1

I have a question here regarding to Security scan: enforcing CRUD. For the example case deletion, but we also have problems with update and creation.

Before I delete a record, I apply deletable check for the custom object, like:

Schema.sObjectType.customObject.isDeletable();

Which works fine for single record.

But if I use something like following and delete a list at one action, the automatic security scanner reports an issue: CRUD Delete - Apex Serious Security Risk.

if(Schema.sObjectType.customObject.isDeletable()){
    List<Database.Deleteresult> deleteResults = Database.delete(customObjectList);            
    System.Debug('Delete Result'+deleteResults);
  }

customObjectList is set correctly and the code executes WITHOUT any problem. Just the security scanner doesn't recognize the deletable check and reports issue.

Same for create and update. Reported issues like following:

Object: customObjectList in file: /classes/DummySearch.cls

    L 54: List<Database.Deleteresult> deleteResults =  Database.delete(customObjectList);

Any advice/workaround I can fix this problem and pass the security scan? Thank you very much in advance.

Scanner Link: http://security.force.com/sourcescanner

2
  • Is your code being called in a class without sharing or unspecified sharing?
    – sfdcfox
    Oct 8 '16 at 2:22
  • The code is in class with sharing. Some logic is span through multiple methods/classes but all with sharing. Oct 10 '16 at 9:10
2

I believe if you think you have the CRUD check in place and you still get the alert, it is better to give a false positive document along with the report to Salesforce while doing a AppExchange release.

We had the same issue last time we released our App and it was accepted. We still have the same list this time as well and we hope the same happens.

Note: This is happening not just for delete, but also for FLS Create and Update as well. As far as the scanner is concerned, I think its still in the nascent stage and has a lot of such issues.

Peace!

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.