AGENTFORCE-25.4: CSRF via ApexPages Parameter DML

🔴 High · CSRF

Detects Apex controllers that perform DML based on ApexPages URL parameters — classic Visualforce CSRF when paired with apex:page action="{!...}".

Details

Field	Value
Rule ID	AGENTFORCE-25.4
Severity	High
Category	CSRF

Remediation

Do not run DML from page action methods. Use apex:form POST with CSRF tokens, or require an explicit commandButton invoke.

See Also

• Rule catalog index
• Scanning basics
• SARIF output