From ee4763e2fd1c224d8a8a8218ca2091509712d366 Mon Sep 17 00:00:00 2001
From: Stephen Carter <stephen.carter@salesforce.com>
Date: Wed, 18 Dec 2024 11:24:24 -0500
Subject: [PATCH] NEW(pmd): @W-17310939@: Add in more AppExchange rules for xml
 language

---
 .../pmd-rules/build.gradle.kts                |  11 +
 .../pmd/xml/DetectSecretsInCustomObjects.java | 195 ++++++++++++++++++
 .../sfca/rulesets/AppExchange_xml.xml         | 183 +++++++++++++++-
 .../AvoidApiSessionIdTest.java                |  16 ++
 .../AvoidAuraWithLockerDisabledTest.java      |  16 ++
 .../AvoidDisableProtocolSecurityTest.java     |  16 ++
 .../AvoidJavaScriptCustomObjectTest.java      |  16 ++
 .../AvoidJavaScriptHomePageComponentTest.java |  16 ++
 .../AvoidLmcIsExposedTrueTest.java            |  16 ++
 .../appexchange_xml/AvoidSControlsTest.java   |  16 ++
 .../LimitConnectedAppScopeTest.java           |  16 ++
 .../ProtectSensitiveDataTest.java             |  11 +
 .../UseHttpsCallbackUrlTest.java              |  16 ++
 .../appexchange_xml/xml/AvoidApiSessionId.xml |  58 ++++++
 .../xml/AvoidAuraWithLockerDisabled.xml       |  32 +++
 .../xml/AvoidDisableProtocolSecurity.xml      |  32 +++
 .../AvoidInsecureHttpRemoteSiteSetting.xml    |  14 +-
 .../xml/AvoidJavaScriptCustomObject.xml       |  34 +++
 .../xml/AvoidJavaScriptHomePageComponent.xml  |  49 +++++
 .../xml/AvoidLmcIsExposedTrue.xml             |  32 +++
 .../appexchange_xml/xml/AvoidSControls.xml    |  19 ++
 .../xml/LimitConnectedAppScope.xml            |  43 ++++
 .../xml/UseHttpsCallbackUrl.xml               |  58 ++++++
 .../code-analyzer-pmd-engine/src/constants.ts |  11 +-
 .../src/pmd-rule-mappings.ts                  |  50 +++++
 .../rules_allLanguages.goldfile.json          | 112 +++++++++-
 26 files changed, 1062 insertions(+), 26 deletions(-)
 create mode 100644 packages/code-analyzer-pmd-engine/pmd-rules/src/main/java/com/salesforce/security/pmd/xml/DetectSecretsInCustomObjects.java
 create mode 100644 packages/code-analyzer-pmd-engine/pmd-rules/src/test/java/sfca/rulesets/appexchange_xml/AvoidApiSessionIdTest.java
 create mode 100644 packages/code-analyzer-pmd-engine/pmd-rules/src/test/java/sfca/rulesets/appexchange_xml/AvoidAuraWithLockerDisabledTest.java
 create mode 100644 packages/code-analyzer-pmd-engine/pmd-rules/src/test/java/sfca/rulesets/appexchange_xml/AvoidDisableProtocolSecurityTest.java
 create mode 100644 packages/code-analyzer-pmd-engine/pmd-rules/src/test/java/sfca/rulesets/appexchange_xml/AvoidJavaScriptCustomObjectTest.java
 create mode 100644 packages/code-analyzer-pmd-engine/pmd-rules/src/test/java/sfca/rulesets/appexchange_xml/AvoidJavaScriptHomePageComponentTest.java
 create mode 100644 packages/code-analyzer-pmd-engine/pmd-rules/src/test/java/sfca/rulesets/appexchange_xml/AvoidLmcIsExposedTrueTest.java
 create mode 100644 packages/code-analyzer-pmd-engine/pmd-rules/src/test/java/sfca/rulesets/appexchange_xml/AvoidSControlsTest.java
 create mode 100644 packages/code-analyzer-pmd-engine/pmd-rules/src/test/java/sfca/rulesets/appexchange_xml/LimitConnectedAppScopeTest.java
 create mode 100644 packages/code-analyzer-pmd-engine/pmd-rules/src/test/java/sfca/rulesets/appexchange_xml/ProtectSensitiveDataTest.java
 create mode 100644 packages/code-analyzer-pmd-engine/pmd-rules/src/test/java/sfca/rulesets/appexchange_xml/UseHttpsCallbackUrlTest.java
 create mode 100644 packages/code-analyzer-pmd-engine/pmd-rules/src/test/resources/sfca/rulesets/appexchange_xml/xml/AvoidApiSessionId.xml
 create mode 100644 packages/code-analyzer-pmd-engine/pmd-rules/src/test/resources/sfca/rulesets/appexchange_xml/xml/AvoidAuraWithLockerDisabled.xml
 create mode 100644 packages/code-analyzer-pmd-engine/pmd-rules/src/test/resources/sfca/rulesets/appexchange_xml/xml/AvoidDisableProtocolSecurity.xml
 create mode 100644 packages/code-analyzer-pmd-engine/pmd-rules/src/test/resources/sfca/rulesets/appexchange_xml/xml/AvoidJavaScriptCustomObject.xml
 create mode 100644 packages/code-analyzer-pmd-engine/pmd-rules/src/test/resources/sfca/rulesets/appexchange_xml/xml/AvoidJavaScriptHomePageComponent.xml
 create mode 100644 packages/code-analyzer-pmd-engine/pmd-rules/src/test/resources/sfca/rulesets/appexchange_xml/xml/AvoidLmcIsExposedTrue.xml
 create mode 100644 packages/code-analyzer-pmd-engine/pmd-rules/src/test/resources/sfca/rulesets/appexchange_xml/xml/AvoidSControls.xml
 create mode 100644 packages/code-analyzer-pmd-engine/pmd-rules/src/test/resources/sfca/rulesets/appexchange_xml/xml/LimitConnectedAppScope.xml
 create mode 100644 packages/code-analyzer-pmd-engine/pmd-rules/src/test/resources/sfca/rulesets/appexchange_xml/xml/UseHttpsCallbackUrl.xml

diff --git a/packages/code-analyzer-pmd-engine/pmd-rules/build.gradle.kts b/packages/code-analyzer-pmd-engine/pmd-rules/build.gradle.kts
index 5c323418..d00b0b8a 100644
--- a/packages/code-analyzer-pmd-engine/pmd-rules/build.gradle.kts
+++ b/packages/code-analyzer-pmd-engine/pmd-rules/build.gradle.kts
@@ -74,6 +74,17 @@ tasks.test {
 // The jacocoTestReport and jacocoTestCoverageVerification tasks must be run separately from the test task
 // Otherwise, running a single test from the IDE will trigger this verification.
 tasks.jacocoTestCoverageVerification {
+
+    // Exclude specific classes from the coverage verification calculation
+    classDirectories.setFrom(
+        fileTree("build/classes/java/main").filter {
+            // Normalize the path to use forward slashes for comparison purposes
+            val normalizedPath = it.path.replace("\\", "/")
+            // Exclude the DetectSecretsInCustomObjects class because the Security team hasn't given us a valid test for it yet:
+            !normalizedPath.contains("com/salesforce/security/pmd/xml/DetectSecretsInCustomObjects.class")
+        }
+    )
+
     violationRules {
         rule {
             limit {
diff --git a/packages/code-analyzer-pmd-engine/pmd-rules/src/main/java/com/salesforce/security/pmd/xml/DetectSecretsInCustomObjects.java b/packages/code-analyzer-pmd-engine/pmd-rules/src/main/java/com/salesforce/security/pmd/xml/DetectSecretsInCustomObjects.java
new file mode 100644
index 00000000..a6f277ce
--- /dev/null
+++ b/packages/code-analyzer-pmd-engine/pmd-rules/src/main/java/com/salesforce/security/pmd/xml/DetectSecretsInCustomObjects.java
@@ -0,0 +1,195 @@
+package com.salesforce.security.pmd.xml;
+
+import net.sourceforge.pmd.lang.xml.ast.internal.XmlParserImpl.RootXmlNode;
+import java.io.File;
+import java.io.IOException;
+import java.util.List;
+import javax.xml.parsers.DocumentBuilder;
+import javax.xml.parsers.DocumentBuilderFactory;
+import javax.xml.parsers.ParserConfigurationException;
+import javax.xml.xpath.XPath;
+import javax.xml.xpath.XPathConstants;
+import javax.xml.xpath.XPathFactory;
+
+import org.w3c.dom.Document;
+import org.w3c.dom.NodeList;
+
+import net.sourceforge.pmd.reporting.RuleContext;
+import net.sourceforge.pmd.lang.ast.Node;
+import net.sourceforge.pmd.lang.document.FileId;
+import net.sourceforge.pmd.lang.rule.AbstractRule;
+import org.xml.sax.SAXException;
+
+public class DetectSecretsInCustomObjects extends AbstractRule {
+    private static final List<String> PRIVACY_FIELD_MAPPINGS_LIST = List.of(
+            "SSN",
+            "SOCIALSECURITY",
+            "SOCIAL_SECURITY",
+            "NATIONALID",
+            "NATIONAL_ID",
+            "NATIONAL_IDENTIFIER",
+            "NATIONALIDENTIFIER",
+            "DRIVERSLICENSE",
+            "DRIVERS_LICENSE",
+            "DRIVER_LICENSE",
+            "DRIVERLICENSE",
+            "PASSPORT",
+            "AADHAAR",
+            "AADHAR" //More?
