethodCtrl" >
    <link rel="stylesheet" href="https://something.example.com/styles.css"/>
    <link rel="stylesheet" href="https://something.example.com/{!myvar}.css"/>
    <link rel="stylesheet" href="{!cssUrl}"/>
    <link rel="stylesheet" href="{!URLFOR($Resource.myresource, 'something/css/something.css')}"/>
    <link rel="stylesheet" href="{!$Resource.mycss}"/>
</apex:page>

LoadJavaScriptHtmlScript

Description: Determines HTML script locations where JavaScript code must be loaded as static resources.

Severity: High (2)

Tags: AppExchange, Security, Visualforce

Example(s):

[Bad] Code that causes a violation:

<apex:page controller="VFFutureMethodCtrl">
    <script src="https://something.example.com/styles.js"/>
    <script src="https://something.example.com/{!myvar}"/>
    <script src="{!jsUrl}"/>
    <script src="{!URLFOR($Resource.myresource, 'something/js/something.js')}"/>
    <script src="{!$Resource.myjs}"/>
</apex:page>

LoadJavaScriptIncludeScript

Description: Determines include script locations where JavaScript code must be loaded as static resources.

Severity: High (2)

Tags: AppExchange, Security, Visualforce

Example(s):

[Bad] Code that causes a violation:

<apex:page controller="VFFutureMethodCtrl">
    <apex:includescript value="https://something.example.com/styles.js"/>
    <apex:includescript value="https://something.example.com/{!myvar}"/>
    <apex:includescript value="{!jsUrl}"/>
    <apex:includescript value="{!URLFOR($Resource.myresource, 'something/js/something.js')}"/>
    <apex:includescript value="{!$Resource.myjs}"/>
</apex:page>

ProtectSensitiveData

Description: Detects where sensitive data must be stored with Protected Custom metadata or Protected Custom settings. Protected custom settings or protected custom metadata should be used to store secrets. Refer to the "Protect Secrets Using Platform Features" Trailhead module for more guidance.

Severity: Moderate (3)

Tags: AppExchange, Security, XML

UseHttpsCallbackUrlConnectedApp

Description: Detects instances of an OAuth callback URL that uses HTTP. Use HTTPS instead.

Severity: Moderate (3)

Tags: AppExchange, Security, XML

Example(s):

[Bad] Code that causes a violation:

<?xml version="1.0" encoding="UTF-8"?>
<ConnectedApp xmlns="http://soap.sforce.com/2006/04/metadata">
    <!-- ... -->
    <oauthConfig>
        <!-- ... -->
	    <callbackUrl>http://example.com/redirect</callbackUrl>
    </oauthConfig>
</ConnectedApp>

[Bad] Code that causes a violation:

<?xml version="1.0" encoding="UTF-8"?>
<ConnectedApp xmlns="http://soap.sforce.com/2006/04/metadata">
    <!-- ... -->
    <oauthConfig>
        <!-- ... -->
	    <callbackUrl>
	        https://test.example.com/redirect
            http://test.example.com:8080/redirect
            https://api.example.com:8080/redirect
        </callbackUrl>
    </oauthConfig>
</ConnectedApp>

[Good] Code that does not cause a violation:

<?xml version="1.0" encoding="UTF-8"?>
<ConnectedApp xmlns="http://soap.sforce.com/2006/04/metadata">
    <!-- ... -->
    <oauthConfig>
        <!-- ... -->
        <callbackUrl>https://login.salesforce.com/services/oauth2/callback</callbackUrl>
    </oauthConfig>
</ConnectedApp>