1

I get a lot of CRUD/FLS security risks on the checkmarx scanner results while scanning our managed package. Does one need CRUD/FLS checks on public custom settings or can they be considered as false positives?

Improve this question
1
  • You should add the CRUD/FLS checks on Custom settings and even after the checks are reported by scanner then you can add in false positive that how you checked handled them, does this make sense?
    – itzmukeshy7
    May 5, 2017 at 3:10

1 Answer 1

Reset to default
1

We can not set FLS on public custom settings. Considering that it appears false positive because if we can not set FLS then what is use of checking the FLS. With this background in mind you have 2 options:

  1. Prepare false positive documentation

  2. Convert this public custom settings in private and provide custom interface(using VF & apex) to manipulate this custom setting.

Improve this answer
2
  • Thanks. Yes, agree a false positive document would be required.
    – Tan
    May 5, 2017 at 9:16
  • If this answer your question then please acpet this as answer by clicking the green check box. It will help community members who face same issue. stackoverflow.com/help/accepted-answer
    – AtulRajguru9
    May 5, 2017 at 12:00

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .