Overview
This rule flags the use of inline JavaScript in Visualforce pages, Lightning components, or any part of your Salesforce UI layer. Inline JavaScript refers to JavaScript code embedded directly within <script> tags in HTML or component markup instead of being referenced from a static resource or external file.
Code reviews classifies this as an Error because inline JavaScript poses security vulnerabilities notably Cross Site Scripting (XSS) and violates Salesforce’s Locker Service and Lightning Web Security standards. It also undermines code organization and reusability.
Why This Matters
Inline JavaScript:
Increases XSS risk, especially when it handles dynamic user input
Violates Salesforce security policies, including CSP (Content Security Policy) in Lightning
Cannot be cached or reused, leading to performance inefficiencies
Complicates testing and maintenance, as logic is buried in markup
Blocks Locker compliant and secure development, limiting component interoperability
Salesforce strongly recommends using static resources or module based scripts to ensure security and maintainability.
What Triggers This Rule
Cod reviews flags UI components where:
JavaScript is written directly within
<script>tags in a Visualforce page or Aura componentEvent handlers are defined inline, such as
onclick="doSomething()"Script blocks are embedded without CSP safe references or encapsulation
Example of a Violation
<apex:page>
<script>
alert('This is inline JavaScript'); // ❌ Vulnerable and non compliant
</script>
</apex:page>
Recommended Approach
Move JavaScript logic to a static resource or use Lightning Web Components (LWC) with scoped, modular scripts.
Best Practice (Static Resource)
<apex:includeScript value="{!URLFOR($Resource.MyCustomJS)}" />Or, in LWC:
// myComponent.js handleClick() { console.log('Handled securely in component JS'); }This allows your JavaScript to follow platform security rules and be reused cleanly across components.
Summary
Inline JavaScript introduces critical security risks and should be avoided entirely in Salesforce development. Use static resources or component based scripts to ensure secure, modular, and maintainable front end logic. Code Reviews flags this as an Error to protect your application from vulnerabilities and enforce best practices.