7

Background

I am using the Apex PMD plugin for VS Code and it's giving me this problem:

Validate CRUD permission before SOQL/DML operation

For this line of code:

insert contentVersion;

Which is part of this method:

private void attachReport(Id recordId) {

    ContentVersion contentVersion = new ContentVersion(
        versionData = Blob.valueOf(buffer.toStr()),
        title = 'Import Report',
        pathOnClient =  StringUtils.format('/Import-Report-{0}.txt', DateTime.now().getTime()),
        FirstPublishLocationId = recordId);

    insert contentVersion;
}

Questions

  1. Why am I getting the problem?
  2. What should I do to not get the problem?

Reference

  1. Github: VS Code Apex PMD
  2. PMD Project
  • 1
    prior to that line of code are you checking that the running user has permission to create that type of record? (i.e. Schema.sObjectType.Contact.isCreatable()) – Mark Pond Sep 20 '18 at 23:33
  • @MarkPond I've added additional code. As you can now see, I am not running that line of code. Should I always be doing this? – Robs Sep 20 '18 at 23:39
6

PMD's Apex ruleset is checking to see that you are enforcing/respecting security in your code.

ISV's Managed packages released to the AppExchange must do this as mandatory criteria in the security review process. The spirit of the requirement is to honor the access control configuration choices that org admins make within ISV application offerings. If an admin explicitly restricts access control for sharing/CRUD/FLS then ISV offerings should respect that.

Theoretically, you should be able to remove this rule from the VS Code PMD ruleset (or build a custom ruleset xml which doesn't include it), if you don't want to be warned about a concern that may not apply to your application's situation.

Looks like the VS Code PMD plugin allows for a custom ruleset. You could take this one here and customize it, removing the rules which are not important to you such as this one:

<rule ref="category/apex/security.xml/ApexCRUDViolation" 
    message="Validate CRUD permission before SOQL/DML operation">

Related:

| improve this answer | |
  • I would like to remove this warning. Where are the rules stored? – Robs Sep 25 '18 at 11:56
  • 1
    @Robs Take the Apex Rule Set XML from the first related link and save it to your computer. Edit the XML to remove the rule entries you do not want to use and then configure the VS Code Apex PMD plugin to use this XML file for its ruleset. – Mark Pond Sep 25 '18 at 17:09
6

removing that kind of rule is not the solution, find an appropriate solution for it, and make changes in your code. I think the below changes in your code might help.

SObject.sObjectType.getDescribe().isAccessible() SObject.sObjectType.getDescribe().isCreateable() SObject.sObjectType.getDescribe().isUpdateable() SObject.sObjectType.getDescribe().isDeleteable() SObject is Object which we want to try over

| improve this answer | |
2

PMD will not throw error if you follow the below syntax:-

     List<Contact> contacts = new List<Contact>();

// You add some code to populate the contacts name and phone. Before performing dml you're checking the object and field level permissions like:-

if(Contact.SObjectType.getDescribe().isAccessible() && Schema.SObjectType.Contact.fields.Name.isAccessible() && Schema.SObjectType.Contact.fields.Phone.isAccessible()) {
     insert contacts;
}

However, the good news is you don't have to check for permissions in the Spring 20 release. You can handle it in the query itself like:-

Contact c = [SELECT Email FROM Contact WHERE Id=:Id WITH SECURITY_ENFORCED];

And before performing a DML, you can strip the fields the user doesn't have access to like:-

SObjectAccessDecision decision = Security.stripInaccessible(AccessType.CREATABLE, contacts);
insert contacts;

Have a look at this link for more info:- Validate CRUD permission before SOQL/DML operation ? Well...that's History 😎

| improve this answer | |
  • It will still show a warning. Use this insert decision.getRecords(); instead of insert contacts; – pmehta28 Jun 25 at 11:25

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.