Salesforce Stack Exchange is a question and answer site for Salesforce administrators, implementation experts, developers and anybody in-between. It only takes a minute to sign up.
Sign up to join this community
We generated a pmd report using sfdx, is it necessary to resolve all the sfdx report issues to pass the salesforce security review or those are just warnings and can be ignored to pass the security review ?
Some issues we got were VfUnescapeEl, ApexCRUDViolation, ApexSuggestUsingNamedCred
Salesforce Security review team expect to see a Checkmarx report, not a PMD report, as part of your submission.
Both Checkmarx and PMD are there to help you identify possible security issues that you should pay attention to. As such you should take action for each item flagged by PMD but more importantly, from the submission perspective, each issue flagged by Checkmarx.
Both tools have a tenancy to report so-called False Positives. For example, you may perform your CRUD/FLS checks in a separate method to a query or DML and both tools are likely to flag the query or DML as involving objects or fields that the user cannot access (of course there are newer Apex features like stripInaccessible etc. that would prevent such reporting).
Anyway, this is where Salesforce would expect you to include a False Positive report with the submission - a document listing all the places where Checkmarx incorrectly flags issues.
We took a slightly different approach. We created a generic document that explained how we added comments on the end of each line of code where Checkmarx flagged an issue that was a False Positive explaining why it is a False Positive. That way the Checkmarx report itself becomes the False Positives document.
