ADVPL/TLPP Code Review

Overview

Systematic code review methodology for ADVPL/TLPP on TOTVS Protheus. This skill provides structured rules to identify issues related to best practices, performance bottlenecks, security vulnerabilities, and modernization opportunities in existing codebases.

When to Use

• Reviewing ADVPL/TLPP source code before merge or deploy
• Auditing existing code for quality and compliance
• Identifying performance bottlenecks in slow routines
• Checking for security vulnerabilities (SQL injection, credential exposure)
• Evaluating code for migration readiness from .prw to .tlpp
• Onboarding reviews to enforce team coding standards

Review Categories

Output Format

Each finding must include:

[RULE-ID] SEVERITY: Brief description
  File: filename.prw (line XX)
  Issue: What was found
  Fix: How to correct it

Severity Levels

Review Process

1. Scan includes and headers - Check for obsolete includes (Protheus.ch vs TOTVS.CH), missing documentation headers
2. Analyze variable declarations - Verify scope (Local preferred), naming conventions (Hungarian notation)
3. Check database operations - Validate RecLock/MsUnlock pairing, GetArea/RestArea usage, error handling around DB ops
4. Evaluate queries - Review Embedded SQL for SELECT *, proper macro usage (%exp:, %table:, %notDel%), index alignment
5. Inspect security surface - Look for SQL injection vectors, hardcoded credentials, sensitive data in logs, unvalidated REST input
6. Assess modernization - Identify candidates for TLPP migration, OOP refactoring, modern UI patterns

Rule ID Format

References

• rules-best-practices.md - Best practice rules with detection patterns and code examples
• rules-performance.md - Performance rules with detection patterns and code examples
• rules-security.md - Security rules with detection patterns and code examples
• rules-modernization.md - Modernization rules with detection patterns and code examples