+    );
+
+    private static final List<String> AUTH_FIELD_MAPPINGS_LIST = List.of(
+            "KEY", // potentially high false +ve rate
+            "ACCESS",
+            "PASS",
+            "ENCRYPT",
+            "TOKEN",
+            "HASH",
+            "SECRET",
+            "SIGNATURE",
+            "SIGN",
+            "AUTH", //AUTHORIZATION,AUTHENTICATION,AUTHENTICATE,OAUTH
+            "AUTHORIZATION",
+            "AUTHENTICATION",
+            "AUTHENTICATE",
+            "BEARER",
+            "CRED", //cred, credential(s),
+            "REFRESH", //
+            "CERT",
+            "PRIVATE",
+            "PUBLIC",
+            "JWT"
+    );
+
+    public static final String VISIBILITY_XPATH_EXPR = "/CustomObject/visibility[text()=\"Public\"]";
+    public static final String PRIVACY_FIELD_XPATH_EXPR = "/CustomField/type[text()!=\"EncryptedText\"]";
+    private static final String CUSTOM_SETTINGS_XPATH_EXPR = "/CustomObject/customSettingsType";
+
+    @Override
+    public void apply(Node target, RuleContext ctx) {
+        FileId fId = target.getReportLocation().getFileId();
+        String fieldFileName = fId.getAbsolutePath();
+        if (!fieldFileName.endsWith(".field-meta.xml")) {
+            return;
+        }
+        String fieldName = fieldNameFromFileName(fieldFileName);
+        if (isAnAuthTokenField(fieldName)) {
+            doObjectVisibilityCheck(ctx, target, fieldFileName);
+        }
+        if (isAnInsecurePrivacyField(fieldName)) {
+            checkFieldType(ctx, target, fieldName);
+        }
+    }
+
+    private void checkFieldType(RuleContext ctx, Node node, String fieldName) {
+        RootXmlNode pmdRootNode = (RootXmlNode) node;
+        Document xmlDoc = pmdRootNode.getNode();
+        if (isXPathExpFoundInDocument(xmlDoc, PRIVACY_FIELD_XPATH_EXPR)) { //not an EncryptedText type
+            ctx.addViolationWithMessage(pmdRootNode,
+                    fieldName +" is a potential privacy field and is not an EncryptedText");
+        }
+    }
+
+    private void doObjectVisibilityCheck(RuleContext ctx, Node pmdRootNode, String fieldFileName) {
+        String fieldName = fieldNameFromFileName(fieldFileName);
+
+        String objectFileName = getObjectFileName(fieldFileName);
+        if (objectFileName == null) {
+            return;
+        }
+        String objectName = objectNameFromFileName(objectFileName);
+
+        if (objectName.endsWith("__mdt") || isCustomSettingsObject(objectFileName)) {
+            if (isObjectVisibilityPublic(objectFileName)) {
+                ctx.addViolationWithMessage(pmdRootNode, fieldName +
+                        " is a potential auth token in the object: " +
+                        objectName + " with public visibility");
+            }
+        } else if (objectName.endsWith("__c")) {
+            ctx.addViolationWithMessage(pmdRootNode, fieldName +
+                    " is a potential auth token in a custom object: " +
+                    objectName);
+        }
+    }
+
+    private boolean isCustomSettingsObject(String filename) {
+        return isXPathExpFoundInDocument(filename, CUSTOM_SETTINGS_XPATH_EXPR);
+    }
+
+    private boolean isObjectVisibilityPublic(String filename) {
+        return isXPathExpFoundInDocument(filename, VISIBILITY_XPATH_EXPR);
+    }
+
+    private boolean isXPathExpFoundInDocument(String filename, String customSettingsXpathExpr) {
+        try {
+            return isXPathExpFoundInDocument(parseDocument(filename), customSettingsXpathExpr);
+        } catch (Exception e) {
+            return false; //TBD: Handle the exception properly
+        }
+    }
+
+    private boolean isXPathExpFoundInDocument(Document parsedXml, String customSettingsXpathExpr) {
+        try {
+            XPath xPath =  XPathFactory.newInstance().newXPath();
+            NodeList nodeList = (NodeList)xPath
+                    .compile(customSettingsXpathExpr)
+                    .evaluate(parsedXml, XPathConstants.NODESET);
+
+            return nodeList.getLength() > 0;
+        }
+        catch (Exception e) {
+            return false; //TBD: Handle the exception properly
+        }
+    }
+
+    private String getObjectFileName(String fieldFileName) {
+        File fieldFile = new File(fieldFileName);
+        try {
+            File objectDirFile = fieldFile.getParentFile() //fields directory
+                    .getParentFile(); //must be the objectName
+            String objectNamePath = objectDirFile.getAbsolutePath();
+            String objectName = objectDirFile.getName();
+            String objectDefinitionFileName = objectName + ".object-meta.xml";
+            return objectNamePath + File.separator + objectDefinitionFileName;
+        }
+        catch(Exception e) {
+            return null; //TBD: Handle the exception properly
+        }
+    }
+
+    public boolean isAnAuthTokenField(String fieldName) {
+        return isAPartialMatchInList(fieldName.toUpperCase(), AUTH_FIELD_MAPPINGS_LIST);
+    }
+
+    public boolean isAnInsecurePrivacyField(String fieldName) {
+        return isAPartialMatchInList(fieldName.toUpperCase(), PRIVACY_FIELD_MAPPINGS_LIST);
+    }
+
+
+    private static boolean isAPartialMatchInList(String inputStr, List<String> listOfStrings) {
+        String inputStrUpper = inputStr.toUpperCase();
+        for (String eachStr : listOfStrings) {
+            if (inputStrUpper.contains(eachStr)) {
+                return true;
+            }
+        }
+        return false;
+    }
+
+    private static Document parseDocument(String xmlFile) throws ParserConfigurationException, SAXException, IOException {
+        DocumentBuilderFactory factory = DocumentBuilderFactory.newInstance();
+        factory.setExpandEntityReferences(false);
+        factory.setFeature("http://xml.org/sax/features/external-general-entities", false);
+        factory.setFeature("http://xml.org/sax/features/external-parameter-entities", false);
+        DocumentBuilder builder = factory.newDocumentBuilder();
+        return builder.parse(new File(xmlFile));
+    }
+
+    private static String fieldNameFromFileName(String fieldFileName) {
+        return (new File(fieldFileName)).getName().replaceFirst(".field-meta.xml","");
+    }
+
+    private static String objectNameFromFileName(String objectFileName) {
+        return (new File(objectFileName)).getName().replaceFirst(".object-meta.xml", "");
+    }
+}
\ No newline at end of file
diff --git a/packages/code-analyzer-pmd-engine/pmd-rules/src/main/resources/sfca/rulesets/AppExchange_xml.xml b/packages/code-analyzer-pmd-engine/pmd-rules/src/main/resources/sfca/rulesets/AppExchange_xml.xml
index 9dbca504..40a86884 100644
--- a/packages/code-analyzer-pmd-engine/pmd-rules/src/main/resources/sfca/rulesets/AppExchange_xml.xml
+++ b/packages/code-analyzer-pmd-engine/pmd-rules/src/main/resources/sfca/rulesets/AppExchange_xml.xml
@@ -5,23 +5,194 @@
          xsi:schemaLocation="http://pmd.sourceforge.net/ruleset/2.0.0 https://pmd.sourceforge.io/ruleset_2_0_0.xsd">
     <description>AppExchange Security Rules</description>
 
+
+    <rule name="AvoidApiSessionId"
+          language="xml"
+          class="net.sourceforge.pmd.lang.rule.xpath.XPathRule"
+          message="Session ID use is not approved.">
+        <!-- TODO: NEED TO ADD IN externalInfoUrl ONCE WE HAVE A PERMANENT LOCATION FOR THE DOC PAGE -->
+        <description>Detects use of Api.Session_ID or GETSESSIONID() to retrieve a session ID.</description>
+        <priority>2</priority>
+        <properties>
+            <property name="xpath">
+                <value><![CDATA[
+//text[
+    contains(upper-case(@Text),"API.SESSION_ID")
+    or
+    contains(upper-case(@Text),"GETSESSIONID")
+]/..
