SonarSource Rules
  • Products

    In-IDE

    Code Quality and Security in your IDE with SonarQube Ide

    IDE extension that lets you fix coding issues before they exist!

    Discover SonarQube for IDE

    SaaS

    Code Quality and Security in the cloud with SonarQube Cloud

    Setup is effortless and analysis is automatic for most languages

    Discover SonarQube Cloud

    Self-Hosted

    Code Quality and Security Self-Hosted with SonarQube Server

    Fast, accurate analysis; enterprise scalability

    Discover SonarQube Server
  • SecretsSecrets
  • ABAPABAP
  • AnsibleAnsible
  • ApexApex
  • AzureResourceManagerAzureResourceManager
  • CC
  • C#C#
  • C++C++
  • CloudFormationCloudFormation
  • COBOLCOBOL
  • CSSCSS
  • DartDart
  • DockerDocker
  • FlexFlex
  • GitHub ActionsGitHub Actions
  • GoGo
  • HTMLHTML
  • JavaJava
  • JavaScriptJavaScript
  • JSONJSON
  • JCLJCL
  • KotlinKotlin
  • KubernetesKubernetes
  • Objective CObjective C
  • PHPPHP
  • PL/IPL/I
  • PL/SQLPL/SQL
  • PythonPython
  • RPGRPG
  • RubyRuby
  • RustRust
  • ScalaScala
  • ShellShell
  • SwiftSwift
  • TerraformTerraform
  • TextText
  • TypeScriptTypeScript
  • T-SQLT-SQL
  • VB.NETVB.NET
  • VB6VB6
  • XMLXML
  • YAMLYAML
Apex

Apex static code analysis

Unique rules to find Bugs, Vulnerabilities, Security Hotspots, and Code Smells in your APEX code

  • All rules 97
  • Vulnerability2
  • Bug26
  • Security Hotspot3
  • Code Smell66
Filtered: 6 rules found
governor-limits
    Impact
      Clean code attribute
        1. SOQL queries should not be executed inside loops

           Code Smell
        2. HTTP requests should have explicit timeout configuration

           Code Smell
        3. SOQL queries should include LIMIT clauses to prevent hitting governor limits

           Bug
        4. Email messages should be sent in batches

           Bug
        5. Tested code should be enclosed between "Test.StartTest()" and "Test.StopTest()"

           Code Smell
        6. DML statements should not be used inside loops

           Bug

        SOQL queries should not be executed inside loops

        intentionality - efficient
        reliability
        maintainability
        Code Smell
        • performance
        • salesforce
        • governor-limits

        This rule raises an issue when a SOQL query is executed inside a loop (for, while, or do-while), which can lead to governor limit violations and poor performance.

        Why is this an issue?

        How can I fix it?

        More Info

        Executing SOQL queries inside loops is a critical performance anti-pattern in Apex development that can quickly exhaust Salesforce’s governor limits.

        Salesforce enforces strict limits on the number of SOQL queries that can be executed in a single transaction: 100 queries in synchronous contexts and 200 in asynchronous contexts. When you place a SOQL query inside a loop, each iteration executes a separate query against the database.

        For example, if you have a loop that processes 50 records and each iteration executes one SOQL query, you’ll consume 50 of your 100 available queries in a single operation. This approach doesn’t scale - processing 150 records would exceed the governor limit and cause a runtime exception.

        Beyond governor limits, this pattern creates significant performance issues. Each SOQL query requires a round trip to the database, and multiple individual queries are much slower than a single bulk query that retrieves all needed data at once.

        The solution is to use bulk processing patterns: collect all the criteria (like IDs) before the loop, execute a single SOQL query with an IN clause or similar bulk operator, and then process the retrieved records. This approach scales efficiently regardless of data volume and respects Salesforce’s platform constraints.

        What is the potential impact?

        This issue can cause runtime exceptions when governor limits are exceeded, leading to transaction failures and poor user experience. It also creates significant performance degradation, especially as data volume increases, making applications slow and unresponsive.

          Available In:
        • SonarQube CloudDetect issues in your GitHub, Azure DevOps Services, Bitbucket Cloud, GitLab repositories

        © 2008-2025 SonarSource SA. All rights reserved.

        Privacy Policy | Cookie Policy | Terms of Use