SonarSource Rules
  • Products

    In-IDE

    Code Quality and Security in your IDE with SonarQube Ide

    IDE extension that lets you fix coding issues before they exist!

    Discover SonarQube for IDE

    SaaS

    Code Quality and Security in the cloud with SonarQube Cloud

    Setup is effortless and analysis is automatic for most languages

    Discover SonarQube Cloud

    Self-Hosted

    Code Quality and Security Self-Hosted with SonarQube Server

    Fast, accurate analysis; enterprise scalability

    Discover SonarQube Server
  • SecretsSecrets
  • ABAPABAP
  • AnsibleAnsible
  • ApexApex
  • AzureResourceManagerAzureResourceManager
  • CC
  • C#C#
  • C++C++
  • CloudFormationCloudFormation
  • COBOLCOBOL
  • CSSCSS
  • DartDart
  • DockerDocker
  • FlexFlex
  • GitHub ActionsGitHub Actions
  • GoGo
  • HTMLHTML
  • JavaJava
  • JavaScriptJavaScript
  • JSONJSON
  • JCLJCL
  • KotlinKotlin
  • KubernetesKubernetes
  • Objective CObjective C
  • PHPPHP
  • PL/IPL/I
  • PL/SQLPL/SQL
  • PythonPython
  • RPGRPG
  • RubyRuby
  • RustRust
  • ScalaScala
  • ShellShell
  • SwiftSwift
  • TerraformTerraform
  • TextText
  • TypeScriptTypeScript
  • T-SQLT-SQL
  • VB.NETVB.NET
  • VB6VB6
  • XMLXML
  • YAMLYAML
Apex

Apex static code analysis

Unique rules to find Bugs, Vulnerabilities, Security Hotspots, and Code Smells in your APEX code

  • All rules 56
  • Vulnerability1
  • Bug12
  • Security Hotspot3
  • Code Smell40
 
Tags
    Impact
      Clean code attribute
        1. Test methods should not be annotated with "@isTest(SeeAllData=true)"

           Code Smell
        2. Tested code should be enclosed between "Test.StartTest()" and "Test.StopTest()"

           Code Smell
        3. Messages should not be hardcoded

           Code Smell
        4. URLs of Salesforce pages should be relative, not absolute.

           Bug
        5. "getRecordTypeInfosByDeveloperName()" should be used instead of "getRecordTypeInfosByName()"

           Bug
        6. System.runAs should be used to test user permissions

           Code Smell
        7. Business logic should not be implemented inside Triggers

           Code Smell
        8. DML statements should not be used inside loops

           Bug
        9. Record IDs should not be hardcoded

           Bug
        10. Executing SOQL, SOSL or DML queries without sharing or with inherited sharing is security sensitive

           Security Hotspot
        11. Sharing level should be specified in Apex Classes with SOQL/SOSL Queries or DML Statements

           Vulnerability
        12. Triggers should process records in bulk

           Bug
        13. Multi-line comments should not be empty

           Code Smell
        14. Methods should not have identical implementations

           Code Smell
        15. All branches in a conditional structure should not have exactly the same implementation

           Bug
        16. Cognitive Complexity of functions should not be too high

           Code Smell
        17. Non-existent operators like "=+" should not be used

           Bug
        18. Track parsing failures

           Code Smell
        19. Hard-coded credentials are security-sensitive

           Security Hotspot
        20. Boolean checks should not be inverted

           Code Smell
        21. Two branches in a conditional structure should not have exactly the same implementation

           Code Smell
        22. Related "if"/"else if" statements and "when" in a "switch" should not have the same condition

           Bug
        23. "switch" statements should not be nested

           Code Smell
        24. Identical expressions should not be used on both sides of a binary operator

           Bug
        25. All code should be reachable

           Bug
        26. Variables should not be self-assigned

           Bug
        27. Unused local variables should be removed

           Code Smell
        28. "switch" statements should not have too many "case" clauses

           Code Smell
        29. Track lack of copyright and license headers

           Code Smell
        30. Functions should not have too many lines of code

           Code Smell
        31. Control flow statements "if", "for", "while", "switch" and "try" should not be nested too deeply

           Code Smell
        32. Using hardcoded IP addresses is security-sensitive

           Security Hotspot
        33. "switch" statements should have "when else" clauses

           Code Smell
        34. "if ... else if" constructs should end with "else" clauses

           Code Smell
        35. Sections of code should not be commented out

           Code Smell
        36. Statements should be on separate lines

           Code Smell
        37. String literals should not be duplicated

           Code Smell
        38. Methods should not be empty

           Code Smell
        39. Unused function parameters should be removed

           Code Smell
        40. Local variable and method parameter names should comply with a naming convention

           Code Smell
        41. "when" clauses should not have too many lines of code

           Code Smell
        42. Useless "if(true) {...}" and "if(false){...}" blocks should be removed

           Bug
        43. Unused "private" methods should be removed

           Code Smell
        44. Track uses of "TODO" tags

           Code Smell
        45. Track uses of "FIXME" tags

           Code Smell
        46. Boolean literals should not be redundant

           Code Smell
        47. Redundant pairs of parentheses should be removed

           Code Smell
        48. Nested blocks of code should not be left empty

           Code Smell
        49. Functions should not have too many parameters

           Code Smell
        50. Expressions should not be too complex

           Code Smell
        51. Mergeable "if" statements should be combined

           Code Smell
        52. Tabulation characters should not be used

           Code Smell
        53. Files should not have too many lines of code

           Code Smell
        54. Lines should not be too long

           Code Smell
        55. Class names should comply with a naming convention

           Code Smell
        56. Function names should comply with a naming convention

           Code Smell

        Test methods should not be annotated with "@isTest(SeeAllData=true)"

        adaptability - modular
        maintainability
        Code Smell

          Why is this an issue?

          More Info

          SeeAllData=true should not be used because it gives your tests access to all data in your organization. Activating this option makes your test dependent on existing data and more difficult to maintain. Tests should create their own data.

          This rule raises an issue when it sees @isTest(SeeAllData=true).

          Noncompliant code example

          @isTest(SeeAllData=true) // Noncompliant
          public class MyTestClass {
              @isTest(SeeAllData=true) // Noncompliant
              static void myTestMethod() {
                  // Can access all data in the organization.
              }
          }
          
            Available In:
          • SonarQube IdeCatch issues on the fly,
            in your IDE
          • SonarQube CloudDetect issues in your GitHub, Azure DevOps Services, Bitbucket Cloud, GitLab repositories
          • SonarQube ServerAnalyze code in your
            on-premise CI
            Enterprise
            Edition
            Available Since
            9.1

          © 2008-2025 SonarSource SA. All rights reserved.

          Privacy Policy | Cookie Policy | Terms of Use