##### Overview

- Download PMD 4.2.5
- What's new in PMD 4.2.5
- PMD in the news
- PMD-related products and books
- Best practices
- Future directions
- Similar projects
- Credits
- License
- What does 'PMD' mean?

##### Usage

- Installation
- Command line usage
- Ant task usage
- Maven plugin usage
- Mvn plugin usage
- IDE plugin usage
- Suppressing warnings
- Finding duplicated code
- JSP support

##### Customizing PMD

- Compiling PMD
- How to write a rule
- Writing XPath rules
- How to make a rule set
- How it works
- Rule guidelines

##### For example

- Run PMD on a Sourceforge project

##### Rule Sets

- Index
- Android
- Basic
- Braces
- Code Size
- Clone
- Controversial
- Coupling
- Design
- Finalizers
- Import Statements
- J2EE
- Javabeans
- JUnit Tests
- Logging (Java)
- Logging (Jakarta)
- Migrating
- Naming
- Optimizations
- Strict Exceptions
- Strings
- Sun Security
- Unused Code
- Java Server Pages
- Java Server Faces

##### Project Documentation

- About
- Project Info
- Project Reports
- Development Process

##### Legend

- External Link
- Opens in a new window

## Security Code Guidelines

These rules check the security guidelines from Sun, published at http://java.sun.com/security/seccodeguide.html#gcg

### MethodReturnsInternalArray

Since: PMD 2.2

Exposing internal arrays directly allows the user to modify some code that could be critical. It is safer to return a copy of the array.

This rule is defined by the following Java class: net.sourceforge.pmd.rules.sunsecure.MethodReturnsInternalArray

Example:

    public class SecureSystem {
      UserData [] ud;
      public UserData [] getUserData() {
          // Don't return directly the internal array, return a copy
          return ud;
      }
    }

### ArrayIsStoredDirectly

Since: PMD 2.2

Constructors and methods receiving arrays should clone objects and store the copy. This prevents that future changes from the user affect the internal functionality.

This rule is defined by the following Java class: net.sourceforge.pmd.rules.sunsecure.ArrayIsStoredDirectly

Example:

    public class Foo {
     private String [] x;
      public void foo (String [] param) {
          // Don't do this, make a copy of the array at least
          this.x=param;
      }
    }