Affects PMD Version:
Rule: ApexCRUDViolation
Description:
With the upcoming Winter '23 (API Version 56) Salesforce is going to add more native capabilities to enforce CRUD and FLS security in SOQL queries and DML statements as described here https://developer.salesforce.com/docs/atlas.en-us.apexcode.meta/apexcode/apex_classes_enforce_usermode.htm.
Currently, the usage of such new features is ignored by PMD and marked as a CRUD Violation. Therefor the rule needs to be extended to recognize and handle them correctly.
Code Sample demonstrating the issue:
public class UserMode {
public void coverAllCasesWithTest() {
// SOQL Queries cases
Contact c;
// Should be flagged a critical issue
c = [SELECT Name FROM Contact];
// Should be ignored
c = [SELECT Name FROM Contact WITH USER_MODE];
// Should be at best a warning because it ignores CRUD but explicitly
c = [SELECT Name FROM Contact WITH SYSTEM_MODE];
// DML cases
// Should be flagged a critical issue
insert contact;
// Should be ignored
insert as user contact;
// Should be at best a warning because it ignores CRUD but explicitly
insert as system contact;
// ...and for ALL other occurrences of System.AccessLevel
}
}
This issue should cover all cases with the optional accessLevel parameter. See Dynamic SOQL.
Database.getQueryLocator methods
Search.query methods
Database DML methods (insert, update, upsert, merge, delete, undelete, and convertLead)
Includes the *Immediate and *Async methods, such as insertImmediate and deleteAsync.
This issuers should be easy to contribute as we can just look at how the related earlier enhancements were done: #2210
tprouvot, jefersonchaves, UrielATZenity and hassanalamibmx
RetroSearch is an open source project built by @garambo | Open a GitHub Issue
Search and Browse the WWW like it's 1997 | Search results from DuckDuckGo
HTML:
3.2
| Encoding:
UTF-8
| Version:
0.7.4