Security scanner: enforcing CRUD. Auto scanner reported issue

Question

I have a question here regarding to Security scan: enforcing CRUD. For the example case deletion, but we also have problems with update and creation.

Before I delete a record, I apply deletable check for the custom object, like:

Schema.sObjectType.customObject.isDeletable();

Which works fine for single record.

But if I use something like following and delete a list at one action, the automatic security scanner reports an issue: CRUD Delete - Apex Serious Security Risk.

if(Schema.sObjectType.customObject.isDeletable()){
    List<Database.Deleteresult> deleteResults = Database.delete(customObjectList);            
    System.Debug('Delete Result'+deleteResults);
  }

customObjectList is set correctly and the code executes WITHOUT any problem. Just the security scanner doesn't recognize the deletable check and reports issue.

Same for create and update. Reported issues like following:

Object: customObjectList in file: /classes/DummySearch.cls

    L 54: List<Database.Deleteresult> deleteResults =  Database.delete(customObjectList);

Any advice/workaround I can fix this problem and pass the security scan? Thank you very much in advance.

Scanner Link: http://security.force.com/sourcescanner

Answer 1

I believe if you think you have the CRUD check in place and you still get the alert, it is better to give a false positive document along with the report to Salesforce while doing a AppExchange release.

We had the same issue last time we released our App and it was accepted. We still have the same list this time as well and we hope the same happens.

Note: This is happening not just for delete, but also for FLS Create and Update as well. As far as the scanner is concerned, I think its still in the nascent stage and has a lot of such issues.

Peace!