How Good Can AL Code Get? — A Live ISO 5055 Review

Overview

The video describes a code review service built on two parts: ISO 5055, a language-independent standard with 119 rules, not all of which fit AL, and a custom set of AL-specific rules. Stefan Maron first covers the default AppSource analyzers and AL Cops, then shows a proprietary analyzer that produces about 500 diagnostics mapped to ISO 5055 and CWE. The source code of that analyzer is not shared.

He then goes through findings on sample code: CWE 732 permissions, read isolation, CWE 1083 data access, field assignment order, logging, isolated storage, hard-coded values, magic numbers, boolean operator precedence, error info, unchecked return values, find set without filters, delete all with is empty, case without else, and HTTP client timeouts. He notes that the project is still changing, some rules are under review, and findings need manual review. He says the analyzer is too noisy for continuous integration and that the signed report is aimed at management.

Key points

• ISO 5055 has 119 rules, and not all of them fully apply to AL. The review adds a custom AL rule set on top.
• The proprietary analyzer gives about 500 diagnostics mapped to ISO 5055 and CWE. It is not published, is not enabled in the author’s daily development, and is meant to surface findings for a manual review.
• Read isolation rule: reads without explicit read isolation default to escalated update locks, which can degrade concurrency under load. A related rule about relying on the primary key when no current key is set is under review and may be removed.
• Field assignment order should follow the page pattern: init, validate primary key fields, insert(true), then validate the remaining fields and modify(true). Exceptions should be documented.
• Use error info with navigate actions and custom dimensions instead of plain errors to give users fix-it actions and give support more context.
• Flagged patterns include find set without filters, delete all without an is empty check, case statements without else, unchecked return values, hard-coded literals and URLs, and HTTP client calls without an explicit timeout. Intentional cases, such as upgrade codeunits, can be documented as accepted.
• Mixed AND and OR without parentheses is flagged. The presenter could not find documentation on AL precedence and recommends parentheses for readability. Findings can be false positives and need manual review.

Features

AL objects mentioned

As heard in the captions. A name that matches one object page by exact type and name links to it; the others stay as named.

• other “Review Analyzer” at 10:03
• codeunit “ISO store manager” at 23:02
• other “error info” at 39:15
• other “codeunit run” at 41:40
• other “extension license” at 46:34
• other “update lock” at 50:06
• other “delete all” at 52:21
• other “lock table” at 54:53
• other “JSON get” at 56:53

Not found in BC28-30: codeunit “ISO store manager”.

Quotes

• 3:38 “this review that I do runs against. And it basically contains two different uh areas. one is uh basically derived from ISO 5055 which”
• 4:19 “and this has 119 rules. Now this is annoying. Um I have evaluated all of them in detail and not all of them are”
• 9:51 “So, what I’ve built is a proprietary analyzer. I won’t share the source code of, but I can show you a little bit of”
• 11:37 “So if we what was it 732 we go onto this one second incorrect permission assignment permission sets grant brower access then intended expose”
• 13:11 “missing expl explicit read isolation on record read. So read reads without explicit read isolation defaults to escalate update locks invisibly causing concurrency degradation”

Disclaimers in the video

• 13:38 subject-to-change: this rule is also under review. I think I will update this and remove this because it doesn’t make that much sense.
• 14:33 subject-to-change: That’s why this rule is uh also under review. I think I will update this and remove this because it …
• 21:21 subject-to-change: telemetry here needs an update because I’ve uh I’ve changed the rule a little bit recently
• 24:12 coming-later: Once we would get an event like this, I would probably add this uh this coverage to this rule
• 1:04:54 subject-to-change: This is a living project. Um the automatic review obviously doesn’t surface what are false positives

Presenters (as heard): Jeremy, Hayden.