2

I got the security scan report, in that, they mentioned 'Test Methods With No Assert' for method 'doInvoke()' method of WebServiceMock Interface.

The 'doInvoke()' is not test method but it is a mock interface method which is used to mock the SOAP API-Callout.

Also there is a getter/setter variable in test class, for that also i got 'Test Methods With No Assert'.

e.g.

@isTest

private class ABC {

    static BV_Behavior_Mapping__c bm {get; set;}    
//got 'Test Methods With No Assert' for this variable
    ---

}

Does anyone know why security scan gives 'Test Methods With No Assert' for method 'doInvoke() and getter/setter variable?

1 Answer 1

4

Thats called false positive .Ideally just to keep Checkmarks Scanner happy you can write below in methods which scanner has caught without asserts just to keep Checkmarks Scanner happy

system.assert(true);

Scanner just looks for all apex and sees if no assert found just throws exception

2
  • 3
    Or... Don't worry about it. If it's for an appexhange app, the security team can tell it's a false positive.
    – sfdcfox
    Jan 27, 2016 at 15:02
  • 1
    I think that you can just justify it to the security team in a written explanation
    – mkorman
    Jan 27, 2016 at 16:31

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .