2

I got the security scan report, in that, they mentioned 'Test Methods With No Assert' for method 'doInvoke()' method of WebServiceMock Interface.

The 'doInvoke()' is not test method but it is a mock interface method which is used to mock the SOAP API-Callout.

Also there is a getter/setter variable in test class, for that also i got 'Test Methods With No Assert'.

e.g.

@isTest

private class ABC {

    static BV_Behavior_Mapping__c bm {get; set;}    
//got 'Test Methods With No Assert' for this variable
    ---

}

Does anyone know why security scan gives 'Test Methods With No Assert' for method 'doInvoke() and getter/setter variable?

4

Thats called false positive .Ideally just to keep Checkmarks Scanner happy you can write below in methods which scanner has caught without asserts just to keep Checkmarks Scanner happy

system.assert(true);

Scanner just looks for all apex and sees if no assert found just throws exception

  • 3
    Or... Don't worry about it. If it's for an appexhange app, the security team can tell it's a false positive. – sfdcfox Jan 27 '16 at 15:02
  • 1
    I think that you can just justify it to the security team in a written explanation – mkorman Jan 27 '16 at 16:31

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.