I have the following situation in my plate ...

  1. On page load, a modal pops up.
  2. The modal is invoked on an action attribute in apex:page.
  3. The method that is on the action has an upsert operation that is mandatory.
  4. Business likes the page load popup feature more than anything.

Checkmarx report the error as XSRF With VF Call. I see no other option available though I have thought of the following points:

  1. Move the action method to an actionfunction--> Won't make a difference, making a DML on pageload.
  2. Move the action method to a button click or link click--> Business Grrr.
  3. DML on constructor-->LOL

I just wanted to check with the community if there is a workaround.

| improve this question | | | | |
  • I don't think XSRF has anything to do with DML on page load. Seems more likely to be related to the modal itself. – Adrian Larson May 5 '17 at 14:07
  • Checkmarx can report false positives. If you have a license to run it on your own, you can adjust the rules according to your own needs. If this is a managed package, you can explain & justify this "failure" during the review. It sounds as though they're making the assumption that what was passed in the querystring causes the DML and was caused by XSRF, when instead it's intended functionality. – crmprogdev May 5 '17 at 15:26

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.