PMD Integration with DefectDojo
PMD is an extensible open-source static code analyzer that detects common programming flaws including unused variables, empty catch blocks, unnecessary object creation, code quality issues, and security vulnerabilities across 16+ programming languages with primary focus on Java, Apex, and JavaScript through over 400 built-in rules. The tool parses source files into Abstract Syntax Trees and executes customizable rulesets to identify violations, integrating seamlessly into IDEs, CI/CD pipelines, and build tools including Maven, Gradle, Jenkins, and GitHub Actions, while also including CPD (Copy-Paste Detector) to identify code duplication across multiple languages, enabling development teams to enforce coding standards and improve code maintainability throughout the software development lifecycle.
Data Granularity: What Gets Imported
The following fields are captured from PMD results and surfaced in DefectDojo findings:
| Field | Source | Notes |
|---|---|---|
| Title | Finding name from the scan | Matched to the tool's own naming |
| Severity | Critical / High / Medium / Low / Info | Mapped from the tool's own severity scale |
| Description | Finding detail from the report | Includes what the issue is and why it matters |
| Mitigation | Remediation guidance | Where the tool provides it |
Importing Into DefectDojo
Use the DefectDojo import API to create a new Test under the relevant Engagement for your product. The request body:
{
"scan_type": "PMD",
"engagement": "<engagement-id>",
"file": "results.json"
}