Apex trigger and call-chain checks
These three checks cover Apex shapes that are easy for data-flow analysis to miss: triggers, deep property chains and chained method calls.
vulkro-sf antipatterns ./force-app
Checks
| Rule ID | Severity | What it finds |
|---|---|---|
| AP-056 | Medium | A .trigger that reads Trigger.new, Trigger.old, Trigger.newMap or Trigger.oldMap and does DML with no CRUD/FLS check (isUpdateable(), WITH SECURITY_ENFORCED, Security.stripInaccessible, AccessLevel.USER_MODE). |
| AP-057 | Medium | A property chain of depth three or more (req.params.lead.email) feeding a SOQL or DML sink on the same line. |
| AP-058 | Medium | A chained method call (Foo.bar().baz()) feeding a DML sink. |
AP-056 is the noisiest on a new project, since every trigger needs one FLS check. AP-057 is usually the most actionable in code that uses request wrapper classes.
Each finding's confidence_reason field explains why it was raised. Suppress a reviewed line with // vulkro:disable-line AP-056, adding until=<date> so the exception is reviewed again.
See also: Cross-method engine, Apex