+                ]]></value>
+            </property>
+        </properties>
+    </rule>
+
+
+    <rule name="AvoidAuraWithLockerDisabled"
+          language="xml"
+          class="net.sourceforge.pmd.lang.rule.xpath.XPathRule"
+          message="To enable Lightning Locker, update the apiVersion to version 40 or greater.">
+        <!-- TODO: NEED TO ADD IN externalInfoUrl ONCE WE HAVE A PERMANENT LOCATION FOR THE DOC PAGE -->
+        <description>Detects use of API versions with Lightning Locker disabled in Aura components. Use API version 40 or greater.</description>
+        <priority>1</priority>
+        <properties>
+            <property name="xpath">
+                <value><![CDATA[
+/document/AuraDefinitionBundle/apiVersion/text[number(@Text) lt 40]
+                ]]></value>
+            </property>
+        </properties>
+    </rule>
+
+
+    <rule name="AvoidDisableProtocolSecurity"
+          language="xml"
+          class="net.sourceforge.pmd.lang.rule.xpath.XPathRule"
+          message="Protocol security setting is disabled.">
+        <!-- TODO: NEED TO ADD IN externalInfoUrl ONCE WE HAVE A PERMANENT LOCATION FOR THE DOC PAGE -->
+        <description>Detects if &quot;Disable Protocol Security&quot; setting is true.</description>
+        <priority>3</priority>
+        <properties>
+            <property name="xpath">
+                <value><![CDATA[
+/document/RemoteSiteSetting/disableProtocolSecurity/text[@Text="true"]
+                ]]></value>
+            </property>
+        </properties>
+    </rule>
+
+
     <rule name="AvoidInsecureHttpRemoteSiteSetting"
           language="xml"
           class="net.sourceforge.pmd.lang.rule.xpath.XPathRule"
           message="Avoid using insecure http urls in Remote Site Settings.">
-          <!-- TODO: NEED TO ADD IN externalInfoUrl ONCE WE HAVE A PERMANENT LOCATION FOR THE DOC PAGE -->
-        <description>Detects instances of a Remote Site Settings that use HTTP.Use HTTPS instead.</description>
+        <!-- TODO: NEED TO ADD IN externalInfoUrl ONCE WE HAVE A PERMANENT LOCATION FOR THE DOC PAGE -->
+        <description>Detects instances of a Remote Site Settings that use HTTP. Use HTTPS instead.</description>
         <priority>3</priority>
         <properties>
             <property name="xpath">
-                <value>
-<![CDATA[
+                <value><![CDATA[
 /document/RemoteSiteSetting/url/text[starts-with(lower-case(@Text),"http://")]
-]]>
-                </value>
+                ]]></value>
+            </property>
+        </properties>
+    </rule>
+
+
+    <rule name="AvoidJavaScriptCustomObject"
+          language="xml"
+          class="net.sourceforge.pmd.lang.rule.xpath.XPathRule"
+          message="Avoid using JavaScript to execute custom button actions.">
+        <!-- TODO: NEED TO ADD IN externalInfoUrl ONCE WE HAVE A PERMANENT LOCATION FOR THE DOC PAGE -->
+        <description>Detects use of custom JavaScript actions in custom rules.</description>
+        <priority>2</priority>
+        <properties>
+            <property name="xpath">
+                <value><![CDATA[
+/document/WebLink/openType/text[@Text="onClickJavaScript"]/../../url
+                ]]></value>
             </property>
         </properties>
     </rule>
 
 
+    <rule name="AvoidJavaScriptHomePageComponent"
+          language="xml"
+          class="net.sourceforge.pmd.lang.rule.xpath.XPathRule"
+          message="Avoid JavaScript in a home page component body.">
+        <description>Detects use of custom JavaScript actions in home page components.</description>
+        <!-- TODO: NEED TO ADD IN externalInfoUrl ONCE WE HAVE A PERMANENT LOCATION FOR THE DOC PAGE -->
+        <priority>2</priority>
+        <properties>
+            <property name="xpath">
+                <value><![CDATA[
+/document/HomePageComponent/body/text[
+    contains(upper-case(@Text),upper-case('<script>'))
+    or
+    contains(upper-case(@Text),upper-case('<script '))
+    or
+    contains(upper-case(@Text),upper-case('javascript:'))
+]
+                ]]></value>
+            </property>
+        </properties>
+    </rule>
+
+
+    <rule name="AvoidLmcIsExposedTrue"
+          language="xml"
+          class="net.sourceforge.pmd.lang.rule.xpath.XPathRule"
+          message="Detected Lightning Message Channel with isExposed set to true.">
+        <!-- TODO: NEED TO ADD IN externalInfoUrl ONCE WE HAVE A PERMANENT LOCATION FOR THE DOC PAGE -->
+        <description>Detects a Lightning Message Channel with isExposed=true, which isn’t allowed in managed packages.</description>
+        <priority>2</priority>
+        <properties>
+            <property name="xpath">
+                <value><![CDATA[
+/document/LightningMessageChannel/isExposed/text[@Text="true"]
+                ]]></value>
+            </property>
+        </properties>
+    </rule>
+
+
+    <rule name="AvoidSControls"
+          language="xml"
+          class="net.sourceforge.pmd.lang.rule.xpath.XPathRule"
+          message="Detected S-Controls.">
+        <!-- TODO: NEED TO ADD IN externalInfoUrl ONCE WE HAVE A PERMANENT LOCATION FOR THE DOC PAGE -->
+        <description>Detects if S-Controls are used since they should not be used in managed packages.</description>
+        <priority>1</priority>
+        <properties>
+            <property name="xpath">
+                <value><![CDATA[
+/document/Scontrol
+                ]]></value>
+            </property>
+        </properties>
+    </rule>
+
+
+    <rule name="LimitConnectedAppScope"
+          language="xml"
+          class="net.sourceforge.pmd.lang.rule.xpath.XPathRule"
+          message="Detected connected app using full scope.">
+        <!-- TODO: NEED TO ADD IN externalInfoUrl ONCE WE HAVE A PERMANENT LOCATION FOR THE DOC PAGE -->
+        <description>Detects if a connected app uses full scope instead of limited scope. Explain this use case in your AppExchange security review submission.</description>
+        <priority>3</priority>
+        <properties>
+            <property name="xpath">
+                <value><![CDATA[
+/document/ConnectedApp/oauthConfig/scopes/text[upper-case(@Text)="FULL"]
+                ]]></value>
+            </property>
+        </properties>
+    </rule>
+
+
+    <rule name="ProtectSensitiveData"
+          language="xml"
+          class="com.salesforce.security.pmd.xml.DetectSecretsInCustomObjects"
+          message="To store secrets, use Protected Custom settings or Protected Custom metadata.">
+        <!-- TODO: NEED TO ADD IN externalInfoUrl ONCE WE HAVE A PERMANENT LOCATION FOR THE DOC PAGE -->
+        <description>Detects where sensitive data must be stored with Protected Custom metadata or Protected Custom settings. Protected custom settings or protected custom metadata should be used to store secrets. Refer to the "Protect Secrets Using Platform Features" Trailhead module for more guidance.</description>
+        <priority>3</priority>
+    </rule>
+
+
+    <rule name="UseHttpsCallbackUrl"
+          language="xml"
+          class="net.sourceforge.pmd.lang.rule.xpath.XPathRule"
+          message="Update to secure Oauth callback URL over HTTPS.">
+        <!-- TODO: NEED TO ADD IN externalInfoUrl ONCE WE HAVE A PERMANENT LOCATION FOR THE DOC PAGE -->
+        <description>Detects instances of an OAuth callback URL that uses HTTP. Use HTTPS instead.</description>
+        <priority>3</priority>
+        <properties>
+            <property name="xpath">
+                <value><![CDATA[
+/document/ConnectedApp/oauthConfig/callbackUrl/text[contains(lower-case(@Text),"http://")]
+                ]]></value>
+            </property>
+        </properties>
+    </rule>
+
 </ruleset>
\ No newline at end of file
diff --git a/packages/code-analyzer-pmd-engine/pmd-rules/src/test/java/sfca/rulesets/appexchange_xml/AvoidApiSessionIdTest.java b/packages/code-analyzer-pmd-engine/pmd-rules/src/test/java/sfca/rulesets/appexchange_xml/AvoidApiSessionIdTest.java
new file mode 100644
index 00000000..72c712ec
--- /dev/null
+++ b/packages/code-analyzer-pmd-engine/pmd-rules/src/test/java/sfca/rulesets/appexchange_xml/AvoidApiSessionIdTest.java
@@ -0,0 +1,16 @@
+package sfca.rulesets.appexchange_xml;
+
+import net.sourceforge.pmd.test.SimpleAggregatorTst;
+
+public class AvoidApiSessionIdTest extends SimpleAggregatorTst {
+    @Override
+    protected void setUp() {
+        // The test data xml file for this rule's test will always be in the resources directory using a naming
+        // convention based off the package for this test and the rule being tested:
+        //     "resources/<TestPackageName>/xml/<RuleName>.xml".
+        // In this case "sfca.rulesets.appexchange_xml" is the package name of this test file. Thus, the associated test
+        // data xml file for this rule must be found at:
+        //      "resource/sfca/rulesets/appexchange_xml/xml/AvoidApiSessionId.xml"
+        addRule("sfca/rulesets/AppExchange_xml.xml", "AvoidApiSessionId");
+    }
+}
diff --git a/packages/code-analyzer-pmd-engine/pmd-rules/src/test/java/sfca/rulesets/appexchange_xml/AvoidAuraWithLockerDisabledTest.java b/packages/code-analyzer-pmd-engine/pmd-rules/src/test/java/sfca/rulesets/appexchange_xml/AvoidAuraWithLockerDisabledTest.java
new file mode 100644
index 00000000..34df3608
--- /dev/null
+++ b/packages/code-analyzer-pmd-engine/pmd-rules/src/test/java/sfca/rulesets/appexchange_xml/AvoidAuraWithLockerDisabledTest.java
@@ -0,0 +1,16 @@
+package sfca.rulesets.appexchange_xml;
+
+import net.sourceforge.pmd.test.SimpleAggregatorTst;
+
+public class AvoidAuraWithLockerDisabledTest extends SimpleAggregatorTst {
+    @Override
+    protected void setUp() {
+        // The test data xml file for this rule's test will always be in the resources directory using a naming
+        // convention based off the package for this test and the rule being tested:
+        //     "resources/<TestPackageName>/xml/<RuleName>.xml".
