mirror of
https://github.com/forcedotcom/afv-library.git
synced 2026-07-30 19:50:42 +08:00
96 lines
2.8 KiB
Markdown
96 lines
2.8 KiB
Markdown
# Metadata XML Examples: Permissions
|
|
|
|
[← Back to Metadata XML Examples Index](metadata-xml-examples.md)
|
|
|
|
## Example 1: Flag ModifyAllData / ViewAllData Permissions
|
|
|
|
**Problem:** Permission sets granting ModifyAllData or ViewAllData are a security risk.
|
|
|
|
**Target file:** `*.permissionset-meta.xml`
|
|
|
|
**Sample violating metadata:**
|
|
```xml
|
|
<PermissionSet xmlns="http://soap.sforce.com/2006/04/metadata">
|
|
<label>Power User</label>
|
|
<userPermissions>
|
|
<enabled>true</enabled>
|
|
<name>ModifyAllData</name>
|
|
</userPermissions>
|
|
</PermissionSet>
|
|
```
|
|
|
|
**XPath (PMD 7):**
|
|
```xpath
|
|
//*[@Text='ModifyAllData' or @Text='ViewAllData']/../..
|
|
[local-name()='userPermissions']
|
|
[.//*[@Text='true']]
|
|
```
|
|
|
|
**How it works:**
|
|
1. `//*[@Text='ModifyAllData' or @Text='ViewAllData']` — find text node with dangerous permission name
|
|
2. `/../..` — navigate up: text node → `<name>` element → `<userPermissions>` parent
|
|
3. `[local-name()='userPermissions']` — confirm we're at the right element
|
|
4. `[.//*[@Text='true']]` — check that a descendant text node contains "true" (the `<enabled>` value)
|
|
|
|
**PMD ruleset:**
|
|
```xml
|
|
<rule name="NoDangerousPermissions"
|
|
language="xml"
|
|
message="Permission set grants ModifyAllData or ViewAllData — use specific object permissions instead"
|
|
class="net.sourceforge.pmd.lang.rule.xpath.XPathRule">
|
|
<description>Flags permission sets that grant ModifyAllData or ViewAllData</description>
|
|
<priority>1</priority>
|
|
<properties>
|
|
<property name="xpath">
|
|
<value><![CDATA[
|
|
//*[@Text='ModifyAllData' or @Text='ViewAllData']/../..
|
|
[local-name()='userPermissions']
|
|
[.//*[@Text='true']]
|
|
]]></value>
|
|
</property>
|
|
</properties>
|
|
</rule>
|
|
```
|
|
|
|
---
|
|
|
|
## Example 4: No Field Permissions in Profiles
|
|
|
|
**Problem:** Field permissions should be managed via Permission Sets, not Profiles.
|
|
|
|
**Target file:** `*.profile-meta.xml`
|
|
|
|
**Sample violating metadata:**
|
|
```xml
|
|
<Profile xmlns="http://soap.sforce.com/2006/04/metadata">
|
|
<fieldPermissions>
|
|
<editable>true</editable>
|
|
<field>Account.Revenue__c</field>
|
|
<readable>true</readable>
|
|
</fieldPermissions>
|
|
</Profile>
|
|
```
|
|
|
|
**XPath:**
|
|
```xpath
|
|
//*[local-name()='Profile']/*[local-name()='fieldPermissions']
|
|
```
|
|
|
|
**PMD ruleset:**
|
|
```xml
|
|
<rule name="NoFieldPermissionsInProfile"
|
|
language="xml"
|
|
message="Field permissions should be in Permission Sets, not Profiles"
|
|
class="net.sourceforge.pmd.lang.rule.xpath.XPathRule">
|
|
<description>Profiles should not contain field-level security — use Permission Sets</description>
|
|
<priority>2</priority>
|
|
<properties>
|
|
<property name="xpath">
|
|
<value><![CDATA[
|
|
//*[local-name()='Profile']/*[local-name()='fieldPermissions']
|
|
]]></value>
|
|
</property>
|
|
</properties>
|
|
</rule>
|
|
```
|