I am using the Apex PMD plugin for VS Code and it's giving me this problem:

Validate CRUD permission before SOQL/DML operation

For this line of code:

insert contentVersion;

Which is part of this method:

private void attachReport(Id recordId) {

    ContentVersion contentVersion = new ContentVersion(
        versionData = Blob.valueOf(buffer.toStr()),
        title = 'Import Report',
        pathOnClient =  StringUtils.format('/Import-Report-{0}.txt', DateTime.now().getTime()),
        FirstPublishLocationId = recordId);

    insert contentVersion;


  1. Why am I getting the problem?
  2. What should I do to not get the problem?


  1. Github: VS Code Apex PMD
  2. PMD Project
  • 1
    prior to that line of code are you checking that the running user has permission to create that type of record? (i.e. Schema.sObjectType.Contact.isCreatable())
    – Mark Pond
    Commented Sep 20, 2018 at 23:33
  • @MarkPond I've added additional code. As you can now see, I am not running that line of code. Should I always be doing this?
    – Robs
    Commented Sep 20, 2018 at 23:39

3 Answers 3


PMD's Apex ruleset is checking to see that you are enforcing/respecting security in your code.

ISV's Managed packages released to the AppExchange must do this as mandatory criteria in the security review process. The spirit of the requirement is to honor the access control configuration choices that org admins make within ISV application offerings. If an admin explicitly restricts access control for sharing/CRUD/FLS then ISV offerings should respect that.

Theoretically, you should be able to remove this rule from the VS Code PMD ruleset (or build a custom ruleset xml which doesn't include it), if you don't want to be warned about a concern that may not apply to your application's situation.

Looks like the VS Code PMD plugin allows for a custom ruleset. You could take this one here and customize it, removing the rules which are not important to you such as this one:

<rule ref="category/apex/security.xml/ApexCRUDViolation" 
    message="Validate CRUD permission before SOQL/DML operation">


  • I would like to remove this warning. Where are the rules stored?
    – Robs
    Commented Sep 25, 2018 at 11:56
  • 1
    @Robs Take the Apex Rule Set XML from the first related link and save it to your computer. Edit the XML to remove the rule entries you do not want to use and then configure the VS Code Apex PMD plugin to use this XML file for its ruleset.
    – Mark Pond
    Commented Sep 25, 2018 at 17:09

PMD will not throw error if you follow the below syntax:-

     List<Contact> contacts = new List<Contact>();

// You add some code to populate the contacts name and phone. Before performing dml you're checking the object and field level permissions like:-

if(Contact.SObjectType.getDescribe().isAccessible() && Schema.SObjectType.Contact.fields.Name.isAccessible() && Schema.SObjectType.Contact.fields.Phone.isAccessible()) {
     insert contacts;

However, the good news is you don't have to check for permissions in the Spring 20 release. You can handle it in the query itself like:-


And before performing a DML, you can strip the fields the user doesn't have access to like:-

SObjectAccessDecision decision = Security.stripInaccessible(AccessType.CREATABLE, contacts);
insert contacts;

Have a look at this link for more info:- Validate CRUD permission before SOQL/DML operation ? Well...that's History 😎

  • 1
    It will still show a warning. Use this insert decision.getRecords(); instead of insert contacts;
    – pmehta28
    Commented Jun 25, 2020 at 11:25
  • 1
    Thanks for making me aware of WITH SECURITY_ENFORCED!
    – sviereckl
    Commented Nov 25, 2020 at 16:55

removing that kind of rule is not the solution, find an appropriate solution for it, and make changes in your code. I think the below changes in your code might help.

SObject.sObjectType.getDescribe().isAccessible() SObject.sObjectType.getDescribe().isCreateable() SObject.sObjectType.getDescribe().isUpdateable() SObject.sObjectType.getDescribe().isDeleteable() SObject is Object which we want to try over

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .