1

I get a lot of CRUD/FLS security risks on the checkmarx scanner results while scanning our managed package. Does one need CRUD/FLS checks on public custom settings or can they be considered as false positives?

  • You should add the CRUD/FLS checks on Custom settings and even after the checks are reported by scanner then you can add in false positive that how you checked handled them, does this make sense? – itzmukeshy7 May 5 '17 at 3:10
1

We can not set FLS on public custom settings. Considering that it appears false positive because if we can not set FLS then what is use of checking the FLS. With this background in mind you have 2 options:

  1. Prepare false positive documentation

  2. Convert this public custom settings in private and provide custom interface(using VF & apex) to manipulate this custom setting.

  • Thanks. Yes, agree a false positive document would be required. – Tan May 5 '17 at 9:16
  • If this answer your question then please acpet this as answer by clicking the green check box. It will help community members who face same issue. stackoverflow.com/help/accepted-answer – AtulRajguru9 May 5 '17 at 12:00

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.