6

Running the Security Scanner showed the Following Issuesenter image description here

In order to avoid it I tried adding the following line

if(Schema.sObjectType.SAP_Change_Event_Config__c.isCreateable())-

For object and not for each field

But still the issue persist

if(Schema.sObjectType.SAP_Change_Event_Config__c.isCreateable()){
    List<SAP_Change_Event_Config__c> lstscec = new List<SAP_Change_Event_Config__c> ();
    SAP_Change_Event_Config__c scecObj = new SAP_Change_Event_Config__c();
    scecObj.Name = 'EKPO-EREKZ' ; 
    scecObj.CDOBJCL__c = 'EINKBELEG' ; 
    scecObj.DDTEXT__c = 'Purchasing Document Item';
    scecObj.Field__c = 'EREKZ' ;
    scecObj.Field_Description__c = 'Purchasing Document';
    scecObj.Field_Screen_Label__c = 'Final Invoice';
    scecObj.IsActive__c = true ;
    scecObj.OBTEXT__c = 'Purchasing Document' ;
    scecObj.Table__c = 'EKPO';
    
    lstscec.add(scecObj);
    
    scecObj = new SAP_Change_Event_Config__c();
    scecObj.Name = 'EKPO-WEBRE'; 
    scecObj.CDOBJCL__c = 'EINKBELEG'; 
    scecObj.DDTEXT__c = 'Purchasing Document Item' ;
    scecObj.Field__c = 'WEBRE';
    scecObj.Field_Description__c = 'Purchasing Document';
    scecObj.Field_Screen_Label__c = 'GR-Based IV';
    scecObj.IsActive__c = true;
    scecObj.OBTEXT__c = 'Purchasing Document';
    scecObj.Table__c = 'EKPO';
    
    lstscec.add(scecObj);
    
    scecObj = new SAP_Change_Event_Config__c();
    scecObj.Name = 'JEST-STAT'; 
    scecObj.CDOBJCL__c = 'ORH'; 
    scecObj.DDTEXT__c = '';
    scecObj.Field__c = 'STAT' ;
    scecObj.Field_Description__c = 'Production Order Status';
    scecObj.Field_Screen_Label__c = 'PO Status';
    scecObj.IsActive__c = true;
    scecObj.OBTEXT__c = '';
    scecObj.Table__c = 'JEST';
    
    lstscec.add(scecObj);

How can it be avoided??Any Suggestions?Should we keep checking this for each field??Or is there any simple way?

4
  • 1
    Can you check this also Schema.sObjectType.SAP_Change_Event_Config__c.fields.Name.isCreateable()
    – Reshma
    Dec 21 '16 at 6:58
  • Yeah that is fine,But I don't want to keep repeating the same for each field.Is there any simple way to avoid adding it for each field? Dec 21 '16 at 7:05
  • Do you have any idea on why it is showing 'lstsec' and 'add' as an error?If we rectify the fields, will that too get resolved?? Dec 21 '16 at 10:22
  • That's how scanner highlight the affected lines. After enforcing fls and crud check it will be resolved.
    – Reshma
    Dec 21 '16 at 11:24
2

Just checking for object permission is not enough. You need to explicitly check it for every field being changed/set in your code. Because fields have their own accessibility settings called FLS.

If you add the below check

Schema.sObjectType.SAP_Change_Event_Config__c.fields.Name.isCreateable() &&
Schema.sObjectType.SAP_Change_Event_Config__c.fields.CDOBJCL__c.isCreateable() &&
Schema.sObjectType.SAP_Change_Event_Config__c.fields.DDTEXT__c.isCreateable() &&
// and so on..

*Use isUpdateable in case you are updating the existing record.

Util Method

If you want you can use a utility method as well as below:

public static Boolean isCreateable(Schema.SObjectType objectType, List<String> fields){
    Boolean retVal = false;
    Map<String, SObjectField > fieldsMap = objectType.getDescribe().fields.getMap();
    for(String fname: fields){
        // If the fields do not exists then we can skip and there will be no change in the DB
        if(!fieldsMap.containsKey(fname) || fieldsMap.get(fname).getDescribe().isCreateable()){
            retVal = true;
        } else {
            return false;
        }
    }
    return retVal;
}

Note this method should be written in the same class where you want to check the accessibility.

0

You can write a utility class/method and pass object name and corresponding fields as list to be check while each dml. Refer this link for sample code. https://developer.salesforce.com/page/Enforcing_CRUD_and_FLS

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.