91

What static code analysis tools are there for apex? The only one I seem to be able to find is the Force.com Security Source Code Scanner but that has the draw back of placing your request into a queue and running it when it can. I would like something I can run locally so I can make refactoring into a number of very short cycles.

Improve this question
1
  • 3
    Bob Roberts: You might be interested so see that there now are also (free open source) alternatives. Check the second answer to learn about the PMD Apex module and the Code Climate engine.
    – Robert Sösemann
    Commented May 31, 2016 at 18:16

8 Answers 8

Reset to default
59

UPDATE: On Pluralsight Robert from PMD and Lorenzo from Clayton.io just released a FREE (no-signup) in-depth course on Automated Code Analysis in Salesforce.

I recently ported the famous Java Static code analyzer PMD to Apex. We also ported many of the original Java rules and created a few Apex specific to showcase how to write language-specific rules (e.g. AvoidSoqlInLoops, AvoidLogicInTriggers,...).

Other than CodeScan, our effort is open source and was merged back into the original PMD repository on Github (https://github.com/pmd/pmd). Every Salesforce developer or expert out there can fork the repo and create new and better rules and integrations.

As the Apex language module is now part of the regular PMD distribution all PMD-based tools also speak Apex now, e.g. the Eclipse / Force.com IDE.

enter image description here

We have also built an open-source engine for CodeClimate so you cannot only analyze files on your local machine but also have code checked into your Github repos verified.

enter image description here

Just recently another Github-integrated services called Codacy.com added full support for PMD and Apex.

enter image description here

Improve this answer
1
  • 2
    I have decided to change this to the accepted answer because it is closer to what I was looking for. Having just the simple and flexible PMD tool is perfect. CodeClimate is just icing on the cake.
    – Bob Roberts
    Commented Jul 13, 2016 at 12:49
34

Apologies for plugging myself, but I've been working on a static analysis tool. You can find some information and try out a single page at http://codescan.villagechief.com/.

The enterprise version is based on Sonar, so it's got graphs and timelines, code reviews functionality, and much more.

There are over 100 static analysis checks including many very specific to Apex; code complexity metrics, etc. You can also build your own rules using XPath, or use it for continuous integration by having it run your Apex class tests and recording the results.

On http://codescan.villagechief.com/ you can also try out the analysis by uploading a single file. It doesn't have all the functionality as the enterprise version though, and quite a few metrics and analysis points are not enabled.

There is an eclipse version of this as well which displays the static analysis results as you work in Eclipse (analysis is done locally, so you can fix it as you work).

Let me know if you want some more information or a demo.

Improve this answer
1
  • I am impressed. The report looks good.
    – Bob Roberts
    Commented Sep 28, 2012 at 2:58
19

For those of you that hate eclipse, I've written an open source vscode extension called Apex PMD. It uses the same rules as code climate by default but allows you to configure your own ruleset.

CodeScan, CodeClimate, Clayton.io, etc are awesome because they show you have your code is improving/degrading between commits/pr's.

Having Static Anylsis in your IDE will help ensure you are following best practices in realtime.

Improve this answer
5
  • Sounds like you duplicated Robert's work! There is already an Eclipse plugin, but it's great to see people thinking about this issue.
    – Adrian Larson ♦
    Commented Nov 11, 2016 at 21:19
  • 5
    @AdrianLarson like i said, this is for those of us who hate to use eclipse (mavenmaters)! vs-code is so easy to extend I was able to write the whole thing end to end in about 3 hours. Big ups to robert for getting apex into pmd!
    – NSjonas
    Commented Nov 11, 2016 at 21:27
  • Ah, I read it as "for those of us who have to use eclipse". That's awesome! How would you implement it for MavensMate?
    – Adrian Larson ♦
    Commented Nov 11, 2016 at 21:31
  • @AdrianLarson Mavensmate has it's own vscode plugin now. You don't have to use mavensmate to run this, but it pairs nicely.
    – NSjonas
    Commented Nov 11, 2016 at 21:44
  • Hi @NSjonas - I have installed PMD and defined the user settings but i'm returning an error in the Apex PMD debug when I do Apex Static Analysis: Show Debug: ' Could not find or load main class net.sourceforge.pmd.PMD'. Do you have any idea what the issue could be? Thanks
    – Andy Hitchings
    Commented May 10, 2018 at 11:21
18

You can get a local version of the Checkmarx source code scanner to run in Eclipse as a plugin. I think you get 90 days for free.

See Apex security scanner - Eclipse Plug-in.

The report is the same as the one you get from the Force.com Security Source Code Scanner, just integrated into the IDE. So you can go straight to the applicable lines in the source code.

While this solution is more local than the version you run from the website, it still relies on sending the code off to Checkmarx for remote analysis.

Improve this answer
10

very old question, but it's worth pointing out a new addition in the static code analysis space, Clayton.io

I am the person who created it. Clayton uses static code analysis techniques to do automatic code reviews. It's hosted on Heroku, meaning that assuming you use a Git repository on the cloud (Github, Bitbucket) you don't need to install anything anywhere.

Improve this answer
2
  • Interesting but your pricing model is not compatible with consulting agencies (where we might have 100's of repos).
    – NSjonas
    Commented Oct 11, 2016 at 23:13
  • 1
    @NSjonas we will be launching a new pricing model soon to make Clayton pricing work well for consultancies . We are be moving away from the charge per repo model. Don't think this is the right forum but get in touch with me personally if you want more details! Thanks
    – Lorenzo Frattini
    Commented Oct 12, 2016 at 11:22
1

I won't take away from the far more feature-full, already accepted answer, but I did write some code and a blog post about static code analysis of apex. Just to toss my own home-made hat in the ring.

Improve this answer
0

Salesforce Code Analyzer is a good tool to consider nowadays.

It’s developed and updated regularly by Salesforce, used by their team during Security Reviews, supports on-command run in the CLI, includes PMD and other engines.

Improve this answer
3
  • Be worth explaining why this is preferred over PMD
    – cropredy
    Commented Apr 3 at 18:43
  • @cropredy I didn’t mean it’s preferred over something, everyone decides for themselves depending on the request. Apologies if I expressed myself badly. What I meant is: Salesforce Code Analyzer is a one to consider today. It’s developed and updated regularly by Salesforce, used by their team during Security Reviews, includes PMD and other engines, supports on-command run in the CLI(what the author asked for).
    – Duck The Developer
    Commented Apr 4 at 11:49
  • 1
    Duck -- please use edit and amend your answer to include your comment (which is excellent)-- this will make things look more like the rest of the answers on StackExchange.
    – cropredy
    Commented Apr 4 at 17:08
-1

I believe Appirio debuted Cloud Metrics at DF12. Not sure if it is available publicly just yet

Improve this answer
1
  • 3
    I checked the Appirio page and this doesn't seem to be a tool but more a service. I guess Appirio consultants will check you code manually and look if there is room for (paid) improvement ;)
    – Robert Sösemann
    Commented Apr 23, 2013 at 19:29

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .