SonarSource Rules
  • Products

    In-IDE

    Code Quality and Security in your IDE with SonarQube Ide

    IDE extension that lets you fix coding issues before they exist!

    Discover SonarQube for IDE

    SaaS

    Code Quality and Security in the cloud with SonarQube Cloud

    Setup is effortless and analysis is automatic for most languages

    Discover SonarQube Cloud

    Self-Hosted

    Code Quality and Security Self-Hosted with SonarQube Server

    Fast, accurate analysis; enterprise scalability

    Discover SonarQube Server
  • SecretsSecrets
  • ABAPABAP
  • AnsibleAnsible
  • ApexApex
  • AzureResourceManagerAzureResourceManager
  • CC
  • C#C#
  • C++C++
  • CloudFormationCloudFormation
  • COBOLCOBOL
  • CSSCSS
  • DartDart
  • DockerDocker
  • FlexFlex
  • GitHub ActionsGitHub Actions
  • GoGo
  • HTMLHTML
  • JavaJava
  • JavaScriptJavaScript
  • JSONJSON
  • JCLJCL
  • KotlinKotlin
  • KubernetesKubernetes
  • Objective CObjective C
  • PHPPHP
  • PL/IPL/I
  • PL/SQLPL/SQL
  • PythonPython
  • RPGRPG
  • RubyRuby
  • RustRust
  • ScalaScala
  • ShellShell
  • SwiftSwift
  • TerraformTerraform
  • TextText
  • TypeScriptTypeScript
  • T-SQLT-SQL
  • VB.NETVB.NET
  • VB6VB6
  • XMLXML
  • YAMLYAML
Apex

Apex static code analysis

Unique rules to find Bugs, Vulnerabilities, Security Hotspots, and Code Smells in your APEX code

  • All rules 97
  • Vulnerability2
  • Bug26
  • Security Hotspot3
  • Code Smell66
Filtered: 2 rules found
async
    Impact
      Clean code attribute
        1. Future methods must be static and return void

           Bug
        2. Future methods making HTTP callouts should include "callout=true" parameter

           Bug

        Future methods making HTTP callouts should include "callout=true" parameter

        intentionality - logical
        reliability
        Bug
        • salesforce
        • apex
        • async

        This is an issue when a method annotated with @future contains HTTP callout operations but does not specify callout=true in the annotation.

        Why is this an issue?

        How can I fix it?

        More Info

        In Salesforce Apex, future methods run asynchronously and have different execution contexts than regular methods. By default, future methods cannot make HTTP callouts to external web services for security and resource management reasons.

        When you attempt to make an HTTP callout from a future method without the callout=true parameter, Salesforce will throw a runtime exception. This happens because the platform needs explicit permission to allow network operations from asynchronous contexts.

        The callout=true parameter tells the Salesforce platform that this future method is authorized to make external HTTP requests. Without this parameter, any attempt to use HTTP classes like Http, HttpRequest, or HttpResponse will fail at runtime, potentially breaking your application’s functionality.

        This restriction exists because HTTP callouts consume system resources and can affect performance. By requiring explicit declaration, Salesforce ensures developers are intentional about which asynchronous methods can access external services.

        What is the potential impact?

        Without the callout=true parameter, the application will throw a runtime exception when the future method attempts to make HTTP callouts. This can cause:

        • Integration failures with external systems
        • Incomplete business processes that depend on external data
        • Poor user experience due to unexpected errors
        • Difficult debugging since the error occurs asynchronously
          Available In:
        • SonarQube CloudDetect issues in your GitHub, Azure DevOps Services, Bitbucket Cloud, GitLab repositories

        © 2008-2025 SonarSource SA. All rights reserved.

        Privacy Policy | Cookie Policy | Terms of Use