Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[apex] ApexCRUDViolation incorrectly cleared when SOQL directly populates a Map #4898

Open
yarhamjohn opened this issue Mar 27, 2024 · 0 comments
Labels
a:false-negative PMD doesn't flag a problematic piece of code

Comments

@yarhamjohn
Copy link

Affects PMD Version:
7.0.0-rc3

Rule:
ApexCRUDViolation - https://pmd.github.io/pmd/pmd_rules_apex_security.html#apexcrudviolation

Description:
PMD incorrectly does not report the need for validation of CRUD permissions before SOQL SELECT statements that directly populate Map objects.

Code Sample demonstrating the issue:

This method queries data and directly populates a Map object and no CRUD validation error is shown (incorrect):

public Map<Id, Account> myMethod()
{
    Map<Id, Account> accountMap = new Map<Id, Account>([SELECT Id, Name FROM Account]);
    return accountMap;
}

incorrect


This method also queries data but doesn't populate a Map - PMD does report a CRUD validation error (correct):

public List<Account> myMethod2()
{
    List<Account> accounts = [SELECT Id, Name FROM Account];
    return accounts;
}

correct

Expected outcome:

PMD should report a violation when doing a SOQL SELECT statement directly into a Map object.

Running PMD through: VSCode using https://marketplace.visualstudio.com/items?itemName=chuckjonas.apex-pmd (v0.6.2)

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
a:false-negative PMD doesn't flag a problematic piece of code
Projects
None yet
Development

No branches or pull requests

1 participant