pmd / pmd/pmd

[apex] ApexCRUDViolation incorrectly cleared when SOQL directly populates a Map

Open
#4,898 0 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

a:false-negative
Dominant language
Java
Stars
5.5k
Forks
1.6k
Avg merge
1d 19h
Merged PRs (30d)
54

Description

Affects PMD Version:
7.0.0-rc3

Rule:
ApexCRUDViolation - https://pmd.github.io/pmd/pmd_rules_apex_security.html#apexcrudviolation

Description:
PMD incorrectly does not report the need for validation of CRUD permissions before SOQL SELECT statements that directly populate Map objects.

Code Sample demonstrating the issue:

This method queries data and directly populates a Map object and no CRUD validation error is shown (incorrect):

public Map<Id, Account> myMethod()
{
    Map<Id, Account> accountMap = new Map<Id, Account>([SELECT Id, Name FROM Account]);
    return accountMap;
}

incorrect


This method also queries data but doesn't populate a Map - PMD does report a CRUD validation error (correct):

public List<Account> myMethod2()
{
    List<Account> accounts = [SELECT Id, Name FROM Account];
    return accounts;
}

correct

Expected outcome:

PMD should report a violation when doing a SOQL SELECT statement directly into a Map object.

Running PMD through: VSCode using https://marketplace.visualstudio.com/items?itemName=chuckjonas.apex-pmd (v0.6.2)

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start with the ApexCRUDViolation rule and reproduce the two SOQL examples from the issue, comparing the Map assignment with the List assignment. Done means the rule reports a CRUD validation violation for a SOQL SELECT that directly populates a Map, while preserving the existing behavior for the List case.

Written by the indexing model from the issue text.

Assessment

Domain
devtools, security
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Stale
Clarity
Clearly specified
Newbie friendliness
55/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.