73

What static code analysis tools are there for apex? The only one I seem to be able to find is the Force.com Security Source Code Scanner but that has the draw back of placing your request into a queue and running it when it can. I would like something I can run locally so I can make refactoring into a number of very short cycles.

  • 3
    Bob Roberts: You might be interested so see that there now are also (free open source) alternatives. Check the second answer to learn about the PMD Apex module and the Code Climate engine. – Robert Sösemann May 31 '16 at 18:16
42

UPDATE: On Pluralsight Robert from PMD and Lorenzo from Clayton.io just released an in-depth course on Automated Code Analysis in Salesforce.

I recently ported the famous Java Static code analyzer PMD to Apex. We also ported many of the original Java rules and created a few Apex specific to showcase how to write language-specific rules (e.g. AvoidSoqlInLoops, AvoidLogicInTriggers,...).

Other than CodeScan, our effort is open source and was merged back into the original PMD repository on Github (https://github.com/pmd/pmd). Every Salesforce developer or expert out there can fork the repo and create new and better rules and integrations.

As the Apex language module is now part of the regular PMD distribution all PMD-based tools also speak Apex now, e.g. the Eclipse / Force.com IDE.

enter image description here

We have also built an open-source engine for CodeClimate so you cannot only analyze files on your local machine but also have code checked into your Github repos verified.

enter image description here

Just recently another Github-integrated services called Codacy.com added full support for PMD and Apex.

enter image description here

  • 2
    I have decided to change this to the accepted answer because it is closer to what I was looking for. Having just the simple and flexible PMD tool is perfect. CodeClimate is just icing on the cake. – Bob Roberts Jul 13 '16 at 12:49
33

Apologies for plugging myself, but I've been working on a static analysis tool. You can find some information and try out a single page at http://codescan.villagechief.com/.

The enterprise version is based on Sonar, so it's got graphs and timelines, code reviews functionality, and much more.

There are over 100 static analysis checks including many very specific to Apex; code complexity metrics, etc. You can also build your own rules using XPath, or use it for continuous integration by having it run your Apex class tests and recording the results.

On http://codescan.villagechief.com/ you can also try out the analysis by uploading a single file. It doesn't have all the functionality as the enterprise version though, and quite a few metrics and analysis points are not enabled.

There is an eclipse version of this as well which displays the static analysis results as you work in Eclipse (analysis is done locally, so you can fix it as you work).

Let me know if you want some more information or a demo.

  • I am impressed. The report looks good. – Bob Roberts Sep 28 '12 at 2:58
17

You can get a local version of the Checkmarx source code scanner to run in Eclipse as a plugin. I think you get 90 days for free.

See Apex security scanner - Eclipse Plug-in.

The report is the same as the one you get from the Force.com Security Source Code Scanner, just integrated into the IDE. So you can go straight to the applicable lines in the source code.

While this solution is more local than the version you run from the website, it still relies on sending the code off to Checkmarx for remote analysis.

11

For those of you that hate eclipse, I've written an open source vscode extension called Apex PMD. It uses the same rules as code climate by default but allows you to configure your own ruleset.

CodeScan, CodeClimate, Clayton.io, etc are awesome because they show you have your code is improving/degrading between commits/pr's.

Having Static Anylsis in your IDE will help ensure you are following best practices in realtime.

  • Sounds like you duplicated Robert's work! There is already an Eclipse plugin, but it's great to see people thinking about this issue. – Adrian Larson Nov 11 '16 at 21:19
  • 3
    @AdrianLarson like i said, this is for those of us who hate to use eclipse (mavenmaters)! vs-code is so easy to extend I was able to write the whole thing end to end in about 3 hours. Big ups to robert for getting apex into pmd! – NSjonas Nov 11 '16 at 21:27
  • Ah, I read it as "for those of us who have to use eclipse". That's awesome! How would you implement it for MavensMate? – Adrian Larson Nov 11 '16 at 21:31
  • @AdrianLarson Mavensmate has it's own vscode plugin now. You don't have to use mavensmate to run this, but it pairs nicely. – NSjonas Nov 11 '16 at 21:44
  • Hi @NSjonas - I have installed PMD and defined the user settings but i'm returning an error in the Apex PMD debug when I do Apex Static Analysis: Show Debug: ' Could not find or load main class net.sourceforge.pmd.PMD'. Do you have any idea what the issue could be? Thanks – Andy Hitchings May 10 '18 at 11:21
8

very old question, but it's worth pointing out a new addition in the static code analysis space, Clayton.io

I am the person who created it. Clayton uses static code analysis techniques to do automatic code reviews. It's hosted on Heroku, meaning that assuming you use a Git repository on the cloud (Github, Bitbucket) you don't need to install anything anywhere.

  • Interesting but your pricing model is not compatible with consulting agencies (where we might have 100's of repos). – NSjonas Oct 11 '16 at 23:13
  • 1
    @NSjonas we will be launching a new pricing model soon to make Clayton pricing work well for consultancies . We are be moving away from the charge per repo model. Don't think this is the right forum but get in touch with me personally if you want more details! Thanks – Lorenzo Oct 12 '16 at 11:22
1

I won't take away from the far more feature-full, already accepted answer, but I did write some code and a blog post about static code analysis of apex. Just to toss my own home-made hat in the ring.

-1

I believe Appirio debuted Cloud Metrics at DF12. Not sure if it is available publicly just yet

  • 3
    I checked the Appirio page and this doesn't seem to be a tool but more a service. I guess Appirio consultants will check you code manually and look if there is room for (paid) improvement ;) – Robert Sösemann Apr 23 '13 at 19:29

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.