+        // In this case "sfca.rulesets.appexchange_xml" is the package name of this test file. Thus, the associated test
+        // data xml file for this rule must be found at:
+        //      "resource/sfca/rulesets/appexchange_xml/xml/AvoidAuraWithLockerDisabled.xml"
+        addRule("sfca/rulesets/AppExchange_xml.xml", "AvoidAuraWithLockerDisabled");
+    }
+}
diff --git a/packages/code-analyzer-pmd-engine/pmd-rules/src/test/java/sfca/rulesets/appexchange_xml/AvoidDisableProtocolSecurityTest.java b/packages/code-analyzer-pmd-engine/pmd-rules/src/test/java/sfca/rulesets/appexchange_xml/AvoidDisableProtocolSecurityTest.java
new file mode 100644
index 00000000..c40e44be
--- /dev/null
+++ b/packages/code-analyzer-pmd-engine/pmd-rules/src/test/java/sfca/rulesets/appexchange_xml/AvoidDisableProtocolSecurityTest.java
@@ -0,0 +1,16 @@
+package sfca.rulesets.appexchange_xml;
+
+import net.sourceforge.pmd.test.SimpleAggregatorTst;
+
+public class AvoidDisableProtocolSecurityTest extends SimpleAggregatorTst {
+    @Override
+    protected void setUp() {
+        // The test data xml file for this rule's test will always be in the resources directory using a naming
+        // convention based off the package for this test and the rule being tested:
+        //     "resources/<TestPackageName>/xml/<RuleName>.xml".
+        // In this case "sfca.rulesets.appexchange_xml" is the package name of this test file. Thus, the associated test
+        // data xml file for this rule must be found at:
+        //      "resource/sfca/rulesets/appexchange_xml/xml/AvoidDisableProtocolSecurity.xml"
+        addRule("sfca/rulesets/AppExchange_xml.xml", "AvoidDisableProtocolSecurity");
+    }
+}
diff --git a/packages/code-analyzer-pmd-engine/pmd-rules/src/test/java/sfca/rulesets/appexchange_xml/AvoidJavaScriptCustomObjectTest.java b/packages/code-analyzer-pmd-engine/pmd-rules/src/test/java/sfca/rulesets/appexchange_xml/AvoidJavaScriptCustomObjectTest.java
new file mode 100644
index 00000000..73b1a60c
--- /dev/null
+++ b/packages/code-analyzer-pmd-engine/pmd-rules/src/test/java/sfca/rulesets/appexchange_xml/AvoidJavaScriptCustomObjectTest.java
@@ -0,0 +1,16 @@
+package sfca.rulesets.appexchange_xml;
+
+import net.sourceforge.pmd.test.SimpleAggregatorTst;
+
+public class AvoidJavaScriptCustomObjectTest extends SimpleAggregatorTst {
+    @Override
+    protected void setUp() {
+        // The test data xml file for this rule's test will always be in the resources directory using a naming
+        // convention based off the package for this test and the rule being tested:
+        //     "resources/<TestPackageName>/xml/<RuleName>.xml".
+        // In this case "sfca.rulesets.appexchange_xml" is the package name of this test file. Thus, the associated test
+        // data xml file for this rule must be found at:
+        //      "resource/sfca/rulesets/appexchange_xml/xml/AvoidJavaScriptCustomObject.xml"
+        addRule("sfca/rulesets/AppExchange_xml.xml", "AvoidJavaScriptCustomObject");
+    }
+}
diff --git a/packages/code-analyzer-pmd-engine/pmd-rules/src/test/java/sfca/rulesets/appexchange_xml/AvoidJavaScriptHomePageComponentTest.java b/packages/code-analyzer-pmd-engine/pmd-rules/src/test/java/sfca/rulesets/appexchange_xml/AvoidJavaScriptHomePageComponentTest.java
new file mode 100644
index 00000000..4a8dc335
--- /dev/null
+++ b/packages/code-analyzer-pmd-engine/pmd-rules/src/test/java/sfca/rulesets/appexchange_xml/AvoidJavaScriptHomePageComponentTest.java
@@ -0,0 +1,16 @@
+package sfca.rulesets.appexchange_xml;
+
+import net.sourceforge.pmd.test.SimpleAggregatorTst;
+
+public class AvoidJavaScriptHomePageComponentTest extends SimpleAggregatorTst {
+    @Override
+    protected void setUp() {
+        // The test data xml file for this rule's test will always be in the resources directory using a naming
+        // convention based off the package for this test and the rule being tested:
+        //     "resources/<TestPackageName>/xml/<RuleName>.xml".
+        // In this case "sfca.rulesets.appexchange_xml" is the package name of this test file. Thus, the associated test
+        // data xml file for this rule must be found at:
+        //      "resource/sfca/rulesets/appexchange_xml/xml/AvoidJavaScriptHomePageComponent.xml"
+        addRule("sfca/rulesets/AppExchange_xml.xml", "AvoidJavaScriptHomePageComponent");
+    }
+}
diff --git a/packages/code-analyzer-pmd-engine/pmd-rules/src/test/java/sfca/rulesets/appexchange_xml/AvoidLmcIsExposedTrueTest.java b/packages/code-analyzer-pmd-engine/pmd-rules/src/test/java/sfca/rulesets/appexchange_xml/AvoidLmcIsExposedTrueTest.java
new file mode 100644
index 00000000..e1a185b7
--- /dev/null
+++ b/packages/code-analyzer-pmd-engine/pmd-rules/src/test/java/sfca/rulesets/appexchange_xml/AvoidLmcIsExposedTrueTest.java
@@ -0,0 +1,16 @@
+package sfca.rulesets.appexchange_xml;
+
+import net.sourceforge.pmd.test.SimpleAggregatorTst;
+
+public class AvoidLmcIsExposedTrueTest extends SimpleAggregatorTst {
+    @Override
+    protected void setUp() {
+        // The test data xml file for this rule's test will always be in the resources directory using a naming
+        // convention based off the package for this test and the rule being tested:
+        //     "resources/<TestPackageName>/xml/<RuleName>.xml".
+        // In this case "sfca.rulesets.appexchange_xml" is the package name of this test file. Thus, the associated test
+        // data xml file for this rule must be found at:
+        //      "resource/sfca/rulesets/appexchange_xml/xml/AvoidLmcIsExposedTrue.xml"
+        addRule("sfca/rulesets/AppExchange_xml.xml", "AvoidLmcIsExposedTrue");
+    }
+}
diff --git a/packages/code-analyzer-pmd-engine/pmd-rules/src/test/java/sfca/rulesets/appexchange_xml/AvoidSControlsTest.java b/packages/code-analyzer-pmd-engine/pmd-rules/src/test/java/sfca/rulesets/appexchange_xml/AvoidSControlsTest.java
new file mode 100644
index 00000000..c308e9a3
--- /dev/null
+++ b/packages/code-analyzer-pmd-engine/pmd-rules/src/test/java/sfca/rulesets/appexchange_xml/AvoidSControlsTest.java
@@ -0,0 +1,16 @@
+package sfca.rulesets.appexchange_xml;
+
+import net.sourceforge.pmd.test.SimpleAggregatorTst;
+
+public class AvoidSControlsTest extends SimpleAggregatorTst {
+    @Override
+    protected void setUp() {
+        // The test data xml file for this rule's test will always be in the resources directory using a naming
+        // convention based off the package for this test and the rule being tested:
+        //     "resources/<TestPackageName>/xml/<RuleName>.xml".
+        // In this case "sfca.rulesets.appexchange_xml" is the package name of this test file. Thus, the associated test
+        // data xml file for this rule must be found at:
+        //      "resource/sfca/rulesets/appexchange_xml/xml/AvoidSControls.xml"
+        addRule("sfca/rulesets/AppExchange_xml.xml", "AvoidSControls");
+    }
+}
diff --git a/packages/code-analyzer-pmd-engine/pmd-rules/src/test/java/sfca/rulesets/appexchange_xml/LimitConnectedAppScopeTest.java b/packages/code-analyzer-pmd-engine/pmd-rules/src/test/java/sfca/rulesets/appexchange_xml/LimitConnectedAppScopeTest.java
new file mode 100644
index 00000000..6da04dfe
--- /dev/null
+++ b/packages/code-analyzer-pmd-engine/pmd-rules/src/test/java/sfca/rulesets/appexchange_xml/LimitConnectedAppScopeTest.java
@@ -0,0 +1,16 @@
+package sfca.rulesets.appexchange_xml;
+
+import net.sourceforge.pmd.test.SimpleAggregatorTst;
+
+public class LimitConnectedAppScopeTest extends SimpleAggregatorTst {
+    @Override
+    protected void setUp() {
+        // The test data xml file for this rule's test will always be in the resources directory using a naming
+        // convention based off the package for this test and the rule being tested:
+        //     "resources/<TestPackageName>/xml/<RuleName>.xml".
