Salesforce Stack Exchange is a question and answer site for Salesforce administrators, implementation experts, developers and anybody in-between. It only takes a minute to sign up.
Sign up to join this community
I have installed Apex PMD in my visual studio code for the static analysis of my code.
I have a global class and inside it, I have written some DML/SOQL query. The static analyzer shows a warning
Apex classes should declare a sharing model if DML or SOQL is used (rule: Security-ApexSharingViolations)
Why apex classes should declare a sharing model if DML or SOQL is used?
As explained in the documentation:
Apex generally runs in system context; that is, the current user's permissions, field-level security, and sharing rules aren’t taken into account during code execution. Because these rules aren't enforced, developers who use Apex must take care that they don't inadvertently expose sensitive data that would normally be hidden from users by user permissions, field-level security, or organization-wide defaults. They should be particularly careful with Web services, which can be restricted by permissions, but execute in system context once they are initiated.
Most of the time, system context provides the correct behavior for system-level operations such as triggers and Web services that need access to all data in an organization. However, you can also specify that particular Apex classes should enforce the sharing rules that apply to the current user. (For more information on sharing rules, see the Salesforce online help.)
