Take the 2-minute tour ×
Salesforce Stack Exchange is a question and answer site for Salesforce administrators, implementation experts, developers and anybody in-between. It's 100% free, no registration required.

I've submitted my application for Security Review and I've got this problem in the report.
I'm not sure how to fix it.

Let's see the First case:
I have some classes that don't have any code like this one:

public with sharing class MyClass{  
    public MyClass(){
    }
}

Why this class does not have any code?
At some time this class was included in a managed package, but later the class and it's code became deprecated and it was all cleared. But since the class is already on the package I didn't delete it.

Second case:

I have some classes that extends a Expection like this one:

public with sharing class MyClassException extends Exception{
}

So. What can I do to fix the this problem and get my app submitted?

share|improve this question
    
Out of interest, if you just shove in a rubbish method does that eliminate the warning? something like public String GetBubbles() { return 'Bub'; } –  LaceySnr Feb 4 '13 at 23:43
add comment

2 Answers

  • You can delete your classes, so long as they are not public. This not always the case, so thus maybe why you didn't delete them before. But you can now.
  • Regarding the Exception class, obviously you have a need for this. I have to confess I've never seen the 'Incomplete code blocks vulnerability', nor can find a reference to it, unlike the others the SF Security team flag. Personally I would say it has a obvious case for a 'false positive' discussion with them, it's clearly a pattern the docs suggest. Though without the 'with sharing' perhaps? Could you maybe share more info you got from the SF security report on this in your answer?
share|improve this answer
1  
The tool is definitely susceptible to false positives and I can confirm that if you file a case and have a chat on the phone it's easy enough to get the go-ahead to submit. –  LaceySnr Feb 4 '13 at 23:42
    
I didn't received any info about this. All I got was a list of classes with this vunerability –  Ivo Rocha Feb 5 '13 at 10:00
    
That is strange, normally the report is very clear about the issue it is highlighting. Its hard to help further without this to be honest. Only thing I still recommend is to discuss with them to find out more. –  Andrew Fawcett Feb 6 '13 at 10:08
add comment

What exactly is the error you are getting flagged with, and from which tool? I have several "empty" exception classes such as your second example and never saw those get flagged from the security scanner.

The first example should not be a problem either; if it is getting flagged by the code scanner it's clearly a false positive.

If you're really worried about it, book office hours with the security team or email them at securecloud@salesforce.com - they are very responsive.

share|improve this answer
    
This was an problem sent on the report from the security review team. Via checkmarx I didn't get any issue, or any other tool. –  Ivo Rocha Feb 5 '13 at 9:18
    
You mean they manually flagged it as a security issue? Did they explain what the vulnerability is?? I don't know why they would flag an empty class as a security issue. I'd suggest scheduling office hours to discuss with them, and please post here what the ultimate resolution is. –  jkraybill Feb 5 '13 at 23:31
    
Yes. they manually flagged it as a security issue. I already talked with them about this, and they said "If this class is empty probably it will have code some day, and for now it does not have any purpose", then I explan that those classes are deprecated, except the Exceptions classes. –  Ivo Rocha Feb 6 '13 at 18:06
    
That is really inane. If any security review people read this, please stop flagging empty classes as some sort of a security risk. They are not, and there are many legitimate use cases for empty classes. @Ivo - I'd suggest the easiest fix is to add some silly code to them, like String getName() { return 'classname'; } –  jkraybill Feb 7 '13 at 4:17
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.