+        // In this case "sfca.rulesets.appexchange_xml" is the package name of this test file. Thus, the associated test
+        // data xml file for this rule must be found at:
+        //      "resource/sfca/rulesets/appexchange_xml/xml/LimitConnectedAppScope.xml"
+        addRule("sfca/rulesets/AppExchange_xml.xml", "LimitConnectedAppScope");
+    }
+}
diff --git a/packages/code-analyzer-pmd-engine/pmd-rules/src/test/java/sfca/rulesets/appexchange_xml/ProtectSensitiveDataTest.java b/packages/code-analyzer-pmd-engine/pmd-rules/src/test/java/sfca/rulesets/appexchange_xml/ProtectSensitiveDataTest.java
new file mode 100644
index 00000000..5c4d3ced
--- /dev/null
+++ b/packages/code-analyzer-pmd-engine/pmd-rules/src/test/java/sfca/rulesets/appexchange_xml/ProtectSensitiveDataTest.java
@@ -0,0 +1,11 @@
+package sfca.rulesets.appexchange_xml;
+
+public class ProtectSensitiveDataTest {
+        /*
+         NOTE: A TEST BASED ON SimpleAggregatorTst CAN'T WORK DUE TO THE WAY THE RULE IS WRITTEN SINCE IT DEPENDS ON THE
+         NAMES OF THE FILES IN A SALESFORCE PROJECT. THIS RULE REALLY ISN'T ONE THAT SHOULD BE WRITTEN AS A PMD RULE IN
+         MY OPINION SINCE WHILE PROCESSING A *.field-meta.xml FILE IT ATTEMPTS TO ALSO LOOK AT AND PROCESS
+         *.object-meta.xml FILES AS WELL, WHICH THIS TYPE OF TESTING FRAMEWORK CAN'T HANDLE.
+         SO THE SECURITY TEAM WILL HAVE TO WRITE A CUSTOM TEST FOR THIS IF WE WANT COVERAGE FOR THIS RULE.
+         */
+}
diff --git a/packages/code-analyzer-pmd-engine/pmd-rules/src/test/java/sfca/rulesets/appexchange_xml/UseHttpsCallbackUrlTest.java b/packages/code-analyzer-pmd-engine/pmd-rules/src/test/java/sfca/rulesets/appexchange_xml/UseHttpsCallbackUrlTest.java
new file mode 100644
index 00000000..b212073a
--- /dev/null
+++ b/packages/code-analyzer-pmd-engine/pmd-rules/src/test/java/sfca/rulesets/appexchange_xml/UseHttpsCallbackUrlTest.java
@@ -0,0 +1,16 @@
+package sfca.rulesets.appexchange_xml;
+
+import net.sourceforge.pmd.test.SimpleAggregatorTst;
+
+public class UseHttpsCallbackUrlTest extends SimpleAggregatorTst {
+    @Override
+    protected void setUp() {
+        // The test data xml file for this rule's test will always be in the resources directory using a naming
+        // convention based off the package for this test and the rule being tested:
+        //     "resources/<TestPackageName>/xml/<RuleName>.xml".
+        // In this case "sfca.rulesets.appexchange_xml" is the package name of this test file. Thus, the associated test
+        // data xml file for this rule must be found at:
+        //      "resource/sfca/rulesets/appexchange_xml/xml/UseHttpsCallbackUrl.xml"
+        addRule("sfca/rulesets/AppExchange_xml.xml", "UseHttpsCallbackUrl");
+    }
+}
diff --git a/packages/code-analyzer-pmd-engine/pmd-rules/src/test/resources/sfca/rulesets/appexchange_xml/xml/AvoidApiSessionId.xml b/packages/code-analyzer-pmd-engine/pmd-rules/src/test/resources/sfca/rulesets/appexchange_xml/xml/AvoidApiSessionId.xml
new file mode 100644
index 00000000..6ad7254f
--- /dev/null
+++ b/packages/code-analyzer-pmd-engine/pmd-rules/src/test/resources/sfca/rulesets/appexchange_xml/xml/AvoidApiSessionId.xml
@@ -0,0 +1,58 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<test-data
+        xmlns="http://pmd.sourceforge.net/rule-tests"
+        xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+        xsi:schemaLocation="http://pmd.sourceforge.net/rule-tests https://pmd.sourceforge.net/rule-tests_1_0_0.xsd">
+
+    <test-code>
+        <description>When custom object weblinks use GETSESSIONID(), then report violation</description>
+        <expected-problems>1</expected-problems>
+        <expected-linenumbers>6</expected-linenumbers>
+        <code><![CDATA[
+<?xml version="1.0" encoding="UTF-8"?>
+<CustomObject xmlns="http://soap.sforce.com/2006/04/metadata">
+    <!-- ... -->
+    <webLinks>
+        <!-- ... -->
+	    <url>{!REQUIRESCRIPT(&apos;/soap/ajax/26.0/connection.js&apos;)}
+		    sforce.connection.sessionId = &apos;{!GETSESSIONID()}&apos;;
+	    </url>
+    </webLinks>
+</CustomObject>
+        ]]></code>
+    </test-code>
+
+    <test-code>
+        <description>When custom object weblinks use API.Session_Id, then report violation</description>
+        <expected-problems>1</expected-problems>
+        <expected-linenumbers>6</expected-linenumbers>
+        <code><![CDATA[
+<?xml version="1.0" encoding="UTF-8"?>
+<CustomObject xmlns="http://soap.sforce.com/2006/04/metadata">
+    <!-- ... -->
+    <webLinks>
+        <!-- ... -->
+        <url>
+            /apex/something?id={!something__c.Id}&amp;sessionId={!$Api.Session_ID}&amp;instance={!$Api.Partner_Server_URL_260}
+        </url>
+    </webLinks>
+</CustomObject>
+        ]]></code>
+    </test-code>
+
+    <test-code>
+        <description>When custom tab uses API.Session_Id, then report violation</description>
+        <expected-problems>1</expected-problems>
+        <expected-linenumbers>4</expected-linenumbers>
+        <code><![CDATA[
+<?xml version="1.0" encoding="UTF-8"?>
+<CustomTab xmlns="http://soap.sforce.com/2006/04/metadata">
+    <!-- ... -->
+    <url>
+        https://test.example.com/dummy.ph?param1={!API.Enterprise_Server_URL_540}&amp;sessionId={!API.Session_ID}&amp;param2={!Organization.Name}&amp;param3={!User.Email}
+    </url>
+</CustomTab>
+        ]]></code>
+    </test-code>
+
+</test-data>
\ No newline at end of file
diff --git a/packages/code-analyzer-pmd-engine/pmd-rules/src/test/resources/sfca/rulesets/appexchange_xml/xml/AvoidAuraWithLockerDisabled.xml b/packages/code-analyzer-pmd-engine/pmd-rules/src/test/resources/sfca/rulesets/appexchange_xml/xml/AvoidAuraWithLockerDisabled.xml
new file mode 100644
index 00000000..d7eca006
--- /dev/null
+++ b/packages/code-analyzer-pmd-engine/pmd-rules/src/test/resources/sfca/rulesets/appexchange_xml/xml/AvoidAuraWithLockerDisabled.xml
@@ -0,0 +1,32 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<test-data
+        xmlns="http://pmd.sourceforge.net/rule-tests"
+        xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+        xsi:schemaLocation="http://pmd.sourceforge.net/rule-tests https://pmd.sourceforge.net/rule-tests_1_0_0.xsd">
+
+    <test-code>
+        <description>When AuraDefinitionBundle has version less than 40, then report violation</description>
+        <expected-problems>1</expected-problems>
+        <expected-linenumbers>3</expected-linenumbers>
+        <code><![CDATA[
+<?xml version="1.0" encoding="UTF-8"?>
+<AuraDefinitionBundle xmlns="http://soap.sforce.com/2006/04/metadata">
+    <apiVersion>39.0</apiVersion>
+    <!-- ... -->
+</AuraDefinitionBundle>
+        ]]></code>
+    </test-code>
+
+    <test-code>
+        <description>When AuraDefinitionBundle has version greater than 40, then do not report violation</description>
+        <expected-problems>0</expected-problems>
+        <code><![CDATA[
+<?xml version="1.0" encoding="UTF-8"?>
+<AuraDefinitionBundle xmlns="http://soap.sforce.com/2006/04/metadata">
+    <apiVersion>53.0</apiVersion>
+    <!-- ... -->
+</AuraDefinitionBundle>
+        ]]></code>
+    </test-code>
+
+</test-data>
\ No newline at end of file
diff --git a/packages/code-analyzer-pmd-engine/pmd-rules/src/test/resources/sfca/rulesets/appexchange_xml/xml/AvoidDisableProtocolSecurity.xml b/packages/code-analyzer-pmd-engine/pmd-rules/src/test/resources/sfca/rulesets/appexchange_xml/xml/AvoidDisableProtocolSecurity.xml
new file mode 100644
index 00000000..841b91a7
--- /dev/null
+++ b/packages/code-analyzer-pmd-engine/pmd-rules/src/test/resources/sfca/rulesets/appexchange_xml/xml/AvoidDisableProtocolSecurity.xml
@@ -0,0 +1,32 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<test-data
+        xmlns="http://pmd.sourceforge.net/rule-tests"
+        xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+        xsi:schemaLocation="http://pmd.sourceforge.net/rule-tests https://pmd.sourceforge.net/rule-tests_1_0_0.xsd">
+
+    <test-code>
+        <description>When RemoteSite Setting Disable Protocol Security is true, then report violation</description>
+        <expected-problems>1</expected-problems>
+        <expected-linenumbers>3</expected-linenumbers>
+        <code><![CDATA[
+<?xml version="1.0" encoding="UTF-8"?>
