##### Overview

- Download PMD 3.9
- What's new in PMD 3.9
- PMD in the news
- PMD-related products and books
- Best practices
- Future directions
- Similar projects
- Credits
- License
- What does 'PMD' mean?

##### Usage

- Installation
- Command line usage
- Ant task usage
- Maven plugin usage
- IDE plugin usage
- Suppressing warnings
- Finding duplicated code
- JSP support

##### Customizing PMD

- Compiling PMD
- How to write a rule
- Writing XPath rules
- How to make a rule set
- How it works

##### For example

- Run PMD on a Sourceforge project

##### Rule Sets

- Index
- Basic
- Braces
- Code Size
- Clone
- Controversial
- Coupling
- Design
- Finalizers
- Import Statements
- J2EE
- Javabeans
- JUnit Tests
- Logging (Java)
- Logging (Jakarta)
- Migrating
- Naming
- Optimizations
- Strict Exceptions
- Strings
- Sun Security
- Unused Code
- Java Server Pages
- Java Server Faces

##### Project Documentation

- About PMD
- Project Info
- Project Reports
- Development Process

## Security Code Guidelines

These rules check the security guidelines from Sun, published at http://java.sun.com/security/seccodeguide.html#gcg

### MethodReturnsInternalArray

Exposing internal arrays directly allows the user to modify some code that could be critical. It is safer to return a copy of the array.

This rule is defined by the following Java class: net.sourceforge.pmd.rules.sunsecure.MethodReturnsInternalArray

Here's an example of code that would trigger this rule:

    public class SecureSystem {
      UserData [] ud;
      public UserData [] getUserData() {
          // Don't return directly the internal array, return a copy
          return ud;
      }
    }

### ArrayIsStoredDirectly

Constructors and methods receiving arrays should clone objects and store the copy. This prevents that future changes from the user affect the internal functionality.

This rule is defined by the following Java class: net.sourceforge.pmd.rules.sunsecure.ArrayIsStoredDirectly

Here's an example of code that would trigger this rule:

    public class Foo {
     private String [] x;
      public void foo (String [] param) {
          // Don't do this, make a copy of the array at least
          this.x=param;
      }
    }