I have the following situation in my plate ...

  1. On page load, a modal pops up.
  2. The modal is invoked on an action attribute in apex:page.
  3. The method that is on the action has an upsert operation that is mandatory.
  4. Business likes the page load popup feature more than anything.

Checkmarx report the error as XSRF With VF Call. I see no other option available though I have thought of the following points:

  1. Move the action method to an actionfunction--> Won't make a difference, making a DML on pageload.
  2. Move the action method to a button click or link click--> Business Grrr.
  3. DML on constructor-->LOL

I just wanted to check with the community if there is a workaround.

  • I don't think XSRF has anything to do with DML on page load. Seems more likely to be related to the modal itself.
    – Adrian Larson
    Commented May 5, 2017 at 14:07
  • Checkmarx can report false positives. If you have a license to run it on your own, you can adjust the rules according to your own needs. If this is a managed package, you can explain & justify this "failure" during the review. It sounds as though they're making the assumption that what was passed in the querystring causes the DML and was caused by XSRF, when instead it's intended functionality.
    – crmprogdev
    Commented May 5, 2017 at 15:26


You must log in to answer this question.

Browse other questions tagged .