+<RemoteSiteSetting xmlns="http://soap.sforce.com/2006/04/metadata">
+    <disableProtocolSecurity>true</disableProtocolSecurity>
+    <!-- ... -->
+</RemoteSiteSetting>
+        ]]></code>
+    </test-code>
+
+    <test-code>
+        <description>When RemoteSite Setting Disable Protocol Security is false, then do not report violation</description>
+        <expected-problems>0</expected-problems>
+        <code><![CDATA[
+<?xml version="1.0" encoding="UTF-8"?>
+<RemoteSiteSetting xmlns="http://soap.sforce.com/2006/04/metadata">
+    <disableProtocolSecurity>false</disableProtocolSecurity>
+    <!-- ... -->
+</RemoteSiteSetting>
+        ]]></code>
+    </test-code>
+
+</test-data>
\ No newline at end of file
diff --git a/packages/code-analyzer-pmd-engine/pmd-rules/src/test/resources/sfca/rulesets/appexchange_xml/xml/AvoidInsecureHttpRemoteSiteSetting.xml b/packages/code-analyzer-pmd-engine/pmd-rules/src/test/resources/sfca/rulesets/appexchange_xml/xml/AvoidInsecureHttpRemoteSiteSetting.xml
index 96213e75..0414c8c8 100644
--- a/packages/code-analyzer-pmd-engine/pmd-rules/src/test/resources/sfca/rulesets/appexchange_xml/xml/AvoidInsecureHttpRemoteSiteSetting.xml
+++ b/packages/code-analyzer-pmd-engine/pmd-rules/src/test/resources/sfca/rulesets/appexchange_xml/xml/AvoidInsecureHttpRemoteSiteSetting.xml
@@ -5,32 +5,28 @@
         xsi:schemaLocation="http://pmd.sourceforge.net/rule-tests https://pmd.sourceforge.net/rule-tests_1_0_0.xsd">
 
     <test-code>
-        <description>When url contains http then violation should be reported</description>
+        <description>When url contains http, then report violation</description>
         <expected-problems>1</expected-problems>
-        <expected-linenumbers>6</expected-linenumbers>
+        <expected-linenumbers>4</expected-linenumbers>
         <expected-messages>
             <message>Avoid using insecure http urls in Remote Site Settings.</message>
         </expected-messages>
         <code><![CDATA[
 <?xml version="1.0" encoding="UTF-8"?>
 <RemoteSiteSetting xmlns="http://soap.sforce.com/2006/04/metadata">
-    <description>Used for Apex callout to mapping web service</description>
-    <disableProtocolSecurity>false</disableProtocolSecurity>
-    <isActive>true</isActive>
+    <!-- ... -->
     <url>http://www.maptestsite.net/mapping1</url>
 </RemoteSiteSetting>
         ]]></code>
     </test-code>
 
     <test-code>
-        <description>When url contains https then violation should not be reported</description>
+        <description>When url contains https, then do not report violation</description>
         <expected-problems>0</expected-problems>
         <code><![CDATA[
 <?xml version="1.0" encoding="UTF-8"?>
 <RemoteSiteSetting xmlns="http://soap.sforce.com/2006/04/metadata">
-    <description>Used for Apex callout to mapping web service</description>
-    <disableProtocolSecurity>false</disableProtocolSecurity>
-    <isActive>true</isActive>
+    <!-- ... -->
     <url>https://www.maptestsite.net/mapping1</url>
 </RemoteSiteSetting>
         ]]></code>
diff --git a/packages/code-analyzer-pmd-engine/pmd-rules/src/test/resources/sfca/rulesets/appexchange_xml/xml/AvoidJavaScriptCustomObject.xml b/packages/code-analyzer-pmd-engine/pmd-rules/src/test/resources/sfca/rulesets/appexchange_xml/xml/AvoidJavaScriptCustomObject.xml
new file mode 100644
index 00000000..bdbe9dbe
--- /dev/null
+++ b/packages/code-analyzer-pmd-engine/pmd-rules/src/test/resources/sfca/rulesets/appexchange_xml/xml/AvoidJavaScriptCustomObject.xml
@@ -0,0 +1,34 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<test-data
+        xmlns="http://pmd.sourceforge.net/rule-tests"
+        xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+        xsi:schemaLocation="http://pmd.sourceforge.net/rule-tests https://pmd.sourceforge.net/rule-tests_1_0_0.xsd">
+
+    <test-code>
+        <description>When JavaScript is in object custom button weblink, then report violation</description>
+        <expected-problems>1</expected-problems>
+        <expected-linenumbers>5</expected-linenumbers>
+        <code><![CDATA[
+<?xml version="1.0" encoding="UTF-8"?>
+<WebLink xmlns="http://soap.sforce.com/2006/04/metadata">
+    <!-- ... -->
+    <openType>onClickJavaScript</openType>
+    <url>alert(&quot;Show this alert!&quot;);</url>
+</WebLink>
+        ]]></code>
+    </test-code>
+
+    <test-code>
+        <description>When JavaScript is not in object custom button weblink, then do not report violation</description>
+        <expected-problems>0</expected-problems>
+        <code><![CDATA[
+<?xml version="1.0" encoding="UTF-8"?>
+<WebLink xmlns="http://soap.sforce.com/2006/04/metadata">
+    <!-- ... -->
+    <openType>newWindow</openType>
+    <url>https://example.com</url>
+</WebLink>
+        ]]></code>
+    </test-code>
+
+</test-data>
diff --git a/packages/code-analyzer-pmd-engine/pmd-rules/src/test/resources/sfca/rulesets/appexchange_xml/xml/AvoidJavaScriptHomePageComponent.xml b/packages/code-analyzer-pmd-engine/pmd-rules/src/test/resources/sfca/rulesets/appexchange_xml/xml/AvoidJavaScriptHomePageComponent.xml
new file mode 100644
index 00000000..7138eb22
--- /dev/null
+++ b/packages/code-analyzer-pmd-engine/pmd-rules/src/test/resources/sfca/rulesets/appexchange_xml/xml/AvoidJavaScriptHomePageComponent.xml
@@ -0,0 +1,49 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<test-data
+        xmlns="http://pmd.sourceforge.net/rule-tests"
+        xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+        xsi:schemaLocation="http://pmd.sourceforge.net/rule-tests https://pmd.sourceforge.net/rule-tests_1_0_0.xsd">
+
+    <test-code>
+        <description>Homepage component has javascript link, then report violation</description>
+        <expected-problems>1</expected-problems>
+        <expected-linenumbers>3</expected-linenumbers>
+        <code><![CDATA[
+<?xml version="1.0" encoding="UTF-8"?>
+<HomePageComponent xmlns="http://soap.sforce.com/2006/04/metadata">
+	<body>&lt;a href=javascript:alert(11)&gt;Hello World &lt;/a&gt;</body>
+    <pageComponentType>htmlArea</pageComponentType>
+</HomePageComponent>
+        ]]></code>
+    </test-code>
+
+    <test-code>
+        <description>When Homepage component has script tag, then report violation</description>
+        <expected-problems>1</expected-problems>
+        <expected-linenumbers>3</expected-linenumbers>
+        <code><![CDATA[
+<?xml version="1.0" encoding="UTF-8"?>
+<HomePageComponent xmlns="http://soap.sforce.com/2006/04/metadata">
+	<body>&lt;b&gt;Hello World &lt;/b&gt;
+		&lt;script&gt;
+		alert(99);
+		&lt;/script&gt;
+	</body>
+    <pageComponentType>htmlArea</pageComponentType>
+</HomePageComponent>
+        ]]></code>
+    </test-code>
+
+    <test-code>
+        <description>When Homepage component does not have script tag, then do not report violation</description>
+        <expected-problems>0</expected-problems>
+        <code><![CDATA[
+<?xml version="1.0" encoding="UTF-8"?>
+<HomePageComponent xmlns="http://soap.sforce.com/2006/04/metadata">
+	<body>&lt;b&gt;Hello World &lt;/b&gt;</body>
+    <pageComponentType>htmlArea</pageComponentType>
+</HomePageComponent>
+        ]]></code>
+    </test-code>
+
+</test-data>
diff --git a/packages/code-analyzer-pmd-engine/pmd-rules/src/test/resources/sfca/rulesets/appexchange_xml/xml/AvoidLmcIsExposedTrue.xml b/packages/code-analyzer-pmd-engine/pmd-rules/src/test/resources/sfca/rulesets/appexchange_xml/xml/AvoidLmcIsExposedTrue.xml
new file mode 100644
index 00000000..e6869fc2
--- /dev/null
+++ b/packages/code-analyzer-pmd-engine/pmd-rules/src/test/resources/sfca/rulesets/appexchange_xml/xml/AvoidLmcIsExposedTrue.xml
@@ -0,0 +1,32 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<test-data
+        xmlns="http://pmd.sourceforge.net/rule-tests"
+        xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+        xsi:schemaLocation="http://pmd.sourceforge.net/rule-tests https://pmd.sourceforge.net/rule-tests_1_0_0.xsd">
+
+    <test-code>
+        <description>When Lightning Message Channel has isExposed=true, then report violation</description>
+        <expected-problems>1</expected-problems>
+        <expected-linenumbers>4</expected-linenumbers>
+        <code><![CDATA[
