1

I can see an unexpected behavior with PMD rules when working with the stripInaccessible method,

I have tried to insert List of Order records in my APEX class like below,

private List<Order> createOrderRecords(List<Order> lstOrder) {

   List<Order> lstOrders = new List<Order>();
   if(lstOrder.size() > 0) {
       SObjectAccessDecision securityDecision = Security.stripInaccessible(
            AccessType.CREATABLE,
            lstOrder);                                        
       lstOrders = securityDecision.getRecords();

       System.debug(LoggingLevel.INFO, '<---Created Orders in Insert method-->' + lstOrders);
       insert lstOrders;
    }

    return lstOrders;
}

When using the above method I am getting the Validate CRUD permission before SOQL/DML operation (rule: Security-ApexCRUDViolation) warning when running the PMD.

But when I tried with the below code I didn't get any warning,

private List<Order> createOrderRecords(List<Order> lstOrder) {

    List<Order> lstOrders = new List<Order>();
    if(lstOrder.size() > 0) {
        SObjectAccessDecision securityDecision = Security.stripInaccessible(
            AccessType.CREATABLE,
            lstOrder);  

        lstOrders = securityDecision.getRecords(); //with or without this line                                     
        insert securityDecision.getRecords();
    }

    return lstOrders;
}

I cannot understand the differences between those two methods. Is it a bug in the PMD for APEX?

2
  • 1
    Sounds like a bug to me. The engine isn't keeping track of if the data is tainted or not. I'd log a bug/issue on the ApexPMD github repo.
    – sfdcfox
    Commented Feb 22, 2021 at 5:12
  • Please do it and link the issue here. Commented Feb 22, 2021 at 7:24

0

You must log in to answer this question.

Browse other questions tagged .