afv-library/skills/dx-code-analyzer-custom-rule-create/examples/metadata-xml-example-permissions.md

Metadata XML Examples: Permissions

← Back to Metadata XML Examples Index

Example 1: Flag ModifyAllData / ViewAllData Permissions

Problem: Permission sets granting ModifyAllData or ViewAllData are a security risk.

Target file: *.permissionset-meta.xml

Sample violating metadata:

<PermissionSet xmlns="http://soap.sforce.com/2006/04/metadata">
    <label>Power User</label>
    <userPermissions>
        <enabled>true</enabled>
        <name>ModifyAllData</name>
    </userPermissions>
</PermissionSet>

XPath (PMD 7):

//*[@Text='ModifyAllData' or @Text='ViewAllData']/../..
  [local-name()='userPermissions']
  [.//*[@Text='true']]

How it works:

1. //*[@Text='ModifyAllData' or @Text='ViewAllData'] — find text node with dangerous permission name
2. /../.. — navigate up: text node → <name> element → <userPermissions> parent
3. [local-name()='userPermissions'] — confirm we're at the right element
4. [.//*[@Text='true']] — check that a descendant text node contains "true" (the <enabled> value)

PMD ruleset:

<rule name="NoDangerousPermissions"
      language="xml"
      message="Permission set grants ModifyAllData or ViewAllData — use specific object permissions instead"
      class="net.sourceforge.pmd.lang.rule.xpath.XPathRule">
    <description>Flags permission sets that grant ModifyAllData or ViewAllData</description>
    <priority>1</priority>
    <properties>
        <property name="xpath">
            <value><![CDATA[
//*[@Text='ModifyAllData' or @Text='ViewAllData']/../..
  [local-name()='userPermissions']
  [.//*[@Text='true']]
]]></value>
        </property>
    </properties>
</rule>

---

Example 4: No Field Permissions in Profiles

Problem: Field permissions should be managed via Permission Sets, not Profiles.

Target file: *.profile-meta.xml

Sample violating metadata:

<Profile xmlns="http://soap.sforce.com/2006/04/metadata">
    <fieldPermissions>
        <editable>true</editable>
        <field>Account.Revenue__c</field>
        <readable>true</readable>
    </fieldPermissions>
</Profile>

XPath:

//*[local-name()='Profile']/*[local-name()='fieldPermissions']

PMD ruleset:

<rule name="NoFieldPermissionsInProfile"
      language="xml"
      message="Field permissions should be in Permission Sets, not Profiles"
      class="net.sourceforge.pmd.lang.rule.xpath.XPathRule">
    <description>Profiles should not contain field-level security — use Permission Sets</description>
    <priority>2</priority>
    <properties>
        <property name="xpath">
            <value><![CDATA[
//*[local-name()='Profile']/*[local-name()='fieldPermissions']
]]></value>
        </property>
    </properties>
</rule>