+<?xml version="1.0" encoding="UTF-8"?>
+<LightningMessageChannel xmlns="http://soap.sforce.com/2006/04/metadata">
+    <!-- ... -->
+    <isExposed>true</isExposed>
+</LightningMessageChannel>
+        ]]></code>
+    </test-code>
+
+    <test-code>
+        <description>When Lightning Message Channel has isExposed=false, then do not report violation</description>
+        <expected-problems>0</expected-problems>
+        <code><![CDATA[
+<?xml version="1.0" encoding="UTF-8"?>
+<LightningMessageChannel xmlns="http://soap.sforce.com/2006/04/metadata">
+    <!-- ... -->
+    <isExposed>false</isExposed>
+</LightningMessageChannel>
+        ]]></code>
+    </test-code>
+
+</test-data>
diff --git a/packages/code-analyzer-pmd-engine/pmd-rules/src/test/resources/sfca/rulesets/appexchange_xml/xml/AvoidSControls.xml b/packages/code-analyzer-pmd-engine/pmd-rules/src/test/resources/sfca/rulesets/appexchange_xml/xml/AvoidSControls.xml
new file mode 100644
index 00000000..9ffb755f
--- /dev/null
+++ b/packages/code-analyzer-pmd-engine/pmd-rules/src/test/resources/sfca/rulesets/appexchange_xml/xml/AvoidSControls.xml
@@ -0,0 +1,19 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<test-data
+        xmlns="http://pmd.sourceforge.net/rule-tests"
+        xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+        xsi:schemaLocation="http://pmd.sourceforge.net/rule-tests https://pmd.sourceforge.net/rule-tests_1_0_0.xsd">
+
+    <test-code>
+        <description>When SControls are found in the code, then report violation.</description>
+        <expected-problems>1</expected-problems>
+        <expected-linenumbers>2</expected-linenumbers>
+        <code><![CDATA[
+<?xml version="1.0" encoding="UTF-8"?>
+<Scontrol xmlns="http://soap.sforce.com/2006/04/metadata">
+    <!-- ... -->
+</Scontrol>
+        ]]></code>
+    </test-code>
+
+</test-data>
diff --git a/packages/code-analyzer-pmd-engine/pmd-rules/src/test/resources/sfca/rulesets/appexchange_xml/xml/LimitConnectedAppScope.xml b/packages/code-analyzer-pmd-engine/pmd-rules/src/test/resources/sfca/rulesets/appexchange_xml/xml/LimitConnectedAppScope.xml
new file mode 100644
index 00000000..9d0225bc
--- /dev/null
+++ b/packages/code-analyzer-pmd-engine/pmd-rules/src/test/resources/sfca/rulesets/appexchange_xml/xml/LimitConnectedAppScope.xml
@@ -0,0 +1,43 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<test-data
+        xmlns="http://pmd.sourceforge.net/rule-tests"
+        xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+        xsi:schemaLocation="http://pmd.sourceforge.net/rule-tests https://pmd.sourceforge.net/rule-tests_1_0_0.xsd">
+
+    <test-code>
+        <description>When Connected App uses FULL scope, then report violation</description>
+        <expected-problems>1</expected-problems>
+        <expected-linenumbers>9</expected-linenumbers>
+        <code><![CDATA[
+<?xml version="1.0" encoding="UTF-8"?>
+<ConnectedApp xmlns="http://soap.sforce.com/2006/04/metadata">
+    <!-- ... -->
+    <oauthConfig>
+        <!-- ... -->
+        <scopes>Basic</scopes>
+        <scopes>Api</scopes>
+        <scopes>RefreshToken</scopes>
+        <scopes>Full</scopes>
+    </oauthConfig>
+</ConnectedApp>
+        ]]></code>
+    </test-code>
+
+    <test-code>
+        <description>When Connected App does not use FULL scope, then do not report violation</description>
+        <expected-problems>0</expected-problems>
+        <code><![CDATA[
+<?xml version="1.0" encoding="UTF-8"?>
+<ConnectedApp xmlns="http://soap.sforce.com/2006/04/metadata">
+    <!-- ... -->
+    <oauthConfig>
+        <!-- ... -->
+        <scopes>Basic</scopes>
+        <scopes>Api</scopes>
+        <scopes>RefreshToken</scopes>
+    </oauthConfig>
+</ConnectedApp>
+        ]]></code>
+    </test-code>
+
+</test-data>
diff --git a/packages/code-analyzer-pmd-engine/pmd-rules/src/test/resources/sfca/rulesets/appexchange_xml/xml/UseHttpsCallbackUrl.xml b/packages/code-analyzer-pmd-engine/pmd-rules/src/test/resources/sfca/rulesets/appexchange_xml/xml/UseHttpsCallbackUrl.xml
new file mode 100644
index 00000000..7657427e
--- /dev/null
+++ b/packages/code-analyzer-pmd-engine/pmd-rules/src/test/resources/sfca/rulesets/appexchange_xml/xml/UseHttpsCallbackUrl.xml
@@ -0,0 +1,58 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<test-data
+        xmlns="http://pmd.sourceforge.net/rule-tests"
+        xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+        xsi:schemaLocation="http://pmd.sourceforge.net/rule-tests https://pmd.sourceforge.net/rule-tests_1_0_0.xsd">
+
+    <test-code>
+        <description>If Connected App has unsafe callback, then report violation</description>
+        <expected-problems>1</expected-problems>
+        <expected-linenumbers>6</expected-linenumbers>
+        <code><![CDATA[
+<?xml version="1.0" encoding="UTF-8"?>
+<ConnectedApp xmlns="http://soap.sforce.com/2006/04/metadata">
+    <!-- ... -->
+    <oauthConfig>
+        <!-- ... -->
+	    <callbackUrl>http://example.com/redirect</callbackUrl>
+    </oauthConfig>
+</ConnectedApp>
+        ]]></code>
+    </test-code>
+
+    <test-code>
+        <description>If Connected App has even just one unsafe callback url, then report violation</description>
+        <expected-problems>1</expected-problems>
+        <expected-linenumbers>6</expected-linenumbers>
+        <code><![CDATA[
+<?xml version="1.0" encoding="UTF-8"?>
+<ConnectedApp xmlns="http://soap.sforce.com/2006/04/metadata">
+    <!-- ... -->
+    <oauthConfig>
+        <!-- ... -->
+	    <callbackUrl>
+	        https://test.example.com/redirect
+            http://test.example.com:8080/redirect
+            https://api.example.com:8080/redirect
+        </callbackUrl>
+    </oauthConfig>
+</ConnectedApp>
+        ]]></code>
+    </test-code>
+
+    <test-code>
+        <description>Connected App with unsafe callback url False positive</description>
+        <expected-problems>0</expected-problems>
+        <code><![CDATA[
+<?xml version="1.0" encoding="UTF-8"?>
+<ConnectedApp xmlns="http://soap.sforce.com/2006/04/metadata">
+    <!-- ... -->
+    <oauthConfig>
+        <!-- ... -->
+        <callbackUrl>https://login.salesforce.com/services/oauth2/callback</callbackUrl>
+    </oauthConfig>
+</ConnectedApp>
+        ]]></code>
+    </test-code>
+
+</test-data>
\ No newline at end of file
diff --git a/packages/code-analyzer-pmd-engine/src/constants.ts b/packages/code-analyzer-pmd-engine/src/constants.ts
index 4bb3ef15..75c920ee 100644
--- a/packages/code-analyzer-pmd-engine/src/constants.ts
+++ b/packages/code-analyzer-pmd-engine/src/constants.ts
@@ -26,7 +26,6 @@ export enum Language {
 //    * Typescript ('typescript') Language Module [CPD Only - No PMD Support]: https://github.com/pmd/pmd/blob/master/pmd-javascript/src/main/java/net/sourceforge/pmd/lang/typescript/TsLanguageModule.java
 //    * Visualforce ('visualforce') Language Model [CPD+PMD]: https://github.com/pmd/pmd/blob/master/pmd-visualforce/src/main/java/net/sourceforge/pmd/lang/visualforce/VfLanguageModule.java
 //    * XML ('xml') Language Model [CPD+PMD]: https://github.com/pmd/pmd/blob/master/pmd-xml/src/main/java/net/sourceforge/pmd/lang/xml/XmlLanguageModule.java
-//   Additionally, we must support the file extensions that the AppExchange rules want to also process per language.
 export const DEFAULT_FILE_EXTENSIONS: Record<Language, string[]> = {
     [Language.APEX]: [
         // From PMD's ApexLanguageModule:
@@ -58,15 +57,7 @@ export const DEFAULT_FILE_EXTENSIONS: Record<Language, string[]> = {
 
     [Language.XML]: [
         // FROM PMD's XmlLanguageModule:
-        '.xml',
-
-        // Salesforce metadata file extensions to associate to XML language, specifically for the AppExchange rules:
-        //   Note: The metadata api pages over at
-        //           https://developer.salesforce.com/docs/atlas.en-us.api_meta.meta/api_meta/meta_types_list.htm
-        //         helps to list the file extensions for each metadata type. For example, the RemoteSiteSettings page
-        //           https://developer.salesforce.com/docs/atlas.en-us.api_meta.meta/api_meta/meta_remotesitesetting.htm
-        //         specifies that .remoteSite is the file extension for remote site settings files.
-        '.remoteSite'
+        '.xml'
     ]
 }
 
diff --git a/packages/code-analyzer-pmd-engine/src/pmd-rule-mappings.ts b/packages/code-analyzer-pmd-engine/src/pmd-rule-mappings.ts
index 75ab4e5d..ebc30dc2 100644
--- a/packages/code-analyzer-pmd-engine/src/pmd-rule-mappings.ts
+++ b/packages/code-analyzer-pmd-engine/src/pmd-rule-mappings.ts
@@ -398,8 +398,58 @@ export const RULE_MAPPINGS: Record<string, {severity: SeverityLevel, tags: strin
     // =================================================================================================================
     //   SFCA-PMD-RULES - APPEXCHANGE XML RULES
     // =================================================================================================================
+    "AvoidApiSessionId": {
+        severity: SeverityLevel.High,
+        tags: [/* NOT RECOMMENDED */  APP_EXCHANGE_TAG, COMMON_TAGS.CATEGORIES.SECURITY, COMMON_TAGS.LANGUAGES.XML]
+    },
+
+    "AvoidAuraWithLockerDisabled": {
+        severity: SeverityLevel.Critical,
+        tags: [/* NOT RECOMMENDED */  APP_EXCHANGE_TAG, COMMON_TAGS.CATEGORIES.SECURITY, COMMON_TAGS.LANGUAGES.XML]
+    },
+
+    "AvoidDisableProtocolSecurity": {
+        severity: SeverityLevel.Moderate,
+        tags: [/* NOT RECOMMENDED */  APP_EXCHANGE_TAG, COMMON_TAGS.CATEGORIES.SECURITY, COMMON_TAGS.LANGUAGES.XML]
+    },
+
     "AvoidInsecureHttpRemoteSiteSetting": {
         severity: SeverityLevel.Moderate,
         tags: [/* NOT RECOMMENDED */  APP_EXCHANGE_TAG, COMMON_TAGS.CATEGORIES.SECURITY, COMMON_TAGS.LANGUAGES.XML]
+    },
+
+    "AvoidJavaScriptCustomObject": {
+        severity: SeverityLevel.High,
+        tags: [/* NOT RECOMMENDED */  APP_EXCHANGE_TAG, COMMON_TAGS.CATEGORIES.SECURITY, COMMON_TAGS.LANGUAGES.XML]
+    },
+
+    "AvoidJavaScriptHomePageComponent": {
+        severity: SeverityLevel.High,
+        tags: [/* NOT RECOMMENDED */  APP_EXCHANGE_TAG, COMMON_TAGS.CATEGORIES.SECURITY, COMMON_TAGS.LANGUAGES.XML]
+    },
+
+    "AvoidLmcIsExposedTrue": {
+        severity: SeverityLevel.High,
+        tags: [/* NOT RECOMMENDED */  APP_EXCHANGE_TAG, COMMON_TAGS.CATEGORIES.SECURITY, COMMON_TAGS.LANGUAGES.XML]
+    },
+
+    "AvoidSControls": {
+        severity: SeverityLevel.Critical,
+        tags: [/* NOT RECOMMENDED */  APP_EXCHANGE_TAG, COMMON_TAGS.CATEGORIES.SECURITY, COMMON_TAGS.LANGUAGES.XML]
+    },
+
+    "LimitConnectedAppScope": {
+        severity: SeverityLevel.Moderate,
+        tags: [/* NOT RECOMMENDED */  APP_EXCHANGE_TAG, COMMON_TAGS.CATEGORIES.SECURITY, COMMON_TAGS.LANGUAGES.XML]
+    },
+
+    "ProtectSensitiveData": {
+        severity: SeverityLevel.Moderate,
+        tags: [/* NOT RECOMMENDED */  APP_EXCHANGE_TAG, COMMON_TAGS.CATEGORIES.SECURITY, COMMON_TAGS.LANGUAGES.XML]
+    },
+
+    "UseHttpsCallbackUrl": {
+        severity: SeverityLevel.Moderate,
+        tags: [/* NOT RECOMMENDED */  APP_EXCHANGE_TAG, COMMON_TAGS.CATEGORIES.SECURITY, COMMON_TAGS.LANGUAGES.XML]
     }
 }
\ No newline at end of file
diff --git a/packages/code-analyzer-pmd-engine/test/test-data/pmdGoldfiles/rules_allLanguages.goldfile.json b/packages/code-analyzer-pmd-engine/test/test-data/pmdGoldfiles/rules_allLanguages.goldfile.json
index 77e41a0f..18b0c913 100644
--- a/packages/code-analyzer-pmd-engine/test/test-data/pmdGoldfiles/rules_allLanguages.goldfile.json
+++ b/packages/code-analyzer-pmd-engine/test/test-data/pmdGoldfiles/rules_allLanguages.goldfile.json
@@ -231,6 +231,28 @@
       "https://docs.pmd-code.org/pmd-doc-{{PMD_VERSION}}/pmd_rules_ecmascript_codestyle.html#assignmentinoperand"
     ]
   },
+  {
+    "name": "AvoidApiSessionId",
+    "severityLevel": 2,
+    "tags": [
+      "AppExchange",
+      "Security",
+      "Xml"
+    ],
+    "description": "Detects use of Api.Session_ID or GETSESSIONID() to retrieve a session ID.",
+    "resourceUrls": []
+  },
+  {
+    "name": "AvoidAuraWithLockerDisabled",
+    "severityLevel": 1,
+    "tags": [
+      "AppExchange",
+      "Security",
+      "Xml"
+    ],
+    "description": "Detects use of API versions with Lightning Locker disabled in Aura components. Use API version 40 or greater.",
+    "resourceUrls": []
+  },
   {
     "name": "AvoidConsoleStatements",
     "severityLevel": 3,
@@ -282,6 +304,17 @@
       "https://docs.pmd-code.org/pmd-doc-{{PMD_VERSION}}/pmd_rules_apex_errorprone.html#avoiddirectaccesstriggermap"
     ]
   },
+  {
+    "name": "AvoidDisableProtocolSecurity",
+    "severityLevel": 3,
+    "tags": [
+      "AppExchange",
+      "Security",
+      "Xml"
+    ],
+    "description": "Detects if \"Disable Protocol Security\" setting is true.",
+    "resourceUrls": []
+  },
   {
     "name": "AvoidGlobalModifier",
     "severityLevel": 3,
@@ -328,7 +361,40 @@
       "Security",
       "Xml"
     ],
-    "description": "Detects instances of a Remote Site Settings that use HTTP.Use HTTPS instead.",
+    "description": "Detects instances of a Remote Site Settings that use HTTP. Use HTTPS instead.",
+    "resourceUrls": []
+  },
+  {
+    "name": "AvoidJavaScriptCustomObject",
+    "severityLevel": 2,
+    "tags": [
+      "AppExchange",
+      "Security",
+      "Xml"
+    ],
+    "description": "Detects use of custom JavaScript actions in custom rules.",
+    "resourceUrls": []
+  },
+  {
+    "name": "AvoidJavaScriptHomePageComponent",
+    "severityLevel": 2,
+    "tags": [
+      "AppExchange",
+      "Security",
+      "Xml"
+    ],
+    "description": "Detects use of custom JavaScript actions in home page components.",
+    "resourceUrls": []
+  },
+  {
+    "name": "AvoidLmcIsExposedTrue",
+    "severityLevel": 2,
+    "tags": [
+      "AppExchange",
+      "Security",
+      "Xml"
+    ],
+    "description": "Detects a Lightning Message Channel with isExposed=true, which isn’t allowed in managed packages.",
     "resourceUrls": []
   },
   {
@@ -370,6 +436,17 @@
       "https://docs.pmd-code.org/pmd-doc-{{PMD_VERSION}}/pmd_rules_apex_performance.html#avoidnonrestrictivequeries"
     ]
   },
+  {
+    "name": "AvoidSControls",
+    "severityLevel": 1,
+    "tags": [
+      "AppExchange",
+      "Security",
+      "Xml"
+    ],
+    "description": "Detects if S-Controls are used since they should not be used in managed packages.",
+    "resourceUrls": []
+  },
   {
     "name": "AvoidTrailingComma",
     "severityLevel": 2,
@@ -738,6 +815,17 @@
       "https://docs.pmd-code.org/pmd-doc-{{PMD_VERSION}}/pmd_rules_ecmascript_errorprone.html#inaccuratenumericliteral"
     ]
   },
+  {
+    "name": "LimitConnectedAppScope",
+    "severityLevel": 3,
+    "tags": [
+      "AppExchange",
+      "Security",
+      "Xml"
+    ],
+    "description": "Detects if a connected app uses full scope instead of limited scope. Explain this use case in your AppExchange security review submission.",
+    "resourceUrls": []
+  },
   {
     "name": "LocalVariableNamingConventions",
     "severityLevel": 3,
@@ -916,6 +1004,17 @@
       "https://docs.pmd-code.org/pmd-doc-{{PMD_VERSION}}/pmd_rules_apex_codestyle.html#propertynamingconventions"
     ]
   },
+  {
+    "name": "ProtectSensitiveData",
+    "severityLevel": 3,
+    "tags": [
+      "AppExchange",
+      "Security",
+      "Xml"
+    ],
+    "description": "Detects where sensitive data must be stored with Protected Custom metadata or Protected Custom settings. Protected custom settings or protected custom metadata should be used to store secrets. Refer to the \"Protect Secrets Using Platform Features\" Trailhead module for more guidance.",
+    "resourceUrls": []
+  },
   {
     "name": "QueueableWithoutFinalizer",
     "severityLevel": 4,
@@ -1077,6 +1176,17 @@
       "https://docs.pmd-code.org/pmd-doc-{{PMD_VERSION}}/pmd_rules_ecmascript_bestpractices.html#usebasewithparseint"
     ]
   },
+  {
+    "name": "UseHttpsCallbackUrl",
+    "severityLevel": 3,
+    "tags": [
+      "AppExchange",
+      "Security",
+      "Xml"
+    ],
+    "description": "Detects instances of an OAuth callback URL that uses HTTP. Use HTTPS instead.",
+    "resourceUrls": []
+  },
   {
     "name": "VfCsrf",
     "severityLevel": 2,